CN117786678A

CN117786678A - Intrusion detection circuit and related equipment

Info

Publication number: CN117786678A
Application number: CN202311695074.7A
Authority: CN
Inventors: 刘勇江; 金军贵; 聂海英; 张书磊
Original assignee: Haiguang Information Technology Suzhou Co ltd
Current assignee: Haiguang Information Technology Suzhou Co ltd
Priority date: 2023-12-11
Filing date: 2023-12-11
Publication date: 2024-03-29

Abstract

The embodiment of the application provides an intrusion detection circuit and related equipment, the intrusion detection circuit includes: the detection module is used for receiving a first signal indicating the opening and closing states of the chassis shell and outputting a corresponding detection signal for determining a state mark signal representing the intrusion state of the chassis; the storage module receives the detection signal and the state mark signal, writes or reads intrusion information, and writes content for at least determining the number of intrusion; the power supply control module is connected with the power supply and is configured to be used as the power supply when only the main board battery works normally, and the main board power supply is configured to be used as the power supply when the main board battery and the main board power supply work normally; and one end of the holding capacitor is grounded, the other end of the holding capacitor is connected with the power supply control module, and the holding capacitor is configured as a power supply when the main board battery works abnormally. According to the technical scheme, intrusion events generated by the chassis can be recorded under various scenes such as shutdown and startup states of the computer, power on and power off of the battery and the like.

Description

Intrusion detection circuit and related equipment

Technical Field

The embodiment of the invention relates to the technical field of security, in particular to an intrusion detection circuit and related equipment.

Background

Once the host chassis of the computer device is opened by an illegal intruder, risks such as data theft and hardware theft are faced. For computer devices with high security requirements, it can be detected by a case intrusion detection (Chassis Instruction Detection) whether the case housing is opened. The principle of the case intrusion detection is as follows: if the case shell is opened, the intrusion detection circuit can generate a corresponding intrusion warning signal, so that a user can know that data in the computer equipment can be stolen in time, and further, related actions are taken to cope with illegal intrusion.

However, when the computer device is in a shutdown or power-off state, conventional intrusion detection circuitry will not generate a valid intrusion alert signal, resulting in intrusion detection failure. Therefore, it is important to provide a reliable intrusion detection circuit and intrusion detection system.

Disclosure of Invention

In view of this, the embodiments of the present application provide an intrusion detection circuit and related devices, which can record intrusion events occurring in a chassis in a state of a computer.

In order to achieve the above purpose, the embodiments of the present application provide the following technical solutions.

In a first aspect, an embodiment of the present invention provides an intrusion detection circuit, including:

The detection module is used for receiving a first signal for indicating the opening and closing states of the chassis shell and outputting a detection signal corresponding to the first signal according to the first signal, wherein the detection signal is used for determining a state mark signal for indicating the intrusion state of the chassis shell;

a storage module, which receives the detection signal and is configured to execute intrusion information writing or intrusion information reading operation according to the detection signal and the state flag signal, wherein the writing content when the writing of the intrusion information is executed is used for at least determining the number of times of intrusion;

the power supply control module is connected with a power supply and is configured to configure the power supply of the intrusion detection circuit as the main board battery when the main board battery works normally and the main board power supply works abnormally, and configure the power supply of the intrusion detection circuit as the main board power supply when the main board power supply and the main board battery work normally;

and one end of the holding capacitor is grounded, and the other end of the holding capacitor is connected with the power control module and is used for configuring a power supply of the intrusion detection circuit into the holding capacitor through the power control module when the main board battery works abnormally.

Optionally, the intrusion detection circuit further includes: and the input end of the voltage accumulation circuit is connected with the output end of the detection module, and is configured to increase the output voltage of the voltage accumulation circuit along with the increase of the number of the detection signals, and the output voltage of the voltage accumulation circuit is used for converting the number of times of invasion.

Optionally, the voltage accumulating circuit includes: and the first capacitor is configured to charge once when the detection module outputs the detection signals once, so that the output voltage of the voltage accumulation circuit increases along with the increase of the number of the detection signals.

Optionally, the intrusion detection circuit further includes: and the input end of the analog-to-digital conversion circuit is connected with the output end of the voltage accumulation circuit and is configured to convert the output voltage of the voltage accumulation circuit from an analog signal to a digital signal so as to determine the invasion times based on the digital signal.

Optionally, the storage module is a static random access memory or a flash memory.

Optionally, the intrusion detection circuit further includes: a real-time clock circuit configured to generate a clock signal; and the timing circuit is connected with the output end of the real-time clock circuit, the output end of the timing circuit is connected with the storage module and is configured to generate timing information according to the clock signal, and the timing information is used as writing content when the storage module executes writing operation so as to determine the invasion time and the invasion times.

Optionally, the power control module further includes: the first switch is arranged on a loop between the holding capacitor and the positive electrode of the main board battery; a second switch provided in a circuit between the holding capacitor and the first switch; a third switch arranged on a loop between the holding capacitor and a power domain on the main board; a power-on/power-off reset circuit configured to control the first switch to be turned on/off; and the power supply switching circuit is configured to control the opening and closing of the second switch and the third switch.

Optionally, the capacitance value of the holding capacitor is greater than or equal to 0.5uF.

In a second aspect, an embodiment of the present application further provides an intrusion detection system, including the intrusion detection circuit of the first aspect, and a control system;

the first input end of the control system is connected with the output end of the storage module and is used for calculating at least the number of invasion times according to the writing content when the storage module executes the writing of invasion information.

Optionally, the writing content when the storage module performs writing operation is timing information, and the control system is configured to calculate at least the number of times of intrusion according to the writing content when the storage module performs writing of intrusion information, including:

And calculating the invasion times and invasion time according to the timing information written by the storage module and the writing times of the timing information.

Optionally, the control system further includes a second input end, where the second input end is connected to an output end of the analog-to-digital conversion circuit of the intrusion detection circuit, and is configured to calculate the number of intrusions according to the writing content written by the storage module and the digital signal converted by the analog-to-digital conversion circuit.

In a third aspect, an embodiment of the present application further provides a chip including the intrusion detection circuit described above.

In a fourth aspect, an embodiment of the present application further provides an electronic device, including the intrusion detection circuit described above.

