X86 SoC array server dual-mode system based on intranet VLAN closed loop

Abstract

The invention discloses an x86SoC array server dual-mode system based on an intranet VLAN closed loop, and relates to the technical field of cross engineering, and the system comprises a VLAN establishment module which is used for executing a configuration instruction, establishing a VLAN, carrying out MAC port binding and private VLAN function operation at the same time, and generating a secure network closed loop with a trusted SoC as the center; the dual-mode generation module is used for inputting the heterogeneous feature vectors into a small neural network, performing cross-node encryption communication and public VLAN access operation, and generating a high-security intranet-open interconnection dual-mode mode; mAC port binding and private VLAN function operation are executed by establishing the VLAN module, a secure network closed loop with the trusted SoC as the center is generated, synchronous construction of a network isolation strategy and a hardware trusted state is achieved, and the effect of hardware identity trusted verification and dynamic secure network cooperative control is achieved.

Description

Technical Field

[0001] This invention relates to the field of cross-engineering technology, and in particular to a dual-mode x86 SoC array server system based on intranet VLAN closed loop. Background Technology

[0002] In the field of data center and server array management, secure access technologies based on hardware authentication and network isolation mechanisms are receiving increasing attention. Traditional methods typically employ pre-shared keys or certificate systems for device authentication, combined with VLAN segmentation and MAC address binding for network access control. This new solution leverages out-of-band management networks such as IPMI and Redfish protocols for remote monitoring and configuration, restricting unauthorized device access through switch port security policies. This ensures communication security for server nodes during deployment and maintenance, forming a relatively mature technical framework.

[0003] However, existing methods have limitations in terms of the dynamism and reliability of hardware-level identity binding. First, MAC address binding, which relies on static configuration, is difficult to prevent physical layer identity spoofing attacks and lacks a real-time verification mechanism for the uniqueness of device hardware. Second, the establishment of network isolation policies usually lags behind device access and is not linked to the trusted state of hardware, resulting in insufficient timeliness of security policy deployment. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a dual-mode system for x86 SoC array servers based on intranet VLAN closed loop, which solves the problem of insufficient dynamics and timeliness of security protection caused by the disconnection of device trusted status.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] This invention provides a dual-mode x86 SoC array server system based on intranet VLAN closed-loop, comprising,

[0008] The address binding module is used to initialize a secure deployment session to generate a challenge code for the x86 SoC node and temporarily bind it to the BMC MAC address of the target SoC to obtain a challenge code with the MAC address.

[0009] The comparison and verification module is used to input the challenge code with MAC address into the BMC, obtain the PUF response through the MAC address binding verification method, and compare it with the expected PUF response characteristics in the SoC hardware information database to verify the rationality of the PUF.

[0010] The instruction generation module is used to define the SoC node as a trusted device based on the reasonableness result of PUF, and generate VLAN joining instructions, MAC address binding instructions and private VLAN isolation instructions through the OpenFlow protocol;

[0011] Establish a VLAN module to execute configuration commands, create VLANs, and simultaneously perform MAC port binding and private VLAN function operations to generate a secure network closed loop centered on the trusted SoC;

[0012] The vector generation module is used for a secure network closed loop centered on a trusted SoC. It extracts heterogeneous hardware resource data and transforms it into heterogeneous feature vectors.

[0013] A dual-mode module is generated to input heterogeneous feature vectors into a small neural network for cross-node encrypted communication and public VLAN access operations, generating a dual-mode of high-security intranet-open interconnection.

[0014] As a preferred embodiment of the dual-mode x86 SoC array server system based on intranet VLAN closed loop described in this invention, the initialization of the security deployment session involves generating a challenge code for the x86 SoC node, and the specific steps are as follows:

[0015] Initialize a secure deployment session and assign a session ID. Input the session ID into an empty secure verification queue and wait for a response from the x86SoC node.

[0016] Receive the response from the x86 SoC node and perform a random number generation operation to generate a cryptographically secure challenge code of a specified length.

[0017] As a preferred embodiment of the dual-mode x86 SoC array server system based on intranet VLAN closed loop described in this invention, the step of obtaining the challenge code with MAC address refers to scanning the out-of-band management network, obtaining the BMC MAC address of the target SoC, and temporarily binding the challenge code with the BMC MAC address of the target SoC through a preset mapping table to generate a challenge code with MAC address.

