An event instruction control method and an image forming apparatus

Abstract

The present disclosure provides an event instruction control method and an image forming device, wherein the method comprises: generating a first temporary session key when an event instruction is detected; encrypting the event instruction based on the first temporary session key to obtain communication ciphertext; and sending the communication ciphertext to a trusted chip, so that the trusted chip identifies whether to perform an operation corresponding to the event instruction based on the communication ciphertext. The present disclosure reduces the possibility that the event instruction of the device is tampered with or captured by others and maliciously controls the device, thereby improving the security protection capability of the device.

Description

Technical Field

[0001] This application relates to the field of printer information security technology, and in particular to an event command control method and an image forming device. Background Technology

[0002] Currently, the addition of a trusted chip to the hardware in trusted computing solutions for devices leads to an increase in overall device power consumption. To reduce power consumption, the common practice is for the device's main control chip (system on a chip, SoC) to send sleep / wake commands to the trusted chip during device sleep / wake-up, allowing the trusted chip to enter / exit a low-power mode to meet energy consumption requirements.

[0003] However, there is a security risk vulnerability in the process of the main control SoC sending corresponding instructions to the trusted chip: due to issues such as the configuration of some trusted chips, the communication channel between the main control SoC and the trusted chip can be probed. Therefore, external attackers can use methods such as probing the chip's communication to obtain event commands such as sleep / wake-up, and then maliciously send event commands to attack the trusted chip, causing the trusted chip to malfunction and affecting the operation of the device. Summary of the Invention

[0004] This application provides an event command control method and an image forming apparatus to reduce malicious attacks on the apparatus.

[0005] In one aspect, this embodiment provides an event command control method applied to the main control unit of a device, wherein the main control unit is communicatively connected to a trusted chip, and the method includes:

[0006] Upon detecting an event command, a first temporary session key is generated;

[0007] The ciphertext of the communication is obtained by encrypting the event command based on the first temporary session key.

[0008] The encrypted communication message is sent to the trusted chip, which then uses the encrypted communication message to identify whether to execute the operation corresponding to the event instruction.

[0009] The first step of generating a temporary session key includes generating a first random number and sending it to the trusted chip; generating a first temporary session key based on the first random number and a pre-stored identity key, wherein the identity key is determined at least based on the device's identity information and the trusted root key of the trusted chip.

[0010] In embodiments of this disclosure, the trusted chip generates a second temporary session key based at least on a first random number and a pre-stored identity key, which is used to decrypt the communication ciphertext to identify whether to execute the operation corresponding to the event instruction.

[0011] In embodiments of this disclosure, the identity key is also determined based on the characteristic information of the event command;

[0012] The event commands include one or a combination of the following: hibernation event commands, wake-up event commands, power on / off event commands, print event commands, and log query commands.

[0013] In embodiments of this disclosure, it further includes: during initial power-on, sending the device's identity information and the characteristic information of the event command to the trusted chip;

[0014] The device receives and stores the identity key sent by the trusted chip. The identity key is determined based at least on the device's identity information, the characteristic information of the event command, and the trusted root key of the trusted chip.

[0015] In embodiments of this disclosure, a first temporary session key is generated based on a first random number and a pre-stored identity key, including:

[0016] A first temporary session key is generated based on a first random number, a pre-stored identity key, and a second random number sent by a trusted chip.

[0017] In embodiments of this disclosure, the ciphertext of the communication is obtained based on the encryption event instruction of the first temporary session key, including:

[0018] Based on the event command and the obtained timestamp information, generate the basic message and the message digest value of the basic message;

[0019] The base message and its message digest value are encrypted using the first temporary session key to obtain the ciphertext.

[0020] In embodiments of this disclosure, the encrypted communication is sent to a trusted chip, followed by:

[0021] Receive the recognition result of the communication ciphertext from the trusted chip;

[0022] If the identification result indicates failure, a warning message will be output.

[0023] In another aspect, this embodiment provides an event command control method applied to a trusted chip in a device. The trusted chip is communicatively connected to a main control unit. The method includes:

[0024] Receive the first random number sent by the main control unit; the first random number is information generated by the main control unit when it detects an event command.

[0025] Based on the first random number and the pre-stored identity key, a second temporary session key is generated to decrypt the communication ciphertext to identify whether to execute the operation corresponding to the event command. The identity key is determined at least based on the device's identity information and the trusted root key of the trusted chip.

[0026] The system receives encrypted communication messages sent by the main control unit. The encrypted communication messages are information obtained by the main control unit encrypting the detected event command based on the first temporary session key. The first temporary session key is a key generated by the main control unit when the event command is detected.

[0027] Whether to execute the operation corresponding to the event command is determined based on the encrypted communication.

[0028] In embodiments of this disclosure, the master control unit generates a first temporary session key based at least on a first random number and a pre-stored identity key.

[0029] In embodiments of this disclosure, it further includes:

[0030] Receive device identity information and event command characteristic information sent by the main control unit during initial power-on;

[0031] Based on the device's identity information, the characteristic information of the event command, and the trusted root key of the trusted chip, an identity key is generated, stored, and sent to the main control unit.

[0032] In embodiments of this disclosure, a second temporary session key is generated based on a first random number and a pre-stored identity key, including:

[0033] Upon receiving the first random number, a second random number is generated and sent to the main control unit;

[0034] A second temporary session key is generated based on the first random number, the second random number, and the identity key.

[0035] The main control unit generates a first temporary session key based on a first random number, an identity key, and a second random number.

[0036] In embodiments of this disclosure, identifying whether to execute the operation corresponding to the event command based on the communication ciphertext includes:

[0037] The communication ciphertext is decrypted based on the second temporary session key to obtain decrypted information, which includes at least the base message and the message digest value of the base message.

[0038] The message digest value of the base message is used as the first digest information, and the second digest information of the base message is calculated.

[0039] If the first digest information is consistent with the second digest information, then based on the timestamp included in the basic message and the historical timestamp recorded by the trusted chip, it is determined whether to execute the operation corresponding to the event instruction.