It can be seen that, the intrusion detection circuit provided in this embodiment can record various illegal intrusion events suffered by the chassis even when the computer is in a shutdown state, so that the intrusion detection circuit provided in this embodiment of the present application can record intrusion events occurring in the chassis in various scenarios such as the shutdown state, the startup state, the battery power-on state, the battery power-off state, and the like of the computer, and can improve the reliability of the intrusion detection circuit and expand the application scenario of the intrusion detection circuit.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings that are required to be used in the embodiments or the description of the prior art will be briefly described below, and it is obvious that the drawings in the following description are only embodiments of the present application, and that other drawings may be obtained according to the provided drawings without inventive effort to a person skilled in the art.

FIG. 1 is a schematic diagram of a detection circuit for detecting intrusion into a chassis;

fig. 2 is a schematic structural diagram of an intrusion detection circuit according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of an intrusion detection circuit according to another embodiment of the present invention;

FIG. 4 is a waveform diagram of determining intrusion time and intrusion times by using time information stored in a memory module according to an embodiment of the present invention;

FIG. 5 is a waveform diagram of determining the intrusion count using the output voltage of the voltage accumulating circuit according to the embodiment of the present invention;

FIG. 6 is a power supply selection flowchart of an intrusion detection circuit according to an embodiment of the present invention;

FIG. 7 is a flowchart of an intrusion detection system according to an embodiment of the present invention;

FIG. 8 is another flowchart of an intrusion detection system according to an embodiment of the present invention.

Detailed Description

The following description of the embodiments of the present application will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are only some, but not all, of the embodiments of the present application. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are within the scope of the present disclosure.

As described in the background art, when an electronic device having a storage and/or computing function, such as various types of computers, is in a power-off state or a power-off state, a conventional intrusion detection circuit cannot generate an effective detection signal, resulting in failure of intrusion detection, so that a user cannot find an illegal intrusion.

Fig. 1 shows a prior art intrusion detection circuit 10, and a board level detection module 11 of the intrusion detection circuit 10 is connected to a control system 13 through a General-purpose input/output (GPIO) port 12 on a motherboard. Specifically, the board-level detection module 11 is configured to generate an intrusion signal, where the intrusion signal is input to the general purpose input/output port 12, and the general purpose input/output port 12 may be, for example, a GPIO18/GPIO33 port on a motherboard, and the intrusion signal is input to the control system 13 via the general purpose input/output port 12 for subsequent processing.

In the intrusion detection circuit 10, the general-purpose input/output port 12 on the motherboard needs to operate in a specific power domain such as VDD18 (1.8V) and VDD33 (3.3V). The power domain is powered on after the computer system is normally started, and the power domain is powered off together when the computer system is in a power-off state. Therefore, the general input/output port 12 and the related intrusion detection circuit 10 can only work normally when the computer system is in the on state, and when the computer system is in the off state, the detection circuit 10 cannot detect the intrusion event, so that the user cannot find illegal intrusion, and the security of the computer system is seriously affected. Further, since the general purpose input/output port 12 only operates in the specific power domains such as VDD18 (1.8V) and VDD33 (3.3V), even if the chassis motherboard is equipped with a battery, the power supply requirement of the general purpose input/output port 12 cannot be satisfied by the battery on the motherboard, and the detection circuit 10 still cannot operate normally.

In view of the foregoing, an aspect of an embodiment of the present disclosure provides an intrusion detection circuit including: the detection module is used for receiving a first signal for indicating the opening and closing states of the chassis shell and outputting a detection signal corresponding to the first signal according to the first signal, wherein the detection signal is used for determining a state mark signal for indicating the intrusion state of the chassis shell; a storage module, which receives the detection signal and is configured to execute intrusion information writing or intrusion information reading operation according to the detection signal and the state flag signal, wherein the writing content when the writing of the intrusion information is executed is used for at least determining the number of times of intrusion; the power supply control module is connected with a power supply and is configured to configure the power supply of the intrusion detection circuit as the main board battery when the main board battery works normally and the main board power supply works abnormally, and configure the power supply of the intrusion detection circuit as the main board power supply when the main board power supply and the main board battery work normally; and one end of the holding capacitor is grounded, and the other end of the holding capacitor is connected with the power control module and is used for configuring a power supply of the intrusion detection circuit into the holding capacitor through the power control module when the main board battery works abnormally.

It can be seen that the intrusion detection circuit provided in this embodiment can record each illegal intrusion event suffered by the chassis in various scenarios such as a computer shutdown state, a startup state, battery power on, battery power off, and the like, so that the reliability of the intrusion detection circuit can be improved and the application scenario of the intrusion detection circuit can be expanded.

For a better understanding and appreciation of the inventive concepts, principles, advantages, etc., those skilled in the art will readily appreciate from the following detailed description of the embodiments with reference to the drawings and specific application scenarios.

The intrusion detection circuit provided by the embodiment of the invention will be described in detail.

The intrusion detection circuit is used for intrusion detection of a chassis, wherein the chassis can be various computer host chassis, such as a computer chassis, a server chassis and the like, and the application is not limited to the above. It will be appreciated that the chassis may also be a housing for a variety of electronic devices having storage and/or computing capabilities.

A computer host typically includes a chassis and hardware devices such as a motherboard, a processor, and a hard disk disposed within the chassis. For a computer host with high security requirements, an intrusion detection device for implementing a chassis intrusion detection function is also required.

As an example, the intrusion detection device may be disposed on a housing of the chassis, such as a side wall of the chassis, and connected to circuitry within the chassis via leads, such as pins preset on intrusion detection circuitry within the chassis. If the side wall of the case moves or is taken down, the side wall of the case can be sensed by the intrusion detection device, so that the level of the connected preset pins is changed. For example, if the side wall of the chassis is moved (e.g., opened), the intrusion detection device and the lead wire disposed inside the side wall of the chassis are also moved, and the level on the preset pin connected to the lead wire is also changed, so that the first signal i_ids is generated on the preset pin, where the first signal i_ids may indicate the open/close state of the chassis, and the first signal i_ids may be used as an input variable of the intrusion detection circuit provided in some embodiments of the present invention.

