Programmable electronic detonator safety communication system and safety communication method

Abstract

The invention provides a programmable electronic detonator safety communication system and a safety communication method, and relates to the technical field of electronic communication safety. The programmable electronic detonator safety communication system comprises a detonation controller and at least one electronic detonator, wherein the electronic detonator is internally provided with a secure communication module, and the secure communication module is configured to generate a unique physical identity label of the electronic detonator based on a physical unclonable function response value generated by the SRAM PUF unit; receiving an encryption instruction frame from the detonation controller for decryption and authentication; sending an encrypted response frame to a detonation controller; the detonation controller is configured to perform bidirectional identity authentication with each electronic detonator and negotiate or derive a session key; constructing a communication frame containing anti-replay parameters and instruction data, encrypting the communication frame by using the session key and generating a message authentication code; and verifying the integrity and freshness of the response frame of the electronic detonator. According to the method, the safety intensity can be ensured, and hardware guarantee is provided for maintaining millisecond-level instruction response.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electronic communication security, in particular to a programmable electronic detonator security communication system and a security communication method. BACKGROUND

[0002] The programmable electronic detonator system is widely used in the fields of civil blasting such as mine exploitation and tunneling, and the communication reliability and security of the system are directly related to the safety and efficiency of the operation. In the prior art, the system usually uses an industrial RS-485 bus to transmit instructions, but the communication protocol has significant security risks. First, the instruction interaction is often in the form of a plaintext frame, which is vulnerable to packet sniffing and man-in-the-middle attacks, resulting in hijacking or tampering of the communication content. Even if some schemes propose an authentication mechanism, such as the published patent CN202211539876.5, it cannot achieve real link layer encryption. Second, the identity authentication process is too weak, and most systems only rely on the serial number of the electronic detonator for comparison, which is easy to copy and forge. According to the patent WO2021155467A1, the success rate of forgery is very high, and it cannot form effective identity protection.

[0003] In terms of time synchronization, existing schemes such as CN113126132A only rely on a single source GPS for time synchronization, which has an inherent clock deviation of tens of microseconds. This provides a time window of hundreds of microseconds for replay attacks, which is difficult to meet the synchronization and security requirements of high-precision blasting. In addition, the core key management mechanism is mostly static, such as EP3680556B1 which uses a pre-set fixed key, lacking the ability to dynamically rotate and update the key. Once a single key is compromised, the security of the entire blasting network will be at risk.

[0004] Upon reviewing the existing technology, there is no published scheme that can simultaneously achieve chip-level physical unclonable function identity binding, dynamic group encryption and hash integrity verification coupling, Beidou-GPS dual-source nanosecond-level high-precision time synchronization, and multi-factor key derivation and online rotation mechanism. Therefore, the present application aims to solve the following technical problems: how to ensure that a large-scale multi-node electronic detonator network has comprehensive security protection capabilities such as chip-level anti-cloning, link-level anti-replay, and system-level anti-side channel attacks while achieving millisecond-level instruction response under strong electromagnetic interference, severe mechanical vibration, and severe temperature drift conditions. SUMMARY

[0005] The present application provides a programmable electronic detonator security communication system and a security communication method to solve the problem of ensuring that a large-scale multi-node electronic detonator network has comprehensive security protection capabilities such as chip-level anti-cloning, link-level anti-replay, and system-level anti-side channel attacks while achieving millisecond-level instruction response.

[0006] In a first aspect, embodiments of the present invention provide a programmable electronic detonator safety communication system, comprising: a detonation controller and at least one electronic detonator; The detonation controller is connected to the electronic detonator via a communication bus; The electronic detonator has a built-in safety communication module, which includes an SRAM PUF unit, a safety chip, and a communication interface. The secure communication module is configured to perform the following operations: Based on the physically unclonable function response value generated by the SRAM PUF unit, a unique physical identifier for the electronic detonator is generated; an encrypted command frame is received from the detonation controller, and the encrypted command frame is decrypted and authenticated; an encrypted response frame is sent to the detonation controller. The detonation controller is configured to perform the following operations: Perform two-way authentication with each electronic detonator and negotiate or derive a session key; construct a communication frame containing anti-replay parameters and instruction data, and use the session key to encrypt the communication frame and generate a message authentication code; verify the integrity and freshness of the electronic detonator response frame.

[0007] In one possible implementation, the secure communication module is specifically used for: During the electronic detonator production and filling stage, the SRAM PUF unit is activated upon power-up to obtain its initial, random power-up response value. The power-on response value is processed with error correction code and post-processed to generate a stable and unique device root key; The device root key is bound to the electronic detonator's factory serial number, together forming the unique physical identity of the electronic detonator.

[0008] In one possible implementation, the detonation controller employs a multi-factor key derivation mechanism to derive the session key required for communication. The multi-factor includes: a preset or negotiated master key, a device root key generated based on the SRAM PUF response, and a precise time stamp obtained from the BeiDou-GPS satellite navigation system.

[0009] In one possible implementation, the system employs a four-dimensional anti-replay mechanism to ensure the freshness and uniqueness of communication commands and prevent commands from being repeatedly attacked. The four-dimensional parameters include: time stamp, dynamic nonce, sequence number, and dual MAC verification. The timestamp is derived from the millisecond-accurate time information of the BeiDou-GPS satellite navigation system; the dynamic Nonce is a random number or counter value generated by the initiator during each communication; the serial number is a unique factory number for each electronic detonator; and the dual MAC verification is used to calculate and verify the message authentication code for the instruction frame and the response frame respectively.

[0010] In this embodiment of the invention, the programmable electronic detonator safety communication system is connected to the electronic detonator via a communication bus between the detonator and the detonator. The safety communication module built into the electronic detonator constructs a unique physical identity identifier using the physical non-cloning function response value generated by the SRAM PUF unit, achieving chip-level anti-cloning. Simultaneously, the two-way identity authentication between the safety communication module and the detonator, the session key negotiation and derivation, as well as the communication frame encryption and message authentication code generation including anti-replay parameters, and the verification of response frame integrity and freshness, form protection at the link level. Combined with the overall system architecture design, it can provide millisecond-level command response for large-scale multi-node electronic detonator networks under conditions of strong electromagnetic interference, severe mechanical vibration, and harsh temperature drift, while possessing comprehensive security protection capabilities of chip-level anti-cloning and link-level anti-replay, effectively addressing the risk of system-level side-channel attacks.

