Host and network card binding method based on read-write of network card EEPROM
By storing the host fingerprint in the network card's EEPROM and combining it with a verification control program, a one-to-one hardware-level binding between the host and the network card is achieved. This solves the problems of insufficient credential security and lack of hardware binding in existing network access authentication, improves the security and reliability of network access, reduces deployment costs, and is applicable to various authentication protocols and scenarios.
Patent Information
- Application Number
- CN202511397026.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-28
- Publication Date
- 2025-12-12
AI Technical Summary
Existing network access authentication mechanisms suffer from insufficient credential security, lack of hardware binding mechanisms, and high-cost hardware solutions that are difficult to promote, making it easy for unauthorized devices to bypass authentication and resulting in insufficient network access security and reliability.
By storing the host fingerprint in the network card's EEPROM through a binding program and comparing it with the verification control program at each startup, a one-to-one hardware-level binding between the host and the network card is achieved. Combined with access authentication processes such as NAC/AAA, the authenticity and security of the binding relationship are ensured.
It achieves one-to-one hardware-level binding between the host and the network card, preventing network card replacement, improving the authenticity and security of network access, reducing deployment costs, adapting to various authentication protocols and scenarios, and improving operational reliability and traceability of security incidents.
Smart Images
Figure CN121125285A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer network security technology, specifically to a method for binding a host and a network card based on EEPROM reading and writing. By cooperating with a binding program and a verification control program, hardware-level binding and pre-authentication control between the host and the network card are achieved. Background Technology
[0002] With the deepening development of informatization, the scale of enterprise networks and public networks continues to expand, and network access security has gradually become an indispensable core component of information security systems. Existing access authentication mechanisms are mainly based on account passwords or digital certificates. While these methods can prevent unauthorized users from accessing the network to some extent, they still have many shortcomings in practical applications.
[0003] First, account and password authentication methods lack security. As the most traditional authentication method, accounts and passwords have long been vulnerable to leakage and brute-force attacks. In enterprise settings, some employees habitually use weak passwords or reuse the same password across multiple systems. Once credentials are leaked, attackers can easily gain access. Furthermore, account and password information is typically stored in local files or server databases, making them susceptible to being stolen by Trojans, phishing attacks, or internal personnel.
[0004] Secondly, digital certificate authentication methods are complex to manage and still carry risks. While digital certificates can improve authentication security to some extent, they rely on the integrity of the certificate file itself. Once a certificate is illegally copied, attackers can still access the network by disguising legitimate devices. Furthermore, certificate management and renewal processes are complex, requiring enterprises to establish robust certificate issuance, revocation, and distribution mechanisms. This not only increases operational costs but also causes inconvenience during use.
[0005] Secondly, existing authentication mechanisms generally lack hardware-level binding capabilities. In traditional architectures, authentication primarily relies on the host's account system or operating system environment, rarely directly constraining the mapping between the host and the network interface card (NIC). This means that attackers can bypass the authentication system simply by replacing the NIC and re-initiating authentication requests using the new NIC. For large enterprise networks, this vulnerability allows unauthorized devices to bypass authentication through simple physical means, posing a serious security risk.
[0006] Finally, while hardware-level security solutions are feasible, they are too costly. Existing solutions, such as TPM chips, smart cards, and dedicated hardware encryption modules, can achieve strong binding at the device level, but these solutions often require new hardware devices or modifications to existing terminals, which are expensive and complex to deploy, making them unsuitable for large-scale deployment in enterprise or public networks.
[0007] In summary, existing network access authentication methods suffer from insufficient credential security, lack of hardware binding mechanisms, and difficulties in promoting high-cost hardware solutions. Therefore, there is an urgent need for a new method that can leverage existing hardware resources to achieve a one-to-one binding between a host and a network interface card (NIC) without incurring additional costs, and ensure the authenticity of the binding relationship through verification and control during network access, thereby improving the security and reliability of network access. Summary of the Invention
[0008] The purpose of this invention is to provide a host-network interface card (NIC) binding method based on NIC EEPROM read / write. This method combines binding and verification control technologies to achieve hardware-level binding between the host and the NIC, and uses the verification result as a prerequisite for access authentication such as NAC / AAA, thereby preventing unauthorized devices from bypassing authentication by replacing the NIC. To achieve the above objective, this invention proposes the following two main technologies: 1. Binding technology The binding technology is implemented by a binding program. When the device is first enabled or the network card is replaced, the binding program runs via external media to complete the binding between the host and the network card. The process includes checking the operating system version, user permissions, and whether dependent tools meet the requirements; collecting the host's unique hardware identification information, including the hard drive serial number, CPU UUID, and motherboard UUID; generating a fixed-length host fingerprint using a hash algorithm (such as SHA-256); encrypting the fingerprint using a private key to generate ciphertext, and writing it to the network card's EEPROM via the ethtool-E interface; immediately reading back after writing to verify the correctness of the write result; retrying if it fails, and recording the error and terminating the process after exceeding a preset number of attempts. The binding technology is executed only once when the device is first enabled or the network card is replaced, and the binding result is valid indefinitely.