Referring to fig. 2, fig. 2 is a schematic structural diagram of an intrusion detection circuit according to an embodiment of the present invention.

As shown in fig. 2, the intrusion detection circuit includes: the detection module 120, the storage module 150, the power control module 200, and the holding capacitor 100.

Wherein the input of the detection module 120 receives a first signal i_ids generated by an intrusion detection device 520 arranged inside the side wall of the chassis, the detection module 120 is configured to generate a detection signal o_ids corresponding to the first signal i_ids and a status flag signal according to the received first signal i_ids, so as to use the status flag signal to represent the intrusion state of the chassis shell, where in an example, the status flag signal may be determined by a value in the detection signal o_ids, e.g. the detection signal o_ids is a high level signal, and the status flag signal may be a value for representing the high level, e.g. a value of "1", indicating that the chassis shell is intruded (moved). The storage module 150 receives the detection signal o_ids, an input end of the storage module 150 is connected to an output end of the detection module 120, and the storage module 150 is configured to perform an operation of writing or reading intrusion information according to the detection signal o_ids and the status flag signal, where a writing content when writing intrusion information is performed is used for determining at least the number of intrusion; for example, the number of times of performing the writing operation in the writing content may be used to determine the number of intrusions, and the information content of each writing recorded in the writing content (for example, the writing time corresponding to the information content written for the first time) may be used to determine the time of the intrusion; the power control module 200 is connected to a power supply, where the power supply includes a main board battery and a main board power supply that are located in the chassis, and is configured to configure the power supply of the intrusion detection circuit as the main board battery when the main board battery is operating normally and the main board power supply is not operating normally, and configure the power supply of the intrusion detection circuit as the main board power supply (e.g., VDD 18) when the main board power supply and the main board battery are operating normally; and one end of the holding capacitor 100 is grounded, and the other end of the holding capacitor is connected with the power control module 200, so that when the main board battery does not work normally, the power supply of the intrusion detection circuit is configured as the holding capacitor through the power control module.

The input terminal of the detection module 120 is connected to a first signal i_ids, which is generated by the intrusion detection device 520 disposed on the chassis shell side, and may indicate the open/close state of the chassis shell, specifically, if the chassis shell is opened, the first signal i_ids generated by the intrusion detection device 520 is in a first state, for example, a high level, and if the chassis shell is not opened, the first signal i_ids generated by the intrusion detection device 520 is in a second state, for example, a low level. The detection module 120 generates a detection signal o_ids corresponding to the first signal i_ids according to the received first signal i_ids, wherein a value corresponding to a level state in the detection signal o_ids can be used as a state flag signal to indicate whether the enclosure is intruded. (an alternative correspondence of the detection signal o_ids to the first signal i_ids is shown in fig. 4). Referring to fig. 4, when the rising edge of the first signal i_ids arrives, that is, when the enclosure of the enclosure is opened, the first signal is in a first state of high level, the detection module 120 correspondingly outputs a detection signal o_ids, and the high level in the detection signal o_ids can form a state flag signal to indicate that the enclosure is intruded at this time. It is understood that the specific correspondence between the detection signal o_ids and the first signal i_ids may be set according to practical situations, which is not limited in this application.

In some embodiments, the detection module 120 may identify whether the first signal i_ids is an outlier signal, such as a dither signal. Specifically, if the first signal i_ids is identified as a jitter signal, the detection module 120 no longer outputs the detection signal o_ids correspondingly, so that the anti-jitter function can be implemented.

As an example, the detection module 120 identifying whether the first signal i_ids is a dither signal includes:

judging whether the holding time after the first signal i_ids turns over is smaller than the preset time (debounce time);

if the first signal i_ids is less than the preset time, the detection module 120 does not output the corresponding detection signal o_ids including the status flag signal;

if the first signal i_ids is greater than or equal to the preset time, the detection module 120 outputs a corresponding detection signal o_ids including a status flag signal.

The input end of the storage module 150 is connected to the output end of the detection module 120, and the detection signal o_ids including the status flag signal output by the detection module 120 can be used as a write signal of the storage module 150 to perform an intrusion information writing operation. The write operation writing content (for example, a value corresponding to a high pulse signal when a chassis intrusion event occurs) may be used to determine the intrusion frequency, and the intrusion frequency may be obtained subsequently according to the write frequency corresponding to the write operation writing content in the write operation writing content.

In some embodiments, the Memory module 150 is a Static Random-Access Memory (SRAM), and the SRAM can always hold data stored in the SRAM as long as the SRAM is powered on, and the SRAM can hold the data stored in the SRAM without a refresh circuit. The memory module 150 may also be a memory that can store data after power failure, such as a flash memory.

In some embodiments, the writing content of the storage module 150 of the intrusion detection circuit may further include a writing time corresponding to the writing content, where the writing time may be used to determine the intrusion time, and the intrusion time may be obtained later according to the writing time. Specifically, for example, after the computer system is powered on, the intrusion time information may be obtained by reading the write time corresponding to the write content in the storage module 150.

The waveforms corresponding to the implementation process for determining the time of intrusion and the number of intrusions based on the written contents written in the storage module 150 may refer to fig. 4. The write time at each execution of the intrusion information writing is sequentially saved as the intrusion time by the storage module 150 such as SRAM, and the number of intrusions is judged by the number of recorded write times. The initial value stored in the storage module 150 defaults to "0", and the number of intrusions can be determined by the number of intrusion times written in the storage module 150. Assuming that n intrusion times are stored in the storage module 150, the number of chassis intrusions is n, and accordingly, the intrusion time at each intrusion can be determined.

For example, as shown in fig. 4, when 3 intrusion times are recorded at the time points t1, t2 and t3, the number of chassis intrusions is 3, and the time of each intrusion can be determined as t1, t2 and t3.

Referring to fig. 3, fig. 3 is a schematic structural diagram of an intrusion detection circuit according to another embodiment of the invention.

As shown in fig. 3, in some embodiments, the intrusion detection circuitry may also include a real-time clock 160 and a timing circuit 170. The real-time clock 160 is used for generating a clock signal, an input end of the timing circuit 170 is connected to an output end of the real-time clock 160, and an output end is connected to the memory module 150. The timing circuit 170 generates timing information according to the clock signal, and the timing information is used as writing content when the storage module 150 performs writing operation, so as to determine the intrusion time and the intrusion times, and finally store the timing information in the storage module 150.