[0011] Secondly, embodiments of the present invention provide a safe communication method for a programmable electronic detonator, applied to a detonation controller, the method comprising: Perform two-way authentication with the target electronic detonator, and negotiate or derive the session key for the current session based on a multi-factor key derivation mechanism; Obtain the current precise BeiDou-GPS time stamp and generate a dynamic random number Nonce; Construct an instruction frame, the instruction frame including: a synchronization header, a control word, the timing timestamp, the dynamic Nonce, and instruction data; Using the session key, the instruction data portion is encrypted using the national cryptographic SM4 algorithm to generate SM4 ciphertext. Using the session key, the complete instruction frame or its key portion is calculated using the national cryptographic SM3 algorithm to generate the first message authentication code SM3-MAC. The synchronization header, control word, time stamp, dynamic nonce, SM4 ciphertext, and first SM3-MAC are then combined to form the final encrypted instruction frame. The encrypted instruction frame is sent to the target electronic detonator via the communication bus. In one possible implementation, the step of using the session key to encrypt the instruction data portion using the national cryptographic SM4 algorithm to generate SM4 ciphertext includes: A temporary working key is derived using the session key and the dynamic Nonce; The instruction data is encrypted using the temporary working key to generate SM4 ciphertext.

[0012] In one possible implementation, the layered encrypted frame structure includes, from front to back, the following components: synchronization header, control word, time stamp, dynamic nonce, SM4 ciphertext, and SM3-MAC.

[0013] In this embodiment of the invention, the secure communication method applied to the detonator controller determines the secure session key through two-way authentication and multi-factor key derivation, obtains the BeiDou-GPS precise time stamp and generates a dynamic Nonce, constructs a standardized command frame, and uses the national cryptographic algorithms SM4 and SM3 to achieve data encryption and message authentication, respectively. The entire process ensures the confidentiality, integrity and anti-attack capability of the detonator controller's sent commands under harsh conditions such as strong electromagnetic interference, and can support the millisecond-level command response requirements of large-scale multi-node electronic detonator networks. At the same time, it strengthens the system's ability to resist side-channel attacks at the link level.

[0014] Thirdly, embodiments of the present invention provide a secure communication method for a programmable electronic detonator, applied to an electronic detonator, the method comprising: Receive encrypted command frames from the detonation controller, and parse the encrypted command frames to extract the synchronization header, control word, timing timestamp, dynamic nonce, SM4 ciphertext, and first SM3-MAC; Using the locally stored or derived session key, the message authentication code of the received frame is recalculated using the SM3 algorithm and compared with the received first SM3-MAC to complete the first layer of identity authentication and integrity verification. The freshness of the time stamp is verified to determine whether it is within the valid time window allowed by the system. The freshness of the dynamic nonce is also verified to check whether it has not been used recently. After the verification is passed, the SM4 ciphertext is decrypted using the session key and the SM4 algorithm to obtain plaintext instruction data. Execute the instructions and prepare the response data; Construct a response frame and use the session key and SM3 algorithm to generate a second message authentication code SM3-MAC for the response data; A response frame containing the second SM3-MAC is sent back to the detonation controller.

[0015] In one possible implementation, verifying the freshness of the dynamic Nonce includes: Obtain the current time synchronized locally from the BeiDou-GPS satellite navigation system for the electronic detonator; Calculate the absolute difference between the received time synchronization timestamp and the local current time; If the absolute value is less than or equal to the predefined threshold time window, the verification passes; otherwise, it is determined to be a replay attack and the instruction frame is discarded.

[0016] In one possible implementation, the construction of the response frame includes: The dynamic Nonce and the timing timestamp from the received instruction frame are included in the response data to be sent; Using the session key and the SM3 algorithm, the complete content including the dynamic Nonce, the time stamp, and the current response data is calculated to generate the second message authentication code SM3-MAC.

[0017] In one possible implementation, the layered encrypted frame structure includes, from front to back, the following components: synchronization header, control word, time stamp, dynamic nonce, SM4 ciphertext, and SM3-MAC.

[0018] In this embodiment of the invention, the secure communication method applied to electronic detonators, from receiving encrypted command frames to parsing, MAC verification, freshness verification, decryption and execution of commands, and construction of encrypted response frames, achieves comprehensive secure verification of received commands and secure construction of its own response under conditions of strong electromagnetic interference, severe mechanical vibration, and severe temperature drift. This ensures that the electronic detonator can respond to the detonation controller commands at the millisecond level while possessing anti-replay and anti-data tampering capabilities at the link level, thus helping large-scale multi-node electronic detonator networks to form system-level protection against side-channel attacks. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the programmable electronic detonator safety communication system provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the interactive communication process between the detonation controller and the electronic detonator provided in an embodiment of the present invention. Detailed Implementation

[0020] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0021] Figure 1 This is a schematic diagram of the programmable electronic detonator safety communication system provided in an embodiment of the present invention. Figure 1 As shown, it includes: a detonation controller and at least one electronic detonator (such as...) Figure 1 (Electronic detonator 1~n).

[0022] The detonation controller and the electronic detonator are connected via a communication bus.

[0023] The electronic detonator has a built-in safety communication module, which includes an SRAM PUF unit, a safety chip, and a communication interface.

[0024] The secure communication module is configured to perform the following operations: Based on the physically unclonable function response value generated by the SRAM PUF unit, a unique physical identifier for the electronic detonator is generated; encrypted command frames are received from the detonation controller, and the encrypted command frames are decrypted and authenticated; and encrypted response frames are sent to the detonation controller.

[0025] The detonation controller is configured to perform the following operations: Perform two-way authentication with each electronic detonator and negotiate or derive a session key; construct a communication frame containing anti-replay parameters and instruction data, and encrypt the communication frame and generate a message authentication code using the session key; verify the integrity and freshness of the electronic detonator response frame.

[0026] The programmable electronic detonator safety communication system in this embodiment mainly consists of a detonation controller and at least one electronic detonator. The two interact with each other via a communication bus, such as an RS-485 bus or a CAN bus.