[0018] As a preferred embodiment of the x86 SoC array server dual-mode system based on intranet VLAN closed loop described in this invention, the specific steps for inputting a challenge code with a MAC address into the BMC and obtaining a PUF response through the MAC address binding verification method are as follows:

[0019] Based on the challenge code with MAC address, the corresponding BMC is addressed through the out-of-band management network and input, and the challenge code instruction is generated through the IPMIOEM extended command encapsulation method;

[0020] The challenge code instruction is input into the PUF circuit register inside the SoC. The challenge code is defined as an stimulus, and a PUF hardware response is generated through physical microvariability.

[0021] As a preferred embodiment of the x86 SoC array server dual-mode system based on intranet VLAN closed loop described in this invention, the step of comparing the expected PUF response characteristics with those in the SoC hardware information database to verify the rationality of the PUF involves the following specific steps:

[0022] Define the BMC MAC address of the target SoC as an index, query the SoC hardware information database, and obtain the expected PUF response characteristics corresponding to the SoC node;

[0023] Calculate the similarity score between the currently received actual PUF hardware response features and the expected PUF response features, and compare it with the PUF response authentication threshold to verify the rationality of PUF.

[0024] As a preferred embodiment of the x86 SoC array server dual-mode system based on intranet VLAN closed-loop as described in this invention, the SoC node is defined as a trusted device based on the rationality of PUF, and VLAN join instructions, MAC address binding instructions, and private VLAN isolation instructions are generated through the OpenFlow protocol. The specific steps are as follows:

[0025] The authentication status information is extracted from the reasonableness result of PUF and compared with the preset logic to obtain the trusted device mark;

[0026] Define the SoC node as a trusted device, and fuse and associate the BMC MAC address, session ID, and trusted device tag to generate a device security context;

[0027] Based on the device security context, VLAN join instructions, MAC address binding instructions, and private VLAN isolation instructions are generated via the OpenFlow protocol.

[0028] As a preferred embodiment of the dual-mode x86 SoC array server system based on intranet VLAN closed-loop as described in this invention, the specific steps for executing configuration commands and establishing VLANs are as follows:

[0029] Based on VLAN join commands and historical network topology mapping tables, determine the target switch connected to the MAC address and the corresponding physical port number.

[0030] Initiate a connection request to the target switch, perform authentication, and establish a TLS-encrypted switch control connection.

[0031] Establish a VLAN based on the physical port number corresponding to the SoC node and the TLS-encrypted switch control connection method.

[0032] As a preferred embodiment of the x86 SoC array server dual-mode system based on intranet VLAN closed loop described in this invention, the specific steps for performing MAC port binding and private VLAN function operations to generate a secure network closed loop centered on the trusted SoC are as follows.

[0033] Based on the VLAN, execute the MAC address binding command to perform data uniqueness processing on the port and generate a dedicated channel with the BMC MAC address;

[0034] Based on the dedicated channel of the BMC MAC address, execute private VLAN isolation commands to generate a secure network closed loop centered on the trusted SoC.

[0035] As a preferred embodiment of the dual-mode x86 SoC array server system based on intranet VLAN closed loop described in this invention, the secure network closed loop centered on the trusted SoC extracts heterogeneous hardware resource data and transforms it into heterogeneous feature vectors. The specific steps are as follows:

[0036] Based on a secure network closed loop centered on a trusted SoC, hardware discovery instructions are generated via the Redfish protocol and input into the BMC of the target trusted device to extract heterogeneous hardware resource data.

[0037] Data cleaning and preprocessing operations are performed on heterogeneous hardware resource data to generate preprocessed heterogeneous hardware resource data, which is then transformed into heterogeneous feature vectors.

[0038] As a preferred embodiment of the x86 SoC array server dual-mode system based on intranet VLAN closed loop described in this invention, the heterogeneous feature vectors are input into a small neural network to perform cross-node encrypted communication and public VLAN access operations, generating a highly secure intranet-open interconnection dual-mode. The specific steps are as follows:

[0039] Heterogeneous feature vectors are input into a small neural network, and probability scores are generated through forward propagation. These scores are then compared with historical pattern probability thresholds to identify pattern classification labels.

[0040] Based on the pattern classification label, perform encryption operations, generate PUF session keys, and simultaneously delete private VLAN isolation commands and add public VLANs through TLS-encrypted switch control connection methods to generate network topology status.

[0041] Based on pattern classification labels, heterogeneous feature vectors, network topology status, and PUF session keys, a dual-mode high-security intranet-open interconnection is generated using a trusted hardware dual-mode dynamic switching method.

