Hardware safety island device of server chip

Abstract

The invention provides a hardware safety island device of a server chip, and relates to the technical field of hardware safety. The hardware security island device of the server chip comprises a security island core module, an independent processor used for executing security-related instructions and operations, and a security memory used for storing sensitive data and a special memory area of a secret key; the secure bus interface is an interface for performing secure communication with other parts of the server chip; and the security monitoring module comprises an intrusion detection system and a security audit log, and the intrusion detection system monitors operation in the chip in real time and detects potential intrusion behaviors. The security island core module runs in an independent execution environment and is isolated from the main processor, even if the main processor is broken through, the security island can still keep safe, complex and advanced attack means can be effectively defended, the security of the whole system is improved, sensitive data and secret keys are ensured to be protected on the hardware level, and data leakage and tampering are prevented.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of hardware security, in particular to a hardware security island device of a server chip. BACKGROUND

[0002] With the rapid development of information technology, servers are increasingly widely used in key fields such as cloud computing, big data, the Internet of Things, and artificial intelligence. These servers usually store and process a large amount of sensitive data, such as personal privacy information, business secrets, and national security data, so their security is crucial. However, with the continuous evolution of network attack methods, servers are facing increasingly severe security threats.

[0003] Traditional server security mainly relies on software-level protection measures such as firewalls, intrusion detection systems, and encryption algorithms. However, these software-level protection methods have certain limitations and are difficult to cope with increasingly complex and diverse hardware attacks. For example, side-channel attacks can steal keys or sensitive data by analyzing physical information such as chip power consumption, electromagnetic radiation, or execution time. Fault injection attacks can bypass security mechanisms or tamper with data by introducing voltage, clock, or temperature fluctuations. Physical tampering attacks can obtain or destroy sensitive information by directly physically manipulating the chip, such as probing, cutting, or microprobe attacks. In addition, with the popularity of the Internet of Things and edge computing devices, server chips not only face remote network attacks but also face physical layer security threats. For example, in unattended environments, attackers may physically contact devices, perform malicious operations, or implant malicious hardware. These attack methods not only threaten data security but also can have a serious impact on the integrity and availability of the entire system. Therefore, the present application provides a hardware security island device of a server chip to solve the problems raised in the background. SUMMARY

[0004] (I) Technical problems solved

[0005] To address the deficiencies in the prior art, the present application provides a hardware security island device of a server chip, which solves the problem of certain limitations of existing protection methods.

[0006] (II) Technical solutions

[0007] To achieve the above purpose, the present application is implemented by the following technical solutions: a hardware security island device of a server chip, comprising:

[0008] a security island core module, an independent processor for executing security-related instructions and operations, a secure memory for storing a dedicated memory area of sensitive data and keys, a secure bus interface for secure communication with other parts of the server chip.

[0009] A security monitoring module, including an intrusion detection system and a security audit log, the intrusion detection system monitors the operation inside the chip in real time, detects potential intrusion behavior; the security audit log records all security-related operations and events, facilitating subsequent audit and analysis;

[0010] A secure communication module, including an encryption engine and a key management unit, the encryption engine is used for encrypting and decrypting data entering and exiting the security island; the key management unit is responsible for generating, storing and managing encryption keys;

[0011] A power management module, including independent power supply and power monitoring, independent power supply provides independent power supply for the security island, ensuring normal work when the main power is cut off; power monitoring monitors the power state in real time to prevent power attacks;

[0012] A physical protection mechanism, including a tamper-proof shell and temperature and voltage sensors, the tamper-proof shell uses special physical structure and materials to prevent physical attacks and tampering, and the temperature and voltage sensors monitor the physical environment of the chip to prevent environmental attacks.

[0013] Preferably, the security island core module comprises the following steps:

[0014] S1. A security processor designed with a special instruction set to support common encryption algorithms such as AES and ECC; the security processor runs in an independent execution environment, isolated from the main processor, preventing the main processor from being compromised and affecting the operation of the security processor; self-checking and verification are performed at startup to ensure that the firmware and code of the security processor have not been tampered with;

[0015] S2. A secure memory for storing sensitive data, keys and certificate information, ensuring that these data are not stolen or tampered with during storage and access; all stored data are encrypted, using a hardware encryption engine for encryption and decryption; a strict access control mechanism is adopted, only authorized security processors can access the stored data; the memory uses special physical structure and materials to prevent physical attacks;

[0016] S3. A secure bus interface responsible for secure communication between the security island and other modules, using an encrypted communication protocol for data transmission to ensure the confidentiality and integrity of data during transmission; identity verification is performed before communication to ensure the legal identity of both parties; message authentication code and digital signature technology are used to ensure data integrity and authenticity.