[0040] In embodiments of this disclosure, it further includes:

[0041] If the ciphertext is received within the preset validity period of the second temporary session key, the step of identifying the ciphertext is executed; otherwise, a risk is confirmed and a confirmation message is sent to the main control unit.

[0042] In another aspect, this embodiment provides a main control unit, including: a first processor and a first communication interface, the first communication interface being connected to the first processor, the first processor being used to execute instructions so that the main control unit performs the method as described above.

[0043] In another aspect, this embodiment provides a trusted chip, including: a second processor and a second communication interface, the second communication interface being connected to the second processor, the second processor being used to execute instructions to cause the trusted chip to perform the method described above.

[0044] In another aspect, this embodiment provides an image forming apparatus, including: a main control unit for executing the method as described above; and a trusted chip communicatively connected to the main control unit for executing the method as described above.

[0045] This application provides an event command control method and an image forming apparatus, which have at least the following technical effects:

[0046] The event command control method and image forming apparatus of this disclosure include a main control unit communicatively connected to a trusted chip. When the main control unit detects an event command, it generates a first temporary session key. The event command is then encrypted using this first temporary session key to obtain ciphertext, which is sent to the trusted chip. The trusted chip then identifies whether to execute the operation corresponding to the event command. These embodiments of the disclosure, by encrypting the event command into ciphertext using the first temporary session key when determining whether to execute the operation corresponding to the event command, reduce the risk of long-term key leakage and protect the event command itself. Furthermore, the trusted chip identifies whether to execute the relevant operation based on the ciphertext, improving the security detection performance of the event command execution. Therefore, these embodiments of the disclosure help reduce the possibility of malicious control of the device after the event command is tampered with or captured by others, thus improving the device's security protection capabilities. Attached Figure Description

[0047] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0048] Figure 1A flowchart illustrating an event instruction control method according to an embodiment of the present disclosure is shown.

[0049] Figure 2 The flowchart illustrating the generation of a first temporary session key according to an embodiment of the present disclosure is shown in the illustration.

[0050] Figure 3 A flowchart illustrating another event instruction control method according to an embodiment of the present disclosure is shown.

[0051] Figure 4 A flowchart illustrating the generation of an identity key according to an embodiment of the present disclosure is shown.

[0052] Figure 5 The flowchart illustrates an embodiment of the present disclosure, illustrating how to identify whether to execute an operation corresponding to an event instruction based on a timestamp included in a base message and a historical timestamp recorded by a trusted chip.

[0053] Figure 6(a) schematically illustrates a flowchart of generating an identity key according to an embodiment of the present disclosure.

[0054] Figure 6(b) schematically illustrates a flowchart of generating a temporary session key according to an embodiment of the present disclosure.

[0055] Figure 6(c) schematically illustrates a flowchart of transmitting encrypted communication according to an embodiment of the present disclosure.

[0056] Figure 7(a) schematically illustrates the structure of the main control unit according to an embodiment of the present disclosure.

[0057] Figure 7(b) schematically illustrates the structure of a trusted chip according to an embodiment of the present disclosure.

[0058] Figure 7(c) schematically illustrates the structure of an image forming apparatus according to an embodiment of the present disclosure. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0060] Next, this article will describe in detail the process of the main control unit and the trusted chip encrypting and transmitting event commands according to the embodiments of this disclosure, with reference to the accompanying drawings.

[0061] Figure 1 A flowchart illustrating an event instruction control method according to an embodiment of the present disclosure is shown.

[0062] like Figure 1 As shown, an event instruction control method according to an embodiment of this disclosure is applied to the main control unit of a device. The main control unit is communicatively connected to a trusted chip, and includes steps S101, S102, and S103:

[0063] S101. When an event command is detected, a first temporary session key is generated.

[0064] In this embodiment of the disclosure, the main control unit of the device can be responsible for receiving / detecting / issuing corresponding event instructions. For example, the main control unit can receive event instructions issued by the user, or the main control unit can issue information to other components of the device to execute event instructions, so that the device can execute the corresponding event.

[0065] A trusted chip can be a dedicated chip with specific security functions external to the main control unit. It can provide security auditing capabilities for the device. The trusted chip and the device's main control unit can be two independent chips. The trusted chip may have a storage area for securely storing sensitive information such as the trusted root key (EK) and certificates, preventing external reading or tampering. The main control unit can interact with the trusted chip through data communication links, such as SPI / I2C / GPIO channels.

[0066] In this embodiment, an event command can be a command sent by a user to the main control unit when the device is expected to perform a corresponding function, or a command generated by the device when a triggering condition is detected. Taking a printer as an example, a user can select printer functions through the device's display interface, such as power on / off, printing, log querying, obtaining the trusted chip version number, etc. The main control unit can monitor event commands in real time, detecting the corresponding event command sent by the user when the user selects a corresponding function. Alternatively, a user can select printer functions through a terminal device, such as power on / off, printing, log querying, etc. The terminal device can send corresponding event commands to the main control unit, which then receives them. Furthermore, the main control unit can trigger an event command when a corresponding triggering condition is detected, causing the device to perform related operations, such as waking the device or putting it into sleep mode.

[0067] In this embodiment of the disclosure, after detecting an event command, the main control unit can generate a first temporary session key for encrypting the event command. The event command may include, for example, a power-on / off event command, a print event command, a log query command, or a sleep / wake-up event command. In some embodiments, a corresponding first temporary session key can be generated for different event commands. For example, after the main control unit detects a power-on / off event command, it can generate a first temporary session key for the power-on / off event to encrypt the power-on / off event command.

[0068] In this embodiment of the disclosure, the first temporary session key can be used to encrypt relevant information when executing the current event command. The first temporary session key is highly bound to the event command, that is, different event commands correspond to different first temporary session keys. Specifically, the first temporary session key is a key used for encryption in a single communication session. It is a temporary key that expires after the communication session ends, and its generation method is dynamic, thereby ensuring security.

