A physical attack resistant intranet specific encryption keyboard and method of controlling the same

Abstract

The application relates to the technical field of information encryption, in particular to a physical attack-resistant intranet special encryption keyboard and a control method thereof. The keyboard comprises a key matrix module for collecting physical key triggering data of a user; a microcontroller which is internally provided with an encryption operation module, a hardware locking module and an on-chip non-volatile memory storing key input permission configuration; wherein the encryption operation module is used for key confirmation of an accessed host; the hardware locking module is used for locking a burning interface of the microcontroller when the key confirmation is passed; the microcontroller is used for comparing the physical key triggering data with the key input permission configuration to convert the physical key triggering data into encrypted messages; and a communication interface module is used for uploading the encrypted messages to the host. Compared with the prior art, the intranet special encryption keyboard provided by the application has higher security.

Description

Technical Field

[0001] This invention relates to the field of information encryption technology. More specifically, this invention relates to a dedicated encrypted keyboard for intranets that is resistant to physical attacks, and its control method. Background Technology

[0002] In highly secure intranet environments, customized dedicated keyboards are often used to restrict user input permissions. Existing keyboard input control largely focuses on software-level permission allocation and encrypted data transmission, neglecting to construct physical layer protection barriers for the keyboard hardware itself. This results in the following drawbacks of such keyboards: Firstly, the existing keyboard hardware architecture typically uses a microcontroller + external Flash chip architecture, which lacks a hardware-level encryption mechanism. Attackers can use a logic analyzer to wiretap bus data and thus obtain plaintext key mappings.

[0003] Secondly, once the keyboard casing is opened, the debugging interface and test contacts are directly exposed. Attackers can connect a hardware programmer to these interfaces / contacts to read the firmware code, keys, or permission configuration information inside the keyboard. They can then use the read firmware code, keys, or permission configuration to flash a hardware Trojan, thus using it as a covert channel to remotely control the computer. This type of information theft by hardware Trojans is almost impossible to circumvent at the software level, posing a significant threat to information security.

[0004] Therefore, the main problem with existing technologies is poor security. Summary of the Invention

[0005] To address the aforementioned security issues, this invention discloses a dedicated encrypted keyboard for intranets that is resistant to physical attacks, and its control method.

[0006] In a first aspect, the present invention discloses a dedicated encrypted keyboard for intranets that is resistant to physical attacks, comprising: The button matrix module is used to collect the user's physical button trigger data; The microcontroller integrates an encryption module, a hardware locking module, and on-chip non-volatile memory storing key input permission configurations. The encryption module verifies the key from the connected host. The hardware locking module locks the microcontroller's programming interface upon successful key verification. The microcontroller compares physical key trigger data with the key input permission configuration to convert it into encrypted messages. The communication interface module is used to upload encrypted messages to the host.

[0007] Beneficial Effects: The keyboard provided by this invention integrates an encryption module, a hardware locking module, and on-chip non-volatile memory within a microcontroller. The encryption module verifies the key of the connected host, ensuring the keyboard's secure connection as a peripheral device and preventing firmware access fraud. The hardware locking module locks the microcontroller's programming interface upon successful key verification, preventing modification, reset, and reading of the microcontroller's configuration. Attackers cannot connect a hardware programmer to these interfaces / contacts to read the keyboard's internal firmware code, keys, or permission configuration information. After the microcontroller's programming interface is locked, the microcontroller compares the physical key trigger data with the key input permission configuration to convert it into encrypted messages, which are then transmitted to the host via the communication interface module. The entire message communication process is uninterruptible and automatically filters out unauthorized input, resulting in higher security. Compared to existing technologies, the intranet-specific encrypted keyboard provided by this invention offers significantly higher security.

[0008] Preferably, it also includes an operation logging module, which is used to convert physical button trigger data into logging messages and upload them to the audit log.

[0009] Preferably, it also includes a casing protection switch, which is located inside the dedicated encrypted keyboard for the intranet; The microcontroller is equipped with a switch detection pin connected to the housing protection switch to clear the key and its cached data when the switch is in the released state.

