An encryption system, method, and storage medium for a trusted chip

Abstract

This application provides an encryption method, system, and storage medium for trusted chips, relating to the field of industrial internet security, and solves the technical problem of insufficient adaptability of existing encryption methods when network scale changes. The method includes: broadcasting encrypted beacon frames to neighboring devices via a built-in dual-mode radio frequency unit and receiving response beacon frames from neighboring devices; constructing a trust topology graph based on the response beacon frames; identifying cluster head devices and member devices in the trust topology graph; and activating corresponding encryption layers according to the cluster head devices and member devices. This application is used for the process of implementing device encryption with trusted chips in industrial networks.

Description

Technical Field

[0001] This invention belongs to the field of industrial network security, specifically a method, system, and storage medium for encrypting a trusted chip. Background Technology

[0002] In industrial networks and related fields, existing encryption methods are inefficient in establishing communication connections between devices and struggle to quickly adapt to dynamic changes in adjacent devices, resulting in insufficient flexibility and adaptability in encryption scenarios. When network device types are mixed or the device topology changes, the connection strategy cannot be dynamically optimized based on the real-time status of the devices, further limiting the flexibility and adaptability of encryption scenarios. For example, in scenarios where devices frequently access or leave the network, existing methods often require complex protocol negotiation and authentication processes to re-establish connections, which not only prolongs connection establishment time but may also lead to connection interruptions due to inappropriate adaptation, making it difficult to meet the real-time and stability requirements of industrial networks. Summary of the Invention

[0003] This application provides an encryption method, system, and storage medium for a trusted chip, which solves the technical problem that the prior art is not adaptable enough when the network scale changes.

[0004] To achieve the above objectives, this application adopts the following technical solution:

[0005] Firstly, a method for encrypting a trusted chip is provided, comprising:

[0006] It broadcasts encrypted beacon frames to neighboring devices via a built-in dual-mode radio frequency unit and receives response beacon frames from neighboring devices.

[0007] Construct a trust topology graph based on response beacon frames;

[0008] Identify the cluster head device and member devices in the trust topology graph, and activate the corresponding encryption layer based on the cluster head device and member devices; the cluster head device represents the central node device, and the member devices represent the edge node devices.

[0009] Based on the above technical solutions, the encryption method for a trusted chip provided in this application achieves dynamic interaction with adjacent devices through a built-in dual-mode radio frequency unit, enabling faster establishment of communication connections between devices and enhancing the flexibility and adaptability of encryption scenarios. By constructing a trust topology map and identifying cluster head devices and member devices, the encryption process becomes more targeted, with different levels of devices activating corresponding encryption layers. This ensures high security for core nodes while avoiding resource waste caused by excessive encryption at edge nodes, achieving a balance between security and efficiency. Furthermore, this layered encryption mode based on trust topology can dynamically adjust the encryption mechanism as devices are added or removed and the network structure changes, possessing stronger scalability and better able to cope with complex and ever-changing network environments, solving the problem of insufficient adaptability of some existing encryption methods when the network scale changes.

[0010] In conjunction with the first aspect above, in one possible implementation, the construction of the trust topology graph based on the response beacon frame includes:

[0011] Parse the device identifier, device type, and signal loudness in the response beacon frame; the device type includes gateways, sensors, and programmable logic controllers (PLCs).

[0012] Calculate the topology trust value for each device based on the parsed data;

[0013] Devices with a topology trust value greater than the first threshold are retained;

[0014] A topology graph is constructed based on the connection methods of the retained devices to obtain a trusted topology graph.

[0015] In conjunction with the first aspect above, in one possible implementation, the topology trust value is calculated as follows: Topology trust value = w1 × device type weight + w2 × (1 - signal strength / theoretical strength) + w3 × historical communication success rate; wherein, the historical communication success rate is obtained by statistically analyzing the ratio of the number of successful communications in the device's historical communication records to the total number of communications, w1, w2, and w3 represent the weight coefficients of each item, and w1 + w2 + w3 = 1.

[0016] In conjunction with the first aspect above, in one possible implementation, the cluster head device and member devices for identifying the trust topology include:

[0017] The device with the highest topology trust value in the trust topology diagram, and whose device type is gateway or PLC, is marked as a cluster head device;

[0018] The device that is directly associated with the cluster head device is marked as a member device.

[0019] In conjunction with the first aspect above, in one possible implementation, activating the corresponding encryption layer based on the cluster head device and member devices includes:

[0020] The cluster head device employs a Physically Unclonable Function (PUF) layer, a national cryptographic algorithm layer, and a quantum-resistant preparatory layer.

[0021] Member devices enable the national cryptographic algorithm layer and / or PUF layer;

[0022] The PUF layer is used to generate a trusted key through the PUF challenge-response mechanism, the national cryptographic algorithm layer is used to complete data encryption and authentication based on the national cryptographic algorithm using the trusted key, and the quantum-resistant preparatory layer is used to deploy the CRYSTALS-Kyber key encapsulation mechanism to perform quantum-safe encryption on the trusted key.

[0023] In conjunction with the first aspect above, in one possible implementation, generating a trusted key via the PUF challenge-response mechanism includes:

[0024] Member devices generate challenge values ​​using physically non-clonable SRAM functions and write them into the 0xAA~0xC9 fields of the encrypted beacon frame;

[0025] After receiving the challenge value, the cluster head device reproduces the PUF response value and signs it with the private key using the SM2 algorithm;

[0026] Both the member device and the cluster head device generate a temporary trusted key based on the PUF response value input into the SM3 hash algorithm; the temporary trusted key is valid for a single communication and becomes invalid after the transmission ends.

[0027] In conjunction with the first aspect above, in one possible implementation, after parsing the response beacon frame, if it is determined that the device is an old device, the trusted chip sends the encryption configuration to the old device through the security policy descriptor SPD.

[0028] The Security Policy Descriptor (SPD) includes the device hash value, executable binary stream, industrial protocol adaptation rules, preset cluster head public key, weight coefficients of various items in the topology trust value calculation formula, and anti-rollback version identifier.

[0029] The device hash value is used to match the device hardware fingerprint, the executable binary stream contains PUF layer firmware and SM4 algorithm logic circuit file, the industrial protocol adaptation rule is used to define the position and offset of the encrypted field, and the preset cluster head public key is used to verify the signature validity of the SPD.

[0030] In conjunction with the first aspect above, in one possible implementation, the device is determined to be an outdated device when the parsed response beacon frame satisfies at least two of the following characteristics:

[0031] (1) The CAPABILITY field has no PUF_SUPPORT and SM2_SUPPORT flags, and the RAM_SIZE field value is ≤0x0FA0;

[0032] (2) Communication is conducted using TCP port 502, or the data frame has no encrypted field;

[0033] (3) Multiple consecutive bytes in the 0x0800F000~0x0800F040 address range of the device memory are all 0 or all 1, or the firmware update package has no SM3 hash value.