The written content may be intrusion time corresponding to each case intrusion behavior occurrence written in the storage module 150 and a state flag signal of a detection signal corresponding to each intrusion time as shown in fig. 4; therefore, the number of invasion times and the corresponding invasion time of each invasion can be determined.

Referring to fig. 3, in some embodiments, the intrusion detection circuit may further include an electrostatic protection circuit 110, where the electrostatic protection circuit 110 is disposed between the intrusion detection device 520 and the detection module 120, specifically, an input terminal of the electrostatic protection circuit 110 is connected to the first signal i_ids, and an output terminal of the electrostatic protection circuit 110 is connected to an input terminal of the detection module 120. The electrostatic protection circuit 110 can prevent the sensitive circuit in the electronic device from being affected by electrostatic discharge (Electrostatic Discharge, ESD), and improve the safety and reliability of the circuit.

Referring to fig. 3, in some embodiments, the intrusion detection circuit may further include a voltage accumulation circuit 130, an input terminal of the voltage accumulation circuit 130 is connected to an output terminal of the detection module 120, an output voltage of the voltage accumulation circuit 130 may increase with an increase in the number of detection signals, and the output voltage of the voltage accumulation circuit 130 is used to convert into the number of intrusions. Specifically, the voltage accumulating circuit 130 includes a first capacitor, the first capacitor is a high-precision capacitor, the detection signal o_ids output by the detection module 120 is used as a control signal of the voltage accumulating circuit 130, each time the detection module 120 outputs the detection signal o_ids, based on the value of the status flag signal in the detection signal o_ids, the pulse control signal as the voltage accumulating circuit is equivalent to charging the first capacitor once with a constant current, so that the output voltage of the voltage accumulating circuit 130 is increased accordingly, the number of invasion times and the output voltage of the voltage accumulating circuit 130 are in a proportional relation, that is, each time the invasion information is written in the storage module 150, after the system is powered on, the written-in content is used as a control signal for controlling the voltage accumulating circuit, for example, the storage module 150 charges the first capacitor once according to the detection signal, when the invasion information is written in the system, the written-in content in the storage module 150 is a high-level signal generated at each time, the write-in content in the storage module 150 is output to the voltage accumulating circuit 130, the invasion information is sequentially charged in the first capacitor after the first invasion information is received, and the first capacitor is sequentially charged in the storage module 150. The intrusion number information may be obtained later through the output voltage of the voltage accumulating circuit 130.

Referring to fig. 3, in some embodiments, the intrusion detection circuit may further include an analog-to-digital conversion circuit 140, where an input terminal of the analog-to-digital conversion circuit 140 is connected to an output terminal of the voltage accumulation circuit 130, and is configured to convert the voltage output by the voltage accumulation circuit 130 from an analog signal to a digital signal, so as to determine the number of intrusions based on the digital signal. The converted voltage value corresponds to the invasion times one by one.

After the system is powered on (for example, when the motherboard power supply is working normally), the voltage accumulating circuit 130 charges the first capacitor in the voltage accumulating circuit 130 under the control of the writing content written in the storage module 150, and the analog-to-digital conversion circuit 140 converts the final voltage of the first capacitor into a digital signal. Therefore, the operations of the analog-to-digital conversion circuit 140 and the voltage accumulating circuit 130 may be performed when the main board power supply is operating normally; the operation of recording the intrusion information (performing the operation of writing the intrusion information into the storage module) may be performed under the condition that the main board power supply is normally operated, or under the condition that the main board power supply is abnormally operated but the main board battery is normally operated, or under the condition that the holding capacitor is normally operated, and the main board battery and the main board power supply are abnormally operated, so that intrusion events occurring in the case can be recorded under various scenes such as shutdown and startup states of the computer, power on and power off of the battery, and the like, thereby improving the reliability of the case intrusion detection circuit and the intrusion detection system.

It will be appreciated that the method for acquiring the number of intrusions may be performed by the voltage accumulating circuit 130The intrusion frequency information may be obtained by reading the effective data writing number in the memory module 150. The two intrusion times acquiring methods may be selected at the same time or alternatively, for example, in some embodiments, the storage module 150 is configured to acquire intrusion times according to the intrusion times and intrusion times (for example, as shown in fig. 4), where the intrusion detection circuit may not include the voltage accumulation circuit 130 and the analog-to-digital conversion circuit 140 related to the voltage accumulation circuit 130. In some other embodiments, the intrusion detection circuit includes a storage module 150, a voltage accumulation circuit 130, and an analog-to-digital conversion circuit 140, where the storage module 150 is configured to obtain write contents recorded corresponding to an intrusion time (for example, when an intrusion occurs, write contents of a high level are recorded corresponding to the storage module 150), the voltage accumulation circuit 130 is configured to output a final voltage obtained by charging the first capacitor according to the write contents recorded by the storage module 150, thereby outputting the final voltage to the analog-to-digital conversion circuit 140, and the analog-to-digital conversion circuit 140 calculates the number of intrusions according to a corresponding resolution, for example, the resolution converted by the analog-to-digital conversion circuit 140 is converted into a binary number of 3 bits, then according to the final voltage and 2 ³ Dividing to calculate the converted voltage value, and further calculating the invasion times according to the voltage value, which can be expressed as: v' =v/2 ³ Then, the number of intrusions is obtained according to n=v '/Δv, where n represents the number of intrusions, V' represents a digital signal that can be used by the digital domain signal converted by the analog-to-digital conversion circuit 140, V represents a final voltage of the first capacitor in the voltage accumulation circuit 130, and Δv is a variation amount at each voltage accumulation.

It can be understood that the two methods may be simultaneously selected, that is, the memory module 150 is used for acquiring the intrusion time and the intrusion times, the memory module 150 acts on the voltage accumulation circuit 130 to output the final voltage, so that the intrusion times are calculated by combining the analog-to-digital conversion circuit 140, and the intrusion times respectively acquired by the memory module 150 and the voltage accumulation circuit 130 can be mutually verified, so as to further improve the reliability and accuracy of the intrusion detection circuit.

