Security authentication method and system based on FPGA fingerprint features

Abstract

The invention discloses a security authentication method and system based on FPGA fingerprint features, and belongs to the field of information security. The method comprises the following steps: extracting a unique PUF value of an FPGA board card, and combining a user account to generate a ciphertext through a national cipher SM3 algorithm; the authentication process is completely compared and authorized in the FPGA; after authorization, firmware is written into Flash through a ping-pong FIFO mechanism, and an ICAP is used for modifying a starting address loading program. Through software and hardware physical isolation, FPGA internal closed authentication and physical fingerprint binding, the physical attack resistance and management safety of FPGA firmware are effectively improved, and the method has the advantages of extremely high safety, physical isolation defense, closed authentication and the like for server safety management.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a security authentication method and system based on FPGA fingerprint features. Background Technology

[0002] With the rapid development of national smart grid and industrial internet technologies, field-programmable gate arrays (FPGAs) are widely used in power distribution automation terminals and core industrial controllers due to their reconfigurable characteristics. For companies involved in critical infrastructure, FPGA firmware is not only core intellectual property but also the cornerstone of safe equipment operation.

[0003] In current FPGA firmware protection and update technologies, the mainstream solution typically adopts an architecture of "external storage + direct software connection". However, this traditional architecture exposes three fatal security flaws in an increasingly complex cyberattack environment, including:

[0004] First, the key storage mechanism is vulnerable to side-channel attacks. Existing FPGA encryption schemes typically store decryption keys statically in external non-volatile memory (such as SPI Flash) or battery-backed RAM. Security studies have shown that this storage method is highly susceptible to physical side-channel attacks such as differential power analysis (DPA). Attackers can extract the decryption key simply by monitoring the device's electromagnetic radiation or power consumption fluctuations at the moment of power-on decryption, and then clone or tamper with the firmware stored in the external Flash, leading to the leakage of core intellectual property rights.

[0005] Second, there is a lack of protection mechanisms against the physical characteristics of Flash memory. Traditional firmware update solutions lack low-level write operation frequency protection. Because Flash chips have a physical write / erase limit, malicious attackers or uncontrolled viruses can send invalid write / erase commands at high frequency, exhausting the physical lifespan of the Flash memory in a short period of time. This "Flash lifespan exhaustion attack" can cause irreversible physical damage to the hardware, resulting in permanent denial of service.

[0006] Third, the network authentication architecture lacks physical isolation. In traditional application scenarios, client-side host computer software typically connects directly to the server database via TCP / IP network for authentication. This "software-to-server" architecture forces the server port to be exposed, making it highly vulnerable to man-in-the-middle (MITM) attacks or SQL injection. Once the client-side software is cracked or hijacked, attackers can directly penetrate the server's core backend, lacking an effective physical hardware barrier.

[0007] Therefore, there is an urgent need for a fingerprint-based security authentication technology that eliminates the need for external key storage, has hardware gating for Flash write operations, and can effectively isolate the user end from the server end, in order to solve the problems of firmware being easily cloned, hardware being easily damaged, and network architecture being fragile. Summary of the Invention

[0008] The purpose of this invention is to overcome the shortcomings of the prior art and provide a security authentication method and system based on FPGA fingerprint features. By extracting the unique FPGA PUF fingerprint, keyless binding is achieved. A hardware state machine is used to gating and protect Flash write operations. The FPGA is used as a signal processing intermediary to ensure firmware security, which significantly enhances the firmware's ability to resist physical attacks and improves management security.

[0009] The objective of this invention is achieved through the following technical solution: a security authentication method based on FPGA fingerprint features, comprising the following steps:

[0010] S1. The user registers an account through the user terminal, and generates ciphertext A by combining the FPGA's Puf value with the national cryptographic SM3 algorithm, and stores the ciphertext corresponding to the account on the remotely connected server;

[0011] S2. When a user logs in through the client, the FPGA generates ciphertext B based on the user's login password and PFU value, and obtains the ciphertext A corresponding to the user's login account from the server, sends it to the FPGA for comparison, and authorizes the user to log in after successful comparison.