[0034] Secondly, this application provides an encryption system for a trusted chip, comprising: a beacon interaction module, a topology construction module, and an encryption execution module; wherein,

[0035] The beacon interaction module is used to broadcast encrypted beacon frames to adjacent devices via a built-in dual-mode radio frequency unit, and to receive response beacon frames from adjacent devices.

[0036] The topology construction module is used to construct a trust topology graph based on response beacon frames and identify the cluster head device and member devices of the trust topology graph;

[0037] The encryption execution module is used to activate the corresponding encryption layer based on the cluster head device and member devices.

[0038] Thirdly, a cryptographic device for a trusted chip is provided, comprising: a communication unit and a processing unit; wherein,

[0039] The communication unit is used to broadcast and receive beacon frames with adjacent devices via a built-in dual-mode radio frequency unit;

[0040] The processing unit is used to construct a trust topology map based on the response beacon frame, identify the cluster head device and member devices in the trust topology map, and activate the corresponding encryption layer according to the cluster head device and member devices.

[0041] Fourthly, this application provides an encryption device for a trusted chip, comprising: a processor and a storage medium; the storage medium includes instructions, and the processor is configured to execute the instructions to implement the methods described in the first aspect and any possible implementation thereof. This encryption device for a trusted chip can be an electronic device or a chip within an electronic device.

[0042] Fifthly, this application provides a computer-readable storage medium storing instructions that, when executed on an encryption device of a trusted chip, cause the encryption device of the trusted chip to perform the methods described in the first aspect and any possible implementation thereof.

[0043] In a sixth aspect, this application provides a computer program product containing instructions that, when run on an encryption device of a trusted chip, cause the encryption device of the trusted chip to perform the methods described in the first aspect and any possible implementation thereof.

[0044] This application provides an encryption method, system, and storage medium for trusted chips, enabling multi-layered, adaptive, secure, and efficient encryption protection. Specifically, this application achieves rapid inter-device connection through a dual-mode RF transceiver and, combined with a topology trust value calculation and filtering mechanism, constructs a secure network foundation based on device trustworthiness. The layered encryption strategy assigns core protection responsibility to the cluster head device (gateway / PLC), enabling triple protection with a PUF layer, a national cryptographic algorithm layer, and a quantum-resistant preparatory layer. Member devices activate the corresponding encryption layer as needed, forming a differentiated security protection system.

[0045] Furthermore, by accurately identifying outdated equipment through a multi-feature determination method and enabling remote encrypted configuration upgrades without physical contact through Security Policy Descriptors (SPDs), this approach addresses the security pain point of slow equipment iteration in industrial settings. It also ensures the security of the upgrade process through mechanisms such as device hash value verification and SM3 algorithm protection. This application, through its principles of "new and old compatibility, dynamic protection, and quantum preparedness," enables the encryption method to address diverse current security threats in complex industrial environments while also providing technical reserves for future quantum technology upgrades.

[0046] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 A system architecture diagram of an encryption system for a trusted chip provided in this application embodiment;

[0049] Figure 2 A flowchart illustrating an encryption method for a trusted chip provided in an embodiment of this application;

[0050] Figure 3 A flowchart illustrating another encryption method for a trusted chip provided in an embodiment of this application;

[0051] Figure 4 A flowchart illustrating another encryption method for a trusted chip provided in an embodiment of this application;

[0052] Figure 5 A schematic diagram of the structure of an encryption device for a trusted chip provided in an embodiment of this application;

[0053] Figure 6 This is a schematic diagram of the hardware structure of an encryption device for a trusted chip provided in an embodiment of this application. Detailed Implementation

[0054] In the description of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. The "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" means one or more, and "multiple" means two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0055] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0056] The encryption method for a trusted chip provided in this application embodiment can be applied to, for example... Figure 1 In a trusted chip encryption system, as shown, Figure 1 As shown, the communication system includes: a beacon interaction module, a topology construction module, and an encryption execution module; wherein,

[0057] The beacon interaction module is used to broadcast encrypted beacon frames to neighboring devices via a built-in dual-mode radio frequency unit and to receive response beacon frames from neighboring devices.

[0058] The topology building module is used to construct a trust topology graph based on response beacon frames and to identify cluster head devices and member devices in the trust topology graph;

[0059] The encryption execution module is used to activate the corresponding encryption layer based on the cluster head device and member devices.

[0060] To address the technical problems of insufficient flexibility, poor network adaptability, and difficulty in balancing security and efficiency in existing trusted chip encryption technologies, embodiments of this application provide a trusted chip encryption method, system, and storage medium. The method includes:

[0061] The trusted chip broadcasts encrypted beacon frames to neighboring devices via its built-in dual-mode radio frequency unit and receives response beacon frames from neighboring devices.

[0062] Construct a trust topology graph based on response beacon frames;

[0063] Identify the cluster head device and member devices in the trust topology, and activate the corresponding encryption layer based on the cluster head device and member devices; where the cluster head device represents the central node device and the member devices represent the edge node devices.

[0064] Based on this, this application improves the adaptability, security and efficiency of trusted chips in complex network environments by dynamically constructing a trust network and activating encryption mechanisms in a layered manner.

[0065] like Figure 2 As shown in the embodiment of this application, an encryption method for a trusted chip includes:

[0066] S1. Broadcasts encrypted beacon frames to adjacent devices via the built-in dual-mode radio frequency unit and receives response beacon frames from adjacent devices.

[0067] Among them, the dual-mode radio frequency transceiver is a communication module that supports two different radio frequency communication modes (such as Bluetooth and Wi-Fi, ZigBee and LoRa, etc.) to achieve compatible communication with devices with different communication protocols; the encrypted beacon frame is a broadcast frame that has been encrypted and contains information such as device identification and communication parameters, and is used to initiate communication requests to devices in neighboring devices and verify device identity; the response beacon frame is a response frame returned by a neighboring device after receiving the encrypted beacon frame, which contains its own device information and the response content to the request.

[0068] In some implementations, symmetric encryption algorithms (such as Advanced Encryption Standard, AES) or asymmetric encryption algorithms can be used to encrypt beacon frames. The broadcast period can be dynamically adjusted according to network density, such as shortening the period when network devices are dense and lengthening the period when devices are sparse. When receiving response beacon frames, valid responses can be filtered by signal strength. For example, only response frames with signal strength higher than a preset threshold can be retained, indicating that the devices participating in the interaction have a stable connection foundation, which can improve the reliability of subsequent trust topology construction.

