Electronic scale anti-tamper metrology system based on physically unclonable functions

Abstract

The application discloses a kind of electronic scale tamper-resistant metrology systems based on physically unclonable function, including integrated in the physically unclonable function module of main control chip, metrology verification generation unit, open shell detection unit and lock machine execution unit.Physically unclonable function module generates and chip physical binding unique device identity label;Metrology verification generation unit carries out one-way irreversible encryption operation to device identity label, sensor serial number and factory metrology calibration parameter, generates metrology verification code as necessary precondition of the start of weighing function;Open shell detection unit multidimensional detection illegal disassembly;Lock machine execution unit detects tampering when from hardware channel locks metrology function and triggers alarm.The scheme constructs "physical identity-metrology parameter-structure protection" trinity linkage protection system, can resist change mainboard, change parameter, change sensor, brush firmware and so on tampering behavior, meet "open shell lock machine, one scale one code" regulatory requirements, applicable to compulsory verification electronic weighing equipment.

Description

Technical Field

[0001] This invention relates to the field of weighing and measurement safety technology, specifically to an anti-tampering measurement system for electronic scales based on physically unclonable functions, applicable to commercial electronic scales, industrial weighing equipment and other mandatory verification measuring instruments that meet the requirements of the "Outline for Type Evaluation of Electronic Price Computing Scales". Background Technology

[0002] Electronic scales are mandatory national verification measuring instruments, and their accuracy directly affects the fairness of market transactions and the legitimate rights and interests of consumers. In recent years, cheating methods for electronic scales have become increasingly sophisticated and covert, evolving from early physical installations of cheating devices to chip-level and firmware-level tampering methods such as replacing the main control board, modifying calibration parameters, flashing cracked firmware, and replacing sensors. Physical seals and software locks can only prevent early, simple cheating methods and are largely ineffective against chip-level and firmware-level tampering.

[0003] To standardize the supervision of measuring instruments, the State Administration for Market Regulation issued the "Outline for Type Evaluation of Electronic Price Computing Scales (Trial)," which clearly put forward mandatory technical requirements such as "unlocking the machine after opening the casing and authorization" and "one scale, one code," setting higher standards for the anti-tampering capabilities of electronic scales.

[0004] Existing anti-tampering technologies mainly suffer from two types of core flaws: Firstly, traditional unlocking solutions rely solely on physical contacts to detect disassembly and lock the metering function via software. This solution has a clear bypass path; attackers can restore the metering function by shorting the locking circuit, replacing the entire main control board, or flashing cracked firmware. The protection only stays at the physical level of the casing and cannot resist chip-level or firmware-level tampering.

[0005] Secondly, traditional device authentication schemes often use software-written unique IDs or external encryption chips. These identity identifiers can be copied and cloned, and identity authentication is decoupled from the core metrology function. Even if identity verification fails, the verification process can be skipped by modifying the firmware, and the metrology function will not be affected. Furthermore, it cannot restrain core cheating behaviors such as sensor replacement and calibration parameter modification.

[0006] Physically unclonable functions (PUFs) have been applied in the field of information security, but no substantial solutions have been found in the field of weighing and measurement. This is because the original response of PUFs is subject to temperature drift and aging deviation, while measuring instruments have extremely high requirements for long-term stability and consistency. The industry generally believes that PUFs are not suitable for core control links in metrology and can only be used in non-core identity traceability scenarios. Summary of the Invention

[0007] (a) Technical problems to be solved To address the shortcomings of existing technologies, this invention aims to provide an anti-tampering measurement system for electronic scales based on physically unclonable functions, solving the following technical problems: It addresses the shortcomings of traditional unlocking solutions that can be bypassed by replacing the motherboard and flashing the firmware, thus constructing an unbypassable root of trust for metrology; it solves the problem of traditional identification identifiers being copyable and tamper-proof, achieving truly unclonable "one scale, one code"; it addresses the industry pain points of unauthorized modification of metrology calibration parameters and arbitrary replacement of sensors, blocking parameter-based cheating paths at the source; and it overcomes the industry's limited understanding of the unstable temperature drift of PUF technology, enabling it to meet the long-term reliability requirements of metrology instruments.

[0008] (II) Technical Solution To achieve the above objectives, the present invention adopts the following technical solution: A tamper-proof electronic scale measurement system based on physically unclonable functions includes a scale body, a weighing sensor module, a main control module, a storage module, a display module, a power supply module, a physically unclonable function module, a measurement verification generation unit, an opening detection unit, and a locking execution unit.