[0012] S3. After authorizing the user to log in, the user can download firmware and manage their account through the user terminal.

[0013] Furthermore, if the comparison between ciphertext A and ciphertext B fails in the FPGA, login will not be authorized, and an "Error" will be displayed on the FPGA board's digital display, awaiting a successful comparison.

[0014] Further, step S1 includes:

[0015] When a user registers through the client, after receiving the ciphertext from the issuer, they enter the ciphertext through the registration login module and register an account and password. The first serial communication interface module transmits the registered account and password to the FPGA. The FPGA extracts its unique PFU value, combines the received password with the PFU value and the national cryptographic SM3 algorithm to generate the ciphertext A corresponding to the account. Then, the account and the corresponding ciphertext A are transmitted to the relay transmission module in the client through the second serial communication interface module. The relay transmission module then transmits the data to the remotely connected server, where the account and the corresponding ciphertext A are stored.

[0016] Further, step S2 includes:

[0017] When a user logs in through the client, they enter their username and password through the registration and login module in the client and send the username and password to the FPGA through the first serial communication interface module. The FPGA finds the username information from the received information, sends it to the client through the first serial communication interface module, and displays it on the client's screen to compare whether the username and password match.

[0018] Then, the FPGA generates ciphertext B based on the password received by the first serial communication interface module, the PFU value, and the national cryptographic SM3 algorithm. At the same time, the FPGA sends the login account entered during login to the server through the second serial communication interface module and the relay transmission module in the user terminal. The server finds the ciphertext A corresponding to the account and feeds it back to the FPGA through the relay transmission module and the second serial communication interface module in the user terminal. The FPGA compares ciphertext A with ciphertext B. If the comparison is successful, the user is authorized to log in.

[0019] Furthermore, in step S3, account management includes:

[0020] After successful authorization login, the server sends all registered accounts to the relay transmission module in the user terminal. The relay transmission module then sends the data to the FPGA via the second serial communication interface module. The FPGA then sends the data to the user terminal via the first serial communication interface module, thereby granting the user terminal account management permissions. The user terminal can then delete and manage the registered accounts.

[0021] Most firmware downloads include:

[0022] In the FPGA, Flash writing operations are performed as follows: After obtaining authorization, the user sends the Flash firmware to be programmed to the FPGA via the third serial communication interface module using the user terminal, and the data flows in and out alternately through the FIFO:

[0023] There are two FIFOs (FIFOA and FIFOB). The FPGA first stores data into one of the FIFOs. If it is not full, it continues to store data into that FIFO. If it is full, the data in that FIFO is written to Flash, and at the same time, data is stored in the other FIFO. This alternating process of data inflow and outflow is called the ping-pong FIFO mechanism.

[0024] The process of writing data from the FIFO to the Flash is as follows:

[0025] The starting address of the Flash memory is modified using Icap, and the Flash memory is written to using QSPI on the FPGA. If the writing is successful, the user terminal will display a message indicating that the download was successful. Then, the FPGA runs the program in the starting address area of ​​the Flash memory to execute the written firmware code.

[0026] Furthermore, the data written to the Flash by the FIFO is a .bin format file.

[0027] Furthermore, a security protection program is added to the Flash memory: an encryption program is pre-written into the running area. If the program fails to run or the user terminates the operation, the power is cut off directly. After restarting, the encryption program will run automatically. Authorization is required each time the system starts to prevent unauthorized malicious operations.

[0028] Furthermore, the management of deleting registered accounts includes:

[0029] After the user client grants account management permissions, if there are multiple registered accounts or accounts with unauthorized writes, the user client sends the account to be deleted to the FPGA. The FPGA then sends the data to the server via the second serial communication interface module and the user client's relay transmission module. The server then locates and deletes the account.

[0030] Furthermore, the registration and login module, firmware loading module, and relay transmission module in the user terminal are implemented by three independently running software programs, and perform data transmission and interaction according to the method described above.

[0031] A security authentication system based on FPGA fingerprint features includes a user terminal, a first serial communication interface module, a second serial communication interface module, a third serial communication interface module, an FPGA, and a server; the user terminal includes a registration and login module, a relay transmission module, and a firmware loading module.