[0042] The beneficial effects of this invention are as follows: by initializing a secure deployment session and generating a challenge code with a MAC address through the address binding module, hardware-level identity authentication based on physical micro-variability is achieved, ensuring the authenticity of the response source; by establishing a VLAN module to perform MAC port binding and private VLAN function operations, a secure network closed loop centered on a trusted SoC is generated, realizing the synchronous construction of network isolation policies and hardware trusted status, and achieving the effect of hardware identity trusted verification and dynamic secure network collaborative control. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a schematic diagram of a dual-mode x86 SoC array server system based on an internal network VLAN closed loop.

[0045] Figure 2 A flowchart for generating a dual-mode network of a highly secure intranet and an open interconnection.

[0046] Figure 3 Establish a flowchart for a secure network closed loop.

[0047] Figure 4 Flowchart for PUF rationality verification. Detailed Implementation

[0048] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0049] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0050] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0051] Reference Figures 1-4 This is one embodiment of the present invention, which provides a dual-mode x86 SoC array server system based on intranet VLAN closed loop, including the following steps:

[0052] The address binding module is used to initialize a secure deployment session to generate a challenge code for the x86 SoC node and temporarily bind it to the BMC MAC address of the target SoC to obtain a challenge code with the MAC address.

[0053] Initialize a secure deployment session and assign a session ID. Input the session ID into an empty secure verification queue and wait for a response from the x86SoC node.

[0054] Furthermore, when initiating the secure deployment process on the target x86 SoC node, a separate secure deployment session is first created. This session uniquely identifies the access and authentication context. Subsequently, a globally unique session ID is assigned. This session ID is generated by combining a timestamp, a random number, and a device identifier, for example, using a UUID format. The generated session ID is written to an initially empty secure verification queue, which temporarily stores session identifiers that have not yet completed PUF authentication. After being written, the session ID remains in a waiting state in the secure verification queue until the corresponding target x86 SoC node returns a response.

[0055] It should be noted that the secure pending verification queue refers to a first-in-first-out data structure used to store session IDs that have not yet completed PUF authentication.

[0056] Receive the response from the x86 SoC node and generate a cryptographically secure challenge code of a specified length using a hardware true random number generation method;

[0057] Furthermore, after detecting that the target x86 SoC node has completed power-on and entered a communicable state, the initialization response signal emitted by the x86 SoC node is captured. The initialization response signal contains node ready state information. After the response signal is received, a hardware true random number generation method is triggered. The hardware true random number generation method relies on physical noise sources, such as thermal noise or electronic shot noise, to generate a random bit stream through a dedicated hardware random number generator circuit. The generated random bit stream is homogenized and debiased by a cryptographic post-processing algorithm to ensure that the statistical characteristics meet cryptographic security requirements. Finally, a cryptographically secure challenge code with a length of 128 bits is output.

[0058] Scan the out-of-band management network to obtain the BMC MAC address of the target SoC, and temporarily bind the challenge code to the BMC MAC address of the target SoC through a preset mapping table to generate a challenge code with the MAC address.

[0059] Furthermore, ARP probing or LLDP discovery is initiated on the out-of-band management network. The SoC nodes in the network are traversed, the BMC interface of the target SoC is identified, and its data link layer identifier is read to obtain the BMC MAC address of the target SoC, for example, in the format 00:1A:2B:3C:4D:5E. Simultaneously, a pre-defined mapping table is invoked, which records the correspondence between BMC MAC addresses and network locations and device identities, used to verify the address's legitimacy. After confirming the validity of the target SoC's BMC MAC address, a cryptographically secure challenge code is associated with the target SoC's BMC MAC address in memory, with a binding validity period set, for example, 300 seconds, forming a temporary binding relationship. Finally, a challenge code containing a composite data structure of the cryptographically secure challenge code and the target SoC's BMC MAC address is output as the MAC address challenge code.

[0060] It should be noted that the mapping relationship table is preset in the following way: Before device deployment, the BMC MAC address of the target SoC is manually entered or batch imported with its corresponding network location, device serial number and session ID of the secure deployment session. The mapping relationship table is stored in a secure configuration database. The content is written by the administrator through a trusted management terminal during the device initialization phase and is checked and updated regularly through the out-of-band management network to ensure that the binding relationship between the BMC MAC address and the device identity is accurate and cannot be tampered with.

[0061] The comparison and verification module is used to input the challenge code with MAC address into the BMC, obtain the PUF response through the MAC address binding verification method, and compare it with the expected PUF response characteristics in the SoC hardware information database to verify the rationality of the PUF.