[0027] The electronic detonator has a built-in safety communication module, which includes an SRAM PUF unit, a safety chip, and a communication interface.

[0028] The SRAM PUF unit utilizes the random noise characteristics of Static Random-Access Memory (SRAM) during power-on to generate a response value that is physically unclonable. During the electronic detonator manufacturing process, this unit is activated upon power-on to acquire the initial power-on response value. After error correction coding and post-processing, a stable and unique device root key is generated. This device root key is bound to the electronic detonator's factory serial number, together forming a unique physical identifier for the electronic detonator, ensuring the uniqueness and unforgeability of each electronic detonator at the hardware level.

[0029] The security chip integrates a cryptographic algorithm module for performing security operations such as encryption, decryption, and message authentication. When receiving an encrypted command frame from the detonation controller, the security chip first obtains the frame data through the communication interface, then decrypts the encrypted command frame using the locally stored session key, and verifies the integrity and authenticity of the command frame by verifying the message authentication code (MAC). When sending an encrypted response frame, the security chip encrypts the response data and generates a MAC, then sends it to the bus through the communication interface.

[0030] The communication interface is responsible for connecting to the physical layer of the communication bus, enabling data transmission and reception, and providing a hardware channel for the transmission of instructions and responses between the safety communication module and the detonation controller.

[0031] As the core of the system, the detonation controller ensures communication security through two-way authentication and session key derivation, communication frame construction, encryption and MAC generation, and response frame verification.

[0032] First, the detonator initiates an authentication process, sending an authentication request containing its own identity information and a challenge value to the electronic detonator. The electronic detonator generates a response using its unique physical identifier and a pre-set algorithm, and sends it back to the detonator. After successful verification by the detonator, both parties derive a session key based on multiple factors, including the master key, the electronic detonator's root key, and a BeiDou-GPS time stamp. This session key is only valid within the current communication session, significantly enhancing key security.

[0033] Secondly, the detonation controller constructs a communication frame containing anti-replay parameters and command data. The anti-replay parameters include a BeiDou-GPS time stamp, dynamic nonce, and electronic detonator serial number, while the command data includes detonation delay and detonation logic. Subsequently, the command data portion of the communication frame is encrypted using a derived session key, employing the national cryptographic algorithm SM4. A message authentication code is then calculated for the complete communication frame or its key components, generated using the national cryptographic algorithm SM3, ensuring data confidentiality and integrity.

[0034] Then, after receiving the encrypted response frame from the electronic detonator, the detonation controller verifies the MAC of the response frame to confirm its integrity, and checks the anti-replay parameters to ensure the freshness of the response. The anti-replay parameters check the freshness of the timestamp and the uniqueness of the nonce, in order to prevent replay attacks.

[0035] In this embodiment, the programmable electronic detonator safety communication system is connected to the electronic detonator via a communication bus between the detonator and the detonator. The safety communication module built into the electronic detonator constructs a unique physical identity using the physical unclonable function response value generated by the SRAM PUF unit, achieving chip-level anti-cloning. Simultaneously, the two-way authentication between the safety communication module and the detonator, the session key negotiation and derivation, as well as the encryption of communication frames containing anti-replay parameters, the generation of message authentication codes, and the verification of response frame integrity and freshness, form protection at the link level. Combined with the overall system architecture design, it can provide millisecond-level command response for large-scale multi-node electronic detonator networks under conditions of strong electromagnetic interference, severe mechanical vibration, and harsh temperature drift, while possessing comprehensive security protection capabilities of chip-level anti-cloning and link-level anti-replay, effectively addressing the risk of system-level side-channel attacks.

[0036] In one possible implementation, the secure communication module is specifically used for: During the electronic detonator production and filling stage, the SRAM PUF cell is activated upon power-up to obtain its initial, random power-up response value; The power-on response value is processed with error correction codes and post-processed to generate a stable and unique device root key; The device root key is bound to the electronic detonator's factory serial number, together forming the electronic detonator's unique physical identity.

[0037] In the core process of electronic detonator production and filling, the safety communication module first activates the SRAM PUF unit. Specifically, power is supplied to the electronic detonator's safety communication module through dedicated testing equipment on the production line, triggering the SRAM PUF unit to power on and start. Because the SRAM memory cell exhibits random high and low voltage states due to differences in internal transistor threshold voltages and manufacturing process deviations during initial power-on, the SRAM PUF unit automatically generates a set of initial power-on response values ​​based on these inherent physical random characteristics. This response value possesses inherent randomness and is strongly bound to the physical structure of a specific SRAM chip, making it impossible to completely replicate through software copying or hardware cloning. This lays a hardware-level security foundation for the subsequent generation of a unique physical identifier.

[0038] Considering the harsh environmental factors that electronic detonators may face in practical applications, such as severe temperature drift (e.g., -40℃ to 85℃) and strong electromagnetic interference, the initial power-on response value may contain a small number of unstable bits. To ensure the long-term reliability of the subsequently generated device root key, the secure communication module performs error correction coding on the acquired initial power-on response value. In this embodiment, the BCH(255,131) error correction code algorithm is used. This algorithm can effectively detect and correct random error bits in the response value, keeping the bit error rate at an extremely low level.

[0039] After error correction processing, the secure communication module performs further post-processing. Using the built-in SM3 hash algorithm (a national cryptographic standard), the corrected response value is hashed to generate a fixed-length (256-bit) hash value. This process not only eliminates any residual minor randomness in the response value but also enhances its tamper resistance through the one-way nature of hash operations, ultimately yielding a stable and unique device root key. This key preserves the physical uniqueness of the SRAM PUF unit while also possessing algorithmic stability and security.

[0040] After generating a stable device root key, the secure communication module binds this key to the electronic detonator's factory serial number. The electronic detonator's factory serial number is assigned by the manufacturer according to a unique coding rule; each serial number corresponds to a unique electronic detonator and is written into the secure communication module's OTP (One-Time Programmable) memory during the production process. Once written, it cannot be modified or erased, ensuring the serial number's immutability.

