An intelligent board card access control system and method based on a secure network chip

Abstract

The application relates to an intelligent board card access control system and method based on a secure network chip, and the system comprises a request authentication and evaluation module, which is used for receiving a request of a terminal for initiating access to a target board card, performing primary hardware encryption authentication on the request by using a secure enhanced baseboard management controller, simultaneously calling historical behavior data of the terminal and a current system risk state to comprehensively evaluate; a secure transmission link establishment module, which is used for creating a unique encrypted transmission link in the secure enhanced baseboard management controller if the primary hardware encryption authentication and the comprehensive evaluation are passed, forwarding the access request to the target board card for processing, and feeding back processing results to the terminal. The application is suitable for secure and efficient access of multiple terminals to multiple board cards in scenes such as servers, high-performance computing clusters and the like.

Description

Technical Field

[0001] This invention relates to the fields of computer hardware and network security technology, and in particular to a smart board access control system and method based on a secure network chip. Background Technology

[0002] With the rapid development of cloud computing, big data, and artificial intelligence, the number of integrated functional cards (such as accelerator cards, storage cards, and dedicated processing cards) in server systems is increasing. In data centers or computing clusters, there are often multiple management or computing terminals that need to access the same or multiple cards, for example, for resource scheduling, status monitoring, or data transmission.

[0003] However, traditional board access mechanisms often lack a unified and secure management channel, have rudimentary access control, and pose a risk of data exchange being eavesdropped on or tampered with.

[0004] In existing technical solutions, the Baseboard Management Controller (BMC) is often used to manage the underlying hardware. However, standard BMC access protocols are insufficient in terms of security, and data transmission may lack encryption and integrity verification. At the same time, traditional network security architectures such as firewalls and intrusion detection systems mainly protect the network boundary, lacking fine-grained security control over point-to-point communication between internal server boards and terminals.

[0005] In addition, existing board configuration methods have limited intelligence and are difficult to dynamically adjust access permissions based on real-time security policies and access behavior.

[0006] Therefore, there is an urgent need for an innovative solution that can deeply integrate hardware access control and network security protection, so as to ensure the security of the entire access link while enabling flexible access. Summary of the Invention

[0007] To address the problems existing in the prior art, the present invention aims to provide a smart board access control system and method based on a secure network chip. By integrating a dedicated secure network chip at the hardware level and introducing a multi-dimensional security authentication and dynamic policy engine into the access control logic, flexible and secure access from multiple terminals to multiple boards can be achieved.

[0008] To achieve the above objectives, the present invention provides the following solution: A smart board access control system based on a secure network chip includes: The authentication and evaluation module is used to receive a request from the terminal to access the target board, perform primary hardware encryption authentication on the request using the security-enhanced board management controller, and simultaneously retrieve the terminal's historical behavior data and current system risk status for comprehensive evaluation. The secure transmission link establishment module is used to create a unique encrypted transmission link within the security-enhanced baseboard management controller if both the primary hardware encryption authentication and comprehensive evaluation are passed, forward the access request to the target board for processing, and feed back the processing result to the terminal.

[0009] Optionally, the request authentication and evaluation module includes: The authentication request submodule is used to receive a request from the terminal to access the target board and to perform primary hardware encryption authentication on the request using the security-enhanced baseboard management controller. The evaluation submodule is used to perform a comprehensive evaluation based on the terminal's historical behavior data and the current system risk status, according to the dynamic access control policy.

[0010] Optionally, the request includes: terminal identity credentials and access intent information.

[0011] Optionally, the evaluation submodule includes: The multi-source security data acquisition and sensing unit is used to collect network access behavior data, terminal device operating status data, and the board's own working status data. The dynamic access control policy engine is used to receive the data collected by the multi-source security data acquisition and perception unit, and generate the dynamic access control policy based on the predefined security model and real-time risk analysis results. Based on the dynamic access control policy, the historical behavior data of the terminal and the current system risk status are retrieved for comprehensive assessment.

[0012] Optionally, the secure transmission link establishment module includes: A secure transmission link establishment unit is used to create a unique encrypted transmission link within the security-enhanced baseboard management controller if both the primary hardware encryption authentication and comprehensive evaluation pass. The key for the transmission link is generated in real time by the secure network chip and is used only for this session. The access request is forwarded to the target board for processing via the transmission link, and the processing result is returned to the security-enhanced baseboard management controller via the same encrypted link. At the same time, the security-enhanced baseboard management controller feeds back the processing result to the terminal. During the feedback to the terminal, a security audit digest of this access is attached and signed by the security network chip.

[0013] Optionally, the security audit summary includes: timestamp, operation type, and data volume hash value.