[0017] Preferably, the security monitoring module comprises the following steps:

[0018] S1. Intrusion detection system monitors the operation of the server chip in real time, detects potential intrusion behavior and abnormal activities, identifies abnormal activities by analyzing the operation mode and behavior of the chip, detects abnormal memory access mode and abnormal instruction execution sequence; based on predefined rules and strategies, real-time matching and detection are carried out; machine learning algorithm is used for behavior modeling and anomaly detection to improve the accuracy and efficiency of detection;

[0019] S2. Security audit log records all security-related operations and events for subsequent audit and analysis, uses a dedicated log storage area to ensure the security and integrity of log data; all log data is encrypted to prevent tampering or theft; log analysis tools are provided to support real-time monitoring and post-audit.

[0020] Preferably, the secure communication module includes the following steps:

[0021] S1. Encryption engine encrypts and decrypts data entering and exiting the secure island, ensuring data confidentiality during transmission and storage, using hardware acceleration technology to improve encryption and decryption efficiency; supports multiple encryption algorithms, including but not limited to AES, DES, RSA and ECC, to meet different security needs; encryption engine works closely with key management unit to ensure key security and effectiveness;

[0022] S2. Key management unit is responsible for generating, storing and managing encryption keys to ensure key security and effectiveness, using a secure random number generator to generate high-quality keys; keys are stored in secure memory and protected by encryption and access control mechanisms; keys are updated regularly to prevent them from being cracked or leaked; when not needed, keys are destroyed in time to prevent illegal use.

[0023] Preferably, the power management module includes the following steps:

[0024] S1. Independent power supply provides independent power supply for the secure island to ensure normal operation when the main power is cut off, designs independent power supply circuit to ensure that the power supply of the secure island is not affected by the main power, and uses backup power to provide emergency power supply when the main power fails;

[0025] S2. Power monitoring monitors the power state in real time to prevent power attacks and power failures, monitors the power voltage to ensure that the voltage is within a safe range, monitors the power current to detect abnormal current fluctuations; detects power failure and takes emergency measures in a timely manner, including but not limited to switching to backup power or shutting down non-critical functions.

[0026] Preferably, the physical protection mechanism includes the following steps:

[0027] S1. Anti-tamper shell, special physical structure and material are adopted to prevent physical attacks and tampering, an anti-tamper coating is coated on the surface of the chip to increase the difficulty of physical attacks, advanced packaging technology is adopted including but not limited to multi-layer packaging, sealed packaging to prevent external intrusion, and intrusion detection sensors are integrated into the anti-tamper shell to detect physical attack behavior;

[0028] S2. Temperature and voltage sensors, monitor the physical environment of the chip to prevent environmental attacks and failures, monitor the working temperature of the chip to prevent security vulnerabilities caused by overheating, monitor the working voltage of the chip to prevent security failures caused by voltage fluctuations, detect environmental abnormalities and take protective measures in a timely manner.

[0029] Preferably, the material of the anti-tamper coating in the S1 step is a conductive polymer or a photosensitive material.

[0030] Preferably, the secure communication module further includes log recording and auditing, important events and operations during communication are recorded, including connection establishment, data transmission and error handling, log data is stored in a secure memory and protected using encryption and access control mechanisms, providing complete audit tracking, recording all communication-related operations and events, facilitating subsequent audits and investigations, providing complete records of the communication process, facilitating subsequent audits and analysis, and improving the security and traceability of the system.

[0031] (Three) beneficial effects

[0032] The present application provides a kind of hardware security island device of server chip.There is the following beneficial effects:

[0033] 1, in the present application, security island core module runs in independent execution environment, is isolated from main processor, even if main processor is broken, security island can still maintain security, can effectively defend complex and advanced attack means, improve the security of overall system, ensure that sensitive data and key are protected at hardware level, prevent data leakage and tampering.