[0032] The user terminal establishes a connection with the FPGA through the first serial port communication module and performs registration, login authentication, and account management based on the registration and login module; the user terminal also establishes a connection with the FPGA through the third serial port communication module and performs Flash firmware programming on the FPGA based on the firmware loading module; the user terminal also establishes a connection with the FPGA through the second serial port communication interface module and performs transmission relay between the server and the FPGA based on the relay transmission module.

[0033] The FPGA is used to extract a unique PFU value. During registration, it receives the account and password input by the user's registration and login module, and generates ciphertext A by combining it with the PFU value. This ciphertext A is then sent to the server for storage via the second serial communication interface module and the relay transmission module in the user terminal. During login, it receives the login account and password sent by the user's registration and login module, and combines them with the extracted PFU value to obtain ciphertext B using the SM3 encryption algorithm. In the FPGA, ciphertext B is compared with ciphertext A of the same account pre-stored in the server. If a match is found, login is authorized; otherwise, authorization is denied. During the programming process, the data stream is stored in a FIFO and written to the Flash using QSPI, enabling reading and writing of the Flash and execution of the firmware program.

[0034] The server receives the account and corresponding ciphertext sent by the FPGA through the second serial port communication interface module and the relay transmission module of the user terminal, stores them on the server, modifies the account password information stored on the server according to the information sent by the FPGA module, and sends the server account and ciphertext information to the FPGA module.

[0035] Furthermore, the first serial communication interface module, the second serial communication interface module, and the third serial communication interface module are connected to the user terminal via a serial communication cable; the first serial communication interface module, the second serial communication interface module, and the third serial communication interface module are connected to the FPGA via a UART driver module.

[0036] The system also includes an LED digital tube display module, which is used to display the FPGA status and monitor the FPGA operation in real time.

[0037] The beneficial effects of this invention are: 1. Resistance to side-channel attacks and cloning: This invention extracts the PUF value of each FPGA motherboard, and the PUF of each board is unique. Using a high-efficiency glitch PUF value as the encryption benchmark, and combining it with the domestic SM3 algorithm, a key is generated in real time inside the chip. The key is not stored locally, thus eliminating physical side-channel attacks and firmware cloning at the source, resulting in greater stability, efficiency, and lower resource consumption.

[0038] 2. Flash Lifespan Protection and PDoS Attack Resistance: This invention innovatively introduces a hardware gating mechanism for Flash write operations. Only after successful authentication is the FPGA's internal state machine activated for writing, effectively blocking high-frequency erase / write attempts by malicious scripts in an unauthorized state, preventing the Flash's physical lifespan from being exhausted (PDoS attack), and significantly extending the device's lifespan.

[0039] 3. Physically Isolated Security Architecture: Both the user software and server software in this invention are independently designed and are not directly connected, neither physically nor non-physically; all connections must be relayed through FPGA hardware. This "air gap" defense layer prevents malicious actors from using the FPGA board and user software to attack and damage the server software or steal information.

[0040] 4. Closed Authentication and Data Security: This invention performs encrypted text comparison and matching within the FPGA, preventing malicious attacks on the server during the comparison process. Registered account password information is stored separately using a unique PFU value for each FPGA board. After gaining account access, the user can only manage and delete accounts registered on that FPGA board and cannot view the corresponding encrypted text, thus increasing the effectiveness of security authentication.

[0041] 5. High-efficiency writing and dynamic operation: This invention uses a ping-pong FIFO, with data flowing in and out alternately, ensuring fast data file writing to Flash and saving resources. Simultaneously, it dynamically modifies the Flash boot address through the ICAP interface, combined with a mechanism to restore the encryption program upon power failure and restart, ensuring that each boot is in a controlled and protected state. Attached Figure Description

[0042] Figure 1 This is a flowchart illustrating the FPGA security authentication process according to an embodiment of the present invention.

[0043] Figure 2 This is a system structure diagram in an embodiment of the present invention.

[0044] Figure 3 This is a diagram illustrating the Flash data writing operation in an embodiment of the present invention.