[0069] This disclosure also provides a method for generating a first temporary session key, such as... Figure 2 As shown.

[0070] Figure 2 The flowchart illustrating the generation of a first temporary session key according to an embodiment of the present disclosure is shown in the illustration.

[0071] like Figure 2 As shown, the above S101 includes S201 and S202:

[0072] S201. Upon detecting an event command, generate a first random number and send it to the trusted chip.

[0073] In this embodiment of the present disclosure, after detecting an event command, the main control unit can generate a first random number and send the first random number to the trusted chip. Preferably, the first random number generated each time is different; that is, when an event command is detected, the main control unit can update the first random number, which is different from the previous one, and send it to the trusted chip. Preferably, it has uniqueness.

[0074] S202. Based on the first random number and the pre-stored identity key, generate a first temporary session key. The identity key is determined at least based on the device's identity information and the trusted root key of the trusted chip.

[0075] In this embodiment, the main control unit may pre-store an identity key. The identity key is determined at least based on the device's identity information and the trusted root key of the trusted chip, and can be used to bind the device to the trusted chip, preventing unauthorized communication between the device and an untrusted trusted chip. In some embodiments, the identity key pre-stored in the main control unit may be pre-sent by the trusted chip. For example, the trusted chip may pre-derive the identity key based on the device's identity information and the trusted root key, store the identity key, and send the identity key to the main control unit. In other embodiments, the identity key pre-stored by the main control unit may also be pre-imported using, for example, a programming device before the device leaves the factory.

[0076] The device's identity information can include, but is not limited to, unique identifiers such as device identifiers or MAC address information. The trusted root of trust for a trusted chip is the starting point of trust in a trusted computing system, encompassing a trusted measurement root, a trusted storage root, and a trusted reporting root, used to ensure system integrity, data security, and identity authentication. Utilizing the "trusted root" as a trusted source, and combining it with the device's identity information to generate an identity key, simplifies the complexity of certificate chain verification in traditional PKI (Public Key Infrastructure) systems, helps reduce the chip's computational and storage resource overhead, and simultaneously ensures the security of the generated first temporary session key. This reduces the possibility of malicious control of the device after its event commands are tampered with or captured, thus enhancing the device's security capabilities.

[0077] In this embodiment of the disclosure, the main control unit and the trusted chip can generate a temporary session key using a first random number and a pre-stored identity key through a key derivation method. The key derivation method can be, for example, based on a standard key derivation function (KDF).

[0078] According to embodiments of this disclosure, since the first temporary session key is bound to the first random number and the event command, the corresponding first temporary session key is different each time the event command is sent. Therefore, the ciphertext of communication encrypted and sent each time using the first temporary session key is different, thereby effectively increasing the difficulty of cracking. Furthermore, even if the current ciphertext of communication is obtained, since the first temporary session key is generated based on the first random number and is temporary, even if it is captured and replayed, there is no corresponding temporary session key for decryption and identification.

[0079] In this embodiment of the disclosure, upon detecting an event command, a first random number is generated and sent to a trusted chip. Then, a first temporary session key is generated based on the first random number and an identity key, wherein the identity key is determined at least based on the device's identity information and a root of trust. This enables the main control unit to encrypt the event command into ciphertext using the first temporary session key. Therefore, in this embodiment of the disclosure, the generation process of the temporary session key helps reduce the resource overhead on the chip, while being dynamically changeable and unique. Using it to encrypt event commands into ciphertext and send it to the trusted chip prevents others from capturing, tampering with, or replaying the command, thus helping to prevent the device from being maliciously controlled and used.

[0080] In this embodiment of the disclosure, the trusted chip generates a second temporary session key based at least on a first random number and a pre-stored identity key, which is used to decrypt the communication ciphertext to identify whether to execute the operation corresponding to the event instruction.

[0081] In this embodiment, the trusted chip can receive a first random number sent by the main control unit, and generate a second temporary session key based on the first random number and a pre-stored identity key. The second temporary session key can be used to decrypt the ciphertext after receiving it from the main control unit.

[0082] In this embodiment of the disclosure, the identity key is further determined based on the feature information of the event command; wherein the event command includes one or a combination of: hibernation event command, wake-up event command, power on / off event command, print event command, and log query command.

[0083] In addition to determining the identity key based on the device's identity information and the trusted root key, the identity key can also be determined based on the characteristic information of the event command. That is, the trusted chip can use the device's identity information, the trusted root key, and the characteristic information of the event command to determine the identity key, enabling the generation of different identity keys for different event commands. Furthermore, the trusted chip and the main control unit can generate temporary session keys based on the identity key, thereby achieving a high degree of binding between the temporary session key and the event command.

[0084] In this embodiment, the identity key can be determined based on the feature information of the event command, the device's identity information, and the trusted root key of the trusted chip. This ensures that the identity key possesses both "trust foundation" and "scenario uniqueness," guaranteeing both the trustworthiness of the key source (based on the trusted root key) and its binding to a specific event scenario (based on the feature information of the event command). This enhances the security and flexibility of identity authentication, reducing security risks such as malicious encryption / decryption, tampering, or replay of device event commands caused by key universality.

[0085] In some embodiments, event commands may include one or a combination of: hibernation event commands, wake-up event commands, power on / off event commands, print event commands, and log query commands. Different event commands have different characteristic information, therefore different event commands can correspond to different identity keys. Using specific identity keys improves the security of temporary session keys.

[0086] In this embodiment of the disclosure, the identity key of the main control unit can be obtained by the following method: during initial power-on, the device's identity information and the feature information of the event command are sent to the trusted chip; the identity key sent by the trusted chip is received and stored, and the identity key is determined based at least on the device's identity information, the feature information of the event command, and the trusted root key of the trusted chip.