[0014] To achieve the above objectives, the present invention also provides a smart board access control method based on a secure network chip, comprising: The receiving terminal initiates a request to access the target board, and uses a security-enhanced board management controller to perform primary hardware encryption authentication on the request. At the same time, it retrieves the terminal's historical behavior data and the current system risk status for comprehensive assessment. If both the initial hardware encryption authentication and comprehensive evaluation are passed, a unique encrypted transmission link is created within the security-enhanced baseboard management controller to forward the access request to the target board for processing, and the processing result is fed back to the terminal.

[0015] The beneficial effects of this invention are as follows: Achieving hardware-level security enhancement: This invention integrates a secure network chip, bringing security functions such as encryption and authentication down to the hardware level. Compared to pure software solutions, it has higher processing efficiency and anti-attack capabilities, ensuring the security of the access link from a physical foundation.

[0016] Provides fine-grained, dynamic access control: This invention combines multi-source behavioral data with real-time risk analysis, changing the traditional static permission allocation model. It can dynamically adjust access policies according to context, effectively addressing potential internal threats.

[0017] Balancing access flexibility and security: While supporting complex access topologies from multiple terminals to multiple boards, this invention ensures that flexible access will not become a security vulnerability by establishing an independent encrypted channel for each session and strict identity and behavior authentication, thus resolving the contradiction between efficiency and security.

[0018] Enhanced system auditability: This invention provides a security audit trail with hardware chip signature for each access operation, providing a reliable and non-repudiable data foundation for post-event tracing and security analysis. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of an intelligent board access control system based on a secure network chip, according to an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] like Figure 1 As shown, this embodiment discloses an intelligent board access control system based on a secure network chip, including: Security Enhanced Baseboard Management Controller (SE-BMC): As the core control unit of the system, it connects multiple terminals and at least one target board. The SE-BMC integrates a dedicated security network chip, possessing hardware-level data encryption / decryption and digital signature verification capabilities; the data encryption / decryption methods can utilize, for example, Chinese national cryptographic algorithms and keys.

[0024] Multi-source security data acquisition and perception module: Deployed on the terminal and board, it is used to collect network access behavior data, terminal device operating status data (such as CPU / memory usage, process logs) and the board's own working status data in real time.

[0025] Dynamic access control policy engine: Running within SE-BMC, it receives information from multi-source security data acquisition modules and dynamically generates or adjusts access control policies based on predefined security models and real-time risk analysis results. That is, once a significant deviation is detected (such as a large number of high-load write operations being initiated during non-working hours), even if the identity credentials are valid, a high-risk alarm will be triggered immediately and the operation privileges will be restricted.

[0026] Secure Transmission Link Establishment Module: Responsible for establishing an end-to-end encrypted transmission channel for authenticated access requests within the SE-BMC.

[0027] This embodiment discloses a smart board access control method based on a secure network chip, including the following steps: Step S1: The terminal initiates a request to the SE-BMC to access the target board. This request includes the terminal's identity credentials and access intent information. The access intent includes obtaining common sensitive data information, etc. If the sensitive data information is identified as having high sensitivity, the monitoring level is automatically increased to check for any unauthorized operations. Step S2: The SE-BMC's secure network chip performs initial hardware encryption authentication on the terminal's identity. This initial hardware encryption authentication uses a national cryptographic algorithm + key to initially encrypt the access process. Simultaneously, the dynamic access control policy engine retrieves the terminal's historical behavior data and the current system risk status for comprehensive evaluation. The current system risk status includes whether the user is accessing unauthorized sensitive information and whether the user is performing unauthorized operations. This comprehensive evaluation is based on the sensitivity of the accessed data and whether the operation is abnormal; for example, whether there is continuous probe access. Step S3: If the authentication and risk assessment pass, the SE-BMC determines the target board, and the secure transmission link establishment module creates a unique, encrypted first transmission link within the SE-BMC. The link key is generated in real time by the secure network chip and is used only for this session. Step S4: The SE-BMC forwards the access request to the target board through the first transmission link. The processing result of the target board is also returned to the SE-BMC through the same encrypted link. Step S5: Before feeding back the final access result to the terminal, the SE-BMC can attach a security audit digest of this access (such as timestamp, operation type, data volume hash value), which is then signed by the secure network chip to ensure the immutability of the result. Step S6: Throughout the session, the multi-source security data acquisition module continuously monitors the link status and terminal / board behavior. Based on this real-time data, the dynamic access control policy engine has the ability to interrupt abnormal sessions and temporarily elevate or reduce access permissions. That is, once a significant deviation is detected (such as initiating a large number of high-load write operations during non-working hours), even if the identity credentials are valid, a high-risk alarm will be immediately triggered and the operation permissions will be restricted.