[0069] It should be noted that the two communication modes of the dual-mode RF device can automatically switch according to the protocol type of nearby devices, ensuring compatibility with different types of devices. For example, when the dual-mode RF device is Bluetooth and Wireless Fidelity (Wi-Fi) dual-mode, its automatic switching process is as follows: the RF device periodically scans the protocol identification information sent by the devices in the neighboring devices, such as the UUID identifier of the Bluetooth device and the SSID identifier of the Wi-Fi device. If the Bluetooth protocol identifier is scanned, it automatically switches to Bluetooth communication mode to match the device; if the Wi-Fi protocol identifier is scanned, it switches to Wi-Fi communication mode; if both protocol identifiers are scanned at the same time, the corresponding mode can be selected according to the device priority (such as preset industrial equipment priority); this includes a clear explanation of how to perform automatic switching; the format of the encrypted beacon frame can follow common communication standards (such as IEEE 802.11 series), which is convenient for devices from different manufacturers to identify.

[0070] For example, the trusted chip enables both Bluetooth and Wi-Fi modes simultaneously via a dual-mode RF device, broadcasting AES-encrypted beacon frames (containing the chip's unique identifier). Nearby Bluetooth and Wi-Fi devices return response beacon frames containing their own MAC addresses. The chip only receives responses with signal strength higher than -70dBm.

[0071] S2. Construct a trust topology graph based on response beacon frames.

[0072] The trust topology graph is a graphical model used to describe the connection relationships and trust levels between devices in a network. It consists of nodes (representing devices) and edges (representing the connection and trust relationships between devices) and is used to intuitively display the trust structure of the network.

[0073] In some implementations, device identifiers such as MAC address, device ID, and connection status (e.g., whether it is the first communication) in the response beacon frame can be parsed. Each device is treated as a node, and edge connections are established between devices that have response interactions. Trust relationships can be quantified based on the device's historical communication success rate, such as the number of historical successful communications / total number of communications, or a preset trust level (e.g., the core device is preset to a high trust level). (For example, the thickness of the edge represents the degree of trust.)

[0074] It should be noted that the trust topology graph should support dynamic updates. When a new device joins (receives a new response beacon frame) or a device leaves (times out without receiving a response), the corresponding node and edge should be added or removed in real time. The topology graph can be stored in the form of an adjacency matrix or an adjacency list, which facilitates quick querying of device connection relationships.

[0075] For example, parsing the response beacon frame yields the MAC addresses of three devices, A, B, and C. A and B, and A and C have response interactions, while B and C have no direct interaction. A trust topology graph is then constructed with A, B, and C as nodes and AB and AC as edges. Based on historical communication success rates, the AB edge (90% success rate) is thicker than the AC edge (70% success rate).

[0076] S3. Identify the cluster head device and member devices in the trust topology, and activate the corresponding encryption layer based on the cluster head device and member devices.

[0077] In this cluster, the cluster head device represents the central node device, responsible for managing the communication and security policies of devices within the cluster; member devices represent the edge node devices, managed by the cluster head device, and participating in data interaction within the cluster. The encryption layer is a logical module that implements specific encryption functions; different encryption layers can employ different encryption algorithms and security mechanisms.

[0078] In some implementations, when identifying cluster head devices, the device with the best overall performance can be selected from the trust topology graph based on its processing power (e.g., CPU clock speed, memory size), communication range (e.g., maximum transmission distance), or preset priority (e.g., designating a gateway device as a candidate cluster head). Member devices are node devices that have direct edge connections with the cluster head device. When activating the encryption layer, the cluster head device can enable multi-layer encryption, such as physical layer encryption + application layer encryption, while member devices can enable single-layer or basic encryption, such as application layer encryption only. Common encryption algorithms such as AES and Elliptic Curve Cryptography (ECC) can be selected.

[0079] It should be noted that cluster head devices can adopt election mechanisms, such as polling election or competitive election, and be updated regularly to avoid single points of failure; the activation state of the encryption layer can be dynamically switched through signaling frames, such as temporarily upgrading the encryption level when a security threat is detected.

[0080] For example, the device A with the strongest processing power is selected from the trust topology as the cluster head device, and B and C, which are directly connected to A, are selected as member devices; the cluster head device A activates physical layer encryption (such as based on ECC algorithm) and application layer encryption (based on AES algorithm), while the member devices B and C only activate application layer encryption (based on AES algorithm).

[0081] Based on the above technical solutions, the encryption method for a trusted chip provided in this application achieves compatible communication with multi-protocol devices through a dual-mode radio frequency device, enhancing the flexibility of encryption scenarios; by constructing a trust topology map, it intuitively presents the trusted network structure and supports dynamic updates, improving the network's adaptability; by identifying cluster heads and member devices and activating differentiated encryption layers, it ensures high security for core devices while avoiding resource waste caused by excessive encryption of edge devices, achieving a balance between security and efficiency, and effectively solving the pain points of existing technologies.

[0082] In one possible implementation of the embodiments of this application, combined with Figure 2 ,like Figure 3 As shown, the above S1 can be implemented through the following S101, S102 and S103, which are explained in detail below:

[0083] S101, the trusted chip broadcasts encrypted beacon frames to adjacent devices via its built-in dual-mode radio frequency unit.

[0084] Among them, the dual-mode radio frequency unit is a module that supports two different radio frequency communication modes and is used to establish a connection with neighboring devices that use different communication protocols; the encrypted beacon frame is a broadcast frame that has been encrypted and contains the device's own identification information, communication parameters and other content. It is used to initiate a communication request to a neighboring device to trigger the neighboring device to return a response beacon frame containing the necessary information.

[0085] In some implementations, the encryption of the encrypted beacon frame can be achieved using symmetric or asymmetric encryption. Specific fields can be reserved within the frame to indicate the type of information that adjacent devices need to return, such as explicitly requiring the response to include the device identifier, device type, and signal loudness.

[0086] It should be noted that during broadcasting, the dual-mode radio frequency unit can simultaneously enable two communication modes to cover more types of nearby devices and increase the probability of receiving beacon frames.

[0087] For example, in this application, the dual-mode radio frequency unit of the trusted chip simultaneously enables Bluetooth and Wi-Fi modes, broadcasts a beacon frame encrypted using national cryptographic algorithms, the frame contains the chip's unique hardware identifier, and prompts neighboring devices to return the device identifier, type, and signal strength, and sends it to neighboring devices within a 50-meter radius.

[0088] S102. After receiving the encrypted beacon frame, the adjacent device generates a response beacon frame and returns it. The trusted chip receives the response beacon frame through a dual-mode radio frequency unit.

[0089] The response beacon frame is a reply frame from a neighboring device to an encrypted beacon frame. It contains the device identifier, device type (such as gateway, sensor, programmable logic controller PLC), and signal loudness of the neighboring device. It is used to respond to the communication request of the trusted chip and provide its own key information.