[0041] The secure communication module combines the device root key and the factory serial number through built-in encryption logic, and then generates final identification data that integrates both information using the SM3 hash algorithm. This data serves as the unique physical identifier of the electronic detonator. This identifier simultaneously incorporates the physical randomness of the SRAM PUF unit and the unique code assigned by the manufacturer (or device root key and factory serial number). This avoids the vulnerability of relying solely on the serial number, which is easily forged, and also solves the stability problem of the SRAM PUF response value in harsh environments. It achieves a dual security binding of "hardware physical characteristics + software unique code," ensuring that the physical identifier of each electronic detonator is unique and cannot be cloned throughout its entire lifecycle, providing core security support for subsequent two-way authentication and resistance to side-channel attacks.

[0042] In this embodiment, the secure communication module activates the SRAM PUF unit during the electronic detonator production and filling stage. After error correction code processing and post-processing, a stable and unique device root key is generated and bound to the factory serial number to form a unique physical identity. This process solves the stability problem of SRAM PUF response under strong electromagnetic interference, severe mechanical vibration and severe temperature drift, ensuring the reliability of the device root key. Furthermore, by binding it with the factory serial number, the uniqueness of the identity is strengthened, achieving non-cloning from the source of chip production. This provides a chip-level anti-cloning foundation for large-scale multi-node electronic detonator networks in harsh environments and supports identity security authentication under millisecond-level command response of the system.

[0043] In one possible implementation, the detonation controller employs a multi-factor key derivation mechanism to derive the session key required for communication. The multi-factors include: a preset or negotiated master key, a device root key generated based on the SRAM PUF response, and a precise time stamp obtained from the BeiDou-GPS satellite navigation system.

[0044] The master key K_master of the detonator is determined using a "pre-set master, negotiation as a supplement" approach. During the system's factory deployment, a 256-bit master key is generated via the hardware security module (HSM). This key is written to the detonator's secure storage area via an encrypted channel, and the plaintext is immediately destroyed after writing. It can only be accessed through the built-in encryption logic, eliminating the risk of the master key being extracted by side-channel attacks. If the master key needs to be updated for subsequent system networking, the detonator can perform two-way authentication with the upper-level management platform using the national cryptographic algorithm SM2. After successful authentication, a new master key is negotiated and generated, overwriting the original master key storage area. This ensures that the master key is always under encrypted protection, providing a fundamental security guarantee for key derivation.

[0045] The device root key K_root required by the detonator is directly derived from the SRAMPUF unit of the electronic detonator's safety communication module. During the electronic detonator's production and filling stage, its SRAMPUF unit generates an initial response value upon power-up. This value is then processed using a BCH(255,131) error correction code to eliminate unstable bits caused by temperature drift and electromagnetic interference. Finally, it is post-processed using the SM3 hash algorithm to generate the device root key, which is then bound to the factory serial number. When the detonator establishes a communication connection with the electronic detonator, the electronic detonator transmits the device root key (encrypted via a temporary session) to the detonator through a two-way authentication process. After verifying the binding relationship between the key and the physical identity of the electronic detonator, the detonator temporarily stores the key for subsequent derivation operations, ensuring a strong association between the key and a specific electronic detonator, thus achieving chip-level identity binding.

[0046] The detonation controller incorporates a BeiDou-GPS dual-source timing module, which supports simultaneous reception of BeiDou and GPS satellite signals. In environments with strong electromagnetic interference, it automatically switches between primary and backup signal sources, prioritizing BeiDou signals to ensure continuous timing. The timing module parses the satellite signals into nanosecond-accurate timestamps and synchronizes them in real-time to the detonation controller's key derivation module. To eliminate signal transmission delays caused by mechanical vibration, the module performs deviation compensation on the acquired timestamps, ultimately outputting stable and accurate timestamps. This introduces a dynamic variation factor into key derivation, avoiding the security risks associated with static keys.

[0047] In this embodiment, the detonation controller adopts a multi-factor key derivation mechanism, using the master key, the device root key based on SRAM PUF, and the BeiDou-GPS precise time synchronization timestamp as factors for deriving the session key. The master key ensures basic security, the device root key is associated with the unique physical identity of the electronic detonator, and the precise time synchronization timestamp introduces dynamic changes. The combination of these three factors enables the session key to have both fixed security attributes and dynamic characteristics under harsh conditions such as strong electromagnetic interference, avoiding the risk of static keys being easily cracked and reused by side-channel attacks, improving key security and timeliness, and ensuring link-level secure communication during millisecond-level command response in large-scale multi-node electronic detonator networks.

[0048] In one possible implementation, the system employs a four-dimensional anti-replay mechanism to ensure the freshness and uniqueness of communication commands and prevent commands from being repeatedly attacked. The four-dimensional parameters include: time stamp, dynamic nonce, sequence number, and dual MAC verification. Among them, the time stamp is derived from the millisecond-accurate time information of the Beidou-GPS satellite navigation system; the dynamic nonce is a random number or counter value generated by the initiator for each communication; the serial number is a unique factory number for each electronic detonator; and the dual MAC verification is used to calculate and verify the message authentication code for the command frame and the response frame respectively.

[0049] The core function of the time stamp is to define the valid window of communication commands through precise time, preventing expired commands from being replayed. This is achieved through a system-integrated BeiDou-GPS dual-source time synchronization module. Both the detonator and electronic detonator's safety communication modules have built-in BeiDou-GPS dual-mode receiver chips, capable of simultaneously receiving BeiDou and GPS satellite signals and extracting millisecond-level time information as the time stamp. During each communication, the detonator writes the current time stamp into the communication frame; upon receiving it, the electronic detonator compares the difference between the locally synchronized BeiDou-GPS time and the time stamp in the frame. If the difference is less than a predefined effective threshold (e.g., 200ns), the command is considered valid; otherwise, it is considered a replay attack and the command is discarded, thus eliminating the risk of expired commands being reused from a time perspective.

[0050] The core function of dynamic nonce is to assign a unique random identifier to each communication, preventing the same command from being sent repeatedly within the valid time. Before each communication is initiated, the detonator or electronic detonator generates a 64-bit dynamic nonce using a built-in true random number generator (TRNG). For multi-node batch communication, the detonator assigns an independent dynamic nonce to each electronic detonator, ensuring that nonces do not conflict between nodes.