[0087] During initial power-on, the main control unit can send the device's identity information, such as a unique identifier (UID) and media access control address (MAC), as well as the characteristic information of event commands, to the trusted chip. The identity information can be used to uniquely identify the device, and the characteristic information can be used to uniquely identify event commands.

[0088] Furthermore, the trusted chip can receive identity information and event command feature information sent by the main control unit, and encrypt the identity information and feature information based on the trusted root key EK (each trusted root's EK is unique) to derive an identity key (IK) used to perform the corresponding function. In some embodiments, the identity key IK is a symmetric key, and the trusted chip can determine the identity key using algorithms such as HMAC-KDF, so that the identity key IK simultaneously possesses the trust foundation of the trusted root key EK and the scenario binding of the event command features. Preferably, the identity key is obtained during the initial power-on initialization before the device leaves the factory.

[0089] In this embodiment, the trusted chip can generate different identity keys IK to correspond to different event commands. The trusted chip can also store the generated identity keys IK in its internal secure storage area for use in generating a second temporary session key. Further, the trusted chip can send the identity keys to the main control unit. The main control unit can receive the identity keys sent by the trusted chip and store them in the secure storage area for use in generating a first temporary session key. During this process, the trusted chip can authenticate the main control unit, achieving mutual identity authentication binding between the trusted chip and the main control unit, and generating an identity key for verifying the legitimacy of the identity when executing event commands. Furthermore, the main control unit, through information interaction with the trusted chip, obtains the identity keys sent by the trusted chip, enabling it to use these identity keys to generate a first temporary session key for secure authentication and execution of event commands. This helps prevent information leakage and malicious attacks caused by external unauthorized intrusion, thus preventing unauthorized control. It also increases the difficulty of deciphering event command information after it is captured, reducing the possibility of malicious replay execution control.

[0090] In this embodiment of the disclosure, S202 includes: generating a first temporary session key based on a first random number, a pre-stored identity key, and a second random number sent by a trusted chip.

[0091] In this embodiment of the disclosure, the trusted chip can receive a first random number sent by the main control unit and temporarily store the first random number, while simultaneously generating a second temporary random number and sending the second random number to the main control unit. The main control unit can receive the second random number sent by the trusted chip and temporarily store the second random number.

[0092] In this embodiment of the disclosure, for example, the main control unit can use a first random number, a second random number, and an identity key to generate a first temporary session key through repeated iterative calculations using a hash-based key derivation function (HMAC-KDF).

[0093] In this embodiment, each time an event command is detected, the first random number generated can be updated, and the second random number generated by the trusted chip is also dynamically updated. This ensures that the temporary session key is dynamically updated and possesses uniqueness. Furthermore, the main control unit obtains the second random number by interacting with the trusted chip, and generates the first temporary session key based on multiple calculations using the first random number and the identity key. This helps improve the protection capability against event commands and reduces the possibility of malicious control of the device after the event commands of the device are tampered with or captured by others.

[0094] Preferably, after each event execution process ends or after the device loses power, both the main control unit and the trusted chip can clear the temporary session key to ensure that the temporary session key is not leaked.

[0095] return Figure 1 S102. Based on the first temporary session key encryption event instruction, the communication ciphertext is obtained.

[0096] In this embodiment of the disclosure, after generating the first temporary session key, the master control unit can use the first temporary session key to encrypt the event command to be sent to the trusted chip, thereby obtaining ciphertext for communication. Specifically, the master control unit can use the first temporary session key to encrypt the event command and timestamp, obtaining ciphertext for communication that includes both event command and timestamp information.

[0097] In this embodiment of the disclosure, when determining whether to execute the operation corresponding to the event command, the event command can be encrypted into communication ciphertext using a first temporary session key. This protects the event command and improves the security detection performance of event command execution. It helps reduce the possibility of malicious control of the device after the device's event commands are tampered with or captured by others.

[0098] In this embodiment of the disclosure, S102 includes: generating a basic message and a message digest value of the basic message based on the event command and the obtained timestamp information; and encrypting the basic message and the message digest value of the basic message using a first temporary session key to obtain communication ciphertext.

[0099] In this embodiment, the main control unit generates a timestamp simultaneously when constructing the basic message. That is, when an event command (such as a device wake-up command) needs to be sent, the main control unit can first combine the event command (such as the command code for waking up the device, the command initiator identifier) ​​with the current timestamp to form the core content of the basic message. By adding a unique timestamp to the event command, attackers can be prevented from forging legitimate requests through replay attacks.

[0100] Furthermore, a message digest value for the base message can be calculated, for example, by generating a message digest value using a hash algorithm. Encrypting the base message and its message digest value using the first temporary session key effectively prevents content leakage. Simultaneously, using the message digest value as a digital fingerprint of the base message effectively verifies whether the base message has been tampered with, achieving both data confidentiality and data integrity verification.

[0101] S103. Send the ciphertext to the trusted chip so that the trusted chip can identify whether to execute the operation corresponding to the event instruction based on the ciphertext.

[0102] In this embodiment of the disclosure, the trusted chip, based on the ciphertext, can identify whether the operation corresponding to the event command contained in the ciphertext has been executed using a pre-set encryption / decryption algorithm, such as a symmetric encryption / decryption algorithm or an asymmetric encryption / decryption algorithm. Optionally, to improve the execution efficiency of the event command, the trusted chip can use a symmetric encryption / decryption algorithm, the same encryption / decryption algorithm as the main control unit, to generate a temporary session key to decrypt the ciphertext and obtain the event command.

[0103] Preferably, the trusted chip can verify the decrypted information. If the verification is successful, it can send an execution event command to the main control unit, causing the main control unit to execute the event, or, if the verification is successful, it can execute the operation corresponding to the event command itself. Otherwise, if the verification fails, it outputs a verification failure alarm message.

