Isolation cipher machine based on single-chip FPGA (Field Programmable Gate Array)

Abstract

The isolation cipher machine based on the single-chip FPGA comprises a shell and a main control board, a pair of GMAC interface modules and a pair of USB interface modules which are used for data transmission are arranged on the two sides of the shell, and an authentication interface, a destruction button and a power interface are arranged on the front face of the shell. An FPGA processing chip and two GMAC interface modules are arranged on the main control board, the two GMAC interface modules are connected to the inner network side signal end and the outer network side signal end of the FPGA processing chip respectively, the two USB interface modules are connected to the inner network side signal end and the outer network side signal end of the FPGA processing chip respectively, the authentication interface and the destruction button are connected to the control end of the FPGA processing chip, and the power interface supplies power to the FPGA processing chip. According to the isolation cipher machine based on the single-chip FPGA, on the basis of achieving the function of encryption isolation connection of an internal network and an external network, hidden dangers such as detection and interference in the data transmission process caused by an existing design are avoided, product miniaturization is achieved, the hardware cost of a product is reduced, and the safety and stability of data transmission in product application are improved.

Description

Technical Field

[0001] The utility model relates to the technical field of data transmission, and in particular to an isolation cipher machine based on a single-chip FPGA. Background Art

[0002] When designing existing cryptographic machines, if the product needs to implement multiple high-performance encryption algorithms and isolation functions at the same time, two or more high-performance cryptographic algorithm chips are usually designed, and each cryptographic chip is required to have its own high-speed transmission interface to avoid affecting the overall performance of the isolated cryptographic machine due to low interface transmission performance. In this design, the cost of the cryptographic chip hardware module that meets the conditions is relatively high, and multiple cryptographic chips and their associated peripheral circuits occupy a large amount of the overall space and onboard space of the cryptographic machine, making it difficult to achieve product miniaturization. In addition, since the cryptographic chip hardware module needs to use external connections to transmit data, there is a risk of data leakage caused by electromagnetic signal leakage, interference, and data signal detection.

[0003] FPGA chips can be designed for partitioning. The system architecture inside a single FPGA chip can be designed as application area + algorithm area + application area. Each area can be connected to external signals through the corresponding functional pins. Among them, the chip algorithm area supports SM3 hash algorithm, SM4, AES, ZUC and other algorithms, as well as SM2 asymmetric algorithm, which can meet the requirements of high-performance encryption functions and can be used as a password area. In this way, data cannot be directly exchanged between application areas and must be processed and forwarded through the intermediate algorithm area, which realizes the principle basis of system-level isolation inside the chip. Utility Model Content

[0004] The technical problem to be solved by the utility model is as follows: Based on the above-mentioned FPGA chip partition design, an implementable and complete product based on a single-chip FPGA isolation cipher machine is provided, which, on the basis of realizing the function of encrypted isolation connection between internal and external networks, avoids the hidden dangers of detection and interference in the data transmission process caused by the existing multi-cipher chip hardware module interface connection design scheme, realizes product miniaturization, reduces the hardware cost of the product, and improves the security and stability of data transmission in product applications.

[0005] The present single-chip FPGA isolated cryptographic machine comprises a shell and a main control board installed in the encapsulated shell, wherein a pair of GMAC interface modules and a pair of USB interface modules for data transmission are arranged on both sides of the shell, and an authentication interface, a destruction button and a power interface are arranged on the front of the shell; an FPGA processing chip is arranged on the main control board, two GMAC interface modules are respectively connected to the internal and external network side signal ends of the FPGA processing chip, two USB interface modules are respectively connected to the internal and external network side signal ends of the FPGA processing chip, the authentication interface and the destruction button are connected to the control end of the FPGA processing chip, and the power interface supplies power to the FPGA processing chip.

[0006] Furthermore, the main control board is also integrated with a physical noise source chip and a power conversion module, the physical noise source chip is connected to the function pins of the operation area of ​​the FPGA processing chip, and the power interface is connected to the power supply pins of the FPGA processing chip via the power conversion module.