[0051] The electronic detonator maintains a "Nonce history table" locally, storing the most recently verified Nonces (e.g., 100). Upon receiving a new instruction, it first queries this table. If the dynamic Nonce already exists in the frame, it is directly determined to be a replay attack; if it does not exist, it is verified, written to the table, and the oldest historical record is removed, ensuring the uniqueness of each communication through random identification.

[0052] The core function of the serial number is to bind communication commands to a specific electronic detonator, preventing command replay across devices on different nodes. This is achieved through the electronic detonator's unique factory-issued code, which cannot be modified or erased after being written, ensuring a strong bond between the serial number and the physical device and preventing cloning and tampering. When the detonation controller sends a command, it must include the target electronic detonator's serial number in the communication frame. After receiving the command, the electronic detonator compares the serial number in the frame with the serial number stored locally in the OTP. If they do not match, it is determined to be a cross-device replay attack and execution is refused.

[0053] Meanwhile, when the detonation controller is networked in batches, it will establish a "serial number-node address" mapping table to ensure that the command is only sent to the electronic detonator with the corresponding serial number, thus limiting the scope of command reuse from the perspective of device identification.

[0054] The core function of dual MAC verification is to verify the integrity and authenticity of command frames and response frames separately, while also assisting in preventing replay attacks. If a frame is tampered with or replayed, the MAC value will change, thus being detected. After the detonator constructs the command frame, it uses the current session key to perform an SM3 hash operation on the complete data of "synchronization header + control word + timing timestamp + dynamic nonce + SM4 ciphertext," generating a 4-byte MAC value, which is then appended to the end of the frame. Upon receiving the data, the electronic detonator repeats the SM3 operation using the same session key and data segment, comparing the generated MAC value with the MAC value in the frame. If they match, the command is determined not to have been tampered with; otherwise, it is determined to be a replay or tampering attack.

[0055] After the electronic detonator executes the command, it constructs a response frame. It also uses the session key to perform SM3 operation on "response data + time stamp of the original command frame + dynamic nonce of the original command frame" to generate a MAC value. After receiving the response frame, the detonation controller verifies the MAC value according to the same logic to ensure that the response comes from the corresponding electronic detonator and has not been tampered with, forming a two-way MAC protection between "command and response" to block replay attack vulnerabilities from the perspective of data integrity.

[0056] In this embodiment, the system's four-dimensional anti-replay mechanism uses BeiDou-GPS millisecond-level time stamps, dynamic nonce, unique serial numbers of electronic detonators, and dual MAC verification. From multiple dimensions such as time, random numbers, device identification, and data integrity, it effectively limits the effective time of commands, ensures the uniqueness of commands, binds commands to specific devices, and detects data tampering under environments with strong electromagnetic interference, severe mechanical vibration, and harsh temperature drift. It comprehensively blocks replay attack paths, ensures the link-level anti-replay capability of large-scale multi-node electronic detonator networks during millisecond-level command response, and enhances the system's protection level against side-channel attacks.

[0057] The above embodiments mainly describe a programmable electronic detonator safety communication system. The following description, in conjunction with a schematic diagram of the interactive communication process between the detonator and the electronic detonator, will illustrate the embodiments of the present invention to facilitate understanding of the information interaction process between the detonator and the electronic detonator. For details not described in detail, please refer to the corresponding system embodiments described above.

[0058] Figure 2 This is a schematic diagram of the interactive communication process between the detonation controller and the electronic detonator provided in an embodiment of the present invention.

[0059] This invention provides a secure communication method for programmable electronic detonators, such as... Figure 2 As shown, applied to an initiation controller, the method includes: Perform two-way authentication with the target electronic detonator, and negotiate or derive the session key for the current session based on a multi-factor key derivation mechanism; Obtain the current precise BeiDou-GPS time stamp and generate a dynamic random number Nonce; Construct a command frame, which includes: a synchronization header, a control word, a time stamp, a dynamic nonce, and command data; Using the session key, the instruction data portion is encrypted using the national cryptographic SM4 algorithm to generate SM4 ciphertext. Using the session key, the complete instruction frame or its key parts are calculated using the national cryptographic SM3 algorithm to generate the first message authentication code SM3-MAC. The synchronization header, control word, time stamp, dynamic nonce, SM4 ciphertext and the first SM3-MAC are combined into the final encrypted instruction frame. The signal is transmitted to the target electronic detonator via a communication bus.

[0060] In the specific implementation process, before the detonator and the target electronic detonator establish communication, two-way identity authentication is completed and the session key is determined based on the multi-factor key derivation mechanism. The detonator, as the authentication initiator, generates a 128-bit PUF challenge value. Combined with the current preliminary time stamp, the combination data of the challenge value and the timestamp is signed with SM3 using the preset authentication key to form an authentication request frame and sent to the target electronic detonator.

[0061] Upon receiving the signal, the target electronic detonator inputs a challenge value into its SRAM PUF unit to generate a physically unclonable response value. After verifying the signature validity, it encrypts and transmits the response value along with the HMAC value of the timestamp back. The detonation controller decrypts the response value and, based on the preset master key, integrates the response value with the precise timestamp synchronized with BeiDou-GPS, generating a 128-bit session key exclusively for this session using the SM3 hash algorithm, ensuring the key's security and timeliness.

[0062] After authentication and key derivation are completed, the detonation controller obtains a precise time stamp through its built-in BeiDou-GPS dual-source timing module. This module can automatically switch between primary and backup signal sources under strong electromagnetic interference. When severe mechanical vibration causes signal fluctuations, it maintains time continuity through a built-in time buffer unit, ultimately extracting time information accurate to the millisecond level. Simultaneously, it calls the built-in true random number generator to generate a 64-bit dynamic Nonce based on circuit thermal noise. Each communication generates a unique Nonce, and during multi-node communication, an independent Nonce is assigned to each target electronic detonator to avoid conflicts.

[0063] The detonation controller then constructs a basic instruction frame according to a preset format, which includes a synchronization header, control word, timing timestamp, dynamic nonce, and instruction data.

[0064] Next, the SM4 algorithm accelerator is invoked, using the session key as the encryption key, and the command data is encrypted in CTR mode to generate SM4 ciphertext of the same length as the command data. Then, the session key is used to perform SM3 hash operation on the complete data segment of the synchronization header, control word, time stamp, dynamic nonce, and SM4 ciphertext to generate the first message authentication code. The above parts are then combined in sequence to form the final encrypted command frame.