[0104] The event command control method of this disclosure embodiment involves a main control unit communicatively connected to a trusted chip. When the main control unit detects an event command, it generates a first temporary session key. The event command is then encrypted using this first temporary session key to obtain ciphertext, which is sent to the trusted chip. The trusted chip then identifies whether to execute the operation corresponding to the event command. This embodiment of the disclosure, by encrypting the event command into ciphertext using the first temporary session key when determining whether to execute the operation corresponding to the event command, reduces the risk of long-term key leakage and also protects the event command. Furthermore, the trusted chip identifies whether to execute the relevant operation based on the ciphertext, improving the security detection performance of event command execution. Therefore, this embodiment of the disclosure helps reduce the occurrence of malicious control of the device after its event commands are tampered with or captured by others, thus improving the device's security protection capabilities.

[0105] return Figure 1 Following S103 above, the process includes: receiving the recognition result of the trusted chip on the communication ciphertext; if the recognition result indicates failure, then outputting a warning message.

[0106] In this embodiment, the main control unit can receive the identification result of the encrypted communication sent by the trusted chip. The identification result may include an execution event command, an end event command, successful identification, or identification failure. If the identification result indicates success, the main control unit can send corresponding commands to other components of the device to execute the event, such as initiating sleep or wake-up. If the identification result indicates failure, the main control unit can terminate the event process and output a warning message indicating a dangerous state.

[0107] In this embodiment of the disclosure, after each event execution process ends or after the device loses power, both the main control unit and the trusted chip can clear the temporary session key to ensure that the temporary session key is not leaked.

[0108] Furthermore, embodiments of this disclosure also provide an event instruction control method for trusted chips, as detailed below.

[0109] Figure 3 The flowchart of another event command control method according to an embodiment of the present disclosure is illustrated. This event command control method is applied to a trusted chip in a device, and the trusted chip is communicatively connected to a main control unit, including steps S301, S302, S303, and S304.

[0110] S301, Receive the first random number sent by the main control unit; the first random number is information generated by the main control unit when it detects an event command.

[0111] In this embodiment of the disclosure, upon receiving a first random number, the trusted chip may temporarily store the first random number.

[0112] S302. Based on the first random number and the pre-stored identity key, a second temporary session key is generated to decrypt the communication ciphertext to identify whether the operation corresponding to the event instruction is executed. The identity key is determined based at least on the device's identity information and the trusted root key of the trusted chip.

[0113] In the embodiments of this disclosure, the trusted chip can generate a second temporary session key using a received first random number and a pre-stored identity key. The generated second temporary session key can be used to decrypt relevant information after receiving encrypted communication data from the main control unit. The second temporary session key can be highly bound to event commands; that is, different event commands correspond to different second temporary session keys. Specifically, the second temporary session key is a key used for decryption in a single communication session. It is a temporary key that expires after the communication session ends, and its generation is dynamic, thereby ensuring security.

[0114] In embodiments of this disclosure, the identity key is determined at least based on the device's identity information and the trusted root key of the trusted chip. The identity key, determined at least based on the device's identity information and the trusted root key of the trusted chip, can be used to bind the device to the trusted chip, preventing unauthorized communication between the device and an untrusted trusted chip. In some embodiments, the trusted chip can pre-derive the identity key based on the device's identity information and the trusted root key, store the identity key, and send the identity key to the main control unit.

[0115] In this embodiment of the disclosure, the generation process of the second temporary session key can help reduce the resource overhead on the trusted chip, while being dynamically changeable and unique. It can be used to decrypt event commands to identify whether the operation corresponding to the event command has been executed, thus helping to prevent the device from being maliciously controlled and used.

[0116] S303. Receive the communication ciphertext sent by the main control unit. The communication ciphertext is the information obtained by the main control unit encrypting the detected event command based on the first temporary session key. The first temporary session key is the key generated by the main control unit when the event command is detected.

[0117] In this embodiment of the disclosure, after detecting an event command, the main control unit can generate a first temporary session key for encrypting the event command. The event command may include, for example, a power-on / off event command, a print event command, a log query command, or a sleep / wake-up event command. In some embodiments, a corresponding first temporary session key can be generated for different event commands. For example, after the main control unit detects a power-on / off event command, it can generate a first temporary session key for the power-on / off event to encrypt the power-on / off event command.

[0118] like Figure 4 As shown, the identity key can be obtained in the following ways. Figure 4 A flowchart illustrating the generation of an identity key according to an embodiment of the present disclosure is shown.

[0119] like Figure 4 As shown, the generation of the identity key includes S401 and S402:

[0120] S401. Receive the device's identity information and event command characteristic information sent by the main control unit during initial power-on.

[0121] In this embodiment of the disclosure, during initial power-on, the main control unit can send the device's identity information and event command feature information to the trusted chip. The trusted chip can receive the device's identity information, such as unique identifiers like UID and MAC, and event command feature information, such as the command number feature information of sleep / wake-up commands (e.g., SLEEP / WAKEUP), sent by the main control unit. The identity information and feature information can be used to uniquely identify the device and event commands, enabling the identity key to be highly bound to the device and specific scenarios.

[0122] S402. Based on the device's identity information, the characteristic information of the event command, and the trusted root key of the trusted chip, generate an identity key, store it, and send it to the main control unit.

[0123] In this embodiment, the trusted chip can encrypt identity and feature information based on the trusted root key EK (each trusted root's EK is unique) to derive an identity key IK used to perform the corresponding function. Simultaneously, the trusted chip can store the identity key in an internal secure storage area to prevent leakage. The trusted chip can also send the generated identity key to the main control unit, so that the main control unit can use the identity key to generate a first temporary session key.

[0124] In this embodiment, the trusted chip can generate different identity keys IK to correspond to different event commands. Simultaneously, the trusted chip can store the generated identity keys IK in an internal secure storage area for use in the generation of a subsequent second temporary session key. Further, the trusted chip can send the identity keys to the main control unit, enabling the main control unit to use them for the generation of a subsequent first temporary session key. During this process, the trusted chip can also authenticate the main control unit, achieving mutual identity authentication binding between the trusted chip and the main control unit, and generating an identity key for verifying the legitimacy of the identity when executing event commands. Therefore, this embodiment improves the security protection capabilities of event command control, helping to prevent information leakage and malicious attacks caused by external illegal intrusion, thus preventing the execution of illegal control. It also helps increase the difficulty of deciphering event command-related information after it is captured, reducing the possibility of malicious replay execution control.