[0034] 2, in the present application, combined with anti-tamper design, environmental monitoring, intrusion detection and encrypted communication and multiple security mechanisms, form a multi-level security protection system, each module works cooperatively, provides comprehensive security protection, through real-time monitoring and dynamic response, new security threats can be discovered and responded in time.

[0035] 3, in the present application, by adopting anti-tamper shell, coating and circuit design, physical attacks and tampering are prevented, environmental parameters such as temperature, voltage and humidity are detected in real time, environmental attacks and security failures caused by environmental factors are prevented, through physical and environmental protection, the security of the chip is further improved, which can work normally in various harsh environments, and the application range is expanded. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 for the schematic diagram of the overall process of the present application;

[0037] Figure 2 for the system flowchart of the safety island core module in the present application;

[0038] Figure 3 for the system flowchart of the safety monitoring module in the present application;

[0039] Figure 4 for the system flowchart of the safety communication module in the present application;

[0040] Figure 5 for the system flowchart of the power management module in the present application;

[0041] Figure 6 for the system flowchart of the physical protection module in the present application. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0043] Embodiment one:

[0044] As shown in the figure, the present application provides a hardware security island device of a server chip, which comprises: Figures 1-6

[0045] a safety island core module, a separate processor, for executing security-related instructions and operations, a secure memory for storing a dedicated memory area of sensitive data and keys; a secure bus interface for secure communication with other parts of the server chip interface;

[0046] a safety monitoring module, including an intrusion detection system and a security audit log, the intrusion detection system monitors the operation inside the chip in real time, detects potential intrusion behavior; the security audit log records all security-related operations and events, which is convenient for subsequent audit and analysis;

[0047] a safety communication module, including an encryption engine and a key management unit, the encryption engine is used for encrypting and decrypting the data entering and exiting the safety island; the key management unit is responsible for generating, storing and managing encryption keys;

[0048] ​Power management module, including independent power supply and power monitoring, independent power supply provides independent power supply for security island, ensures normal work when main power is cut off; power monitoring monitors power state in real time, prevents power attack;

[0049] Physical protection mechanism, including tamper-resistant shell and temperature and voltage sensors, tamper-resistant shell uses special physical structure and materials to prevent physical attack and tampering, temperature and voltage sensors monitor the physical environment of the chip to prevent environmental attack.

[0050] The security island core module includes the following steps:

[0051] S1. Secure processor, designed with a dedicated instruction set to support advanced encryption standard, elliptic curve encryption commonly used encryption algorithm; the secure processor runs in an independent execution environment, isolated from the main processor, preventing the main processor from being compromised to affect the operation of the secure processor; self-check and verification at startup to ensure that the firmware and code of the secure processor have not been tampered with;

[0052] S2. Secure memory, used to store sensitive data, keys and certificate information, to ensure that these data are not stolen or tampered with during storage and access; all stored data are encrypted, using a hardware encryption engine for encryption and decryption; strict access control mechanism is adopted, only authorized secure processor can access the stored data; the memory uses special physical structure and materials to prevent physical attack;

[0053] S3. Secure bus interface, responsible for secure communication between the security island and other modules, using encrypted communication protocol for data transmission to ensure data confidentiality and integrity during transmission; identity verification before communication to ensure the identity of both parties is legal; using message authentication code and digital signature technology to ensure data integrity and authenticity.

[0054] The security monitoring module includes the following steps:

[0055] S1. Intrusion detection system monitors the operation inside the server chip in real time, detects potential intrusion behavior and abnormal activity, identifies abnormal activity by analyzing the operation mode and behavior inside the chip, detects abnormal memory access mode, abnormal instruction execution sequence; based on predefined rules and strategies, real-time matching and detection; using machine learning algorithm for behavior modeling and anomaly detection to improve detection accuracy and efficiency;

[0056] S2. Security audit log, records all security-related operations and events, facilitates subsequent audit and analysis, uses a dedicated log storage area to ensure the security and integrity of log data; all log data is encrypted to prevent tampering or theft; provides log analysis tools to support real-time monitoring and post-audit.