Referring to fig. 4, fig. 4 is a waveform diagram of determining intrusion time and intrusion times by using time information stored in a memory module according to an embodiment of the present invention.

Fig. 4 shows waveforms for determining intrusion time and intrusion times using time information stored in the memory module 150 (in the drawings, SRAM memory). In the figure, the storage module 150 sequentially stores the time of each illegal intrusion, and further obtains the intrusion times through the time number recorded by the storage module 150. In the figure, i_ids is a first signal generated by the intrusion detection device 520 arranged on the chassis shell side, when the chassis shell is punched, the intrusion detection device 520 also acts so as to change the first signal i_ids from a low level to a high level, and when the chassis shell is restored to the original position, the first signal i_ids is changed from the high level to the low level again; the o_ids is a detection signal including a status flag signal, specifically, a high-level pulse signal in the illustration, which is generated by the detection module 120 according to the received first signal i_ids, and each time the first signal i_ids changes from low level to high level, the detection module 120 generates one high-level pulse signal, wherein the first signal i_ids is shown to be changed from low level to high level three times in total, and the corresponding detection signal o_ids generates three high-level pulses; the Time signal is a clock signal generated by the real-Time clock 160 oscillation circuit; the Addr signal is an address signal of the memory module 150; the Data signal is a Data signal of the memory module 150, that is, according to the writing content of the detection signal o_ids written into the memory module 150, the detection signal o_ids is used as a writing signal of the memory module 150, and when the detection signal o_ids arrives, the memory module 150 performs write once, and the corresponding Addr signal and the Data signal flip, and the memory module 150 defaults to "0". The intrusion times and intrusion times may be determined according to the time data recorded in the storage module 150, and if n intrusion times are stored in the storage module 150, the number of chassis intrusion times may be obtained as n.

Referring to fig. 5, fig. 5 is a waveform diagram of determining the intrusion count by using the output voltage of the voltage accumulating circuit according to the embodiment of the invention.

In the case shown in fig. 5, the writing content stored in the memory module 150 is used as a control signal of the voltage accumulating circuit, so that the control signal acts on the voltage accumulating circuit 130 to output a final voltage, and the intrusion frequency is determined according to the analog-to-digital converting circuit 140. Specifically, the analog-to-digital conversion circuit 140 outputs the digital code to determine the intrusion times, the pulse of the detection signal o_ids controls the high-precision current to charge the first capacitor, so as to obtain the output voltage vo_ids of the voltage accumulating circuit 130, the first capacitor is charged once every time an illegal intrusion occurs, the voltage variation of the output voltage vo_ids of the voltage accumulating circuit 130 is Δv every time an illegal intrusion occurs, if n times of illegal intrusion occurs, the voltage of the output voltage vo_ids of the voltage accumulating circuit 130 is n×Δv, and the output voltage vo_ids of the voltage accumulating circuit 130 can be converted into the corresponding digital domain signal adc_dout through the analog-to-digital conversion circuit 140, so that the number of times of the case intrusion is obtained according to n×Δv.

In summary, the writing content stored in the storage module 150 may be intrusion time of each intrusion or intrusion information (for example, high pulse representing intrusion) corresponding to each intrusion written according to the detection signal and the status flag signal, so that the number of times of intrusion and the time of intrusion may be determined according to the intrusion time and the writing number of times corresponding to the recorded intrusion time, or the first capacitor in the voltage accumulating circuit 130 may be charged according to the intrusion information corresponding to each intrusion, and then the final voltage in the first capacitor output by the voltage accumulating circuit 130 may be converted into a digital domain signal by the analog-to-digital converting circuit 140, so as to determine the number of times of intrusion.

The power control module 200 is connected to a battery and a main board power supply inside the chassis, and is configured to switch the intrusion detection circuit to use the battery for power supply when the battery works normally and the main board power supply works abnormally, and to use the main board power supply as a power supply of the intrusion detection circuit when the main board power supply and the main board battery work normally. In particular, in some embodiments, the battery is a motherboard battery, which is generally used to record the time of the computer system and maintain the accuracy of the computer system clock, and in this embodiment, the motherboard battery is also used to supply power to the intrusion detection circuit, and in particular, to supply power to each functional module in the intrusion detection circuit, for example, the electrostatic protection circuit 110, the detection module 120, the voltage accumulation circuit 130, the storage module 150, the real-time clock 160, the timing circuit 170, and so on.

Referring to fig. 3, as a specific implementation manner, the power control module 200 includes a power on/off reset circuit 210, a power switching circuit 220, and a power voltage detection circuit 230, where the power voltage detection circuit 230 is configured to detect voltages of respective power supplies to determine whether the respective power supplies can normally supply power, and the power on/off reset circuit 210 and the power switching circuit 220 are configured to switch each functional module of the intrusion detection circuit to a certain power supply capable of normally supplying power according to a detection result of the power voltage detection circuit 230. In this embodiment, the power supply may be a battery in the chassis and/or a VDD18 power domain on the motherboard, that is, a motherboard battery or motherboard power. In other embodiments, the power supply may further include a holding capacitor C inside the chassis _VDDI 。

In some embodiments, the power-on-power-off reset circuit 210 is configured to control the first switch 201 to be turned on or off; the power switching circuit 220 is used for controlling the second switch 202 and the third switch 203 to be opened and closed. The first switch 201 is disposed on a loop between the power supply end of the intrusion detection circuit and the main board battery 510; the second switch 202 is disposed on a loop between the intrusion detection circuit power supply terminal and the first switch 201; the third switch 203 is disposed on the loop between the intrusion detection circuit power supply terminal and the VDD18 power domain on the motherboard. The power supply end of the intrusion detection circuit is connected to the main board battery 510 through the first switch 201 and the second switch 202, if the power supply voltage detection circuit 230 detects that the main board battery 510 can work normally, and when the main board power supply is in abnormal work, the power on-off reset circuit 210 controls the first switch 201 to be in a closed state, the power supply switching circuit 220 controls the second switch 202 to be in a closed state and the third switch 203 to be in an open state, and the intrusion detection circuit supplies power through the main board battery 510; of course, when the power supply voltage detection circuit 230 detects that both the main board battery 510 and the main board power supply can work normally, the power-on/off reset circuit 210 controls the first switch 201 to be in an open state, the power supply switching circuit 220 controls the second switch 202 to be in an open state, and the third switch 203 to be in a closed state, and the intrusion detection circuit can supply power through the main board power supply at this time.