[0125] In embodiments of this disclosure, the master control unit generates a first temporary session key based at least on a first random number and a pre-stored identity key.

[0126] After the trusted chip generates different identity keys (IK), it can send these keys to the master control unit. The master control unit can receive and store these identity keys. Simultaneously, the master control unit can generate a first temporary session key based on a generated first random number and the pre-stored identity keys. The first temporary session key generated by the master control unit can be used to encrypt event commands to obtain ciphertext for communication.

[0127] return Figure 3 S302 above includes: generating a second random number when a first random number is received, and sending the second random number to the main control unit; generating a second temporary session key based on the first random number, the second random number, and the identity key; wherein, the main control unit generates the first temporary session key based on the first random number, the identity key, and the second random number.

[0128] In this embodiment of the disclosure, upon receiving the first random number, the trusted chip can also generate a second random number. Simultaneously, the trusted chip can send the second random number to the main control unit, so that the main control unit can use the first random number, the second random number, and the identity key to generate a first temporary session key.

[0129] Furthermore, the trusted chip can use the received first random number, the generated second random number, and the identity key, along with the main control unit, to generate a second temporary session key using the same method. The identity key can be stored in the trusted chip's secure storage area. After receiving the first random number, the trusted chip dynamically updates the generated second random number, thereby ensuring that the second temporary session key is dynamically updated and unique. In this embodiment, the information exchange method between the trusted chip and the main control unit, and the generation of temporary session keys through multiple calculations, improves the confidentiality of event commands, thus helping to reduce the possibility of malicious replay of control devices after being tampered with or captured by others.

[0130] return Figure 3 S304. Based on the communication ciphertext, identify whether to execute the operation corresponding to the event instruction.

[0131] In this embodiment of the disclosure, the trusted chip, based on the ciphertext, can use a pre-set encryption / decryption algorithm, such as a symmetric encryption / decryption algorithm or an asymmetric encryption / decryption algorithm, to identify whether the operation corresponding to the event command contained in the ciphertext has been executed. Optionally, to improve the execution efficiency of the event command, the trusted chip can use a symmetric encryption / decryption algorithm, the same encryption / decryption algorithm as the main control unit, to generate a second temporary session key to decrypt the ciphertext and obtain the event command.

[0132] In the event command control method of this disclosure, when the trusted chip receives encrypted communication from the main control unit, it identifies whether to execute the operation corresponding to the event command. Specifically, when the main control unit detects an event command, it generates a first temporary session key, which is used to encrypt the event command to obtain encrypted communication, which is then sent to the trusted chip. This disclosure allows the temporary session key to be used to encrypt and decrypt the event command when determining whether to execute the operation corresponding to the event command. This reduces the risk of long-term key leakage and also protects the event command. Furthermore, the trusted chip identifies whether to execute the relevant operation based on the encrypted communication, improving the security detection performance of event command execution. Therefore, this disclosure helps reduce the possibility of malicious control of the device after the event commands of the device are tampered with or captured by others, thus improving the device's security protection capabilities.

[0133] In this embodiment, step S304 includes: decrypting the ciphertext based on the second temporary session key to obtain decrypted information, the decrypted information including at least the base message and the message digest value of the base message. The message digest value of the base message is used as the first digest information, and a second digest information of the base message is calculated. If the first digest information matches the second digest information, then based on the timestamp included in the base message and the historical timestamp recorded by the trusted chip, it is determined whether to execute the operation corresponding to the event instruction.

[0134] In this embodiment, the trusted chip can calculate the second digest information of the basic message using the same algorithm that generates the message digest value of the basic message, such as calculating the second digest information of the basic message using a hash algorithm. When the first digest information matches the calculated second digest information, it indicates that the content of the communication ciphertext has not been tampered with. However, to prevent malicious replay control after being captured by others, in this case, the trusted chip can identify whether the operation corresponding to the event instruction has been executed by using the timestamp included in the basic message and the historical timestamps recorded by the trusted chip.

[0135] like Figure 5 As shown, Figure 5 The flowchart illustrates an embodiment of the present disclosure, illustrating how to identify whether to execute an operation corresponding to an event instruction based on a timestamp included in a base message and a historical timestamp recorded by a trusted chip.

[0136] like Figure 5 As shown, it includes S501, S502 and S503:

[0137] S501. Determine whether the timestamp included in the basic message is a historical timestamp.

[0138] Optionally, a digest value of the timestamp included in the basic message can be calculated, for example, by a hash algorithm, and it can be determined whether the digest value is consistent with the digest value of the historical timestamp stored in the trusted chip.

[0139] S502. In response to a timestamp that does not belong to a historical timestamp, determine the operation corresponding to the event instruction to be executed.

[0140] When the timestamp included in the base message does not belong to a historical timestamp, the security conditions can be determined, and the main control unit or trusted chip can execute the event command. Simultaneously, the timestamp carried in the encrypted message of this communication can be recorded inside the trusted chip for security authentication of the next event command.

[0141] S503. In response to the timestamp being a historical timestamp, determine that the operation corresponding to the event instruction will not be executed.

[0142] When the timestamp included in the basic message is a historical timestamp, it indicates that the ciphertext containing the event command may have been stolen and replayed. Its anomaly means that the operation corresponding to the event command may not be executed to prevent the device from being maliciously controlled.

[0143] In this embodiment, the security and integrity of the encrypted communication can be guaranteed by the second digest information; and the timestamp comparison can ensure that the encrypted communication is not subject to replay attacks. Therefore, the security protection capability of the device can be improved.