[0062] Based on the challenge code with MAC address, the corresponding BMC is addressed through the out-of-band management network and input, and the challenge code instruction is generated through the IPMIOEM extended command encapsulation method;

[0063] Furthermore, the challenge code with MAC address is parsed to extract the BMC MAC address of the target SoC. Using the BMC MAC address, ARP resolution or static route lookup is performed in the out-of-band management network to determine the corresponding BMC IP address. The challenge code with MAC address is then sent to the BMC's IP address via UDP or RMCP protocol to establish a session connection based on the IPMI protocol. Subsequently, based on IPMI OEM extended commands, the cryptographically secure challenge code is embedded as a payload into the command's data field, for example, using a custom OEM command format with NetFn as 0x30 and command code as 0x01. The IPMI OEM extended command encapsulation method converts the cryptographically secure challenge code into an in-band instruction frame recognizable by the BMC, ultimately generating the challenge code instruction.

[0064] The challenge code instruction is input into the PUF circuit register inside the SoC. The challenge code is defined as an stimulus, and a PUF hardware response is generated through physical microvariability.

[0065] Furthermore, upon receiving the challenge code instruction, the cryptographically secure challenge code is loaded into the dedicated PUF circuit register within the SoC. The cryptographically secure challenge code is defined as an excitation signal in the PUF circuit. The excitation signal triggers a change in the physical path delay or the initial state of the storage cell in the PUF circuit. Due to unavoidable physical micro-variability during manufacturing, each path or cell generates a unique and stable electrical signal difference under the same excitation. The electrical signal difference is sampled, amplified, and digitized by the arbitration circuit to ultimately generate the PUF hardware response.

[0066] It should be noted that the stimulus refers to the cryptographically secure challenge code input into the PUF circuit register inside the SoC, which is used to trigger the PUF circuit to generate a unique hardware response based on physical microvariability.

[0067] It should be noted that physical microvariability refers to the small and uncontrollable random differences in physical parameters such as transistor size, doping concentration, and film thickness caused by process fluctuations during integrated circuit manufacturing. Physical microvariability is unique between chips and affects their electrical characteristics.

[0068] Define the BMC MAC address of the target SoC as an index, query the SoC hardware information database, and obtain the expected PUF response characteristics corresponding to the SoC node;

[0069] Furthermore, using the BMC MAC address of the target SoC as the unique lookup key, a database retrieval operation is performed on the SoC hardware information database. The SoC hardware information database stores PUF response feature data of each SoC node collected in advance during the device manufacturing or registration phase. By matching the BMC MAC address of the target SoC, the corresponding record entry is located. The record entry contains the expected PUF response features bound to the physical identity of the SoC node, such as a set of reference bit sequences of length 256 bits and their fault tolerance range. After a successful retrieval, the expected PUF response features are returned.

[0070] The similarity score between the actual received PUF hardware response features and the expected PUF response features is calculated using a dynamic matching algorithm and compared with the PUF response authentication threshold to verify the rationality of the PUF.

[0071] Furthermore, the currently received actual PUF hardware response features are compared bit by bit with the expected PUF response features obtained by querying the SoC hardware information database. The Hamming distance algorithm is used to calculate the difference in the number of bits between the two, and the similarity score is obtained by matching the number of bits. The calculated similarity score is compared with the PUF response authentication threshold (usually ranging from 85% to 95%), for example, 90%. If the similarity score is greater than or equal to the PUF response authentication threshold, the PUF's rationality verification is deemed to have passed; otherwise, the PUF's rationality verification is deemed to have failed.

[0072] The instruction generation module is used to define the SoC node as a trusted device based on the reasonableness result of PUF, and generate VLAN joining instructions, MAC address binding instructions and private VLAN isolation instructions through the OpenFlow protocol;

[0073] The authentication status information is extracted from the reasonableness result of PUF and compared with the preset logic to obtain the trusted device mark;

[0074] Furthermore, the rationality result of PUF is analyzed. The rationality result of PUF includes the judgment output after comparing the similarity score with the PUF response authentication threshold. The authentication status information is extracted from it, which is "PUF authentication successful" or "PUF authentication failed". The authentication status information is compared with the preset logic, which is defined as executing a trusted tag when the authentication status information is "PUF authentication successful". If the comparison result meets the preset logic, a trusted device tag uniquely associated with the SoC node is generated. The trusted device tag is, for example, an encrypted identifier containing a session ID and a timestamp.

[0075] It should be noted that the preset logic is preset by solidifying the authentication success criteria into executable rules in the device management policy configuration. It explicitly specifies that when the authentication status information is "PUF authentication successful", the trusted device tag generation process is triggered, and the logic entry is written into the security policy configuration file, for example, stored in the read-only configuration area of ​​the controller in JSON format, to ensure that it cannot be dynamically modified during operation.