[0090] In some implementations, a signal strength threshold can be set when receiving response beacon frames, so that only frames with signal strength that meet the requirements are received to ensure the stability of subsequent interactions; at the same time, response frames containing complete device identifiers, device types and signal loudness will be given priority.

[0091] It should be noted that during the reception process, the dual-mode RF device will automatically match the corresponding reception mode according to the communication mode of the adjacent device to ensure that the response beacon frame can be correctly parsed, thereby accurately extracting the device identifier, device type and signal loudness.

[0092] For example, after receiving the encrypted beacon frame, the nearby PLC device and sensor device return response beacon frames respectively. The response frame of the PLC device contains its unique device code (identifier), the type identifier "PLC" and the signal strength -75dBm, and the response frame of the sensor device contains its hardware serial number (identifier), the type identifier "sensor" and the signal strength -78dBm. The dual-mode RF unit of the trusted chip receives these response frames and retains only the frames with a signal strength higher than -80dBm.

[0093] S103, the trusted chip performs preliminary processing on the received response beacon frames to prepare for the subsequent construction of the trust topology graph.

[0094] The initial processing includes operations such as verifying the integrity of the response beacon frames and extracting key information (i.e., device identifiers, device types, and signal loudness) to ensure that the information used to construct the topology map is accurate and effective.

[0095] In some implementations, the validity of a response beacon frame can be determined by pre-defined verification rules, such as verifying whether the frame header and footer conform to the format and whether key information fields are empty. Invalid frames are discarded directly. The extracted information is temporarily stored in a temporary storage area for subsequent calculation of the topology trust value.

[0096] For example, the trusted chip verifies the received response beacon frame. After confirming that the frame format is complete and that the device identifier, device type, and signal loudness fields are not empty, it extracts the identifier "PLC-001", type "PLC", and signal loudness -75dBm of device X, and the identifier "Sensor-002", type "sensor", and signal loudness -78dBm of device Y. This information is temporarily stored to prepare for building the trust topology.

[0097] Based on the above technical solution, by broadcasting beacon frames and receiving and initially processing response frames, the effective transmission of encrypted beacon frames and the accurate acquisition of key information in response beacon frames can be ensured, providing a foundation for the subsequent construction of the trust topology and the implementation of layered encryption.

[0098] In one possible implementation of the embodiments of this application, combined with Figure 2 ,like Figure 4 As shown, the above S2 can be implemented through the following S201, S202, S203 and S204, which are explained in detail below:

[0099] S201. Parse the response beacon frame, extract key equipment information, and identify outdated equipment.

[0100] Parsing response beacon frames refers to extracting data from received response beacon frames to obtain information such as device identifiers (e.g., unique hardware identifiers), device types (including gateways, sensors, and programmable logic controllers (PLCs), and signal loudness. Outdated devices refer to devices that lack advanced encryption capabilities or have low hardware configurations, and their determination is based on specific characteristics of response beacon frames.

[0101] In some implementations, the parsing process can be completed using a dedicated parsing algorithm that can locate and extract the aforementioned information according to a preset format. When identifying outdated devices, the identification can be determined by detecting features such as whether the CAPABILITY field in the beacon frame contains the PUF_SUPPORT and SM2_SUPPORT flags, the value of the RAM_SIZE field, the status of the communication port and encryption field, and data in a specific address segment of the device's memory. If at least two of these features are met, the device is identified as outdated. Specifically, if the parsed response beacon frame meets at least two of the following features, the device is identified as outdated:

[0102] (1) The CAPABILITY field has no PUF_SUPPORT and SM2_SUPPORT flags, and the RAM_SIZE field value is ≤0x0FA0;

[0103] (2) Communication is conducted using TCP port 502, or the data frame has no encrypted field;

[0104] (3) Multiple consecutive bytes in the 0x0800F000~0x0800F040 address range of the device memory are all 0 or all 1, or the firmware update package has no SM3 hash value.

[0105] For example, after parsing a response beacon frame, the device identifier is "Dev-001", the device type is sensor, and the signal loudness is -72dBm. At the same time, it is detected that the CAPABILITY field of the frame does not have the PUF_SUPPORT and SM2_SUPPORT flags, the RAM_SIZE field value is 0x0F90 (≤0x0FA0), and it uses TCP port 502 for communication, which meets the three characteristics of old devices. Therefore, it is determined to be an old device.

[0106] S202. Issue a Security Policy Descriptor (SPD) to the device identified as an outdated device and receive its processing response.

[0107] SPD is a data packet used to send encrypted configurations to legacy devices. It includes device hash value, executable binary stream, industrial protocol adaptation rules, preset cluster head public key, topology trust value calculation weight coefficient, and anti-rollback version identifier, etc. The purpose is to enable legacy devices to have basic encryption capabilities so that they can be incorporated into the trust system.

[0108] In some implementations, SPDs can be transmitted via encrypted channels. Before transmission, the signature validity of the SPD must be verified using a preset cluster header public key. After receiving the SPD, the legacy device needs to match its own hardware fingerprint based on the device hash value. Once the match is confirmed, it loads the executable binary stream (containing PUF layer firmware and SM4 algorithm logic circuit files) and configures the position and offset of the encrypted fields according to industry protocol adaptation rules. After loading is complete, the legacy device will enable the encryption layer specified in the SPD, giving it basic encryption capabilities and thus integrating it into the trust topology.

[0109] It should be noted that after configuration, the older device will return a response frame containing "configuration successful" to the trusted chip, informing the trusted chip that it has completed the upgrade and has new encryption capabilities. After receiving the new response frame from the older device, the trusted chip will calculate the trust value of the device based on the parsed response beacon frames of all devices and construct a trust topology graph.

[0110] For example, for "Dev-001", which is determined to be an old device, an SPD is sent through an encrypted channel: the device hash value matches its hardware fingerprint, the executable binary stream contains the basic PUF layer firmware, and the industrial protocol adaptation rules define the offset of the encrypted field in the sensor data frame; after "Dev-001" verifies the validity of the SPD signature, it loads the firmware and completes the configuration, and returns a "configuration successful" response frame.

[0111] S203. Calculate the topology trust value for each device.

[0112] The topology trust value is a quantitative indicator used to measure the trustworthiness of a device in a network. Its calculation formula is: Topology Trust Value = w1 × Device Type Weight + w2 × (1 - Signal Strength / Theoretical Strength) + w3 × Historical Communication Success Rate, where w1, w2, and w3 are weighting coefficients and w1 + w2 + w3 = 1.