[0065] Finally, the detonation controller sends encrypted command frames via an anti-interference RS-485 communication bus with an electromagnetic shielding layer, using differential signal transmission to reduce signal attenuation or distortion caused by severe mechanical vibration. At the same time, it monitors the bus transmission status in real time and immediately retransmits if a transmission error is detected, ensuring that the target electronic detonator accurately receives the command and supporting reliable communication in a large-scale multi-node network.

[0066] In this embodiment, the secure communication method applied to the detonator controller determines the secure session key through two-way authentication and multi-factor key derivation, obtains the BeiDou-GPS precise time stamp and generates a dynamic Nonce, constructs a standardized command frame, and uses the national cryptographic algorithms SM4 and SM3 to achieve data encryption and message authentication, respectively. Under harsh conditions such as strong electromagnetic interference, the entire process not only ensures the confidentiality, integrity and anti-attack capability of the detonator controller's sent commands, but also supports the millisecond-level command response requirements of a large-scale multi-node electronic detonator network. At the same time, it strengthens the system's ability to resist side-channel attacks at the link level.

[0067] In one possible implementation, a session key is used to encrypt the instruction data portion using the national cryptographic algorithm SM4, generating SM4 ciphertext, including: A temporary working key is derived using the session key and a dynamic nonce; The instruction data is encrypted using a temporary working key to generate SM4 ciphertext.

[0068] In this embodiment, the instruction data is encrypted using SM4 by using a session key and a temporary working key derived from a dynamic nonce. The randomness of the dynamic nonce ensures that the temporary working key is different each time under conditions such as strong electromagnetic interference, avoiding the risk of all encrypted data being cracked after the session key is leaked. This improves the security of the SM4 encryption process, reduces the probability of the key being cracked and reused by side-channel attacks, and provides a higher level of security for the encryption of instruction data during millisecond-level instruction responses in large-scale multi-node electronic detonator networks.

[0069] In one possible implementation, the layered encrypted frame structure, from front to back, includes: a synchronization header, a control word, a time stamp, a dynamic nonce, SM4 ciphertext, and SM3-MAC.

[0070] In a specific implementation process, the protocol frame structure is shown in Table 1: Table 1 Protocol Frame Structure

[0071] In this embodiment, the layered encrypted frame structure is arranged in the following order: synchronization header, control word, timing timestamp, dynamic nonce, SM4 ciphertext, and SM3-MAC. Each part functions clearly and works synergistically under strong electromagnetic interference, severe mechanical vibration, and harsh temperature drift environments. The synchronization header quickly captures the frame signal, the control word specifies the processing method, the timing timestamp and dynamic nonce prevent replay, the SM4 ciphertext ensures confidentiality, and the SM3-MAC verifies integrity. This ensures that the security functions of each stage of frame data transmission and processing are carried out in an orderly and efficient manner, facilitating parsing and processing by the receiver. While ensuring millisecond-level command response in large-scale multi-node electronic detonator networks, it also strengthens the system's resistance to side-channel attacks at the link structure level. The above embodiments mainly describe a safe communication method for programmable electronic detonators when applied to a detonation controller. The following describes the method when applied to electronic detonators.

[0072] This invention also provides a secure communication method for a programmable electronic detonator, applied to an electronic detonator, the method comprising: Receive encrypted command frames from the detonation controller, parse the encrypted command frames, and extract the synchronization header, control word, timing timestamp, dynamic nonce, SM4 ciphertext, and first SM3-MAC; Using the locally stored or derived session key, the message authentication code of the received frame is recalculated using the SM3 algorithm and compared with the received first SM3-MAC to complete the first layer of identity authentication and integrity verification. The freshness of the time stamp is verified to determine whether it is within the valid time window allowed by the system. The freshness of the dynamic nonce is also verified to check whether it has not been used recently. After the verification is passed, the SM4 ciphertext is decrypted using the session key and the SM4 algorithm to obtain the plaintext instruction data. Execute the instructions and prepare the response data; Construct a response frame and generate a second message authentication code (SM3-MAC) for the response data using the session key and the SM3 algorithm; A response frame containing the second SM3-MAC is sent back to the detonation controller.

[0073] In practical implementation, the electronic detonator first receives encrypted command frames from the detonation controller through its built-in safety communication module. This module's communication interface employs a differential signal reception design resistant to electromagnetic interference, enabling stable capture of frame data even in strong electromagnetic environments and with signal fluctuations caused by severe mechanical vibrations. After reception, the safety communication module parses the encrypted command frame according to a preset frame structure, sequentially extracting the synchronization header, control word, time stamp, dynamic nonce, SM4 ciphertext, and SM3-MAC, laying the foundation for subsequent verification and decryption.

[0074] After frame parsing is completed, the electronic detonator calls the session key stored locally in the safety chip. This key is a 128-bit key generated and solidified in the safe storage area based on the multi-factor key derivation mechanism during the initial two-way authentication with the detonator controller. According to the data range consistent with the detonator controller, namely the complete data segment of "synchronization header + control word + timing timestamp + dynamic nonce + SM4 ciphertext", the message authentication code is recalculated using the national cryptographic SM3 algorithm. The recalculated SM3-MAC is compared byte by byte with the extracted first SM3-MAC. If the two are completely consistent, the first layer of identity authentication (confirming that the instruction comes from a legitimate detonator controller) and integrity verification (confirming that the instruction has not been tampered with during transmission) are completed. If the comparison is inconsistent, the instruction frame is directly discarded to avoid security risks.

[0075] Subsequently, the electronic detonator verifies the freshness of the time stamp by obtaining the current local synchronization time through the built-in BeiDou-GPS dual-source timing module. It calculates the difference between the local time and the extracted time stamp; if the difference is less than the system's predefined 200ns effective time window, the timestamp is considered fresh. Simultaneously, the electronic detonator queries the locally maintained "Dynamic Nonce History Table." If the extracted dynamic nonce does not exist in the table, the nonce is considered fresh. After both freshness verifications pass, the electronic detonator uses the session key to decrypt the SM4 ciphertext according to the SM4-CTR encryption mode specified by the control word. The decryption process is completed by the SM4 algorithm accelerator built into the security chip, which can quickly restore the plaintext command data (such as detonation delay, detonation logic, and other core command information) within milliseconds, meeting the command response time requirements of large-scale multi-node networks.