[0007] Specifically, the GMAC interface module and the USB interface module on the intranet side are connected to the function pins of the application area on one side of the operation area in the FPGA processing chip, and the GMAC interface module and the USB interface module on the extranet side are connected to the function pins of the application area on the other side of the operation area in the FPGA processing chip.

[0008] Specifically, the authentication interface is unidirectionally connected to the pin of the operation area of ​​the FPGA processing chip, and the destruction button is connected to the pin of the operation area of ​​the FPGA processing chip through GPIO.

[0009] Optimally, an indicator light is provided on the front side of the shell, and the indicator light is connected to the operation area pin of the FPGA processing chip.

[0010] The utility model is a single-chip FPGA-based isolated cipher machine, which, on the basis of realizing the function of encrypted isolated connection between internal and external networks, avoids the hidden dangers of detection and interference in the data transmission process caused by the existing multi-cipher chip hardware module interface connection design scheme, realizes product miniaturization, reduces the hardware cost of the product, and improves the security and stability of data transmission in product applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The following is a further description of the utility model based on a single-chip FPGA isolation cipher machine in conjunction with the accompanying drawings:

[0012] Figure 1 This is a schematic diagram of the main perspective structure of the single-chip FPGA isolated cryptographic machine;

[0013] Figure 2 This is a top-down perspective structural diagram of the single-chip FPGA-based isolated cryptographic machine;

[0014] Figure 3 This is a side perspective structural diagram of the single-chip FPGA-based isolated cryptographic machine;

[0015] Figure 4 This is a wireframe diagram of the logic structure and connection principle of this single-chip FPGA isolated cipher machine.

[0016] In the figure:

[0017] 1-housing; 11-GMAC interface module, 12-USB interface module, 13-authentication interface, 14-destroy button, 15-power interface, 16-indicator light;

[0018] 2-main control board; 21-FPGA processing chip, 22-physical noise source chip, 23-power conversion module. DETAILED DESCRIPTION

[0019] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be directly connected or indirectly connected through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0020] In the description of the present invention, it should be understood that the terms "left", "right", "front", "back", "top", "bottom", "inside", "outside", etc., indicating directions or positional relationships, are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as a limitation on the present invention.

[0021] The technical solution of the utility model is further described below with specific embodiments, but the protection scope of the utility model is not limited to the following embodiments.

[0022] Implementation method 1: Figures 1 to 4 As shown, the present single-chip FPGA isolated cryptographic machine includes a shell 1 and a main control board 2 installed in the encapsulated shell 1, wherein a pair of GMAC interface modules 11 and a pair of USB interface modules 12 for data transmission are provided on both sides of the shell 1, and an authentication interface 13, a destruction button 14 and a power interface 15 are provided on the front of the shell 1; an FPGA processing chip 21 is provided on the main control board 2, two GMAC interface modules 11 are respectively connected to the internal and external network side signal ends of the FPGA processing chip 21, two USB interface modules 12 are respectively connected to the internal and external network side signal ends of the FPGA processing chip 21, the authentication interface 13 and the destruction button 14 are connected to the control end of the FPGA processing chip 21, and the power interface 15 supplies power to the FPGA processing chip 21.

[0023] Implementation 2: The main control board 2 of this single-chip FPGA isolation cipher machine is also integrated with a physical noise source chip 22 and a power conversion module 23. The physical noise source chip 22 is connected to the function pin of the operation area of ​​the FPGA processing chip 21, and the power interface 15 is connected to the power supply pin of the FPGA processing chip 21 through the power conversion module 23. The physical noise source adopts the HSN3 model RNG chip to generate a high-speed random number sequence. The remaining structures and components are as described in Implementation 1 and will not be described again.