[0113] In some implementations, the weight of device type can be preset according to the importance of the device, such as the weight of gateway and PLC being higher than that of sensor; the signal strength is the measured value of the signal loudness in the response beacon frame, and the theoretical strength is the maximum signal strength of the device type; the historical communication success rate is obtained by querying the device's historical communication records, that is, by calculating the ratio of the number of successful communications in the past preset time period to the total number of communications.

[0114] For example, the weight of device type can be set according to the core status of the device in the industrial network. For example, the weight of the device type of gateways and PLCs as core control devices can be set to 0.6; the weight of the device type of sensors as edge data acquisition devices can be set to 0.3. In this way, the difference in weight reflects the difference in importance of different types of devices in the network trust system.

[0115] It should be noted that the weighting coefficients can be dynamically adjusted according to the network scenario. For example, after multiple manual experiments, it was determined that in an industrial scenario, the weight w1 for device type can be set to 0.4, the weight w2 for signal strength to be set to 0.3, and the weight w3 for historical communication success rate to be set to 0.3. The manual experimentation method may include the following steps:

[0116] (1) Experimental environment setup. A simulated industrial network scenario was set up, including various types of equipment. By controlling the signal strength to adjust the equipment deployment location, introducing appropriate communication interference using electromagnetic interference, and recording the historical communication data of the equipment, a test platform close to the real industrial environment was constructed.

[0117] (2) Variable control and data acquisition. First, with fixed signal strength and historical communication success rate, only the device type is changed, and the actual reliable performance of different device types such as test gateway, PLC, and sensor in the network is recorded in turn. For example, the communication stability of the core control device gateway / PLC has a greater impact on the network and should be given a higher basic trust weight.

[0118] Then, with fixed device type and historical communication success rate, the signal strength was adjusted by changing the device spacing or interference intensity, and the impact of signal strength changes on device communication reliability was recorded.

[0119] Next, by fixing the device type and signal strength, and artificially introducing communication faults such as disconnection or data errors, the historical communication success rate is altered, and the correlation between the success rate and the actual reliability of the device is recorded.

[0120] (3) Iterative adjustment of weight coefficients. Based on the correlation data of collected device type, signal strength, historical communication success rate and actual reliable performance, multiple sets of weight coefficient combinations are initially set, substituted into the topology trust value calculation formula, and the consistency between the calculation results and the actual reliable performance of the devices is compared. For example, whether the devices with high trust values ​​calculated are actually more stable and secure. If, under a certain set of weights, the trust value of core devices (gateways / PLCs) is significantly higher than that of edge devices (sensors), and the trust value of devices with strong signals and high success rates shows a positive growth, then this set of weights is more in line with the needs of industrial scenarios.

[0121] (4) Verification and Determination: Finally, the initially determined weight coefficients are continuously tested in simulated scenarios, introducing new devices or changes in network structure to observe whether the topology trust value can accurately reflect the trustworthiness of the devices in dynamic environments. If the weight combination can stably correlate with the actual performance of the devices in multiple tests, it is finally determined as the applicable weight for industrial scenarios.

[0122] For example, for device "Dev-002" (type PLC, signal strength -65dBm, theoretical strength -30dBm, historical communication success rate 90%), let w1=0.4, w2=0.3, w3=0.3, then the topology trust value = 0.4×0.8 (PLC weight) + 0.3×(1-(-65) / (-30)) + 0.3×0.9 = 0.32 + 0.3×(-0.17) + 0.27≈0.54 (the calculation result is only an example, and the actual value should be taken according to the real parameters).

[0123] S204. Filter out devices that meet the criteria and construct a trust topology graph.

[0124] The trust topology graph is a graphical model that reflects the trusted connections between devices in a network. It consists of selected devices (nodes) and the connections between devices (edges).

[0125] In some implementations, when filtering devices, devices with a topology trust value greater than a first threshold (such as 0.8) can be retained, including older devices that have completed SPD configuration; when constructing the topology graph, the filtered devices are used as nodes, and edge connections are established based on the communication interaction relationship between devices, such as whether there is a direct response interaction, and the trustworthiness of the nodes is marked with the topology trust value.

[0126] It should be noted that the trust topology graph must support dynamic updates. When the device topology trust value is lower than the threshold or fails to respond within a timeout period, the corresponding node must be removed in a timely manner. For older devices, a special identifier must be marked on the topology graph to facilitate subsequent encryption strategy adaptation.

[0127] The first threshold can be determined based on the distribution statistics of historical trusted device topology trust values. Specifically, in industrial scenarios, historical topology trust value data of normally operating devices in the network (including older devices configured with SPD) can be collected first, and their distribution range can be statistically analyzed. If the trust values ​​of most trusted devices are concentrated in the range of 0.6 to 0.9, the basic threshold can be set to the lower limit of this range (e.g., 0.6) to ensure that most trusted devices can be included in the trusted topology. For scenarios with higher security requirements, such as networks involving the transmission of core control commands, the threshold can be increased through configuration parameters in the SPD to reduce the access of low-trust value devices.

[0128] Based on the above technical solution, by parsing beacon frames, identifying and adapting to old devices, quantifying trust values, and constructing a topology map, the trust topology map can accurately reflect the trusted connection relationships of devices in the network and is compatible with old devices, providing a comprehensive and reliable foundation for subsequent device role identification and encryption layer activation.

[0129] In one possible implementation of the embodiments of this application, combined with Figure 2 ,like Figure 3 As shown, the above S3 can be implemented through the following S301, S302 and S303, which are explained in detail below:

[0130] S301. Identify cluster head devices in the trust topology graph.

[0131] The cluster head device is the central node device in the trust topology, and it needs to meet two conditions: first, it must have the highest topology trust value; second, it must be a gateway or a programmable logic controller (PLC). Its core function is to undertake core security management and encryption coordination functions in the network.

[0132] In some implementations, the topology trust value of all nodes in the trust topology graph can be traversed to filter out the device with the highest value, and then its device type can be verified as a gateway or a PLC. If multiple devices have the same topology trust value and are all the highest, such as two gateways with identical trust values, the final cluster head can be determined by further examining the device's historical communication stability, such as the number of communication interruptions in the last 30 minutes, or its processing power, such as CPU clock speed.

[0133] It should be noted that cluster head identification must be based on a complete trust topology map, ensuring that all screened devices are included, including older devices that have completed SPD configuration. If there are no gateway or PLC devices in the topology map, the sensor device with the highest topology trust value can be temporarily used as a cluster head and marked as "temporary cluster head" to distinguish it from regular cluster heads.

[0134] S302, Identify member devices in the trust topology graph.

[0135] Member devices are edge nodes in the trust topology graph, meaning they are devices directly associated with the cluster head device, i.e., devices with direct connections in the topology graph. They primarily undertake data acquisition or edge computing tasks and are subject to the security management of the cluster head device.