[0009] The physically unclonable function module is integrated inside the main control chip. Based on the inherent physical differences generated during the chip manufacturing process, it generates a device identity that is uniquely bound to the chip. This identity cannot be copied or exported and changes irreversibly when the chip's physical structure is damaged.

[0010] The metrological verification generation unit performs a one-way irreversible encryption operation on the device identification, the unique hardware serial number of each weighing sensor, and the factory metrological calibration parameters to generate a unique metrological verification code. This verification code is a necessary prerequisite for enabling the weighing and metering function. If the verification fails, the metrological hardware channel will be completely shut down and cannot be bypassed by software.

[0011] The shell opening detection unit adopts a multi-redundant detection mechanism to detect the illegal opening state of the shell from multiple dimensions such as physical contact, capacitance displacement, and photosensitive changes, so as to avoid the single detection method being bypassed by humans.

[0012] When the locking unit detects abnormal states such as unauthorized opening, identity verification failure, or parameter mismatch, it immediately sets the metering verification flag to an invalid state in the hardware security domain, locks all weighing functions from the hardware channel, and generates an unalterable event record and uploads it to the monitoring terminal.

[0013] Furthermore, the main control chip has a built-in PUF response error correction unit, which corrects the temperature drift and aging deviation of the original PUF response through auxiliary data, ensuring the stability of the device identification throughout the entire temperature range and the entire life cycle.

[0014] Furthermore, the storage module is equipped with a one-time programmable (OTP) storage area. The factory calibration parameters and sensor serial number are written once and cannot be modified. They are also deeply bound to the device identification. Replacing the chip or sensor will cause the verification to fail.

[0015] Furthermore, the system adopts a dynamic verification mechanism, which automatically performs identity and verification code comparison at three nodes: power-on startup, entering the weighing steady state, and performing calibration operation. The verification process runs in the hardware security domain and is not subject to application layer program intervention.

[0016] (III) Beneficial Effects Compared with the prior art, the present invention has the following technical effects: A device identity system that cannot be cloned has been established. The device identity generated based on the physical characteristics of the chip does not require software storage and cannot be reverse-copied. Each device has a globally unique physical identity, which fundamentally meets the "uniqueness information verification" requirement of the new regulations and completely eliminates device cloning and identity forgery.

[0017] This creates a strong synergistic effect between physical identity and measurement parameters. This solution is not simply a combination of PUF and a lock-picking device, but rather a two-way dependent, interconnected protection system: On one hand, PUF provides an unbypassable root of trust for the lock-picking device. Traditional lock-picking devices can be cracked by replacing the motherboard; in this solution, replacing the motherboard changes the PUF identifier, directly invalidating the measurement verification code and completely disabling the measurement function, thus blocking the core vulnerability of "board replacement bypass." On the other hand, the lock-picking detection provides a physical security barrier for PUF. Traditional PUF solutions are vulnerable to attacks from disassembly probes; in this solution, once the casing is illegally opened, it immediately triggers locking and erases sensitive data. Attackers cannot access the chip for reverse engineering without triggering an alarm. The combination of these two methods effectively resists various common tampering behaviors such as disassembly, chip replacement, sensor replacement, calibration parameter modification, and firmware flashing, with no known bypass paths.

[0018] This eliminates parameter-based cheating at the source. Calibration parameters and sensor serial numbers are permanently stored in a one-time programmable memory area and are deeply bound to the PUF identity. Any modification or replacement will result in verification failure, completely blocking the path to cheating by privately modifying calibration coefficients or replacing sensors.

[0019] The solution aligns with current regulatory policies and possesses end-to-end traceability capabilities. The system fully complies with current regulations for electronic price-computing scales, automatically uploading evidence of tampering to the blockchain, supporting remote monitoring by regulatory authorities and verification by consumers via QR code scanning, enabling reliable supervision throughout the entire lifecycle from production and calibration to use. Attached Figure Description

[0020] Figure 1This is a block diagram of the overall hardware architecture of the system; Figure 2 Flowchart for the generation and verification of measurement verification codes; Figure 3 Flowchart for illegal shell opening detection and machine locking; Figure 4 This is a schematic diagram of the hardware layout of the shell opening detection unit; The attached diagram lists the components represented by each number as follows: 1. Housing; 2. Capacitive sensing array; 3. Main control board; 4. Physical contact switch; 5. Weighing sensor; 6. Metal shielding cover. Detailed Implementation

[0021] Example 1: System Hardware Architecture This embodiment provides a hardware implementation scheme for a commercial electronic price-computing scale, the overall architecture of which is as follows: Figure 1 As shown.