It can be seen that, the intrusion detection circuit provided in this embodiment can record the time of each illegal intrusion suffered by the chassis even when the computer is in the shutdown state, and each illegal intrusion time corresponds to one illegal intrusion event, so that the illegal intrusion can be detected when the computer is in the shutdown state, the reliability of the intrusion detection circuit is improved, and the application scenario of the intrusion detection circuit is expanded.

In some embodiments, the intrusion detection circuit provided by the present disclosure may also operate in a battery power-down state, and even if an illegal intruder takes out the main board battery 510, the intrusion detection circuit may still realize the functions of recording intrusion time, intrusion times, and the like. In order to be able to operate in a battery powered down state, the intrusion detection circuitry further comprises: holding capacitor C _VDDI . The holding capacitor C _VDDI One end is grounded, and the other end is connected with the power control module 200. The power control module 200 is further configured to switch the intrusion detection circuit to use the holding capacitor C when the motherboard battery 510 cannot normally operate _VDDI And (5) supplying power.

The holding capacitor C _VDDI The other end is connected with the power control module 200, specifically, the holding capacitor C _VDDI Is connected to the VDD18 power domain on the motherboard power-up via a third switch 203, or the holding capacitor C _VDDI The other end of which is connected to the positive electrode of the main board battery 510 via the first switch 201 and the second switch 202. Holding capacitor C _VDDI And the circuit is used for supplying power to the intrusion detection circuit when the main board battery cannot work normally.

In some embodiments, when the main board battery 510 is operating normally, each functional module in the intrusion detection circuit is powered by the main board battery 510, and at this time, the first switch 201 controlled by the power on/off reset circuit 210 is closed, and the second switch 202 controlled by the power switching circuit 220 is also closed, and the intrusion detection circuit operates in the VBAT voltage domain provided by the main board battery 510, and at this time, the intrusion times and intrusion time can be detected even if the computer system is turned off.

In some embodiments, when the main board battery 510 cannot work normally, for example, the main board battery 510 is taken out, the first switch 201 controlled by the power-on-power-off reset circuit 210 is turned off, and the voltage of the VBATI voltage domain and the voltage of the VDDI voltage domain can pass through C _VDDI The static protection circuit 110, the detection module 120, the voltage accumulation circuit 130, the analog-to-digital conversion circuit 140, the storage module 150, the real-time clock 160, the timing circuit 170 and other functional modules in the intrusion detection circuit can work normally.

In some embodiments, the holding capacitance C _VDDI The capacitance value of (2) is in the range of 0.5uF or more, preferably 0.5uF to 20uF, although in other embodiments, a capacitance value of 20uF or more may be selected. The reset (reset) current of 288bytes memory module 150 in the RTC is currently 70mA@50ns, and the accumulated charge I is approximately 3.5x10 ^-9 . The normal voltage of VBAT voltage domain provided by main board battery 510 is typically 1.2V-1.5V, and according to ixt= C x Δv (e.g. 1.5V-1.2v=0.3V), it is known that power is lost in main board battery 510 and capacitor C is maintained _VDDI A holding capacitor C having a capacitance value C of 1uF in a power supply state _VDDI The maximum number of intrusion detections t is: 1 uFx 0.3V/3.5x10 ^-9 =85.7 (times). Further, if the capacitor C is to be held _VDDI The capacitance value of (2) is increased from 1uF to 10uF, so that 857 intrusion detection records can be recorded at most, and the application scenario of detecting the intrusion of the chassis in the power-down state of the main board battery 510 can be satisfied.

Referring to fig. 6, fig. 6 is a flowchart of power supply selection of an intrusion detection circuit according to an embodiment of the present invention.

As shown in fig. 6, the power supply selection step of the intrusion detection circuit includes:

step S101, judging whether the main board battery voltage VBAT is normal, if so, executing step S103, and if not, executing step S102;

Step S102, the processThe power supply of the intrusion detection circuit is switched to a holding capacitor C _VDDI ；

Step S103, judging whether the motherboard voltage VDD18 is normal, if the motherboard voltage VDD18 is normal, executing step S104, and if the motherboard voltage VDD18 is abnormal, executing step S105;

step S104, switching the power supply of the intrusion detection circuit to a main board voltage VDD18;

step S105, switching the power supply of the intrusion detection circuit to the motherboard battery voltage VBAT.

In each judging step, the output voltage of each power supply source by the power supply module can be used for judging whether each power supply source is normal or not. As an example, in step S101, when the motherboard battery voltage VBAT is greater than 1.2V, the motherboard battery voltage VBAT is normal, and in step S103, when the motherboard voltage VDD18 is greater than 1.5V, the motherboard voltage VDD18 is normal, and when the motherboard voltage VDD18 is less than 1.45V, the motherboard voltage VDD18 is abnormal. (there are also cases where more than 1.45V and less than 1.5V).

It can be seen that the intrusion detection circuit provided in this embodiment can record intrusion events occurring in the chassis in the state of the computer, and further set the holding capacitor C _VDDI The intrusion event generated by the case can be further recorded under the condition that the main board battery is taken out, so that the reliability and the safety of the detection circuit can be improved, and the application range of the detection circuit is expanded.

In an embodiment of the present invention, an intrusion detection system is further provided, including the intrusion detection circuit and the control system 300 provided in the embodiments of the present application.

The first input terminal of the control system 300 is connected to the output terminal of the storage module 150, and is configured to calculate the number of intrusions according to the number of write operations of the storage module 150, and/or calculate the time of intrusion according to the time information stored in the storage module 150.

The second input end of the control system 300 is connected to the output end of the analog-to-digital conversion circuit 140, and is used for calculating the number of intrusion according to the digital voltage signal output by the analog-to-digital conversion circuit 140.

The control signal output end of the control system 300 is connected with the detection module 120, and is used for controlling the detection module 120 to operate. Specifically, the control system 300 outputs an i_ids_en signal to control the enable port of the detection module 120, and the control system 300 outputs an i_ids_rst signal to control the reset port of the detection module 120.