[0076] Define the SoC node as a trusted device, and use a multi-source data fusion method to fuse and associate the BMC MAC address, session ID and trusted device tag to generate a device security context;

[0077] Furthermore, after obtaining the trusted device tag, the SoC node is officially identified as a trusted device; data items from three independent sources—BMC MAC address, session ID, and trusted device tag—are collected using a multi-source data fusion method; through timestamp alignment and identity consistency verification, it is confirmed that the BMC MAC address, session ID, and trusted device tag all point to the same SoC node; subsequently, the BMC MAC address, session ID, and trusted device tag are aggregated according to the defined structure to construct a composite data structure containing three fields, ultimately generating the device security context.

[0078] Based on the device security context, VLAN join instructions, MAC address binding instructions, and private VLAN isolation instructions are generated via the OpenFlow protocol.

[0079] Furthermore, the device security context is parsed to extract the BMC MAC address, session ID, and trusted device tag. Based on the BMC MAC address, the target switch port is determined. Combined with security network policies, a VLAN join instruction is generated, requiring the corresponding port to be added to the specified security VLAN, such as VLAN 4090. Using the BMC MAC address as the unique source address, a MAC address binding instruction is generated, and a port security policy is configured to restrict access only to the BMC MAC address. Based on security isolation requirements, a private VLAN isolation instruction is generated, setting the port as an isolated port and prohibiting direct communication with other ports.

[0080] Establish a VLAN module to execute configuration commands, create VLANs, and simultaneously perform MAC port binding and private VLAN function operations to generate a secure network closed loop centered on the trusted SoC;

[0081] Based on VLAN join commands and historical network topology mapping tables, determine the target switch connected to the MAC address and the corresponding physical port number.

[0082] Furthermore, the VLAN join command is parsed to extract the BMC MAC address contained within it; using the BMC MAC address as the query key, a search is performed in the historical network topology mapping table, which records the correspondence between each BMC MAC address and the IP address and physical port of the access switch; by matching the BMC MAC address, the associated target switch identifier and physical port number are obtained.

[0083] It should be noted that the historical network topology mapping table refers to a static or dynamically updated network device connection information table that records the correspondence between BMC MAC addresses and access switch identifiers and physical port numbers.

[0084] Initiate a connection request to the target switch, authenticate using a shared key, and establish a TLS-encrypted switch control connection.

[0085] Furthermore, using the target switch's IP address and port, a TCP connection request is initiated. After the connection is established, the TLS handshake protocol is started, and both parties exchange certificate information and use a shared key method for authentication. The pre-shared key is, for example, a 256-bit symmetric key stored in a secure key store. A session key is generated through a key derivation function to complete two-way authentication. A cryptographic suite is negotiated and a secure channel is established, ultimately forming a TLS-encrypted switch control connection to ensure the confidentiality and integrity of subsequent command transmissions.

[0086] It should be noted that a shared key refers to the same symmetric encryption key that is securely distributed and stored in advance between the target switch and the controller, and is used for authentication and session key negotiation when establishing a TLS-encrypted switch control connection.

[0087] It should be noted that the switch control connection method refers to the network connection mechanism that enables secure command transmission and status management between the controller and the target switch through a TLS-encrypted communication channel.

[0088] Based on the physical port number corresponding to the SoC node and the TLS-encrypted switch control connection method, VLANs are established through a collaborative protection method of VLAN isolation and MAC binding.

[0089] Based on the VLAN, execute the MAC address binding command, and use the static MAC binding mechanism to process the data uniqueness of the port and generate a dedicated channel with the BMC MAC address;

[0090] Furthermore, using TLS-encrypted switch control connection, OpenFlow configuration commands are sent to the target switch to configure the physical port number corresponding to the SoC node to join the specified security VLAN, such as VLAN 4090, to achieve network layer isolation. At the same time, port security policies are issued to bind the physical port number to the BMC MAC address contained in the device security context, enabling MAC port binding to ensure that only MAC address traffic can pass through. The VLAN establishment is completed by the synchronous implementation of VLAN isolation and MAC binding collaborative protection.

[0091] It should be noted that a port refers to the interface on a network switch used to connect physical devices, for receiving and forwarding data frames, and has a unique physical number and configurable network attributes.

[0092] It should be noted that data uniqueness processing refers to ensuring, through verification and deduplication mechanisms, that each data item, such as session ID, BMC MAC address, or challenge code, is only validly recorded and processed once in the processing flow, avoiding duplication or conflict.

[0093] Based on the dedicated channel of the BMC MAC address, execute private VLAN isolation commands to generate a secure network closed loop centered on the trusted SoC.