[0010] Preferably, the communication interface module adopts a wired serial communication interface.

[0011] Preferably, it also includes an insulating sealant layer covering the surface of the microcontroller.

[0012] Secondly, the present invention also discloses a method for controlling a physical attack-resistant encrypted keyboard for intranet use, for the physical attack-resistant encrypted keyboard for intranet use described in the first aspect, comprising: In response to the communication interface module connecting to the host, the host performs key verification; In response to successful key verification, the microcontroller's programming interface is locked; Collect data triggered by the user's physical buttons; The physical button trigger data is compared with the button input permission configuration to convert it into an encrypted message; Upload the encrypted message to the host.

[0013] Preferably, locking the microcontroller's programming interface includes: Write a lock instruction to the microcontroller's security configuration register; Configure the pin function corresponding to the programming interface to be disabled.

[0014] Preferably, key verification of the host includes: Send a dynamic verification random number to the host; Receive authentication response data packets generated based on dynamically verified random numbers, and derive temporary session keys for valid response periods using the authentication response data packets; Send the temporary session key to the access host for verification; If a verification receipt is received from the host, the key is considered to have been successfully verified.

[0015] Preferably, the physical button trigger data is compared with the button input permission configuration, including: Read key input permission configuration; Decrypt the key input permission configuration and map it to a whitelist dictionary; Analyze the physical button trigger data and extract the corresponding current button feature value; The current key press feature value is entered into the whitelist dictionary for comparison; If the comparison matches, the current physical button is determined to be compliant; If the comparison fails, discard the physical button trigger data and clear the cache of the current button feature value.

[0016] Preferably, the current key feature value is entered into a whitelist dictionary for comparison, including: Obtain the starting base address of the whitelist dictionary in static random access memory; Mask the current key feature value to generate a memory address offset; The starting base address is superimposed with the memory addressing offset, and the target memory address is located at a constant clock cycle. The permission status bits stored in the target memory address are then read. If the permission status bit is a pass level signal, it is determined that the comparison has been successful.

[0017] The beneficial effects of this invention are as follows: (1) Compared with the prior art, the present invention provides a dedicated encrypted keyboard for intranet with key verification, whitelist key comparison and interface locking functions, which has stronger security.

[0018] (2) Compared with the prior art, the method of the present invention introduces a two-way identity authentication strategy based on random numbers, which can achieve accurate and secure hardware authentication.

[0019] (3) Compared with the prior art, the method of the present invention introduces dictionary offset addressing, which can effectively prevent memory overflow attacks and further enhance the security of the present invention. Attached Figure Description

[0020] The above and other objects, features, and advantages of exemplary embodiments of the present invention will become readily apparent upon reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of the invention are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein: Figure 1 This is a schematic diagram of the structure of the intranet-specific encrypted keyboard that is resistant to physical attacks in Embodiment 1 of the present invention; Figure 2 This is a flowchart of the intranet-specific encrypted keyboard control method for preventing physical attacks in Embodiment 2 of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0023] Example 1 like Figure 1 As shown in the figure, this embodiment discloses a dedicated encrypted keyboard for intranets that is resistant to physical attacks, including a key matrix module, a microcontroller, and a communication interface module.

[0024] The key matrix module is used to collect physical key press data from the user. In this embodiment, the key matrix module refers to the key matrix scanning circuit, keyboard sensing membrane, and keycaps as a whole. This key matrix module is a component found in most conventional keyboards and will not be described in detail here.

[0025] In this embodiment, the microcontroller is a 32-bit MCU, which supports encryption algorithms, code read protection, and original factory basic configuration. Furthermore, the microcontroller integrates an encryption operation module, a hardware locking module, and on-chip non-volatile memory (Flash). The encryption operation module and the hardware locking module are both firmware program scripts, while the on-chip non-volatile memory is hardware with storage capabilities, pre-storing key input permission configurations. The key input permission configuration is a constraint on physical key trigger data, specifying the allowed single key inputs and combinations of multiple keys.

