Zero terminal system

Abstract

The invention discloses a zero terminal system, relates to the technical field of electronic information, thoroughly cuts a central processing unit (CPU) and an operating system of a terminal, and improves the end side security of a desktop cloud system. The system specifically comprises the following modules: a network PHY module used for connecting a network cable and receiving and transmitting a network data packet; and the network TCP / IP module is based on a network TCP / IP protocol stack realized by hardware, is internally provided with a hardware authentication private key ID, and is used for packing and unpacking the TCP / IP protocol of the network data. And the encryption and decryption module is used for encrypting and decrypting the transmission data. And the PS / 2 keyboard and mouse module is used for connecting a PS / 2 keyboard and mouse and analyzing the input of the PS / 2 keyboard and mouse. And the decoding module is used for decoding the received display coding data. And the display module is used for processing display data. And the HDMI PHY / VGA interface module is used for being externally connected with a display. All the modules transmit data by sharing a static random access memory (SRAM).

Description

Technical Field

[0001] This invention relates to the field of electronic information technology, and more specifically to a zero-terminal system. Background Technology

[0002] In recent years, with the rapid development of Internet technology, cloud desktop technology has gradually become more popular. Cloud desktop is a cloud computing-based solution that allows users to access and use a complete desktop operating system and its related applications from anywhere via a network connection using a cloud terminal.

[0003] A typical desktop cloud operating mode is as follows: Figure 1 As shown.

[0004] The user area is located in Security Zone 1 (e.g., a typical office space), where many desktop cloud terminals are deployed. Security Zone 2 (usually a dedicated area within a data center) houses a cluster of data center servers. Generally, Security Zone 2 is protected by expensive and complex security equipment / mechanisms, offering significantly better information security protection than Security Zone 1.

[0005] The data center server cluster in Security Zone 2 runs a virtualization and management platform that manages and maintains a large number of virtual machines. These virtual machines can be divided into two categories: functional virtual machines and user virtual machines. Functional virtual machines are used to ensure the operation of the entire desktop cloud system, including the desktop cloud login portal, user management, storage management, etc. Users operate desktop cloud terminals and connect to user virtual machines to use desktop services after logging into the desktop cloud portal via the network.

[0006] The technology by which users access their virtual machines via a desktop cloud terminal is typically called a remote display protocol, such as Remote Desktop Protocol (RDP) or Virtual Network Computing (VNC). Remote display protocols obtain user input from the desktop cloud terminal and transmit the screen content to the desktop cloud terminal for display over the network. Specifically, the screen content displayed by the user virtual machine is captured, encoded, and then transmitted to the desktop cloud terminal over the network. After decoding, the desktop cloud terminal displays the content to the user. Simultaneously, the desktop cloud terminal captures user input and USB redirection data, analyzes input events, and transmits them to the user virtual machine over the network. The user virtual machine then receives the input and executes the input logic.

[0007] It can be observed that in the desktop cloud model, all user data and desktop environment are stored in secure zone 2, which has high security protection measures. In the entire desktop cloud solution, only the cloud terminal is placed in secure zone 1 and is easily accessible to malicious users. Therefore, the security of the cloud terminal often becomes the weak link in the overall security of the desktop cloud solution.

[0008] A typical desktop cloud terminal login solution is as follows: Figure 2 As shown. Desktop cloud client software is installed and running on the desktop cloud terminal. Users first use the client software to configure the desktop cloud terminal (this requires at least network configurations such as the local IP address and the desktop cloud login portal IP address, and may also include configurations related to user experience, such as resolution and smoothness). Then, the user uses the client software to access the desktop cloud login portal. After successful authentication using various methods such as password / Ukey, the desktop cloud login portal will assign a virtual machine to the desktop cloud terminal for access, and the user can begin normal use.

[0009] Typical desktop cloud terminals require a central processing unit (CPU) and an operating system, posing security risks. Some researchers have proposed the concept of zero-terminal terminals, which involves extremely stripping down the operating system, but still requires a CPU and a small embedded operating system.