[0136] In some implementations, all nodes directly connected to the cluster head device can be marked as member devices by querying the adjacency relationships in the trust topology graph, such as the direct connection records in the adjacency table. If the cluster head device is replaced, for example, due to a failure of the original cluster head, the member devices of the new cluster head need to be re-identified based on direct association relationships.

[0137] It should be noted that member devices include normal devices and older devices that have completed SPD configuration; both must meet the condition that the topology trust value is greater than the first threshold. If a device is directly connected to the cluster head but its trust value is lower than the threshold, it must be excluded from the member devices list.

[0138] S303. Activate the corresponding encryption layer according to the roles of the cluster head device and member devices.

[0139] The encryption layer is a logical module that implements specific encryption functions. The cluster head device must enable the Physically Unclonable Technology (PUF) layer, the Chinese national cryptographic algorithm layer, and the quantum-resistant pre-preparation layer. Member devices must enable the Chinese national cryptographic algorithm layer and / or the PUF layer. The PUF layer is used to generate trusted keys through the PUF challenge-response mechanism; the Chinese national cryptographic algorithm layer is used to perform data encryption and authentication based on the Chinese national cryptographic algorithm using the trusted keys; and the quantum-resistant pre-preparation layer is used to deploy the CRYSTALS-Kyber key encapsulation mechanism to perform quantum-safe encryption on the trusted keys.

[0140] In some implementations, the PUF layer generates trusted keys through the PUF challenge-response mechanism, including:

[0141] Member devices generate a challenge value using a physically non-clonable SRAM function, and then write the challenge value into a specific field of the encrypted frame, such as the 0xAA~0xC9 field, to complete the preparation for the transmission of the challenge value.

[0142] After receiving an encrypted frame containing a challenge value, the cluster head device reproduces the corresponding PUF response value based on its own physical unclonable property, and then uses the SM2 algorithm to sign the response value with a private key to ensure the authenticity and integrity of the response value.

[0143] Both the member device and the cluster head device receive the PUF response value signed by the SM2 algorithm. This response value is then input into the SM3 hash algorithm for calculation, generating a temporary trusted key. This temporary trusted key is valid only during a single communication session and expires immediately after the communication ends, thus ensuring key security.

[0144] The national cryptographic algorithm layer can include the national cryptographic algorithms SM2, SM3, and SM4. Among them, the SM2 algorithm is used to sign the PUF response value with a private key to ensure the authenticity and integrity of the response value; the SM3 algorithm is used to perform hash operations on the PUF response value to generate a temporary trusted key; and the SM4 algorithm is used to complete data encryption based on the trusted key.

[0145] In some implementations, the three-layer encryption operation of the cluster head device may include the following steps:

[0146] A1. Activate the PUF layer to generate a trusted key. Member devices generate a challenge value using a physically non-clonable SRAM function, write it into fields 0xAA~0xC9 of the encrypted frame, and send it to the cluster head device. Upon receiving the challenge value, the cluster head device recreates the corresponding PUF response value based on its own physical characteristics and then signs the response value with its private key using the SM2 algorithm. Subsequently, the cluster head device and member devices jointly input the signed response value into the SM3 hash algorithm to generate a temporary trusted key. This key is only valid for a single communication.

[0147] A2 activates the national cryptographic algorithm layer to complete data encryption and authentication. The cluster head device calls the SM4 algorithm, using the temporary trusted key generated by the PUF layer as input, to encrypt the data to be transmitted. Simultaneously, the SM2 algorithm is used to sign the encrypted data, ensuring the integrity and immutability of the data during transmission, achieving dual protection of data encryption and identity authentication.

[0148] A3 activates a quantum-resistant pre-layer for quantum security protection of the key. The cluster head device deploys a CRYSTALS-Kyber key encapsulation mechanism in the quantum-resistant pre-layer, using its own long-term private key to encapsulate the temporary trusted key generated by the PUF layer. The encapsulation process combines the temporary key with a random number to generate ciphertext, ensuring that even under quantum computing attacks, the original key cannot be obtained by cracking traditional encryption methods. The encapsulated ciphertext is transmitted along with the encrypted data, providing quantum-level protection for key security.

[0149] In some implementations, the encryption operation of member devices can be as follows:

[0150] If a member device is an older device, due to its limited hardware resources and only basic encryption capabilities after being configured with the Security Policy Descriptor (SPD), the PUF layer is enabled. In this case, the member device generates a challenge value using a physically non-clonable SRAM function, writes it into a specific field of the encrypted frame, and sends it to the cluster head device. After receiving the PUF response value signed by the SM2 algorithm from the cluster head device, the member device inputs the response value into the SM3 hash algorithm to generate a temporary trusted key for subsequent data encryption.

[0151] If the member device is a normal sensor device, the national cryptographic algorithm layer is enabled because it natively supports the operation of national cryptographic algorithms. In this case, the member device can reuse the temporary trusted key generated by the cluster head device through the PUF layer, or generate its own basic key, and use the national cryptographic algorithm layer to complete data encryption and authentication based on national cryptographic algorithms.

[0152] If the member device is a normal gateway or PLC device, due to its strong hardware capabilities, it can support the challenge-response mechanism of the Physically Unclonable Function (PUF) layer to generate trusted keys and can efficiently run the national cryptographic algorithm. As a non-edge device, it needs to enhance the security of data transmission through a dual encryption layer. Therefore, the PUF layer and the national cryptographic algorithm layer are enabled. The PUF layer generates trusted keys through the challenge-response mechanism, and the national cryptographic algorithm layer uses the key to complete the encryption and authentication of data based on the national cryptographic algorithm, so as to meet the security requirements of its important tasks such as edge computing or data forwarding in the network.

[0153] It should be noted that the temporary trusted key strictly adheres to the principle of single-communication validity, becoming invalid immediately after transmission to avoid the risk of key leakage. The deployment of the quantum-resistant pre-layer must be compatible with existing encryption processes and must not affect the real-time performance of the national cryptographic algorithm layer.

[0154] Based on the above technical solution, by accurately identifying cluster heads and member devices and activating differentiated encryption layers, both high security protection for core nodes and encryption efficiency for edge nodes are ensured. Simultaneously, the PUF challenge-response mechanism and quantum-resistant preparatory layer enhance key security and future compatibility, making the encryption method adaptable to the security needs of devices with different roles in industrial networks.

[0155] It should be noted that in existing technologies, there are significant limitations in handling older industrial IoT devices due to limited hardware resources and lack of encryption capabilities: traditional solutions either require direct hardware upgrades to support new encryption algorithms, but older devices often cannot complete this due to firmware fixation and memory capacity limitations, resulting in long-term network exposure to security vulnerabilities; or they use gateways to proxy encryption, but this requires the additional deployment of hardware relay nodes, increasing network complexity and potentially affecting real-time performance, or they directly discard older devices, resulting in high replacement costs, making it difficult to promote in long-lifecycle industries such as chemical and power.