[0026] More specifically, the encryption module is used to verify the key of the connected host. The hardware locking module is used to lock the microcontroller's programming interface when the key verification is successful. Once locked, it requires a device key provided by the manufacturer to unlock. The microcontroller is used to compare the physical button trigger data with the button input permission configuration to convert it into encrypted messages.

[0027] As for the communication interface module, in this embodiment, it is a wired serial communication interface based on the USB 2.0 standard HID keyboard protocol, which has security features that wireless communication connections such as Bluetooth or WiFi do not have.

[0028] Through the above technical solution, the intranet-specific encrypted keyboard provided in this embodiment integrates three core components—an encryption processing module, a hardware locking module, and on-chip non-volatile memory—into a microcontroller, constructing a multi-dimensional security protection system. The encryption processing module, through bidirectional key verification with the host, can accurately verify the identity of peripheral devices, establishing a robust hardware anti-counterfeiting defense from the source of access and preventing unauthorized devices from entering the intranet. Once the key verification is successful, the hardware locking module immediately activates, physically locking the microcontroller's programming interface, completely blocking the connection path of the external programmer. This prevents the core data such as the keyboard's firmware code, key information, and permission configurations from being read, modified, or reset, effectively sealing off attackers' channels of theft at the hardware level. After the interface is locked, the keyboard will enter normal working state: the data triggered by the physical keys will first be compared with the preset key input permission configuration. Illegal inputs will be automatically filtered out, and compliant data will be converted into encrypted messages and securely transmitted to the host through the communication interface module. The entire process is encrypted and cannot be intercepted, building a full-chain security barrier for intranet data interaction from access to transmission. Compared with traditional keyboards, the security performance has been qualitatively improved, making it very suitable for portable legal / police law enforcement terminals.

[0029] Preferably, the microcontroller also incorporates an operation logging module, which is also a type of script execution. It primarily backs up the original physical button trigger data, converts the physical button trigger data into logging messages, and uploads them to the audit log. After uploading the logging messages to the audit log, it clears the cache of the backup data, thereby releasing memory.

[0030] With the above technical solution, any key presses made by an operator will be uploaded to the audit log, which will facilitate the tracing of the operator's responsibility.

[0031] Furthermore, to enhance hardware-level security, in this embodiment, the internal encrypted keyboard also incorporates a housing protection switch. The microcontroller is equipped with a switch detection pin connected to the housing protection switch to clear the key and its cached data when the switch is in the released state.

[0032] Furthermore, the aforementioned enclosure protection switch can be a resettable limit switch or an infrared switch for detecting presence or absence.

[0033] By setting up the above-mentioned anti-tampering keyboard scheme, the security of the intranet-specific encrypted keyboard in this embodiment is further improved. Once the keyboard shell is removed, the irreversible key and cache will be automatically deleted, making it impossible for attackers to obtain any useful information.

[0034] Furthermore, to protect the microcontroller from programming and signal interference, this embodiment also covers the surface of the microcontroller and its peripheral circuits with an insulating sealant layer. Epoxy sealant is preferred due to its high adhesion, waterproof properties, strong electrical insulation, corrosion resistance, and high thermal conductivity. When an attacker creates an opening in the casing using special methods, resetting or modifying the microcontroller requires scraping off the insulating sealant layer. However, given the high adhesion of epoxy sealant, scraping off the layer often causes irreversible damage to the microcontroller. This sealant application method further enhances the security of the intranet-specific encrypted keyboard in this embodiment.

[0035] Example 2 like Figure 2 As shown, this embodiment discloses a method for controlling a dedicated encrypted keyboard for intranets that is resistant to physical attacks, used for the dedicated encrypted keyboard for intranets that is resistant to physical attacks described in Embodiment 1. The aforementioned method for controlling a dedicated encrypted keyboard for intranets that is resistant to physical attacks includes: S10: In response to the communication interface module accessing the host, perform key verification on the host.