[0010] It is evident that existing solutions cannot fundamentally prevent the possibility of malicious users intruding into cloud terminals and stealing critical data from the entire desktop cloud system due to software vulnerabilities. Summary of the Invention

[0011] In view of this, the present invention provides a zero-terminal system that completely eliminates the central processing unit (CPU) and operating system of the terminal, thereby improving the edge security of the desktop cloud system.

[0012] To achieve the above objectives, the present invention provides a zero-terminal system, the technical solution of which includes the following modules: The network PHY module is used to connect network cables and send and receive network data packets.

[0013] The network TCP / IP module is a hardware-based network TCP / IP protocol stack with a built-in hardware authentication private key ID, used for TCP / IP protocol packet assembly and decompression of network data.

[0014] The encryption / decryption module is used to encrypt and decrypt transmitted data.

[0015] The PS / 2 keyboard and mouse module is used to connect PS / 2 keyboards and mice and to parse PS / 2 keyboard and mouse input.

[0016] The decoding module is used to decode the received display encoded data.

[0017] The display module is used to process and display data.

[0018] HDMI PHY / VGA interface module for connecting an external monitor.

[0019] All the above modules transfer data by sharing a single static random access memory (SRAM).

[0020] Furthermore, the zero terminal includes two data streams: one is a network-transmitted display encoding data stream, and the other is a network-uploaded keyboard and mouse data stream.

[0021] Furthermore, the network sends the display encoded data stream, specifically as follows: the network PHY module receives network data packets and sends them directly to the network TCP / IP module; after completing TCP / IP unpacking, the network TCP / IP module places the display encoded data in static random access memory (SRAM) and notifies the encryption / decryption module; both the encryption / decryption module and the decoding module use a double-buffering mechanism to communicate asynchronously with subsequent modules, ultimately enabling the display encoded data to be displayed on an external monitor via the display module and the HDMI PHY / VGA interface module.

[0022] Furthermore, the network upload of keyboard and mouse data streams is specifically as follows: the PS / 2 keyboard and mouse module receives a set of keyboard and mouse input data from the PS / 2 keyboard and mouse, parses it, sends it to the encryption / decryption module, and then uploads it to the network via the network TCP / IP module and the network PHY module; the network upload of keyboard and mouse data streams processes only one set of keyboard and mouse input data at a time, and all data streams are transmitted synchronously.

[0023] Furthermore, both the encryption / decryption module and the decoding module use a double-buffering mechanism to communicate asynchronously with subsequent modules, as follows: when the encryption / decryption module is writing, the decoding module is reading; when the decoding module is writing data, the display module is reading.

[0024] Furthermore, the buffer is located in SRAM and is divided into buffer A and buffer B. Both buffer A and buffer B have readable and releaseable flags. First, the releaseable flag of buffer A is checked, and then data is written to buffer A. After the writing is completed, the readable flag of buffer A is set to 1 to notify the read module that data can be retrieved from buffer A. After the read module retrieves the data, it sets the readable flag of buffer A to 0 and sets the releaseable flag of buffer A to 1. Then, the releaseable flag of buffer B is checked, and data is written to buffer B. After the writing is completed, the readable flag of buffer B is set to 1 to notify the read module that data can be retrieved from buffer B. After the read module retrieves the data, it sets the readable flag of buffer B to 0 and sets the releaseable flag of buffer B to 1. This process is repeated.

[0025] Furthermore, synchronous data transmission is used between the display module, the HDMI PHY VGA interface, and the monitor interface.