[0045] Figure 4 This is a flowchart illustrating the process of deleting an account in an embodiment of the present invention. Detailed Implementation

[0046] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings, but the scope of protection of the present invention is not limited to the following description.

[0047] To further illustrate the technical means adopted by the present invention to achieve the intended purpose, the specific embodiments, structure and effects of the present invention will be described in more detail below with reference to the accompanying drawings. However, the scope of protection of the present invention is not limited to the following description.

[0048] Reference Figure 1 A security authentication method based on FPGA fingerprint features includes the following steps:

[0049] S1. The user registers an account through the user terminal, and generates ciphertext A by combining the FPGA's Puf value with the national cryptographic SM3 algorithm, and stores the ciphertext corresponding to the account on the remotely connected server;

[0050] S2. When a user logs in through the client, the FPGA generates ciphertext B based on the user's login password and PFU value, and obtains the ciphertext A corresponding to the user's login account from the server, sends it to the FPGA for comparison, and authorizes the user to log in after successful comparison.

[0051] S3. After authorizing the user to log in, the user can download firmware and manage their account through the user terminal.

[0052] In one embodiment of the present invention, a fingerprint-based security authentication technology is provided, comprising the following steps: when a user registers using the user-end software, after obtaining the publisher's registration key, the user enters the registration key in the registration login module to register an account and password, and sends the account and password to the FPGA using the first serial port communication module. The FPGA extracts its own unique PFU value, combines the password entered by the user with the PFU value and the national cryptographic SM3 algorithm to generate the ciphertext A corresponding to this account, and then connects the account and the corresponding ciphertext A to the user-end relay transmission module using the second serial port communication module, and then stores them to the server via TCP remote connection.

[0053] In this embodiment, it should be understood that the steps in the above processes are executed sequentially, but if there is a reasonable logical adjustment, they can also be executed in other orders. Furthermore, each step is not necessarily completed at the same time, and can be executed alternately or in turn with some parts of other steps depending on the actual situation.

[0054] In embodiments of this application, the system also includes a power supply module for supplying power to the FPGA and the LED digital tube display module.

[0055] In a specific embodiment, refer to Figure 2 The user terminal includes a registration and login module, a relay transmission module, and a firmware loading module. The first serial communication interface module (serial port A), the second serial communication interface module (serial port B), and the third serial communication interface module (serial port C) are connected to the user terminal via serial communication cables. The first serial communication interface module, the second serial communication interface module, and the third serial communication interface module are connected to the FPGA via a UART driver module.

[0056] In a specific embodiment, when a user logs in through the user terminal, they enter their account and password based on the registration and login module in the user terminal, and send the account and password to the FPGA through the first serial communication interface module. The FPGA finds the account information from the received information, sends it to the user terminal through the first serial communication interface module, and displays it on the display screen of the user terminal to compare whether the account matches.

[0057] Then, the FPGA generates ciphertext B based on the password received by the first serial communication interface module, the PFU value, and the national cryptographic SM3 algorithm. At the same time, the FPGA sends the login account entered during login to the server through the second serial communication interface module and the relay transmission module in the user terminal. The server finds the ciphertext A corresponding to the account and feeds it back to the FPGA through the relay transmission module and the second serial communication interface module in the user terminal. The FPGA compares ciphertext A with ciphertext B. If the comparison is successful, the user is authorized to log in.

[0058] Furthermore, in step S3, account management includes:

[0059] After successful authorization login, the server sends all registered accounts to the relay transmission module in the user terminal. The relay transmission module then sends the data to the FPGA via the second serial communication interface module. The FPGA then sends the data to the user terminal via the first serial communication interface module, thereby granting the user terminal account management permissions. The user terminal can then delete and manage the registered accounts.

[0060] Most firmware downloads include:

[0061] In the FPGA, Flash writing operations are performed as follows: After obtaining authorization, the user sends the Flash firmware to be programmed to the FPGA via the third serial communication interface module using the user terminal, and the data flows in and out alternately through the FIFO:

[0062] There are two FIFOs. The FPGA first stores data into one of the FIFOs. If it is not full, it continues to store data into that FIFO. If it is full, the data in that FIFO is written to Flash, and at the same time, data is stored in the other FIFO. This alternating process of data inflow and outflow is called the ping-pong FIFO mechanism.