[0022] The main control module uses a low-power secure MCU with TrustZone hardware security extension, and integrates an SRAM-type PUF module. The MCU is internally divided into a secure zone and a non-secure zone. The PUF module, metering verification generation unit, and lock execution unit all operate in the secure zone. Applications in the non-secure zone cannot directly access or modify its operating logic and stored data.

[0023] The weighing sensor module uses four digital weighing sensors, each with a unique 64-bit hardware serial number. It communicates with the main control module via an RS485 bus, and the communication data is encrypted using AES-128 to prevent interception and tampering during transmission.

[0024] The storage module includes a Flash main storage area and an OTP storage area. The OTP storage area has a capacity of 1KB and is used to solidify core metrology and safety parameters such as range, graduation value, zero-point calibration coefficient, gain calibration coefficient, sensor serial number, and PUF auxiliary data. It is burned once at the factory and cannot be physically rewritten after burning.

[0025] The shell opening detection unit adopts a triple detection redundancy design: four normally open microswitches are distributed on the four corners of the shell 1. When the shell 1 is assembled, the switches are in the closed state. When the shell 1 is separated, the switches are open, triggering an external interrupt; one set of capacitive sensing array 2 is attached to the inside of the top cover. It identifies the minute displacement of the shell 1 by detecting changes in capacitance value, with a detection accuracy of 0.1mm; one photoresistor is arranged inside the metal shield 31 of the main control board 3. It is in a dark state under normal conditions. When the shell 1 is opened and light is incident, the resistance value changes abruptly, triggering detection.

[0026] The communication and display module integrates an NB-IoT IoT module for data uploading and remote command reception; the display module uses a separate touch screen and communicates wirelessly with the main control module. The power module adopts a dual power supply mode of lithium battery + external power supply, supports low-power sleep mode, and has a standby power consumption of less than 1μA.

[0027] The hardware channel locking mechanism is implemented as follows: The weighing sensor power supply path is equipped with a MOSFET switching circuit controlled by the TrustZone security domain GPIO. Under normal conditions, the MOSFET is on to power the sensor. In the locked state, the security domain directly pulls the GPIO level low, the MOSFET is cut off, and the sensor power supply is interrupted, preventing the application layer program from restarting. The analog-to-digital converter (ADC) data path locking is achieved as follows: The ADC module's clock enable register and data output register are mapped to the TrustZone security peripheral area, accessible only to secure-mode code. During locking, the security domain directly clears the ADC clock enable bit and writes to protect the register, preventing non-secure-mode applications from reconfiguring the ADC, resulting in a physical interruption of the weighing data path. The control logic for both hardware channels is embedded in the secure zone ROM and cannot be modified by firmware flashing.

[0028] Example 2: Measurement Verification Code Generation and Verification Process Factory initialization phase: (1) When the device is powered on, the main control chip’s security zone automatically calls the PUF module and collects the original PUF response based on the initial power-on state of the SRAM; (2) Through the PUF response error correction unit, a 128-bit stable device identity ID_PUF is generated based on the original response, and corresponding auxiliary data HelperData is generated at the same time; (3) Read the hardware serial numbers SN1~SN4 of each weighing sensor 5 and combine them into a sensor identifier group SN_Group; (4) Read the factory calibration parameters Param, including range, scale division, zero calibration value, and gain calibration value; (5) The metering verification generation unit uses the SHA-256 algorithm to perform hash operation on ID_PUF+SN_Group+Param to generate a 256-bit metering verification code CheckCode; (6) Write Param, SN_Group, CheckCode, and HelperData into the OTP storage area at once to complete the factory initialization.

[0029] To address the temperature drift and aging characteristics of SRAM-type PUFs, the error correction unit in this embodiment employs a fuzzy extraction algorithm. The original response collected under standard conditions during the factory manufacturing phase is used to generate auxiliary data. During operation, the original response generated in real-time by the PUF is first corrected using the auxiliary data before outputting the final device identification identifier. This error correction scheme ensures that the device's identification identifier remains consistent across its entire operating temperature range of -20℃ to +85℃ and throughout its entire lifespan, avoiding misjudgments and accidental device locking due to temperature drift and aging.