[0076] Upon receiving the plaintext instruction data, the electronic detonator's control unit executes the corresponding instruction and prepares response data based on the execution result (such as success status and current detonator status parameters). A response frame is then constructed, containing the timestamp and dynamic nonce of the original encrypted instruction frame, along with the prepared response data, ensuring the integrity and traceability of the response frame information. Next, the electronic detonator uses the session key again to perform an SM3 hash operation on the complete response frame data ("original timestamp + original dynamic nonce + response data"), generating a 4-byte second SM3-MAC. This MAC value is used by the detonation controller to verify the integrity and legitimacy of the response frame. Finally, the electronic detonator sends the response frame containing the second SM3-MAC back to the detonation controller via the communication interface of the safety communication module in the form of an anti-interference differential signal. During transmission, the bus status is monitored in real time; if a transmission error is detected, the signal is immediately retransmitted, ensuring stable delivery of the response information in complex environments and forming a complete communication loop.

[0077] In this embodiment, the secure communication method applied to electronic detonators, from receiving encrypted command frames to parsing, MAC verification, freshness verification, decryption and execution of commands, and construction of encrypted response frames, achieves comprehensive secure verification of received commands and secure construction of its own response under conditions of strong electromagnetic interference, severe mechanical vibration, and severe temperature drift. This ensures that the electronic detonator can respond to the detonation controller commands at the millisecond level while possessing anti-replay and anti-data tampering capabilities at the link level, thus helping large-scale multi-node electronic detonator networks to form system-level protection against side-channel attacks.

[0078] In one possible implementation, verifying the freshness of a dynamic nonce includes: Obtain the current time synchronized locally from the BeiDou-GPS satellite navigation system for the electronic detonator; Calculate the absolute difference between the received timestamp and the local current time; If the absolute value is less than or equal to the predefined threshold time window, the verification passes; otherwise, it is determined to be a replay attack and the instruction frame is discarded.

[0079] In this embodiment, the dynamic nonce freshness verification method calculates the difference between the local time synchronized with BeiDou-GPS and the time stamp and compares it with a threshold. This ensures the uniformity and accuracy of the time reference under harsh environments such as strong electromagnetic interference, accurately defines the effective time range of the command, effectively identifies replay attacks, avoids the electronic detonator from executing expired or duplicate commands, ensures the link-level anti-replay capability of the large-scale multi-node electronic detonator network in the millisecond-level command response process, and enhances the system's resistance to side-channel attacks.

[0080] In one possible implementation, constructing the response frame includes: The dynamic nonce and time stamp from the received instruction frame are included in the response data to be sent; Using the session key and the SM3 algorithm, the complete content, including the dynamic nonce, time stamp, and current response data, is calculated to generate the second message authentication code SM3-MAC.

[0081] In this embodiment, when constructing the response frame, the dynamic Nonce and time stamp are included in the response data and an associated second message authentication code is generated. Under conditions such as strong electromagnetic interference, the detonation controller can confirm the correlation and consistency between the response and the command, while ensuring the integrity and authenticity of the response data, preventing false or tampered responses from being misjudged, improving the safety and reliability of the electronic detonator response process, and supporting system-level safety protection for large-scale multi-node electronic detonator networks in millisecond-level response.

[0082] In one possible implementation, the layered encrypted frame structure, from front to back, includes: a synchronization header, a control word, a time stamp, a dynamic nonce, SM4 ciphertext, and SM3-MAC.

[0083] In this embodiment, the layered encrypted frame structure is arranged in the order of synchronization header, control word, timing timestamp, dynamic nonce, SM4 ciphertext, and SM3-MAC. Each part has a clear function and works synergistically under strong electromagnetic interference, severe mechanical vibration, and harsh temperature drift environments. The synchronization header quickly captures the frame signal, the control word specifies the processing method, the timing timestamp and dynamic nonce prevent replay, the SM4 ciphertext ensures confidentiality, and the SM3-MAC verifies integrity. This ensures that the security functions of each link in the frame data transmission and processing are carried out in an orderly and efficient manner, which is convenient for the receiver to parse and process. While ensuring the millisecond-level command response of the large-scale multi-node electronic detonator network, it also strengthens the system's ability to resist side-channel attacks at the link structure level.

[0084] To verify the effectiveness of the electronic detonator safety communication scheme provided in this application, a comparative test was conducted with the communication system and chip established by the IEC 62056 standard to verify both safety performance and anti-attack capabilities.

[0085] Table 2 Comparison of Safety Performance

[0086] Table 2 shows a comparison of the security performance of the communication system established by the IEC 62056 standard and the communication system established in this application. The results show that, in terms of man-in-the-middle attacks, the IEC 62056 standard system has a 100% success rate, while the proposed solution has a 0% success rate; regarding the replay attack window, the IEC 62056 standard system has a window of 500 μs, while the proposed solution has a window of less than 200 ns; and in terms of key cracking difficulty, the IEC 62056 standard system has a key cracking difficulty of 2. 56This application proposal has been upgraded to 2 128 Regarding the success rate of fault injection, the IEC 62056 standard system achieves 83.7%, while the proposed solution is less than 0.1%. In summary, the proposed solution significantly outperforms the IEC 62056 standard communication system in terms of security performance, including resisting man-in-the-middle attacks, shortening the replay attack window, increasing the difficulty of key cracking, and reducing the success rate of fault injection.

[0087] Table 3 Electromagnetic fault injection test:

[0088] Table 3 shows the comparison results of electromagnetic fault injection tests between conventional chips and the chip provided in this application. As shown in Table 3, in the electromagnetic fault injection test, the conventional chip failed 89% of the time at an injection voltage of 200V and 100% of the time at an injection voltage of 500V; while the chip of this invention failed 0% of the time at an injection voltage of 200V and only 3% of the time at an injection voltage of 500V, and it was self-recovering. Therefore, it is evident that the chip of this invention is significantly superior to conventional chips in its resistance to electromagnetic fault injection.