[0024] Implementation method 3: The GMAC interface module 11 and USB interface module 12 on the intranet side of the present single-chip FPGA isolated cipher machine are connected to the application area function pins on one side of the operation area in the FPGA processing chip 21, and the GMAC interface module 11 and USB interface module 12 on the extranet side are connected to the application area function pins on the other side of the operation area in the FPGA processing chip 21. It is used to quickly and efficiently transmit data between the intranet and extranet and the application area. The authentication interface 13 is unidirectionally connected to the operation area pins of the FPGA processing chip 21, and the destruction button 14 is connected to the operation area pins of the FPGA processing chip 21 through GPIO. The authentication interface is used to connect to an external USB key and collect authentication information. After the operation area detects that the USBKey authentication information is legal, the data of the intranet can be transmitted to the application area; when the FPGA processing chip detects that the destruction button is triggered, it will erase the sensitive information data such as keys, algorithm parameters, and algorithms stored in the Flash of the password area; the power interface is used to connect to an external power supply. The remaining structures and components are as described in Implementation method 1 and will not be described again.

[0025] Implementation 4: The front of the housing 1 of this single-chip FPGA isolated cryptographic machine is provided with an indicator light 16, which is connected to the operation area pin of the FPGA processing chip 21. It is used to display operating parameters such as power supply, data transmission, authentication success / failure, etc. The remaining structures and components are as described in Implementation 1 and will not be described again.

[0026] This single-chip FPGA isolated cipher machine not only realizes the function of encrypted isolated connection between internal and external networks, but also avoids the hidden dangers of detection and interference in the data transmission process caused by the existing multi-cipher chip hardware module interface connection design scheme, realizes product miniaturization, reduces the hardware cost of the product, and improves the security and stability of data transmission in product applications.

[0027] The above description shows the main features, basic principles, and advantages of the utility model. For those skilled in the art, it is obvious that the utility model is not limited to the details of the above exemplary embodiments or embodiments, and the utility model can be implemented in other specific forms without departing from the spirit or basic features of the utility model. Therefore, the above embodiments or embodiments should be regarded as exemplary and non-restrictive. The scope of the utility model is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the utility model. Any figure mark in the claims should not be regarded as limiting the claims involved.

[0028] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A single-chip FPGA-based isolated cryptographic machine, characterized by: It comprises a housing (1) and a main control board (2) installed in the encapsulated housing (1), wherein: A pair of GMAC interface modules (11) and a pair of USB interface modules (12) for data transmission are provided on both sides of the housing (1), and an authentication interface (13), a destruction button (14) and a power supply interface (15) are provided on the front side of the housing (1); The main control board (2) is provided with an FPGA processing chip (21), two GMAC interface modules (11) are respectively connected to the internal and external network side signal ends of the FPGA processing chip (21), two USB interface modules (12) are respectively connected to the internal and external network side signal ends of the FPGA processing chip (21), the authentication interface (13) and the destruction button (14) are connected to the control end of the FPGA processing chip (21), and the power supply interface (15) supplies power to the FPGA processing chip (21).

2. The single-chip FPGA-based isolated cryptographic machine according to claim 1, characterized in that: The main control board (2) is also integrated with a physical noise source chip (22) and a power conversion module (23); the physical noise source chip (22) is connected to a function pin of the operation area of ​​the FPGA processing chip (21); and the power interface (15) is connected to a power supply pin of the FPGA processing chip (21) via the power conversion module (23).

3. The single-chip FPGA-based isolated cryptographic machine according to claim 2 is characterized in that: The GMAC interface module (11) and the USB interface module (12) on the internal network side are connected to the application area function pins located on one side of the operation area in the FPGA processing chip (21), and the GMAC interface module (11) and the USB interface module (12) on the external network side are connected to the application area function pins located on the other side of the operation area in the FPGA processing chip (21).

4. The single-chip FPGA-based isolated cryptographic machine according to claim 3 is characterized in that: The authentication interface (13) is unidirectionally connected to the operation area pin of the FPGA processing chip (21), and the destruction button (14) is connected to the operation area pin of the FPGA processing chip (21) via GPIO.

5. The single-chip FPGA-based isolated cryptographic machine according to any one of claims 1 to 4, characterized in that: An indicator light (16) is provided on the front of the housing (1), and the indicator light (16) is connected to a pin of a calculation area of ​​the FPGA processing chip (21).

Images