[0036] In this embodiment, after the keyboard's USB interface is connected to the host, the host initiates two-way key authentication. Specifically, step S10 includes: S11: Send a dynamic verification random number to the host.

[0037] Specifically, when the microprocessor receives an authentication request, it first retrieves its own SN (Signature Number), then uses its built-in random number generator to generate a random number. Finally, it concatenates the SN and the random number to obtain a dynamically verified random number, which is then sent to the host. This completes the first encrypted transmission of information from the keyboard to the host.

[0038] S12: Receive the authentication response data packet generated based on the dynamic verification random number, and derive the temporary session key for the valid response period using the authentication response data packet.

[0039] Specifically, after receiving the aforementioned dynamically verified random number, the host parses the feature data of the random number and concatenates the host's root key with the feature data segment to obtain an authentication response data packet, which is then returned to the microprocessor. The microprocessor then creates a valid response period to constrain the validity period of the two-way key authentication, and assigns a validity period to the authentication response data packet, forming a temporary session key which is returned to the host. In this way, the second encrypted information transmission from the keyboard to the host is completed, and a two-way encrypted authentication period is assigned, further improving the security of the method in this embodiment.

[0040] S13: Send the temporary session key to the access host for verification.

[0041] It should be explained that during the verification process, the host first performs a hash calculation on the authentication response data packet to generate a first hash value of fixed length. When the temporary session key is returned, it performs another hash calculation on the temporary session key to generate a second hash value of the same fixed length. Then, a similarity or consistency calculation is performed on the first and second hash values. If the similarity is higher than a threshold or the two are identical, the verification is considered successful, and a success receipt is returned to the microcontroller.

[0042] S14: If a verification receipt is received from the host, the key is deemed to have been successfully verified.

[0043] Through steps S11-S14 above, the method of this embodiment realizes two-way key authentication based on hash calculation, and utilizes the "avalanche effect" of multiple encrypted transmission and hash calculation to achieve highly secure hardware identity authentication.

[0044] S20: In response to successful key verification, lock the microcontroller's programming interface.

[0045] Furthermore, step S20 above includes: S21: Write a lock instruction to the microcontroller's security configuration register.

[0046] It should be noted that the above locking command includes the currently confirmed key and the command to disable operation. After writing the locking command to the above security configuration register, it can only be unlocked by entering the correct key or returning to factory reset.

[0047] S22: Configure the pin function corresponding to the programming interface to be disabled.

[0048] When the above programming interface is configured to be disabled, it is impossible to read information or write data through pin multiplexing via external access methods.

[0049] Through the above steps S21-S22, the method of this embodiment achieves hardware-level key locking. Once locked, attackers are completely unable to wiretap bus data through the logic analyzer, thus providing higher security.

[0050] S30: Collects data triggered by the user's physical buttons.

[0051] It should be noted that the process of collecting physical key trigger data described above is no different from the method of collecting data using a matrix scanning circuit on a regular physical keyboard, and will not be elaborated further here.

[0052] S40: Compare the physical button trigger data with the button input permission configuration to convert it into an encrypted message.

[0053] Specifically, step S40 includes: S41: Read key input permission configuration.

[0054] In this embodiment, the aforementioned key input permission configuration is similar to a whitelist pre-stored in the on-chip non-volatile memory. It restricts the input of individual keys or shortcut key combinations. Taking individual keys as an example, "Delete" or "PrtSc" can be pre-configured to disable input to prevent the operator from performing deletion or screenshot operations. Taking key combinations as an example, "Alt+F4" or "Alt+A+Delete" can be pre-configured to disable input to prevent the operator from performing system shutdown or batch deletion operations.

[0055] S42: Decrypt the key input permission configuration and map it to a whitelist dictionary.

[0056] It should be explained that the whitelist dictionary mentioned above is a data structure used to define a set of keys that are allowed to be input or operated. It is stored in the form of key-value pairs, where the key represents a specific key identifier (such as a character, number, or function key), and the value indicates whether the key is allowed to be used.