[0144] In this embodiment of the disclosure, Figure 3 The event instruction control method also includes: if a ciphertext is received within the preset validity period of the second temporary session key, then the step of identifying the ciphertext is executed; otherwise, a risk is confirmed and confirmation information is sent to the main control unit.

[0145] In this embodiment of the disclosure, if the trusted chip receives the ciphertext within the valid time of generating the second temporary session key, it can authenticate the ciphertext; otherwise, it considers there to be a risk and ends the authentication. At the same time, it can send a confirmation message to the main control unit to prompt the main control unit that there is a risk and request confirmation, thereby ensuring the timeliness of the authentication.

[0146] Figure 6(a) schematically illustrates a flowchart of generating an identity key according to an embodiment of the present disclosure.

[0147] As shown in Figure 6(a), it includes a main control unit 601 and a trusted chip 602.

[0148] S601a, Send identity information and feature information.

[0149] The main control unit 601 can send the device's identity information and the characteristic information of the event command to the trusted chip 602.

[0150] S602a, Generate identity key.

[0151] The trusted chip 602 can encrypt identity and feature information based on the trusted root key EK to derive the identity key IK used to perform the corresponding function.

[0152] S603a, Store the identity key and send it.

[0153] The trusted chip 602 can store the generated identity key in an internal secure storage area to prevent leakage. Simultaneously, it sends the generated identity key to the main control unit 601, so that the main control unit 601 can use the identity key to generate a first temporary session key.

[0154] S604a, Receive and store the identity key.

[0155] The main control unit 601 can receive the identity key and store it in the internal secure storage area.

[0156] Figure 6(b) schematically illustrates a flowchart of generating a temporary session key according to an embodiment of the present disclosure.

[0157] As shown in Figure 6(b), it includes a main control unit 601 and a trusted chip 602.

[0158] S601b, Event information detected.

[0159] The main control unit 601 can monitor event information in real time. When an event command is detected, this process begins execution.

[0160] S602b: Generate and send the first random number.

[0161] The main control unit 601 can generate and temporarily store the first random number, and the main control unit 601 can also send the first random number to the trusted chip 602.

[0162] S603b, Receive the first random number.

[0163] The trusted chip 602 can receive the first random number and store it temporarily.

[0164] S604b: Generate and send a second random number.

[0165] The trusted chip 602 can generate and temporarily store a second random number. Simultaneously, the trusted chip 602 can also send the second random number to the main control unit 601.

[0166] S605b, Receives a second random number.

[0167] The main control unit 601 can receive the second random number and temporarily store it.

[0168] S606b, Generate the first temporary session key.

[0169] S607b, Generate a second temporary session key.

[0170] Both the main control unit 601 and the trusted chip 602 can use the first random number, the second random number, and the identity key to generate the first temporary session key and the second temporary session key respectively using the same method.

[0171] Figure 6(c) schematically illustrates a flowchart of transmitting encrypted communication according to an embodiment of the present disclosure.

[0172] As shown in Figure 6(c), it includes a main control unit 601 and a trusted chip 602.

[0173] S601c: Encrypt the event command using the first temporary session key.

[0174] The main control unit 601 uses the first temporary session key to encrypt event commands such as those in hibernation, generates communication ciphertext, and sends it to the trusted chip 602. The communication ciphertext includes a base message and a message digest value of the base message, wherein the base message includes information about the event command and a timestamp.

[0175] S602c, Decrypt using the second temporary session key.

[0176] The trusted chip 602 uses the second temporary session key to decrypt the communication ciphertext and obtain decrypted information, which includes the base message and the message digest value of the base message.

[0177] S603c, Calculate the second digest information of the base message in the decryption information.

[0178] S604c: Determine whether the first digest information (i.e., the message digest value of the original base message) is consistent with the second digest information. If they are inconsistent, execute S607; if they are consistent, execute S605.

[0179] S605c, whether the timestamp in the basic message is a historical timestamp.

[0180] If the trusted chip 602 determines that the first digest information and the second digest information are consistent, it will determine whether the timestamp in the basic message is a historical timestamp. If it is, it will execute S607; if it is not, it will execute S606.

[0181] S606c, Record this timestamp as a historical timestamp.

[0182] If the trusted chip 602 determines that the timestamp in the basic message does not belong to the historical timestamp, it records the timestamp as a historical timestamp and stores it.

[0183] S607c, Response identification result.

[0184] The trusted chip 602 replies to the main control unit 601 with the identification result, including whether the security authentication identification failed or succeeded.

[0185] S608c, Execute the recognition result.

[0186] If the identification result indicates failure, the main control unit 601 will output a warning message; if the identification result indicates success, it will allow the execution of the operation corresponding to the event command.

[0187] Figure 7(a) schematically illustrates the structure of the main control unit according to an embodiment of the present disclosure.

[0188] As shown in Figure 7(a), the main control unit 601 includes a first processor 6011 and a first communication interface 6012. The first processor 6011 is connected to the first communication interface 6012, and the first processor 6011 is used to execute instructions so that the main control unit 601 performs the above-mentioned method.

[0189] Figure 7(b) schematically illustrates the structure of a trusted chip according to an embodiment of the present disclosure.

[0190] As shown in Figure 7(b), the trusted chip 602 includes a second processor 6021 and a second communication interface 6022. The second processor 6021 is connected to the second communication interface 6022, and the second processor 6021 is used to execute instructions so that the trusted chip 602 performs the method described above.

[0191] Figure 7(c) schematically illustrates the structure of an image forming apparatus according to an embodiment of the present disclosure.

[0192] As shown in Figure 7(c), the image forming apparatus 600 includes a main control unit 601 and a trusted chip 602 that is communicatively connected to the main control unit 601.

[0193] The main control unit 601 is used to execute the event instruction control method applied to the main control unit of the device as described above.

[0194] Trusted chip 602 is used to execute the event instruction control method applied to the trusted chip described above.