[0028] In one possible implementation, a high-performance computing server cluster is deployed with various boards, including GPU accelerator cards and FPGA computing cards. Both administrator terminal A and AI training terminal B need to access the same GPU accelerator card.

[0029] Terminal A initiates a monitoring request to the SE-BMC of its host server via the out-of-band management network. The SE-BMC's security network chip verifies Terminal A's digital certificate.

[0030] The policy engine detected that terminal A had an administrator role and was not exhibiting any abnormal behavior, so it authorized the establishment of an access link. The security network chip generated a session key and established an encrypted channel to the GPU accelerator card.

[0031] Almost simultaneously, terminal B initiated a computation task submission request. After verifying terminal B's identity, the policy engine assessed that the GPU accelerator card's current load had exceeded the safety threshold, and that the data pattern of terminal B's current request deviated from the historical normal pattern.

[0032] The policy engine makes a dynamic decision: allow the connection to be established, but limit its computation task queue priority and mark the session as "needs monitoring". Simultaneously, send a risk alert to administrator terminal A.

[0033] During subsequent data transmission, the multi-source data acquisition module detected an abnormal surge in the rate of data packets sent by terminal B to the board, consistent with the characteristics of a DoS attack. The policy engine immediately instructed the SE-BMC to interrupt the encrypted transmission link of terminal B and temporarily add it to the access blacklist.

[0034] Through this embodiment, the system not only achieves hardware-level security isolation for multi-terminal access, but also effectively prevents potential internal attacks through dynamic policies, demonstrating the practicality and security of the present invention in complex scenarios.

[0035] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A smart board access control system based on a secure network chip, characterized in that, include: The authentication and evaluation module is used to receive a request from the terminal to access the target board, perform primary hardware encryption authentication on the request using the security-enhanced board management controller, and simultaneously retrieve the terminal's historical behavior data and current system risk status for comprehensive evaluation. The secure transmission link establishment module is used to create a unique encrypted transmission link within the security-enhanced baseboard management controller if both the primary hardware encryption authentication and comprehensive evaluation are passed, forward the access request to the target board for processing, and feed back the processing result to the terminal.

2. The intelligent board access control system based on a secure network chip according to claim 1, characterized in that, The request authentication and evaluation module includes: The authentication request submodule is used to receive a request from the terminal to access the target board and to perform primary hardware encryption authentication on the request using the security-enhanced baseboard management controller. The evaluation submodule is used to perform a comprehensive evaluation based on the terminal's historical behavior data and the current system risk status, according to the dynamic access control policy.

3. The intelligent board access control system based on a secure network chip according to claim 2, characterized in that, The request includes: terminal identity credentials and access intent information.

4. The intelligent board access control system based on a secure network chip according to claim 2, characterized in that, The evaluation submodule includes: The multi-source security data acquisition and sensing unit is used to collect network access behavior data, terminal device operating status data, and the board's own working status data. The dynamic access control policy engine is used to receive the data collected by the multi-source security data acquisition and perception unit, and generate the dynamic access control policy based on the predefined security model and real-time risk analysis results. Based on the dynamic access control policy, the historical behavior data of the terminal and the current system risk status are retrieved for comprehensive assessment.

5. The intelligent board access control system based on a secure network chip according to claim 1, characterized in that, The secure transmission link establishment module includes: A secure transmission link establishment unit is used to create a unique encrypted transmission link within the security-enhanced baseboard management controller if both the primary hardware encryption authentication and comprehensive evaluation pass. The key for the transmission link is generated in real time by the secure network chip and is used only for this session. The access request is forwarded to the target board for processing via the transmission link, and the processing result is returned to the security-enhanced baseboard management controller via the same encrypted link. At the same time, the security-enhanced baseboard management controller feeds back the processing result to the terminal. During the feedback to the terminal, a security audit digest of this access is attached and signed by the security network chip.

6. The intelligent board access control system based on a secure network chip according to claim 5, characterized in that, The security audit summary includes: timestamp, operation type, and data volume hash value.

7. A smart board access control method based on a secure network chip implemented according to any one of claims 1-6, characterized in that, include: The receiving terminal initiates a request to access the target board, and uses a security-enhanced board management controller to perform primary hardware encryption authentication on the request. At the same time, it retrieves the terminal's historical behavior data and the current system risk status for comprehensive assessment. If both the initial hardware encryption authentication and comprehensive evaluation are passed, a unique encrypted transmission link is created within the security-enhanced baseboard management controller to forward the access request to the target board for processing, and the processing result is fed back to the terminal.

Images