[0057] The secure communication module includes the following steps:

[0058] S1. Encryption engine encrypts and decrypts data entering and exiting the security island, ensuring data confidentiality during transmission and storage, using hardware acceleration technology to improve encryption and decryption efficiency; supports multiple encryption algorithms, including but not limited to AES, DES, RSA and ECC, to meet different security needs; the encryption engine works closely with the key management unit to ensure the security and effectiveness of the key;

[0059] S2. Key management unit, responsible for generating, storing and managing encryption keys, ensuring the security and effectiveness of the key, using a secure random number generator to generate high-quality keys; the key is stored in a secure memory and protected by encryption and access control mechanisms; update the key regularly to prevent it from being cracked or leaked; destroy the key in time when it is not needed to prevent illegal use.

[0060] The power management module includes the following steps:

[0061] S1. Independent power supply, provides independent power supply for the security island, ensuring normal operation when the main power is cut off, designs independent power supply circuit to ensure that the power supply of the security island is not affected by the main power, and uses backup power to provide emergency power supply when the main power fails;

[0062] S2. Power monitoring, real-time monitoring of power status to prevent power attacks and power failures, monitoring power voltage to ensure voltage within a safe range, monitoring power current to detect abnormal current fluctuations; detect power failure and take emergency measures in time, including but not limited to switching to backup power or shutting down non-critical functions.

[0063] The physical protection mechanism includes the following steps:

[0064] S1. Tamper-proof shell, uses special physical structure and materials to prevent physical attacks and tampering, applies tamper-proof coating on the chip surface to increase the difficulty of physical attacks; uses advanced packaging technology, including but not limited to multi-layer packaging, sealed packaging, to prevent external intrusion; integrates intrusion detection sensors in the tamper-proof shell to detect physical attack behavior;

[0065] S2. Temperature and voltage sensors monitor the physical environment of the chip, preventing environmental attacks and failures; monitor the operating temperature of the chip, preventing security vulnerabilities caused by overheating; monitor the operating voltage of the chip, preventing security failures caused by voltage fluctuations, detect environmental anomalies, and take protective measures in a timely manner.

[0066] The material of the anti-tampering coating in step S1 is a conductive polymer or a photosensitive material.

[0067] The secure communication module also includes log recording and auditing, which records important events and operations during the communication process, including connection establishment, data transmission and error handling, stores log data in secure memory, and protects it using encryption and access control mechanisms, provides complete audit tracking, records all communication-related operations and events, facilitates subsequent audits and investigations, provides complete records of the communication process, facilitates subsequent audits and analysis, and improves the security and traceability of the system.

[0068] Although embodiments of the present application have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions and alterations can be made thereto without departing from the principles and spirit of the application, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A hardware security island device for a server chip, characterized in that: The security island core module includes: a separate processor for executing security-related instructions and operations, a secure memory for storing sensitive data and keys, a dedicated memory area for storing sensitive data and keys; a secure bus interface for secure communication with other parts of the server chip; a security monitoring module, including an intrusion detection system and a security audit log, the intrusion detection system monitors the chip's internal operations in real time, detecting potential intrusion behavior; the security audit log records all security-related operations and events, facilitating subsequent audit and analysis; a secure communication module, including an encryption engine and a key management unit, the encryption engine is used to encrypt and decrypt data entering and exiting the security island; the key management unit is responsible for generating, storing and managing encryption keys; a power management module, including independent power supply and power monitoring, the independent power supply provides independent power supply for the security island, ensuring normal operation when the main power is cut off; power monitoring monitors the power state in real time to prevent power attacks; physical protection mechanisms, including tamper-resistant shell and temperature and voltage sensors, the tamper-resistant shell uses special physical structure and materials to prevent physical attacks and tampering, and the temperature and voltage sensors monitor the physical environment of the chip to prevent environmental attacks.