[0009] 2. Verification control technology Verification control technology is implemented by a verification control program. The program automatically runs each time the host boots up or the network card is enabled to verify the binding relationship. The steps include: collecting current host hardware information to generate a fingerprint; reading the stored encrypted fingerprint from the EEPROM and decrypting it using the public key to obtain the binding fingerprint; comparing the decryption result with the current host fingerprint. If they match, the network card is allowed to work normally and enters the NAC / AAA authentication process; if they do not match, the verification control program prevents the network card from continuing to be used for network communication on the host side, thus preventing the host's access request from entering the NAC / AAA authentication process and rejecting it.
[0010] This invention achieves a one-to-one binding relationship between the host and the network card by combining the above-mentioned binding technology and verification control technology, and provides a prerequisite for subsequent access authentication such as NAC / AAA, thereby significantly improving the authenticity and security of network access.
[0011] Compared with the prior art, the present invention has the following beneficial effects: 1. Preventing the risk of credential leakage: This invention adopts an asymmetric encryption mechanism. During the binding stage, the private key is used to write the fingerprint, and during the verification stage, the public key is used to decrypt and compare, thereby ensuring that the fingerprint data cannot be forged or copied, effectively avoiding security risks caused by the leakage of account passwords or certificates.
[0012] 2. Achieve hardware-level binding: By storing the host's encrypted fingerprint in the network card's EEPROM and verifying it every time the host is enabled, this invention establishes a one-to-one binding relationship between the host and the network card at the hardware level, solving the problem that existing authentication mechanisms cannot prevent network card replacement.
[0013] 3. Enhance the authenticity of access authentication: The verification control technology runs automatically every time the host starts up and uses the comparison result as a prerequisite for NAC / AAA authentication, ensuring that only legitimate host-NIC combinations can continue authentication, thereby guaranteeing the authenticity and reliability of access authentication from the source.
[0014] 4. Reduced deployment costs: This invention requires no new hardware and can be implemented entirely based on existing network card EEPROM and operating system tools. Compared with TPM or smart card-based solutions, it significantly reduces costs and is suitable for large-scale enterprise and organization deployments.
[0015] 5. Improve operational reliability: The binding technology only needs to be executed once, and the binding result is valid for a long time; the verification control technology runs automatically when the host is enabled, and together with the abnormal log recording and reporting mechanism, it not only ensures the stability of the authentication process, but also improves the traceability of security events.
[0016] 6. Enhanced adaptability and scalability: This invention can be seamlessly integrated with existing NAC / AAA systems, 802.1X protocols, EAP-TLS authentication, etc., and can also be extended to various scenarios such as cloud platforms and zero-trust architectures, demonstrating good adaptability and scalability. Attached Figure Description
[0017] Figure 1 The overall working architecture of the host and network card binding method based on network card EEPROM read / write provided in this embodiment of the invention is as follows: It includes an external medium 101, a binding program 102, a host 103, a host fingerprint 104, a verification control program 105, a network card 106, and an EEPROM storage area 107; Figure 2 This is a flowchart illustrating the binding technology provided in an embodiment of the present invention. Detailed Implementation
[0018] The technical solutions described below will be explained in detail and completely with reference to the accompanying drawings of the embodiments of this application. It should be noted that the embodiments described are merely examples of a part of this application, and not all of it. Other implementation methods that can be obtained by those skilled in the art based on these embodiments without creative effort should all fall within the protection scope of this application.
[0019] like Figure 1 As shown, the overall working architecture of the host-network card binding method based on network card EEPROM read / write of the present invention includes: an external medium 101, used to run the binding program when the device is first enabled or the network card is replaced; a binding program 102, used to collect host hardware information and generate host fingerprint; a host 103, providing unique identification information such as hard disk serial number, CPU UUID, and motherboard UUID; a host fingerprint 104, a fixed-length feature value generated by a hash algorithm; a verification control program 105 used to verify the binding relationship when the host starts up; a network card 106 and an EEPROM storage area 107 located on the network card, used to store the encrypted host fingerprint. The interaction between the components is as follows: When the binding program 102 is first enabled, it runs through the external medium 101 to generate the host fingerprint 104 and write it into the EEPROM storage area 107; the verification control program 105 runs every time the host 103 is started, reads the binding fingerprint from the EEPROM area 107 and compares it with the host fingerprint 104 generated in real time. The comparison result determines whether the network card 106 is allowed to continue working, thereby determining whether the host 103 can enter the NAC / AAA access authentication process.
[0020] Example 1: Implementation of Binding Technology like Figure 2 When the device is first activated or the network card is replaced, the engineer runs the binding program 102 via an external medium 101 (such as a USB flash drive). The program first checks the operating environment to confirm that the operating system version, user permissions, and dependent tools meet the requirements. Then, the binding program 102 collects unique hardware identification information from the host 103, including the hard drive serial number, CPU UUID, and motherboard UUID. These multiple pieces of hardware information can be concatenated in a preset order, such as "hard drive serial number + CPU UUID + motherboard UUID," or they can be combined using summation, XOR, or weighted combinations to generate a comprehensive identifier string. To avoid conflicts caused by differences in the length of different hardware information, separators or standardization can be added after concatenation.