[0057] For example, the above key input permission configuration can be: key_whitelist = { 'a': True, 'b': True, 'c': True, '1': True, '2': True, '3': True, 'Enter': True, 'Space': True } In one embodiment, based on the above key input permission configuration, the whitelist dictionary also needs to pre-configure input mode determination for each supported key, which can be: self.whitelist_dict = { 'single_click':{'high_ratio':0.2,'rise_count':1,'fall_count':1,'max_high_duration': 0.2}, 'double_click':{'high_ratio':0.3,'rise_count':2,'fall_count':2,'max_high_duration': 0.17} 'long_click':{'high_ratio':0.4,'rise_count':3,'fall_count':3,'max_high_duration': 0.20} } S43: Parse the physical button trigger data and extract the corresponding current button feature value.

[0058] It should be explained that when a user presses a key, there may be accidental touches, single keystrokes, continuous keystrokes, and long presses. To avoid keyboard flooding that could trigger buffer overflow vulnerabilities, causing performance bottlenecks in the logging system and ultimately leading to audit monitoring failure, this embodiment requires that feature extraction simultaneously with key recognition, including the percentage of high-level events, the number of rising / falling edges, and the longest continuous high-level duration. Then, a long press (long_click) is restricted to prevent input.

[0059] S44: Input the current key feature value into the whitelist dictionary for comparison.

[0060] In one embodiment, the compliance of the input can be initially confirmed by the truth value confirmation table in the whitelist dictionary. Then, the memory addressing calculation of the current key feature value is performed using the Euclidean distance algorithm, and the calculation result is compared with the above-mentioned mode determination configuration.

[0061] For example, its script execution segment is as follows: / / Iterate through each pattern in the whitelist for pattern_name, pattern_features in self.whitelist_dict.items(): / / Calculate the Euclidean distance between the current feature and the whitelisted features. distance = 0 for key in ['high_ratio', 'rise_count', 'fall_count', 'max_high_duration']: if key in features and key in pattern_features: distance += (features[key] - pattern_features[key]) 2 distance = distance 0.5 / / Find the nearest pattern if distance <min_distance: min_distance = distance matched_pattern = pattern_name return matched_pattern, min_distance S45: If the comparison is successful, the current physical button is determined to be compliant.

[0062] Specifically, if the key input matched in the truth value confirmation table is true, and the distance of the value calculated by the Euclidean distance algorithm is closest to the "single tap" or "continuous tap" mode, then the current physical key is determined to be compliant.

[0063] S46: If the comparison fails, discard the physical button trigger data and clear the cache of the current button feature value.

[0064] Through the above steps S41-S46, the method of this embodiment achieves compliant key input control based on a whitelist dictionary, which can prevent malicious input operations by internal personnel and further improve the security of the method of this embodiment.

[0065] Preferably, in addition to the above-described calculation and comparison method based on the Euclidean distance algorithm, in another embodiment, step S44 can also be: S441: Get the starting base address of the whitelist dictionary in static random access memory.

[0066] S442: Mask the current key feature value to generate a memory address offset.

[0067] S443: Superimpose the starting base address with the memory addressing offset, locate the target memory address with a constant clock cycle, and read the permission status bit stored in the target memory address.

[0068] S444: If the permission status bit is a pass level signal, it is determined that the comparison has been successful.

[0069] It should be explained that, compared to the Euclidean distance calculation comparison method, the key feature value comparison method based on memory addressing has significant advantages in terms of execution efficiency, hardware resource consumption, real-time performance, and anti-interference capability in steps S441-S444. Specifically, it can complete memory access with a fixed clock cycle, making it suitable for resource-constrained embedded systems, such as older devices in organizations with high information security requirements.

[0070] S50: Upload the encrypted message to the host.

[0071] Specifically, after the above key input is successful, the physical key trigger data is converted into a message packaged and uploaded to the host through a hash algorithm or national cryptographic algorithm.