[0094] Furthermore, based on the physical port number corresponding to the dedicated channel of the BMC MAC address, a private VLAN isolation command is issued through a TLS-encrypted switch control connection method; the physical port number is configured as the isolation port of the private VLAN, the private VLAN function is enabled, and direct Layer 2 communication between the physical port and other access ports is prohibited; it is ensured that all traffic entering and leaving the BMC MAC address must be forwarded through the upper-layer gateway and undergo policy inspection; through the isolation mechanism, combined with the established VLAN isolation and MAC port binding, a secure network closed loop centered on the trusted SoC is formed.

[0095] The vector generation module is used for a secure network closed loop centered on a trusted SoC. It extracts heterogeneous hardware resource data and transforms it into heterogeneous feature vectors.

[0096] Based on a secure network closed loop centered on a trusted SoC, hardware discovery instructions are generated via the Redfish protocol and input into the BMC of the target trusted device. Heterogeneous hardware resource data is extracted using the feature vectorization method.

[0097] Furthermore, leveraging the secure communication path provided by the secure network closed loop centered on the trusted SoC, a hardware discovery command conforming to the Redfish protocol specification is constructed. This command includes enumeration requests for CPU, memory, storage, and expansion devices. The hardware discovery command is sent to the BMC management interface of the target trusted device via HTTPS, triggering a scan of the underlying hardware. Upon response, the BMC returns JSON data containing various hardware attributes. The received JSON data is parsed, and for parameters of different hardware types, such as the number of cores, capacity, and vendor ID, feature vectorization is used to convert them into a uniform-dimensional numerical vector representation, extracting heterogeneous hardware resource data.

[0098] Data cleaning and preprocessing operations are performed on heterogeneous hardware resource data to generate preprocessed heterogeneous hardware resource data, which is then transformed into heterogeneous feature vectors through data mapping.

[0099] Furthermore, the extracted heterogeneous hardware resource data undergoes integrity verification, removing entries with missing key fields or incorrect formats, and filling in inferable missing values, such as uniformly converting memory capacity units to GB; textual fields such as manufacturer names and device models are standardized and encoded, and numerical fields are normalized to generate preprocessed heterogeneous hardware resource data with a consistent structure; data mapping is applied to map various hardware attributes to a multi-dimensional feature space, such as mapping the number of CPU cores as the first dimension, memory capacity (GB) as the second dimension, and storage type (SATA=0, NVMe=1) as the third dimension, ultimately generating a heterogeneous feature vector.

[0100] It should be noted that preprocessing includes performing integrity checks, missing value imputation, format standardization, unit unification, and numerical normalization on heterogeneous hardware resource data.

[0101] A dual-mode module is generated to input heterogeneous feature vectors into a small neural network for cross-node encrypted communication and public VLAN access operations, generating a dual-mode of high-security intranet-open interconnection.

[0102] Heterogeneous feature vectors are input into a small neural network, and probability scores are generated through forward propagation. These scores are then compared with historical pattern probability thresholds to identify pattern classification labels.

[0103] Furthermore, the heterogeneous feature vectors are input into a small neural network model. The input layer dimension of the small neural network model is aligned with the heterogeneous feature vectors, and forward propagation calculation is performed. The calculation process is as follows: Hidden layer 1 = ReLU(W1·heterogeneous feature vector + b1), Hidden layer 2 = ReLU(W2·hidden layer 1 + b2), Output layer = Sigmoid(W3·hidden layer 2 + b3), generating probability scores with a value range of [0,1]. The probability scores are compared with historical pattern probability thresholds (usually ranging from 0 to 1). If the probability score is greater than or equal to the historical pattern probability threshold, the pattern classification label is 1 (open interconnection mode); otherwise, the pattern classification label is 0 (high-security intranet mode).

[0104] It should be noted that the small neural network model refers to a three-layer fully connected neural network with a multilayer perceptron (MLP) architecture. The training process of the three-layer fully connected neural network with a multilayer perceptron architecture is as follows: input heterogeneous feature vectors into the three-layer fully connected neural network with a multilayer perceptron architecture, calculate the cross-entropy loss between the predicted output and the true label, and use the Adam optimizer to iteratively update the weight matrices W1, W2, W3 and the bias vectors b1, b2, b3 until the loss function converges, thus completing the training process.

[0105] Based on the pattern classification label, perform encryption operations, generate PUF session keys, and simultaneously delete private VLAN isolation commands and add public VLANs through TLS-encrypted switch control connection methods to generate network topology status.