[0089] Furthermore, during implementation, the network setup time and communication latency of the system provided by the embodiments of this application were further tested. According to the experimental results, when 100 nodes were networked, the network setup time was 2.8s and the authentication latency was 38ms; when 500 nodes were networked, the network setup time was 6.5s and the authentication latency was only 152ms, providing chip-level to system-level safety assurance for electronic detonators.

[0090] In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not detailed or described in a particular embodiment can be referred to in the relevant descriptions of other embodiments. Unless otherwise specified or in conflict with logic, the terminology and / or descriptions between different embodiments are consistent and can be referenced interchangeably. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0091] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A programmable electronic detonator safety communication system, characterized in that, include: Detonation controller and at least one electronic detonator; The detonation controller is connected to the electronic detonator via a communication bus; The electronic detonator has a built-in safety communication module, which includes an SRAM PUF unit, a safety chip, and a communication interface. The secure communication module is configured to perform the following operations: Based on the physically unclonable function response value generated by the SRAM PUF unit, a unique physical identifier for the electronic detonator is generated; an encrypted command frame is received from the detonation controller, and the encrypted command frame is decrypted and authenticated; an encrypted response frame is sent to the detonation controller. The detonation controller is configured to perform the following operations: Perform two-way authentication with each electronic detonator and negotiate or derive a session key; construct a communication frame containing anti-replay parameters and instruction data, and use the session key to encrypt the communication frame and generate a message authentication code; verify the integrity and freshness of the electronic detonator response frame.

2. The programmable electronic detonator safety communication system according to claim 1, characterized in that, The secure communication module is specifically used for: During the electronic detonator production and filling stage, the SRAM PUF unit is activated upon power-up to obtain its initial, random power-up response value. The power-on response value is processed with error correction code and post-processed to generate a stable and unique device root key; The device root key is bound to the electronic detonator's factory serial number, together forming the unique physical identity of the electronic detonator.

3. The programmable electronic detonator safety communication system according to claim 2, characterized in that, The detonation controller employs a multi-factor key derivation mechanism to derive the session key required for communication. The multi-factors include: a preset or negotiated master key, a device root key generated based on the SRAM PUF response, and a precise time stamp obtained from the BeiDou-GPS satellite navigation system.

4. The programmable electronic detonator safety communication system according to claim 1, characterized in that, The system employs a four-dimensional anti-replay mechanism to ensure the freshness and uniqueness of communication commands and prevent commands from being repeatedly attacked. The four-dimensional parameters include: time stamp, dynamic nonce, sequence number, and dual MAC verification. The timestamp is derived from the millisecond-accurate time information of the BeiDou-GPS satellite navigation system; the dynamic Nonce is a random number or counter value generated by the initiator during each communication; the serial number is a unique factory number for each electronic detonator; and the dual MAC verification is used to calculate and verify the message authentication code for the instruction frame and the response frame respectively.

5. A secure communication method for a programmable electronic detonator, characterized in that, Applied to a detonation controller, the method includes: Perform two-way authentication with the target electronic detonator, and negotiate or derive the session key for the current session based on a multi-factor key derivation mechanism; Obtain the current precise BeiDou-GPS time stamp and generate a dynamic random number Nonce; Construct an instruction frame, the instruction frame including: a synchronization header, a control word, the timing timestamp, the dynamic Nonce, and instruction data; Using the session key, the instruction data portion is encrypted using the national cryptographic SM4 algorithm to generate SM4 ciphertext. Using the session key, the complete instruction frame or its key portion is calculated using the national cryptographic SM3 algorithm to generate the first message authentication code SM3-MAC. The synchronization header, control word, time stamp, dynamic nonce, SM4 ciphertext, and first SM3-MAC are then combined to form the final encrypted instruction frame. The encrypted instruction frame is sent to the target electronic detonator via the communication bus.

6. The secure communication method for a programmable electronic detonator according to claim 5, characterized in that, The step of using the session key and encrypting the instruction data portion using the national cryptographic SM4 algorithm to generate SM4 ciphertext includes: A temporary working key is derived using the session key and the dynamic Nonce; The instruction data is encrypted using the temporary working key to generate SM4 ciphertext.

7. A secure communication method for a programmable electronic detonator, characterized in that, Applied to electronic detonators, the method includes: Receive encrypted command frames from the detonation controller, and parse the encrypted command frames to extract the synchronization header, control word, timing timestamp, dynamic nonce, SM4 ciphertext, and first SM3-MAC; Using the locally stored or derived session key, the message authentication code of the received frame is recalculated using the SM3 algorithm and compared with the received first SM3-MAC to complete the first layer of identity authentication and integrity verification. The freshness of the time stamp is verified to determine whether it is within the valid time window allowed by the system. The freshness of the dynamic nonce is also verified to check whether it has not been used recently. After the verification is passed, the SM4 ciphertext is decrypted using the session key and the SM4 algorithm to obtain plaintext instruction data. Execute the instructions and prepare the response data; Construct a response frame and use the session key and SM3 algorithm to generate a second message authentication code SM3-MAC for the response data; A response frame containing the second SM3-MAC is sent back to the detonation controller.

8. The secure communication method for a programmable electronic detonator according to claim 7, characterized in that, The verification of the freshness of the dynamic nonce includes: Obtain the current time synchronized locally from the BeiDou-GPS satellite navigation system for the electronic detonator; Calculate the absolute difference between the received time synchronization timestamp and the local current time; If the absolute value is less than or equal to the predefined threshold time window, the verification passes; otherwise, it is determined to be a replay attack and the instruction frame is discarded.

9. The secure communication method for a programmable electronic detonator according to claim 7, characterized in that, The constructed response frame includes: The dynamic Nonce and the timing timestamp from the received instruction frame are included in the response data to be sent; Using the session key and the SM3 algorithm, the complete content including the dynamic Nonce, the time stamp, and the current response data is calculated to generate the second message authentication code SM3-MAC.

10. The secure communication method for a programmable electronic detonator according to claim 5 or 7, characterized in that, The layered encrypted frame structure, from front to back, includes: synchronization header, control word, time stamp, dynamic nonce, SM4 ciphertext, and SM3-MAC.

Images