In one embodiment, the writing content when the storage module performs the writing operation is timing information, and the control system 300 is configured to calculate at least the number of invasions according to the writing content when the storage module performs the writing of the invasiveness information, including:

In one embodiment, the control system 300 further includes a second input end, where the second input end is connected to an output end of the analog-to-digital conversion circuit of the intrusion detection circuit, and is configured to calculate the number of intrusions according to the writing content written by the storage module and the digital signal converted by the analog-to-digital conversion circuit.

FIG. 7 is a flowchart illustrating an intrusion detection system according to an embodiment of the present invention. Referring to fig. 7, the workflow of the intrusion detection system may include the steps of:

step S200, the battery is powered on.

The battery is electrified, so that the intrusion detection circuit can work normally, and the working voltage of the battery can be between 0V and 1.5V.

In step S201, a "1" is stored in the storage module.

The memory content in the memory module may initialize a "1", although in other embodiments, the memory content page in the memory module may initialize a "0". Initializing the storage content in the storage module facilitates writing corresponding writing content in the storage module.

Step S202, the control system is started and works normally.

After the power supply of the intrusion detection circuit supplies power smoothly and the storage module is initialized, the computer system can be started, and other power supplies are powered on to work the computer system.

In step S203, the software sets the reset signal of the status flag signal to "1", clears the status flag signal, and sets the reset signal of the memory module to "1", clears the content stored in the memory module.

The software may be implemented for a control system in an intrusion detection system.

The reset signal of the state flag signal is used for guaranteeing the stability of the circuit operation when the intrusion detection circuit is started. The value of the status flag signal (status flag bit) is determined based on the detection signal generated by the first signal.

In step S204, the intrusion detection circuit is turned on to perform chassis intrusion detection.

At this time, the intrusion detection circuit can be turned on by default, that is, when the control system (computer system) is turned on, the intrusion detection circuit is automatically turned on to perform intrusion detection and recording.

In step S205, a chassis intrusion event occurs.

The case intrusion event occurs, which indicates that the case is moved, and at this time, a first signal is generated, and the detection module receives the first signal and outputs a detection signal, where the detection signal may include a status flag signal, and since the case intrusion event occurs at this time, a value of the status flag signal included in the detection signal may be represented by "1".

In step S206, it is detected whether the status flag signal is "1". If yes, step S207 is performed, and if no, step S204 is performed.

In step S207, the storage module performs an operation of writing the intrusion time, and writes the intrusion time into the storage module.

When the state flag signal (intrusion flag bit) is detected to be 1, the case intrusion event is indicated to occur at the moment, and the storage module is triggered to write the intrusion event into the storage module for subsequent intrusion time determination and intrusion frequency determination.

In step S208, the software detects whether the status flag signal is "1". If yes, step S209 is performed, and if no, step S204 is performed.

In step S209, the software reads the intrusion reading flag bit.

After outputting the detection signal including the status flag signal based on the first signal, the intrusion detection circuit can determine the number of intrusions and the time of the intrusions based on the output signal of the hardware circuit, i.e. the intrusion detection circuit, and can also control the control system through software, and combine the hardware circuit to realize the determination of the final number of intrusions and the time.

The intrusion reading zone bit is used for controlling the moment of reading the written content in the storage module by the software side so as to ensure the reliability of the read written content.

In step S210, the software detects whether the read intrusion reading flag bit is "0". If yes, step S211 is executed, and if no, step S209 is executed.

Step S211, after the state flag signal is delayed by 1 ms or more, the intrusion reading flag position "1".

Because the intrusion reading flag bit is used for controlling the moment of reading the writing content in the storage module by the software side so as to ensure the reliability of the read writing content, when the intrusion reading flag bit is detected to be 0, in order to ensure the accurate reading of the writing content in the storage module, after the state flag signal delay is more than or equal to 1 millisecond, the intrusion reading flag bit is 1, instead of standing the horse to read the writing content in the storage module at the moment of detecting the intrusion reading flag bit to be 1, so as to prevent the misread and the misread of the writing content.

In step S212, the software reads the written content in the storage module.

The written content in the memory module is considered invalid data if it is all "0" or all "1".

In step S213, the software will intrusion read flag location "0".

At this time, the intrusion reading flag position "0" is set, and the software-side reading operation is stopped, and the next time the status flag signal is detected to be "1", the next time the status flag signal is delayed by 1 ms or more, and then the reading operation is performed again.

In step S214, the software sets the reset signal of the status flag signal to high pulse, and clears the status flag signal.

After the written content in the memory module is read once, the state flag signal is cleared, the initial working state of the circuit is restored, and preparation is made for the next detection.

In step S215, the software detects whether the intrusion enable signal is set to "0", and if so, performs step S216, and if not, performs step S204.

The intrusion enable signal is used for indicating whether the intrusion detection circuit is in a working state, namely whether the intrusion detection circuit is still detecting the occurrence of a case intrusion event, if so, continuing to execute the steps of writing the intrusion time in the storage module and reading the intrusion time stored in the storage module by the software, and if not, stopping the detection of the intrusion circuit.

Step S216, the detection of the chassis intrusion event is ended.

It can be seen that, in the foregoing embodiment, in the process of detecting the intrusion detection circuit, the intrusion detection circuit is automatically defaulted to be in an on state when the system is turned on, so that the intrusion detection circuit is convenient to use, and of course, in other embodiments, in order to facilitate detection of a case intrusion event under the condition that the system is turned off or the battery is powered down, the on state of the intrusion detection circuit may be controlled by using an intrusion enable signal.

Referring to fig. 8, fig. 8 is another flowchart of an intrusion detection system according to an embodiment of the present invention. As shown in fig. 8, the workflow of the intrusion detection system may include the steps of:

in step S300, the intrusion enable signal is initialized.

In order to make the intrusion detection circuit not affected by the power-on of the system, the intrusion detection circuit can be started at any time, so that the intrusion detection circuit is controlled to be in an on state by using the initialization setting of the intrusion enable signal, for example, the intrusion enable signal is initialized to be 1, and the intrusion detection circuit is controlled to be in an on state.

Step S301, the software detects whether the intrusion enable signal is "0", if so, step S304 is performed, and if not, step S302 is performed.