[0156] This application effectively solves these problems through the SPD dynamic adaptation mechanism and dynamic construction of trust topology: Firstly, without replacing hardware, a Security Policy Descriptor (SPD) containing an executable binary stream is issued to legacy devices via a trusted chip, enabling a soft upgrade of their encryption capabilities by loading firmware, thus significantly reducing costs. Secondly, through a layered encryption architecture, addressing the capability differences between legacy devices and cluster head devices, legacy devices load a basic PUF layer and the SM4 algorithm for lightweight encryption, while cluster head devices enable triple encryption: a PUF layer, a national cryptographic algorithm layer, and a quantum-resistant pre-preparation layer, balancing security and resource consumption. Thirdly, in this application, the industrial protocol adaptation rules in the SPD allow legacy devices to be compatible with national cryptographic algorithms without modifying their communication protocols, while the deployment of the quantum-resistant pre-preparation layer provides pre-adaptation capabilities to address future quantum computing threats, avoiding the cost of secondary upgrades. Overall, this achieves low-cost, secure compatibility, making it more suitable for complex industrial environments.

[0157] The foregoing primarily describes the solutions of the embodiments of this application from the perspective of device implementation. It is understood that each device, such as an encryption device for a trusted chip, includes at least one of the hardware structures and software modules corresponding to the execution of each function in order to achieve the aforementioned functions. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0158] This application embodiment can divide a trusted chip encryption device into functional units based on the above method example. For example, each function can be divided into separate functional units, or two or more functions can be integrated into one processing unit. The integrated unit can be implemented in hardware or as a software functional unit. It should be noted that the unit division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0159] When using integrated units, Figure 5 A possible structural schematic diagram of a trusted chip encryption device (referred to as a trusted chip encryption device 50) involved in the above embodiments is shown. The trusted chip encryption device 50 includes a processing unit 501 and a communication unit 502, and may also include a storage unit 503. Figure 5 The schematic diagram shown can be used to illustrate the structure of an encryption device for a trusted chip involved in the above embodiments.

[0160] when Figure 5 The schematic diagram shown illustrates the structure of a trusted chip encryption device involved in the above embodiments. The processing unit 501 is used to control and manage the operation of the trusted chip encryption device, the communication unit 502 is used for the trusted chip encryption device to communicate with other devices, and the storage unit 503 is used to store the program code and data of the trusted chip encryption device.

[0161] For example, communication unit 502 is used to broadcast encrypted beacon frames to adjacent devices via a built-in dual-mode radio frequency unit and to receive response beacon frames returned by adjacent devices.

[0162] The processing unit 501 is used to construct a trust topology map based on the received response beacon frame, identify the cluster head device and member device in the trust topology map, and activate the corresponding encryption layer according to the role of the cluster head device and member device.

[0163] In one possible implementation, the processing unit 501 is further configured to parse the response beacon frame to extract the device identifier, device type and signal loudness, calculate the topology trust value of each device based on the parsing results, retain devices whose topology trust values ​​meet the conditions, and construct a trust topology map based on the connection method of the devices.

[0164] In one possible implementation, the communication unit 502 is further configured to issue a Security Policy Descriptor (SPD) to the device identified as an old device and receive a configuration response frame returned by the old device; the processing unit 501 is further configured to identify the old device by the features of the response beacon frame, process the challenge-response mechanism of the Physically Unclonable Function (PUF) layer according to the roles of the cluster head device and member devices to generate a trusted key, and enable the corresponding encryption layer to complete data encryption and authentication.

[0165] The processing unit 501 can be a processor or a controller, and the communication unit 502 can be a communication interface, transceiver, transceiver circuit, transceiver device, etc. The term "communication interface" is a general term and may include one or more interfaces. The storage unit 503 can be a memory. When the encryption device 50 of a trusted chip is a chip, the processing unit 501 can be a processor or a controller, and the communication unit 502 can be an input interface and / or an output interface, pins, or circuits, etc. The storage unit 503 can be a storage unit within the chip (e.g., a register, cache, etc.) or a storage unit located outside the chip (e.g., read-only memory (ROM), random access memory (RAM, etc.)).

[0166] The communication unit can also be called a transceiver unit. An antenna with transceiver functions and a control circuit in a trusted chip encryption device 50 can be considered as a communication unit 502 of the trusted chip encryption device 50, and a processor with processing functions can be considered as a processing unit 501 of the trusted chip encryption device 50. Optionally, the device in the communication unit 502 that implements the receiving function can be considered as a communication unit, which is used to execute the receiving steps in the embodiments of this application. The communication unit can be a receiver, a receiver circuit, etc. The device in the communication unit 502 that implements the transmitting function can be considered as a transmitting unit, which is used to execute the transmitting steps in the embodiments of this application. The transmitting unit can be a transmitter, a transmitter, a transmitting circuit, etc.

[0167] Figure 5 If the integrated units in the process are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. Storage media for storing computer software products include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0168] Figure 5 The units in the process can also be called modules; for example, a processing unit can be called a processing module.

[0169] This application also provides a hardware structure diagram of a trusted chip encryption device (denoted as a trusted chip encryption device 60), see [link to diagram]. Figure 6 The encryption device 60 of the trusted chip includes a processor 601, and optionally, a memory 602 connected to the processor 601.

[0170] In the first possible implementation, see Figure 6The encryption device 60 for a trusted chip also includes a transceiver 603. The processor 601, memory 602, and transceiver 603 are connected via a bus. The transceiver 603 is used to communicate with other devices or communication networks. Optionally, the transceiver 603 may include a transmitter and a receiver. The device in the transceiver 603 that implements the receiving function can be considered as a receiver, which is used to perform the receiving steps in the embodiments of this application. The device in the transceiver 603 that implements the transmitting function can be considered as a transmitter, which is used to perform the transmitting steps in the embodiments of this application.

[0171] Based on the first possible implementation method Figure 6 The schematic diagram shown can be used to illustrate the structure of an encryption device for a trusted chip involved in the above embodiments.

[0172] in, Figure 6 This can also be illustrated as a system chip in a trusted chip's encryption device. In this case, the actions performed by the aforementioned trusted chip's encryption device can be implemented by this system chip; the specific actions performed are described above and will not be repeated here.

[0173] In implementation, each step of the method provided in this embodiment can be completed by integrated logic circuits in the processor or by instructions in software form. The steps of the method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or being executed by a combination of hardware and software modules in the processor.