[0106] Furthermore, based on the pattern classification label, an encryption algorithm is invoked to perform encryption operations on the heterogeneous feature vectors. For example, the AES-256 algorithm is used to perform encryption operations with a key length of 256 bits, and the output result is used as the PUF session key. At the same time, using the established TLS-encrypted switch control connection method, the private VLAN isolation command for the device BMC MAC address is removed, and a configuration command is issued to add the device port to the specified public VLAN. For example, the public VLAN with VLAN ID 100 is assigned to the port. After the public VLAN configuration command is completed, the VLAN affiliation status of the switch port changes, and the network topology status of the connection relationship and port configuration information in the public VLAN is finally formed.

[0107] Based on pattern classification labels, heterogeneous feature vectors, network topology status, and PUF session keys, a dual-mode high-security intranet-open interconnection is generated using a trusted hardware dual-mode dynamic switching method.

[0108] Furthermore, using the mode classification label as the trigger for mode switching, when the mode classification label indicates high-security intranet mode, the PUF session key is used to encrypt communication data end-to-end, and the communication path is restricted by the private VLAN connection relationship recorded in the network topology status. At the same time, access control is implemented based on the hardware resource configuration information such as the number of CPU cores, memory capacity, and storage type contained in the heterogeneous feature vector to ensure that only devices with matching hardware characteristics can access each other. When the mode classification label indicates open interconnection mode, the PUF session key is used to negotiate session layer security parameters, a secure channel is established using the TLS protocol and the RSA key exchange algorithm, and the isolation restriction of the private VLAN is removed by combining the connectivity configuration of the public VLAN in the network topology status, allowing data exchange with other devices in the public VLAN through network protocols. Throughout the switching process, the dual-mode dynamic switching method based on trusted hardware adjusts the security policy and network connectivity configuration in real time according to the changes in the mode classification label, and finally generates a dual-mode high-security intranet-open interconnection mode that includes both high-security intranet mode and open interconnection mode.

[0109] This embodiment also provides a computer device applicable to a dual-mode x86 SoC array server system based on an intranet VLAN closed loop, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to realize the dual-mode x86 SoC array server system based on an intranet VLAN closed loop as proposed in the above embodiment.

[0110] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0111] This embodiment also provides a storage medium storing a computer program. When executed by a processor, the program implements the dual-mode x86 SoC array server system based on intranet VLAN closed-loop as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0112] In summary, this invention achieves hardware-level identity authentication based on physical micro-variability by: initializing a secure deployment session and generating a challenge code with a MAC address through an address binding module, thus ensuring the authenticity of the response source; and by establishing a VLAN module to perform MAC port binding and private VLAN function operations, generating a secure network closed loop centered on a trusted SoC, thereby achieving the synchronous construction of network isolation policies and hardware trusted states, and realizing the effect of hardware identity trusted verification and dynamic secure network collaborative control.

[0113] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A dual-mode x86 SoC array server system based on intranet VLAN closed loop, characterized in that: include, The address binding module is used to initialize a secure deployment session to generate a challenge code for the x86 SoC node and temporarily bind it to the BMC MAC address of the target SoC to obtain a challenge code with the MAC address. The comparison and verification module is used to input the challenge code with MAC address into the BMC, obtain the PUF response through the MAC address binding verification method, and compare it with the expected PUF response characteristics in the SoC hardware information database to verify the rationality of the PUF. The instruction generation module is used to define the SoC node as a trusted device based on the reasonableness result of PUF, and generate VLAN joining instructions, MAC address binding instructions and private VLAN isolation instructions through the OpenFlow protocol; Establish a VLAN module to execute configuration commands, create VLANs, and simultaneously perform MAC port binding and private VLAN function operations to generate a secure network closed loop centered on the trusted SoC; The vector generation module is used for a secure network closed loop centered on a trusted SoC. It extracts heterogeneous hardware resource data and transforms it into heterogeneous feature vectors. A dual-mode module is generated to input heterogeneous feature vectors into a small neural network for cross-node encrypted communication and public VLAN access operations, generating a dual-mode of high-security intranet-open interconnection.

2. The dual-mode x86 SoC array server system based on intranet VLAN closed loop as described in claim 1, characterized in that: The steps for generating a challenge code for the x86 SoC node to initialize the secure deployment session are as follows: Initialize a secure deployment session and assign a session ID. Input the session ID into an empty secure verification queue and wait for a response from the x86 SoC node. Receive the response from the x86 SoC node and perform a random number generation operation to generate a cryptographically secure challenge code of a specified length.