[0063] The process of writing data from the FIFO to the Flash is as follows:

[0064] The starting address of the Flash memory is modified using Icap, and the Flash memory is written to using QSPI on the FPGA. If the writing is successful, the user terminal will display a message indicating that the download was successful. Then, the FPGA runs the program in the starting address area of ​​the Flash memory to execute the written firmware code.

[0065] In a specific embodiment, refer to Figure 3 After successful authorization and login, when serial port C performs data transmission alternately in the FIFO, it needs to ensure that a certain FIFO is not full. If it is not full, data is continuously stored in that FIFO; if it is full, the data in that FIFO is written to Flash, and data is stored in another FIFO at the same time. If the transmission is successful, the data transmission ends; if the transmission is unsuccessful, the data transmission is restarted.

[0066] In a specific embodiment, refer to Figure 4 After obtaining account management permissions, users can select and delete registered accounts in the client software. After clicking delete, the client software sends the account to the FPGA. The FPGA needs to check whether it is in an authorized state to prevent the software from sending the account maliciously. If it is not authorized, an error will be reported and the digital tube will display "Error" and return to the initial waiting state. If it is already authorized, the user and the extracted PFU value will be sent to the server. The server will find the account and delete it from the server.

[0067] The above embodiments are preferred embodiments of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in other combinations, modifications, and environments, and can be modified within the scope of the concept described herein through the above teachings or related technologies or knowledge. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A security authentication method based on FPGA fingerprint features, characterized in that: Includes the following steps: S1. The user registers an account through the user terminal, and generates ciphertext A by combining the FPGA's Puf value with the national cryptographic SM3 algorithm, and stores the ciphertext corresponding to the account on the remotely connected server; S2. When a user logs in through the client, the FPGA generates ciphertext B based on the user's login password and PFU value, and obtains the ciphertext A corresponding to the user's login account from the server, sends it to the FPGA for comparison, and authorizes the user to log in after successful comparison. S3. After authorizing the user to log in, the user can download firmware and manage their account through the user terminal.

2. The security authentication method based on FPGA fingerprint features according to claim 1, characterized in that: If the comparison between ciphertext A and ciphertext B fails in the FPGA, login will not be authorized, and an "Error" will be displayed on the FPGA board's digital display, waiting for a successful comparison.

3. The security authentication method based on FPGA fingerprint features according to claim 1, characterized in that: Step S1 includes: When a user registers through the client, after receiving the ciphertext from the issuer, they enter the ciphertext through the registration login module and register an account and password. The first serial communication interface module transmits the registered account and password to the FPGA. The FPGA extracts its unique PFU value, combines the received password with the PFU value and the national cryptographic SM3 algorithm to generate the ciphertext A corresponding to the account. Then, the account and the corresponding ciphertext A are transmitted to the relay transmission module in the client through the second serial communication interface module. The relay transmission module then transmits the data to the remotely connected server, where the account and the corresponding ciphertext A are stored.

4. The security authentication method based on FPGA fingerprint features according to claim 1, characterized in that: Step S2 includes: When a user logs in through the client, they enter their username and password through the registration and login module in the client and send the username and password to the FPGA through the first serial communication interface module. The FPGA finds the username information from the received information, sends it to the client through the first serial communication interface module, and displays it on the client's screen to compare whether the username and password match. Then, the FPGA generates ciphertext B based on the password received by the first serial communication interface module, the PFU value, and the national cryptographic SM3 algorithm. At the same time, the FPGA sends the login account entered during login to the server through the second serial communication interface module and the relay transmission module in the user terminal. The server finds the ciphertext A corresponding to the account and feeds it back to the FPGA through the relay transmission module and the second serial communication interface module in the user terminal. The FPGA compares ciphertext A with ciphertext B. If the comparison is successful, the user is authorized to log in.