[0026] Beneficial effects: This invention provides a zero-terminal system that connects to a desktop cloud system, completely eliminating the need for the terminal's CPU and operating system, thus significantly improving the edge security of the desktop cloud system. The zero-terminal system described in this invention uses dedicated, unmodifiable, and unprogrammable circuitry, fundamentally eliminating the possibility of intrusion by malicious code and malicious users. Attached Figure Description

[0027] Figure 1 This is a typical desktop cloud operating mode diagram; Figure 2 This is a schematic diagram of a typical desktop cloud terminal login solution; Figure 3 This is a diagram illustrating the overall framework of a zero-terminal system provided in an embodiment of the present invention. Figure 4 Display the encoded data flow diagram for network distribution; Figure 5 Upload keyboard and mouse data flow diagrams to the network; Figure 6 The flowchart shows the double buffering mechanism. Figure 7 This is a diagram illustrating the direct interaction between the zero-terminal and desktop cloud virtualization systems provided in this embodiment of the invention. Detailed Implementation

[0028] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0029] The zero-terminal system provided by this invention consists of the following components: Figure 3 As shown, it includes a total of 7 modules: A network PHY is used to connect network cables and send and receive network data packets.

[0030] The network TCP / IP module is a hardware-based implementation of the network TCP / IP protocol stack, with a built-in hardware authentication private key ID. It is used for TCP / IP protocol packet assembly and unpacking of network data.

[0031] The encryption / decryption module is used to encrypt and decrypt transmitted data.

[0032] The PS / 2 keyboard and mouse module is used to connect PS / 2 keyboards and mice and to parse PS / 2 keyboard and mouse input.

[0033] The decoding module is used to decode the received display encoded data.

[0034] The display module is used to process and display data.

[0035] HDMI PHY / VGA interface for connecting an external monitor.

[0036] In this embodiment of the invention, the various modules share a single Static Random-Access Memory (SRAM) to transmit data. The zero-terminal internally has two data streams: one is a network-transmitted display encoding data stream, and the other is a network-uploaded keyboard and mouse data stream.

[0037] In this embodiment of the invention, a real-coded data stream is discovered under the network, such as... Figure 4 As shown, in the network-transmitted display encoded data stream, the network PHY receives network data packets and sends them directly to the network TCP / IP module; after TCP / IP unpacking, the network TCP / IP module places the data in SRAM and notifies the encryption / decryption module. This data transmission logic is synchronous. Both the encryption / decryption and decoding modules use a double-buffering mechanism to communicate asynchronously with subsequent modules, ultimately enabling the display encoded data to be transmitted through the display module and the HDMI PHY / VGA interface module, and finally displayed on the external monitor.

[0038] In this embodiment of the invention, the keyboard and mouse data stream is uploaded over the network as follows: Figure 5 As shown, the PS / 2 keyboard and mouse module receives a set of keyboard and mouse input data from the PS / 2 keyboard and mouse, parses it, sends it to the encryption / decryption module, and then uploads it to the network via the network TCP / IP module and the network PHY module. The logic for uploading the keyboard and mouse data stream over the network is relatively simple, and the keyboard and mouse data stream only needs to process one set of data at a time, so the entire data stream is transmitted synchronously.

[0039] In this embodiment of the invention, both the encryption / decryption module and the decoding module use a double-buffering mechanism to communicate asynchronously with subsequent modules, as follows: Figure 6 As shown. When the encryption / decryption module writes data, the decoding module acts as the reading module; when the decoding module writes data, the display module acts as the reading module. The buffer is located in SRAM and divided into two blocks, A and B. Each block has a readable flag and a free flag (also located in SRAM, with only two bits). First, the free flag of buffer A is checked. Then, data is written to buffer A. After writing, the readable flag of buffer A is set to 1 to notify the reading module that data can be retrieved from buffer A. After retrieving the data, the reading module sets the readable flag of buffer A to 0 and sets the free flag of buffer A to 1. Next, the free flag of buffer B is checked, data is written to buffer B, and after writing, the readable flag of buffer B is set to 1 to notify the reading module that data can be retrieved from buffer B. After retrieving the data, the reading module sets the readable flag of buffer B to 0 and sets the free flag of buffer B to 1. This process repeats continuously.

[0040] Synchronous data transmission is used between the display module, HDMI PHY VGA interface, and monitor interface.