[0195] The above description, with reference to the accompanying drawings, illustrates an event command control method and image forming apparatus according to embodiments of the present disclosure. The method utilizes a temporary session key to encrypt and decrypt event commands, and this key is dynamically updated to prevent tampering, capture, and replaying, or malicious control of other devices after capture. This further enhances trusted security performance. Simultaneously, using a trusted root key as a trusted source, and combining it with the device's identity information to generate an identity key, simplifies the complexity of certificate chain verification in traditional public key infrastructure (PKI) systems, reduces the computational and storage resource overhead of the device, and lightens resource consumption.

[0196] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0197] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0198] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0199] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0200] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described above can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0201] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0202] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. An event instruction control method, characterized in that, A main control unit for an image forming apparatus, the main control unit being communicatively connected to a trusted chip, the method comprising: When the main control unit detects an event command, the main control unit generates a first random number and sends it to the trusted chip. The first random number is used to generate a first temporary session key for encrypting the event command. The trusted chip receives a second random number sent by the trusted chip, the second random number being generated by the trusted chip when it receives the first random number sent by the main control unit and then sent to the main control unit. Based on the first random number, the second random number, and the pre-stored identity key corresponding to the event instruction, the first temporary session key is generated; The event command is encrypted using the first temporary session key to obtain the ciphertext for communication; and The encrypted communication is sent to the trusted chip, which enables the trusted chip to identify whether to execute the operation corresponding to the event instruction based on the encrypted communication; The main control unit stores multiple identity keys, and different event commands correspond to different identity keys. The identity key is determined by the trusted chip based on the identity information of the image forming device, the feature information of the event command, and the trusted root key of the trusted chip.

2. The event instruction control method according to claim 1, characterized in that, The trusted chip generates a second temporary session key based at least on the first random number and the pre-stored identity key, which is used to decrypt the communication ciphertext to identify whether to execute the operation corresponding to the event instruction.

3. The event instruction control method according to claim 1, characterized in that, The event commands include one or a combination of the following: hibernation event commands, wake-up event commands, power on / off event commands, print event commands, and log query commands.

4. The event instruction control method according to claim 1, characterized in that, Also includes: During initial power-on, the image forming device's identity information and the event command's characteristic information are sent to the trusted chip; Receive and store the identity key sent by the trusted chip.

5. The event instruction control method according to claim 1, characterized in that, The step of encrypting the event command based on the first temporary session key to obtain the communication ciphertext includes: Based on the event command and the obtained timestamp information, a basic message and a message digest value of the basic message are generated; The first temporary session key is used to encrypt the base message and its message digest value to obtain the ciphertext.

6. The event instruction control method according to any one of claims 1 to 5, characterized in that, Sending the encrypted communication to the trusted chip, followed by: Receive the recognition result of the trusted chip on the encrypted communication; If the identification result indicates failure, a warning message will be output.

7. An event instruction control method, characterized in that, A trusted chip used in an image forming apparatus, the trusted chip being communicatively connected to a main control unit, the method comprising: The system receives a first random number sent by the main control unit. The first random number is information generated by the main control unit when it detects an event command. The first random number is used to generate a first temporary session key for encrypting the event command. When the trusted chip receives the first random number sent by the main control unit, it generates a second random number; Based on the first random number, the second random number, and the pre-stored identity key corresponding to the event instruction, a second temporary session key is generated to decrypt the communication ciphertext to identify whether the operation corresponding to the event instruction is executed. The identity key is determined at least based on the identity information of the image forming device, the feature information of the event instruction, and the trusted root key of the trusted chip. Different event instructions correspond to different identity keys. The system receives the encrypted communication sent by the main control unit; the encrypted communication is information obtained by the main control unit encrypting the detected event command based on a first temporary session key; the first temporary session key is a key generated by the main control unit when the event command is detected. Whether to execute the operation corresponding to the event instruction is determined based on the encrypted communication.

8. The event instruction control method according to claim 7, characterized in that, The main control unit generates the first temporary session key based at least on the first random number and the pre-stored identity key.

9. The event instruction control method according to claim 7, characterized in that, Also includes: Receive the identity information of the image forming device and the feature information of the event command sent by the main control unit during initial power-on; Based on the identity information of the image forming device, the feature information of the event command, and the trusted root key of the trusted chip, the identity key is generated, stored, and sent to the main control unit.

10. The event instruction control method according to claim 7, characterized in that, Based on the first random number and the pre-stored identity key, a second temporary session key is generated, including: The second random number is sent to the main control unit; The main control unit generates the first temporary session key based on the first random number, the identity key, and the second random number.

11. The event instruction control method according to claim 7, characterized in that, Based on the encrypted communication, it is determined whether to execute the operation corresponding to the event instruction, including: The communication ciphertext is decrypted based on the second temporary session key to obtain decryption information, which includes at least the base message and the message digest value of the base message. The message digest value of the basic message is used as the first digest information, and the second digest information of the basic message is calculated. If the first digest information is consistent with the second digest information, then based on the timestamp included in the basic message and the historical timestamp recorded by the trusted chip, it is determined whether to execute the operation corresponding to the event instruction.

12. The event instruction control method according to any one of claims 7-11, characterized in that, Also includes: If the ciphertext is received within the preset validity period of the second temporary session key, the step of identifying the ciphertext is executed; otherwise, a risk is confirmed and confirmation information is sent to the main control unit.

13. A main control unit, characterized in that, include: A first processor and a first communication interface, the first communication interface being connected to the first processor, the first processor being configured to execute instructions such that the main control unit performs the method as described in any one of claims 1 to 6.

14. A trusted chip, characterized in that, include: A second processor and a second communication interface, the second communication interface being connected to the second processor, the second processor being configured to execute instructions such that the trusted chip performs the method as described in any one of claims 7 to 12.

15. An image forming apparatus, characterized in that, include: A main control unit, the main control unit being configured to perform the method as described in any one of claims 1 to 6; as well as A trusted chip, which is communicatively connected to the main control unit, is used to perform the method as described in any one of claims 7 to 12.

Images