5. The security authentication method based on FPGA fingerprint features according to claim 1, characterized in that: In step S3, account management includes: After successful authorization login, the server sends all registered accounts to the relay transmission module in the user terminal. The relay transmission module then sends the data to the FPGA via the second serial communication interface module. The FPGA then sends the data to the user terminal via the first serial communication interface module, thereby granting the user terminal account management permissions. The user terminal can then delete and manage the registered accounts. Most firmware downloads include: In the FPGA, Flash writing operations are performed as follows: After obtaining authorization, the user sends the Flash firmware to be programmed to the FPGA via the third serial communication interface module using the user terminal, and the data flows in and out alternately through the FIFO: There are two FIFOs. The FPGA first stores data into one of the FIFOs. If it is not full, it continues to store data into that FIFO. If it is full, the data in that FIFO is written to Flash, and at the same time, data is stored in the other FIFO. The data flow in and out is alternately implemented. The process of writing data from the FIFO to the Flash is as follows: The starting address of the Flash memory is modified using Icap, and the Flash memory is written to using QSPI on the FPGA. If the writing is successful, the user terminal will display a message indicating that the download was successful. Then, the FPGA runs the program in the starting address area of ​​the Flash memory to execute the written firmware code.

6. The security authentication method based on FPGA fingerprint features according to claim 1, characterized in that: The data written to the Flash by the FIFO is a .bin file.

7. The security authentication method based on FPGA fingerprint features according to claim 1, characterized in that: A security protection program is added to the Flash memory: an encryption program is pre-written into the running area. If the program fails to run or the user terminates the operation, the power is cut off directly. After restarting, the encryption program will run automatically. Authorization is required each time the system starts to prevent unauthorized malicious operations.

8. The security authentication method based on FPGA fingerprint features according to claim 5, characterized in that: The management of deleting registered accounts includes: After the user client grants account management permissions, if there are multiple registered accounts or accounts with unauthorized writes, the user client sends the account to be deleted to the FPGA. The FPGA then sends the data to the server via the second serial communication interface module and the user client's relay transmission module. The server then locates and deletes the account.

9. A security authentication system based on FPGA fingerprint features, employing the method described in any one of claims 1 to 8, characterized in that: It includes a user terminal, a first serial communication interface module, a second serial communication interface module, a third serial communication interface module, an FPGA, and a server; the user terminal includes a registration and login module, a relay transmission module, and a firmware loading module; The user terminal establishes a connection with the FPGA through the first serial port communication module and performs registration, login authentication, and account management based on the registration and login module; the user terminal also establishes a connection with the FPGA through the third serial port communication module and performs Flash firmware programming on the FPGA based on the firmware loading module; the user terminal also establishes a connection with the FPGA through the second serial port communication interface module and performs transmission relay between the server and the FPGA based on the relay transmission module. The FPGA is used to extract a unique PFU value; during registration, it receives the account and registration password input by the user terminal registration and login module, and combines them with the PFU value to generate ciphertext A, which is then sent to the server for storage through the second serial port communication interface module and the relay transmission module in the user terminal; during login, it receives the login account and password sent by the user terminal registration and login module, combines them with the extracted PFU value, and uses the SM3 encryption algorithm to obtain ciphertext B. In the FPGA, the ciphertext B is compared with the ciphertext A of the same account pre-stored in the server. If the match is successful, login is authorized; otherwise, authorization is denied. During the programming process, the data stream is stored in the FIFO and written to the Flash using QSPI, realizing the reading and writing of the Flash and the execution of the firmware program. The server receives the account and corresponding ciphertext sent by the FPGA through the second serial port communication interface module and the relay transmission module of the user terminal, stores them on the server, modifies the account password information stored on the server according to the information sent by the FPGA module, and sends the server account and ciphertext information to the FPGA module.

10. A security authentication system based on FPGA fingerprint features according to claim 9, characterized in that: The first serial communication interface module, the second serial communication interface module, and the third serial communication interface module are connected to the user terminal via serial communication cables; the first serial communication interface module, the second serial communication interface module, and the third serial communication interface module are connected to the FPGA via a UART driver module. The system also includes an LED digital tube display module, which is used to display the FPGA status and monitor the FPGA operation in real time.

Images