[0030] Runtime verification phase: The system automatically performs verification in three scenarios: upon power-on, before entering steady-state weighing, and before performing metrological calibration operations. The verification process is as follows: (1) The security zone calls the PUF module again, collects the current original response, and obtains the current device identity ID_PUF' after correction by the error correction unit; (2) Read the serial number SN_Group' of the currently connected sensor and read the calibration parameter Param stored in the OTP storage area; (3) Using the same hash algorithm as the factory, perform the operation on ID_PUF'+SN_Group'+Param to generate the current check code CheckCode'; (4) Compare CheckCode' with CheckCode stored in OTP storage area: If they match, the verification is successful, the weighing and metering function hardware channel is opened, and the weighing process is executed normally; if they do not match, it is determined that the device has been tampered with, and the machine lock execution unit is immediately triggered.

[0031] This mechanism ensures that any action, such as replacing the main control chip, replacing the sensor, or modifying the calibration parameters, will result in a mismatch of the verification code and the inability to enable the measurement function, thus blocking the core cheating path at its source.

[0032] The error correction process of the fuzzy extractor includes: first, binarizing the original PUF response; then, encoding it using a BCH code of length n and error correction capability t to generate auxiliary data; and finally, using the corresponding BCH decoding algorithm to correct errors in the real-time response during the recovery phase, outputting a stable 128-bit device identity identifier. In this embodiment, a BCH(255,131,37) error correction code is used, which can correct up to 37 bit errors.

[0033] Example 3: Illegal shell opening detection and machine locking execution process During normal operation, the three sensors of the shell opening detection unit collect data in real time, and the main control module polls the detection status every 10ms. When any one of the sensors detects an abnormality (microswitch disconnection, sudden change in capacitance value, sudden change in photosensitivity value) and the duration exceeds 20ms, it is determined to be an illegal shell opening event.

[0034] Upon determining that the shell has been illegally opened, the locking execution unit synchronously performs the following operations within 100ms: (1) Set the metering verification flag to the invalid state within the hardware security domain, forcibly close the weighing and metering channel from the hardware channel, and display "The device has been tampered with. Please contact authorized personnel to unlock it" on the screen. (2) Clear all temporary calibration data and sensitive keys from the RAM; (3) Generate a tampering event log, which includes: device ID, event time, trigger detection type, and device geographical location; (4) Upload the event logs to the regulatory platform through the Internet of Things module and write the log hash value to the consortium blockchain evidence storage node; (5) Trigger local audible and visual alarm.

[0035] Once the device is locked, it can only be unlocked through the authorized unlocking unit. Unlocking uses the TOTP dynamic password algorithm. The monitoring platform generates a one-time password valid for 5 minutes based on the device ID and the authorized personnel's account. After the operator enters the password on the device, the system and the cloud perform two-way authentication. Only after successful authentication can the device be unlocked. The entire unlocking process generates an operation log, which is stored in a protected local partition and cannot be deleted locally. Simultaneously, it is uploaded to the monitoring platform and the consortium blockchain's evidence storage node, ensuring permanent traceability.

[0036] Figure 1 Note: The area within the outer dashed box is the division of the internal functional modules of the main control chip. The TrustZone security domain is further marked with a dotted-dash box, and all sensitive logic units operate within this security domain.

[0037] Figure 2 Note: The dashed box on the left represents the factory initialization phase, and the dashed box on the right represents the operational verification phase. The factory initialization phase completes PUF identifier acquisition, sensor serial number reading, calibration parameter hash binding, and OTP firmware writing; the operational phase completes real-time acquisition, hash calculation, and comparison judgment.

[0038] Figure 3 Note: The area within the dashed box represents the set of mandatory response actions triggered by the lock-up execution unit. The six actions are executed sequentially, and the device enters the lock-up state upon completion. The boundary of the dashed box indicates that this set of actions cannot be interrupted once triggered.

[0039] Experimental data and effect verification: Experiment Example 1: Verification of Anti-tampering Effectiveness. One hundred electronic scales equipped with this system were selected as the experimental group, and 100 electronic scales using the traditional lead seal + software locking scheme were selected as the control group. Professional metrology and testing personnel simulated common cheating methods to conduct attack tests. The test results are as follows: ; Experimental results show that the system of the present invention achieves a 100% success rate in intercepting various common electronic scale cheating methods, which is far superior to the average interception rate of 11% of traditional solutions, effectively solving the technical defects of traditional solutions that can be bypassed.

[0040] Experiment Example 2: PUF Identity Stability Verification. Twenty prototype units underwent 1000 power-on PUF response tests at three temperature points: -20℃, 25℃, and 85℃. The identity identification error rate was less than 10%. -9 This meets the long-term stability requirements of measuring instruments.

[0041] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the invention should be included within the scope of protection of the invention.