[0072] Through the above steps S10-S50, the method of this embodiment constructs a dual hardware-level security constraint mechanism of "external confidentiality" + "internal constraint", which has higher security. Moreover, the process from key input to message conversion and uploading takes less than 10 milliseconds, which is far below the human perception threshold (100 milliseconds), and can ensure security performance without destroying the user's key input latency experience.

[0073] In the description of this specification, "multiple" means at least two, such as two, three or more, etc., unless otherwise expressly and specifically defined.

[0074] While this specification has shown and described numerous embodiments of the invention, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will occur to those skilled in the art without departing from the spirit and essence of the invention. It should be understood that various alternatives to the embodiments of the invention described herein may be employed in the practice of this invention.

Claims

1. A physical attack-resistant encrypted keyboard for intranet use, characterized in that, include: The button matrix module is used to collect the user's physical button trigger data; The microcontroller includes a built-in encryption module, a hardware locking module, and on-chip non-volatile memory storing key input permission configurations. The encryption module verifies the key of the connected host. The hardware locking module locks the microcontroller's programming interface upon successful key verification. The microcontroller compares the physical key trigger data with the key input permission configuration to convert it into an encrypted message. A communication interface module is used to upload the encrypted message to the host. The physical button trigger data is compared with the button input permission configuration, including: Read key input permission configuration; Decrypt the key input permission configuration and map it to a whitelist dictionary; Analyze the physical button trigger data and extract the corresponding current button feature value; The current key feature value is input into the whitelist dictionary for comparison; If the comparison matches, the current physical button is determined to be compliant; If the comparison fails, the physical button trigger data is discarded and the cache of the current button feature value is cleared. The current key feature value is input into the whitelist dictionary for comparison, including: Obtain the starting base address of the whitelist dictionary in static random access memory; The current key feature value is masked to generate a memory address offset; The starting base address is superimposed with the memory addressing offset, and the target memory address is located at a constant clock cycle. The permission status bit stored in the target memory address is then read. If the permission status bit is a pass level signal, then the comparison is determined to be a match.

2. The intranet-specific encrypted keyboard for preventing physical attacks according to claim 1, characterized in that, It also includes an operation logging module, which converts the physical button trigger data into logging messages and uploads them to the audit log.

3. The intranet-specific encrypted keyboard for preventing physical attacks according to claim 1, characterized in that, It also includes a casing protection switch, located inside the dedicated encrypted keyboard for the intranet; The microcontroller is equipped with a switch detection pin connected to the housing protection switch to clear the key and its cached data when the switch is in the released state.

4. The intranet-specific encrypted keyboard for preventing physical attacks according to claim 1, characterized in that, The communication interface module adopts a wired serial communication interface.

5. The intranet-specific encrypted keyboard for preventing physical attacks according to claim 1, characterized in that, It also includes an insulating sealant layer covering the surface of the microcontroller.

6. A method for controlling a dedicated encrypted keyboard on an intranet to prevent physical attacks, characterized in that, The intranet-specific encrypted keyboard for physical attack protection as described in any one of claims 1-5 includes: In response to the communication interface module accessing the host, the host performs key verification; In response to successful key verification, the microcontroller's programming interface is locked; Collect data triggered by the user's physical buttons; The physical button trigger data is compared with the button input permission configuration to convert it into an encrypted message; The encrypted message is uploaded to the host.

7. The intranet-specific encrypted keyboard control method for preventing physical attacks according to claim 6, characterized in that, Locking the microcontroller's programming interface includes: Write a lock instruction to the security configuration register of the microcontroller; Configure the pin functions corresponding to the programming interface to be disabled.

8. The intranet-specific encrypted keyboard control method for preventing physical attacks according to claim 6, characterized in that, Key verification for the host includes: Send a dynamic verification random number to the host; Receive the authentication response data packet generated based on the dynamic verification random number, and derive a temporary session key for a valid response period using the authentication response data packet; The temporary session key is sent to the access host for verification. If a verification receipt is received from the host, the key is considered to have been successfully verified.

Images