In order to ensure that the intrusion enable signal can control the intrusion detection circuit to be in an on state, the software side can detect the value of the intrusion enable signal.

In step S302, the software sets the reset signal of the status flag signal to a high pulse, and clears the status flag signal.

The software ensures the basic operating environment of the intrusion detection circuitry so that the intrusion detection circuitry is in a stable circuit operating environment.

In step S303, the intrusion enable signal is set to "1".

If the software detects that the initial setting of the intrusion enable signal is not '1', the hardware circuit sets the intrusion enable signal to '1', and the intrusion detection circuit is ensured to be always in an on state.

Step S304, the intrusion detection circuit is started to perform the intrusion detection of the chassis.

At this time, the intrusion enable signal is set to "1", and the intrusion detection circuit is turned on to perform intrusion detection and recording.

In step S305, a chassis intrusion event occurs.

In step S306, it is detected whether the status flag signal is 1. If yes, step S307 is performed, and if no, step S304 is performed.

In step S307, the storage module performs an operation of writing the intrusion time, and writes the intrusion time into the storage module.

In step S308, the software detects whether the status flag signal is "1". If yes, step S309 is executed, and if no, step S304 is executed.

In step S309, the software reads the intrusion reading flag bit.

The intrusion reading zone bit is used for controlling the software side to read the writing content stored in the storage module.

In step S310, the software detects whether the read intrusion reading flag bit is "0". If yes, step S311 is performed, and if no, step S309 is performed.

In step S311, after the status flag signal is delayed by 1 ms or more, the intrusion reading flag position "1" is set.

When the intrusion reading flag bit is detected to be 0, in order to ensure accurate reading of the written content in the storage module, after the state flag signal delay is greater than or equal to 1 millisecond, the intrusion reading flag bit is 1, instead of immediately reading the written content in the storage module at the moment when the intrusion reading flag bit is detected to be 1, and error reading and missing reading of the written content are prevented.

In step S312, the software reads the written contents in the storage module.

In step S313, the software will intrusion read flag location "0".

In step S314, the software sets the reset signal of the status flag signal to high pulse, clears the status flag signal.

Since the setting of the intrusion enable signal is initialized by the software and the hardware, the ending condition of the intrusion behavior detection of the chassis is determined by the setting conditions of the software and the hardware, and the intrusion enable signal is not detected again.

In the embodiment of the application, an electronic device is further provided, and the electronic device may include the intrusion detection circuit provided in the embodiment of the application. As an example, the electronic device in embodiments of the present application may be various types of computer hosts, including, but not limited to, desktop hosts, server hosts, and the like.

In the embodiment of the application, a chip is also provided, and the chip can comprise the intrusion detection circuit provided in the embodiment of the application. As an example, the intrusion detection circuit provided by the embodiment of the application is packaged into a chip and welded on the computer motherboard, so that the intrusion detection circuit can be prevented from being tampered or removed, and the security of the computer system is improved.

The foregoing describes several embodiments of the present invention, and the various alternatives presented by the various embodiments may be combined, cross-referenced, with each other without conflict, extending beyond what is possible embodiments, all of which are considered to be embodiments of the present invention disclosed and disclosed.

Although the embodiments of the present application are disclosed above, the present application is not limited thereto. Various changes and modifications may be made by one skilled in the art without departing from the spirit and scope of the invention, and the scope of the invention shall be defined by the appended claims.

Claims

1. An intrusion detection circuit, comprising:

2. The intrusion detection circuit of claim 1, wherein the intrusion detection circuit further comprises:

and the input end of the voltage accumulation circuit is connected with the output end of the detection module, and is configured to increase the output voltage of the voltage accumulation circuit along with the increase of the number of the detection signals, and the output voltage of the voltage accumulation circuit is used for converting the number of times of invasion.

3. The intrusion detection circuit of claim 2 wherein the voltage accumulation circuit comprises:

and the first capacitor is configured to charge once when the detection module outputs the detection signals once, so that the output voltage of the voltage accumulation circuit increases along with the increase of the number of the detection signals.

4. The intrusion detection circuit of claim 2, wherein the intrusion detection circuit further comprises:

and the input end of the analog-to-digital conversion circuit is connected with the output end of the voltage accumulation circuit and is configured to convert the output voltage of the voltage accumulation circuit from an analog signal to a digital signal so as to determine the invasion times based on the digital signal.

5. The intrusion detection circuit of claim 1, wherein the memory module is a static random access memory or a flash memory.

6. The intrusion detection circuit of claim 1, wherein the intrusion detection circuit further comprises:

a real-time clock circuit configured to generate a clock signal;

and the timing circuit is connected with the output end of the real-time clock circuit, the output end of the timing circuit is connected with the storage module and is configured to generate timing information according to the clock signal, and the timing information is used as writing content when the storage module executes writing operation so as to determine the invasion time and the invasion times.

7. The intrusion detection circuit of claim 1 wherein the power control module further comprises:

the first switch is arranged on a loop between the holding capacitor and the positive electrode of the main board battery;

a second switch provided in a circuit between the holding capacitor and the first switch;

a third switch arranged on a loop between the holding capacitor and a power domain on the main board;

a power-on/power-off reset circuit configured to control the first switch to be turned on/off;

and the power supply switching circuit is configured to control the opening and closing of the second switch and the third switch.

8. The intrusion detection circuit according to claim 1, wherein the capacitance value of the holding capacitance has a value range of greater than or equal to 0.5uF.

9. An intrusion detection system, comprising: an intrusion detection circuit according to any one of claims 1-8, and a control system;

10. The intrusion detection system according to claim 9, wherein the write contents when the storage module performs the write operation are timing information, and the control system for calculating at least the number of intrusions from the write contents when the storage module performs the write operation of the intrusion information includes:

11. The intrusion detection system according to claim 9, wherein the control system further comprises a second input terminal connected to an output terminal of the analog-to-digital conversion circuit of the intrusion detection circuit for counting the number of intrusions based on the writing contents written by the storage module and the digital signals converted by the analog-to-digital conversion circuit.

12. A chip, comprising: an intrusion detection circuit according to any one of claims 1-8.

13. An electronic device, comprising: an intrusion detection circuit according to any one of claims 1-8.