[0041] A stripped-down desktop cloud terminal, no longer possessing user login and local peripheral driving capabilities. Its overall framework is as follows: Figure 7 As shown. The zero-terminal system provided by this invention can communicate with the desktop cloud virtualization system via remote display protocol A, and log in to the user's virtual machine through the desktop cloud virtualization system. The desktop cloud virtualization system adopts an existing design, which is described in patent application number 202510350944.X. In this invention, remote display protocol A is fixed to only have basic login functions, and the terminal / virtual machine configuration is hard-coded to ensure that the functionally limited zero terminal can correctly access the jump server virtual machine. The remote display protocol B involved in the desktop cloud virtualization system runs in the virtual machine, can use multiple protocols, and can have rich functions; protocol B is not the core content of this patent.

[0042] In summary, the above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A zero terminal system, characterized by, The application relates to a zero terminal, which comprises the following modules: The network PHY module is used for connecting a network cable and transmitting network data packets; The network TCP / IP module is used for implementing a network TCP / IP protocol stack based on hardware, and is internally provided with a hardware authentication private key ID for TCP / IP protocol packet assembling and disassembling of network data; The encryption and decryption module is used for encrypting and decrypting transmission data; The PS / 2 keyboard and mouse module is used for connecting a PS / 2 keyboard and mouse and analyzing PS / 2 keyboard and mouse input; The decoding module is used for decoding received display encoding data; The display module is used for processing display data; The HDMI PHY / VGA interface module is used for externally connecting a display. The above modules transmit data by sharing a static random access memory (SRAM).

2. A terminal-free system as claimed in claim 1, characterized in that The zero terminal internally comprises two data streams, one is a network display encoding data stream, and the other is a network keyboard and mouse data stream.

3. A terminal-free system as claimed in claim 2, characterized in that The network display encoding data stream is as follows: the network PHY module receives network data packets and directly sends the network data packets to the network TCP / IP module; the network TCP / IP module completes TCP / IP packet disassembling, places display encoding data in the static random access memory (SRAM), and notifies the encryption and decryption module; The encryption and decryption module and the decoding module use a double buffering mechanism to asynchronously communicate with subsequent modules, and finally realize display of the display encoding data on an external display through the display module and the HDMI PHY / VGA interface module.

4. A zero terminal system as claimed in claim 2 or 3, characterized in that The network keyboard and mouse data stream is as follows: the PS / 2 keyboard and mouse module receives a group of keyboard and mouse input data of the PS / 2 keyboard and mouse, analyzes the keyboard and mouse input data, and then sends the keyboard and mouse input data to the encryption and decryption module, and then the network keyboard and mouse data stream is uploaded to the network through the network TCP / IP module and the network PHY module; The network keyboard and mouse data stream only processes one group of keyboard and mouse input data each time, and all the data streams are synchronously transmitted.

5. A terminal-free system as claimed in claim 3, characterized in that The encryption and decryption module and the decoding module use a double buffering mechanism to asynchronously communicate with subsequent modules, and the process is as follows: when the encryption and decryption module writes data, the decoding module is a reading module; when the decoding module writes data, the display module is a reading module.

6. A terminal-free system as claimed in claim 1, characterized in that The buffer area is located in the SRAM and is divided into buffer area A and buffer area B, and the buffer area A and the buffer area B are provided with readable flags and releasable flags; First, the releasable flag of the buffer area A is checked, then data is written into the buffer area A, after the data is written, the readable flag of the buffer area A is set to 1 to inform the reading module that the data in the buffer area A can be read, after the reading module reads the data, the readable flag of the buffer area A is set to 0, and the releasable flag of the buffer area A is set to 1; then the releasable flag of the buffer area B is checked, data is written into the buffer area B, after the data is written, the readable flag of the buffer area B is set to 1 to inform the reading module that the data in the buffer area B can be read, after the reading module reads the data, the readable flag of the buffer area B is set to 0, and the releasable flag of the buffer area B is set to 1, and the process is repeated.

7. A terminal system as claimed in claim 1, characterized in that Synchronous data transmission is used between the display module, the HDMI PHY / VGA interface and the display interface.

Images