2. The hardware security island apparatus of a server chip of claim 1, wherein: The security island core module includes the following steps: S1. Security processor, designed with a special instruction set to support advanced encryption standard, elliptic curve encryption commonly used encryption algorithm; the security processor runs in an independent execution environment, isolated from the main processor, to prevent the main processor from being compromised and affecting the operation of the security processor; self-check and verification at startup to ensure that the firmware and code of the security processor have not been tampered with; S2. Secure memory for storing sensitive data, keys and certificates, to ensure that these data are not stolen or tampered with during storage and access; all stored data are encrypted, using a hardware encryption engine for encryption and decryption; strict access control mechanism is adopted, only authorized security processor can access the stored data; the memory uses special physical structure and materials to prevent physical attacks; S3. Secure bus interface, responsible for secure communication between the security island and other modules, uses encryption communication protocol for data transmission to ensure the confidentiality and integrity of data during transmission; identity verification before communication to ensure the identity of both parties is legal; use message authentication code and digital signature technology to ensure data integrity and authenticity.

3. The hardware security island apparatus of a server chip of claim 1, wherein: The security monitoring module includes the following steps: S1. Intrusion detection system monitors the chip's internal operations in real time, detects potential intrusion behavior and abnormal activities, identifies abnormal activities by analyzing the chip's internal operation mode and behavior, detects abnormal memory access mode and abnormal instruction execution sequence; based on predefined rules and strategies, real-time matching and detection are performed; machine learning algorithms are used for behavior modeling and anomaly detection to improve detection accuracy and efficiency; S2. Security audit log, records all security-related operations and events, facilitates subsequent audit and analysis, uses a dedicated log storage area to ensure the security and integrity of log data; all log data is encrypted to prevent tampering or theft; provides log analysis tools to support real-time monitoring and post-audit.

4. The hardware security island apparatus of a server chip of claim 1, wherein: The security communication module includes the following steps: S1. Encryption engine encrypts and decrypts data entering and exiting the security island, ensuring data confidentiality during transmission and storage, using hardware acceleration technology to improve encryption and decryption efficiency; supports multiple encryption algorithms, including but not limited to AES, DES, RSA and ECC, to meet different security needs; encryption engine works closely with key management unit to ensure key security and effectiveness; S2. Key management unit, responsible for generating, storing and managing encryption keys, ensuring key security and effectiveness, using a secure random number generator to generate high-quality keys; keys are stored in secure memory and protected by encryption and access control mechanisms; update keys regularly to prevent key cracking or leakage; destroy keys in a timely manner when not needed to prevent illegal use.

5. The hardware security island apparatus of a server chip of claim 1, wherein: The power management module includes the following steps: S1. Independent power supply, provides independent power supply for the security island, ensuring normal operation when the main power is cut off, designs independent power supply circuit to ensure that the power supply of the security island is not affected by the main power, uses backup power to provide emergency power supply when the main power fails; S2. Power monitoring, real-time monitoring of power status to prevent power attacks and power failures, monitoring power voltage to ensure voltage within a safe range, monitoring power current to detect abnormal current fluctuations; detect power failure and take emergency measures in a timely manner, including but not limited to switching to backup power or shutting down non-critical functions.

6. The hardware security island apparatus of a server chip of claim 1, wherein: The physical protection mechanism includes the following steps: S1. Tamper-proof shell, uses special physical structure and materials to prevent physical attacks and tampering, applies tamper-proof coating on the chip surface to increase the difficulty of physical attacks; uses advanced packaging technology, including but not limited to multi-layer packaging, sealed packaging, to prevent external intrusion; integrates intrusion detection sensors into the tamper-proof shell to detect physical attack behavior; S2. Temperature and voltage sensors monitor the physical environment of the chip to prevent environmental attacks and failures; monitor the operating temperature of the chip to prevent overheating from causing security vulnerabilities; monitor the operating voltage of the chip to prevent voltage fluctuations from causing security failures, detect environmental abnormalities and take protective measures in a timely manner.

7. The hardware security island apparatus of a server chip of claim 6, wherein: The material of the tamper-proof coating in S1 is a conductive polymer or a photosensitive material.

8. The hardware security island apparatus of a server chip of claim 4, wherein: The secure communication module also includes logging and auditing, by recording important events and operations during the communication process, including connection establishment, data transmission and error handling, storing log data in secure memory, and protecting it using encryption and access control mechanisms, providing complete audit tracking, recording all communication-related operations and events, facilitating subsequent audits and investigations, providing complete records of the communication process, facilitating subsequent audits and analysis, and improving the security and traceability of the system.

Images