3. The dual-mode x86 SoC array server system based on intranet VLAN closed loop as described in claim 2, characterized in that: The process of obtaining a challenge code with a MAC address involves scanning the out-of-band management network, obtaining the BMC MAC address of the target SoC, and temporarily binding the challenge code with the BMC MAC address of the target SoC through a preset mapping table to generate a challenge code with a MAC address.

4. The dual-mode x86 SoC array server system based on intranet VLAN closed loop as described in claim 3, characterized in that: The steps for inputting a challenge code containing the MAC address into the BMC and obtaining a PUF response through the MAC address binding verification method are as follows: Based on the challenge code with MAC address, the corresponding BMC is addressed through the out-of-band management network and input, and the challenge code instruction is generated through the IPMIOEM extended command encapsulation method; The challenge code instruction is input into the PUF circuit register inside the SoC. The challenge code is defined as an stimulus, and a PUF hardware response is generated through physical microvariability.

5. The dual-mode x86 SoC array server system based on intranet VLAN closed loop as described in claim 4, characterized in that: The specific steps for verifying the rationality of the PUF are as follows: Define the BMC MAC address of the target SoC as an index, query the SoC hardware information database, and obtain the expected PUF response characteristics corresponding to the SoC node; Calculate the similarity score between the currently received actual PUF hardware response features and the expected PUF response features, and compare it with the PUF response authentication threshold to verify the rationality of PUF.

6. The dual-mode x86 SoC array server system based on intranet VLAN closed loop as described in claim 5, characterized in that: Based on the reasonableness of the PUF-based approach, the SoC node is defined as a trusted device. VLAN join instructions, MAC address binding instructions, and private VLAN isolation instructions are generated via the OpenFlow protocol. The specific steps are as follows. The authentication status information is extracted from the reasonableness result of PUF and compared with the preset logic to obtain the trusted device mark; Define the SoC node as a trusted device, and fuse and associate the BMC MAC address, session ID, and trusted device tag to generate a device security context; Based on the device security context, VLAN join instructions, MAC address binding instructions, and private VLAN isolation instructions are generated via the OpenFlow protocol.

7. The dual-mode x86 SoC array server system based on intranet VLAN closed loop as described in claim 6, characterized in that: The specific steps for executing configuration commands and establishing a VLAN are as follows. Based on VLAN join commands and historical network topology mapping tables, determine the target switch connected to the MAC address and the corresponding physical port number. Initiate a connection request to the target switch, perform authentication, and establish a TLS-encrypted switch control connection. Establish a VLAN based on the physical port number corresponding to the SoC node and the TLS-encrypted switch control connection method.

8. The dual-mode x86 SoC array server system based on intranet VLAN closed loop as described in claim 7, characterized in that: The specific steps for performing MAC port binding and private VLAN functions to generate a secure network closed loop centered on the trusted SoC are as follows. Based on the VLAN, execute the MAC address binding command to perform data uniqueness processing on the port and generate a dedicated channel with the BMC MAC address; Based on the dedicated channel of the BMC MAC address, execute private VLAN isolation commands to generate a secure network closed loop centered on the trusted SoC.

9. The dual-mode x86 SoC array server system based on intranet VLAN closed loop as described in claim 8, characterized in that: The secure network closed loop centered on the trusted SoC extracts heterogeneous hardware resource data and transforms it into heterogeneous feature vectors. The specific steps are as follows. Based on a secure network closed loop centered on a trusted SoC, hardware discovery instructions are generated via the Redfish protocol and input into the BMC of the target trusted device to extract heterogeneous hardware resource data. Data cleaning and preprocessing operations are performed on heterogeneous hardware resource data to generate preprocessed heterogeneous hardware resource data, which is then transformed into heterogeneous feature vectors.

10. The dual-mode x86 SoC array server system based on intranet VLAN closed loop as described in claim 9, characterized in that: The process of inputting heterogeneous feature vectors into a small neural network to perform cross-node encrypted communication and public VLAN access operations, generating a dual-mode high-security intranet-open interconnection network, is detailed below. Heterogeneous feature vectors are input into a small neural network, and probability scores are generated through forward propagation. These scores are then compared with historical pattern probability thresholds to identify pattern classification labels. Based on the pattern classification label, perform encryption operations, generate PUF session keys, and simultaneously delete private VLAN isolation commands and add public VLANs through TLS-encrypted switch control connection methods to generate network topology status. Based on pattern classification labels, heterogeneous feature vectors, network topology status, and PUF session keys, a dual-mode high-security intranet-open interconnection is generated using a trusted hardware dual-mode dynamic switching method.

Images