Claims

1. A tamper-proof electronic scale measurement system based on physically unclonable functions, comprising a scale body, a weighing sensor module, a main control module, a storage module, a display module, and a power supply module, characterized in that, Also includes: The physically unclonable function module is integrated inside the main control chip and is used to generate a device identity that is uniquely bound to the physical structure of the main control chip based on the inherent physical differences generated during the chip manufacturing process. The metrological verification generation unit is used to perform a one-way irreversible encryption operation on the device identification, the unique hardware serial number of each weighing sensor (5) and the factory metrological calibration parameters to generate a unique metrological verification code. The metrological verification code is a necessary pre-verification condition for the system to enable the weighing and metering function. If the verification fails, the weighing and metering function cannot be started. The shell opening detection unit is located between the weighing body shell (1) and the main control board (3) and is used to detect the illegal opening status of the weighing body shell (1) in real time. The locking execution unit is used to immediately set the metering verification flag to an invalid state in the TrustZone hardware security domain of the main control chip when illegal opening of the casing or failure of device identification verification is detected, and to lock all weighing and metering functions from the hardware channel. The hardware channel includes the power supply path of the weighing sensor and the data path of the analog-to-digital converter, and simultaneously triggers local and remote alarms.

2. The tamper-proof electronic scale measuring system according to claim 1, characterized in that, The Physically Unclonable Function (PUF) module is of SRAM type or arbiter type, and automatically generates a 128-bit uncopyable device identity identifier after power-on; When the main control chip is subjected to desoldering, grinding, or probe attacks that cause physical structural damage, the device identification is irreversibly changed, and the metering verification code becomes invalid simultaneously.

3. The tamper-proof electronic scale measuring system according to claim 2, characterized in that, The main control chip has a built-in PUF response error correction unit, which uses a fuzz extractor to correct errors in the original response generated by the physically unclonable function module. During the factory delivery phase, auxiliary data corresponding to the original response is generated and stored in a one-time programmable storage area. During the operation phase, the real-time response is corrected based on the auxiliary data, and a stable device identification is output.

4. The tamper-proof electronic scale measuring system according to claim 1, characterized in that, The one-way irreversible encryption operation is a SHA-256 hash operation.

5. The tamper-proof electronic scale measuring system according to claim 1, characterized in that, The storage module includes a one-time programmable storage area. The factory calibration parameters, including the range, scale division, zero-point calibration coefficient, and gain calibration coefficient, are all permanently written into the one-time programmable storage area. When written, the parameters are bound to the device identification and cannot be modified or erased.

6. The tamper-proof electronic scale measuring system according to claim 5, characterized in that, The hardware serial number and factory calibration parameters are both permanently written into the one-time programmable storage area; When the weighing sensor (5) is replaced, the current sensor serial number does not match the pre-stored serial number, the measurement verification code comparison fails, and the weighing measurement function cannot be enabled.

7. The tamper-proof electronic scale measuring system according to claim 1, characterized in that, The shell opening detection unit includes a physical contact switch (4), a capacitive sensing array (2), and a photosensitive detection element; The physical contact switches (4) are distributed at multiple points on the assembly surface of the housing (1), the capacitive sensing array (2) is attached to the inside of the housing (1), and the photosensitive detection element is arranged in the shielding area of ​​the main control board (3). If any path detects displacement, separation, or abnormal light transmission of the outer shell (1), an illegal shell opening determination will be triggered.

8. The tamper-proof electronic scale measuring system according to claim 1, characterized in that, It also includes an authorization unlocking unit, which uses a time-based one-time password algorithm. The unlocking password is bidirectionally bound to the device identity and the authorized personnel's identity information, and the validity period of a single password does not exceed 5 minutes. The entire unlocking process generates an operation log, which is stored in a protected partition of the storage module and cannot be deleted locally. The log is also simultaneously uploaded to the regulatory platform and the consortium blockchain evidence storage node.

9. The tamper-proof electronic scale measuring system according to claim 1, characterized in that, The system automatically performs equipment identification verification and metrological verification code comparison before each power-on start-up, before each entry into weighing steady state, and before each metrological calibration operation; The verification process is completed within the TrustZone hardware security domain of the main control chip, and the verification results cannot be tampered with or bypassed by software means.

10. The anti-tampering measurement system for electronic scales according to claim 1, characterized in that, It also includes an IoT communication module; when the lock execution unit is triggered, it synchronously clears the local temporary calibration data and generates a tampering event log with a timestamp. The log is stored in the protected partition of the storage module and cannot be deleted locally. The device identification, geographical location, and event type are uploaded to the supervision platform and the consortium blockchain evidence storage node through the IoT communication module.

Images