[0021] The integrated identifier string is hashed to obtain a fixed-length host fingerprint 104. After the fingerprint is generated, it is encrypted using a private key to generate fingerprint ciphertext. The binding program 102 calls an operating system tool (such as the ethtool -E interface) to write the ciphertext into the EEPROM area 107 of the network card 106. After writing, the program immediately reads back the EEPROM content and compares it byte by byte with the original ciphertext to ensure the integrity and correctness of the data writing; if the comparison fails, it automatically performs a preset number of retries, such as three. If it still fails after exceeding the maximum number of retries, the program will record an error log, including the failure time, network card model, failure reason, etc., and terminate the binding process. After successful binding, the external medium 101 is removed, and the binding result is valid indefinitely and does not change with host restart or network environment changes.
[0022] Example 2: Implementation of Verification Control Technology The verification control program 105 runs automatically each time host 103 starts up or network card 106 is enabled. The program again collects the hardware unique identification information of the current host 103 and concatenates or combines it according to the same rules as in the binding phase (e.g., fixed-order concatenation, concatenation with delimiters, or accumulation / XOR method) to generate a real-time host fingerprint 104. This processing rule must be consistent with the binding phase; otherwise, fingerprint inconsistency will occur.
[0023] Subsequently, the verification control program 105 reads the previously written fingerprint ciphertext from the network card's EEPROM area 107 and decrypts the ciphertext using the public key to obtain the bound fingerprint. To improve security, the decryption process can employ multi-threaded verification or incorporate a checksum to prevent data tampering during the reading process.
[0024] The program compares the real-time host fingerprint 104 with the decrypted binding fingerprint. The comparison method can be a byte-by-byte exact match, or, in a specific implementation, allow for a certain amount of redundant check bits. If they match, the binding relationship is determined to be valid, the network card 106 is allowed to work normally, and the system enters the NAC / AAA access authentication process. If they do not match, the binding relationship is determined to be invalid, and the verification control program 105 prevents the network card from continuing to be used for network communication on the host side, thereby rejecting the host's access request. At the same time, the system generates an exception log, recording key information including timestamps, host hardware parameters, network card model, and comparison results. If necessary, the log is reported to the network security management platform via syslog or API for subsequent security auditing and tracing.
[0025] The technical features disclosed in the above embodiments can be combined arbitrarily to form new technical solutions. For the sake of brevity, not all possible combinations of features are listed here, but any combination that does not have logical contradictions should be considered as included within the scope of this specification.
[0026] It should be noted that the above embodiments are only used to illustrate the principles and specific implementation methods of this application, and are intended to enable those skilled in the art to better understand the core ideas of this application. For those skilled in the art, based on the concept of this application, corresponding adjustments and changes can be made to the specific implementation process and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A method for binding a host and a network card based on EEPROM read / write, characterized in that, This includes the following two technologies: (1) Binding technology: The binding technology is implemented by the binding program; when the device is first enabled or the network card is replaced, the binding program is run through the external medium to collect hardware information such as host hard disk serial number, CPU UUID, motherboard UUID, etc., and execute hash algorithm to generate host fingerprint; the host fingerprint is encrypted with private key and the generated ciphertext is written to the EEPROM area of the network card, while the write result is read back to verify. (2) Verification control technology: Verification control technology is implemented by verification control program; the verification control program runs every time the host starts or the network card is enabled, generates the current host fingerprint, reads the stored fingerprint ciphertext from the network card EEPROM area, decrypts it with public key to obtain the binding fingerprint, and compares it with the current host fingerprint; when the comparison is consistent, the binding relationship is determined to be established, the network card is allowed to work normally and enter the NAC / AAA authentication process; when the comparison is inconsistent, the binding relationship is determined to be not established, the verification control program prevents the network card from continuing to be used for network communication on the host side, thereby rejecting the host's access request and recording or reporting the abnormality.
2. The host and network card binding method based on network card EEPROM read and write according to claim 1, wherein the binding program is executed only once when the device is first enabled or the network card is replaced, and the binding result is valid for a long time.
3. The host-network card binding method based on network card EEPROM read / write according to claim 1, wherein the host fingerprint is generated by a hash algorithm, and the collected hardware information includes at least the hard disk serial number, CPU UUID and motherboard UUID.
4. The host-network card binding method based on network card EEPROM read and write according to claim 1, wherein the binding technology retryes a preset number of times when the readback verification fails, and if the maximum number of retries is exceeded and the binding process is still unsuccessful, the binding process is terminated and an error log is recorded.
5. The host-network card binding method based on network card EEPROM read / write according to claim 1, wherein the verification control technology allows the network card to work normally when the binding relationship is determined to be established, and submits the result as a prerequisite for NAC / AAA authentication to the authentication server.
6. The host-network card binding method based on network card EEPROM read / write according to claim 1, wherein the verification control technology directly blocks the authentication request and records the abnormal log when it determines that the binding relationship is not established, and reports it to the network security management platform when necessary.
7. The host-network card binding method based on network card EEPROM read / write according to claim 1, wherein the binding technology is run through an external medium, removed after execution, and is not permanently resident on the host.