[0174] The processor in this application may include, but is not limited to, at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a microcontroller unit (MCU), or an artificial intelligence processor, etc., which are various computing devices that run software. Each computing device may include one or more cores for executing software instructions to perform calculations or processing. The processor may be a separate semiconductor chip or integrated with other circuits into a single semiconductor chip. For example, it may be integrated with other circuits (such as encoding / decoding circuits, hardware acceleration circuits, or various bus and interface circuits) to form a SoC (System-on-a-Chip), or it may be integrated as a built-in processor within an ASIC. The ASIC with the integrated processor may be packaged separately or together with other circuits. In addition to the cores for executing software instructions to perform calculations or processing, the processor may further include necessary hardware accelerators, such as field-programmable gate arrays (FPGAs), PLDs (programmable logic devices), or logic circuits that implement dedicated logic operations.

[0175] The memory in the embodiments of this application may include at least one of the following types: read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; or electrically erasable programmable-only memory (EEPROM). In some scenarios, the memory may also be a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto.

[0176] This application also provides a computer-readable storage medium including instructions that, when run on a computer, cause the computer to perform any of the methods described above.

[0177] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to perform any of the methods described above.

[0178] This application also provides a chip including a processor and an interface circuit. The interface circuit is coupled to the processor. The processor is used to run computer programs or instructions to implement the above-described method. The interface circuit is used to communicate with other modules outside the chip.

[0179] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)).

[0180] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple instances. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0181] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely illustrative descriptions of the application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and variations.

Claims

1. An encryption method for a trusted chip, characterized in that, include: It broadcasts encrypted beacon frames to neighboring devices via a built-in dual-mode radio frequency unit; Receive response beacon frames from adjacent devices; Construct a trust topology graph based on response beacon frames; Identify the cluster head device and member devices in the trust topology graph, and activate the corresponding encryption layer based on the cluster head device and member devices; the cluster head device represents the central node device, and the member devices represent the edge node devices; The step of activating the corresponding encryption layer based on the cluster head device and member devices includes: The cluster head device employs a Physically Unclonable Function (PUF) layer, a national cryptographic algorithm layer, and a quantum-resistant preparatory layer. Member devices enable the national cryptographic algorithm layer and / or PUF layer; The PUF layer is used to generate a trusted key through the PUF challenge-response mechanism, the national cryptographic algorithm layer is used to complete data encryption and authentication based on the national cryptographic algorithm using the trusted key, and the quantum-resistant preparatory layer is used to deploy the CRYSTALS-Kyber key encapsulation mechanism to perform quantum-safe encryption on the trusted key.

2. The encryption method for a trusted chip according to claim 1, characterized in that, The construction of the trust topology graph based on the response beacon frame includes: Parse the device identifier, device type, and signal loudness in the response beacon frame; the device type includes gateways, sensors, and programmable logic controllers (PLCs). Calculate the topology trust value for each device based on the parsed data; Devices with a topology trust value greater than the first threshold are retained; A topology graph is constructed based on the connection methods of the retained devices to obtain a trusted topology graph.

3. The encryption method for a trusted chip according to claim 2, characterized in that, The formula for calculating the topology trust value is: Topology trust value = w1 × Device type weight + w2 × (1 - Signal strength / Theoretical strength) + w3 × Historical communication success rate; where the historical communication success rate is obtained by statistically analyzing the ratio of the number of successful communications in the device's historical communication records to the total number of communications, w1, w2 and w3 represent the weight coefficients of each item, and w1 + w2 + w3 = 1.

4. The encryption method for a trusted chip according to claim 2, characterized in that, The cluster head device and member devices for identifying the trust topology include: The device with the highest topology trust value in the trust topology diagram, and whose device type is gateway or PLC, is marked as a cluster head device; The device that is directly associated with the cluster head device is marked as a member device.

5. The encryption method for a trusted chip according to claim 1, characterized in that, The generation of trusted keys through the PUF challenge-response mechanism includes: Member devices generate challenge values ​​using physically non-clonable SRAM functions and write them into the 0xAA~0xC9 fields of the encrypted beacon frame; After receiving the challenge value, the cluster head device reproduces the PUF response value and signs it with the private key using the SM2 algorithm; Both the member device and the cluster head device generate a temporary trusted key based on the PUF response value input into the SM3 hash algorithm; the temporary trusted key is valid for a single communication and becomes invalid after the transmission ends.

6. The encryption method for a trusted chip according to claim 2, characterized in that, After parsing the response beacon frame, if the device is determined to be an old device, the trusted chip will send the encryption configuration to the old device through the Security Policy Descriptor (SPD). The Security Policy Descriptor (SPD) includes the device hash value, executable binary stream, industrial protocol adaptation rules, preset cluster head public key, weight coefficients of various items in the topology trust value calculation formula, and anti-rollback version identifier. The device hash value is used to match the device hardware fingerprint, the executable binary stream contains PUF layer firmware and SM4 algorithm logic circuit file, the industrial protocol adaptation rule is used to define the position and offset of the encrypted field, and the preset cluster head public key is used to verify the signature validity of the SPD.

7. The encryption method for a trusted chip according to claim 6, characterized in that, The method for determining the old equipment is as follows: The device is considered an outdated device when the parsed response beacon frame meets at least two of the following characteristics: Feature 1: The CAPABILITY field has no PUF_SUPPORT and SM2_SUPPORT flags, and the RAM_SIZE field value is ≤0x0FA0; Feature 2: Communication is conducted using TCP port 502, or the data frames have no encrypted fields; Feature 3: Multiple consecutive bytes in the 0x0800F000~0x0800F040 address range of the device memory are all 0s or all 1s, or the firmware update package has no SM3 hash value.

8. An encryption system for a trusted chip, characterized in that, include: The module consists of a beacon interaction module, a topology construction module, and an encryption execution module; among them, The beacon interaction module is used to broadcast encrypted beacon frames to adjacent devices via a built-in dual-mode radio frequency unit, and to receive response beacon frames from adjacent devices. The topology construction module is used to construct a trust topology graph based on response beacon frames and identify the cluster head device and member devices of the trust topology graph; The encryption execution module is used to activate the corresponding encryption layer based on the cluster head device and member devices, including: The cluster head device employs a Physically Unclonable Function (PUF) layer, a national cryptographic algorithm layer, and a quantum-resistant preparatory layer. Member devices enable the national cryptographic algorithm layer and / or PUF layer; The PUF layer is used to generate a trusted key through the PUF challenge-response mechanism, the national cryptographic algorithm layer is used to complete data encryption and authentication based on the national cryptographic algorithm using the trusted key, and the quantum-resistant preparatory layer is used to deploy the CRYSTALS-Kyber key encapsulation mechanism to perform quantum-safe encryption on the trusted key.

9. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the encryption method of the trusted chip according to any one of claims 1 to 7.

Images