CN116340954B - Data security channel establishment method, system control processor and starting firmware - Google Patents

Abstract

This application belongs to the field of communication security technology and discloses a data security channel establishment method, a system control processor and startup firmware. The method includes: generating a startup firmware key hash based on a pre-stored startup firmware key, and sending the startup firmware key hash to the startup firmware. Send a request message; receive the response message sent by the startup firmware, and determine whether the real startup firmware key hash and the startup firmware key hash are consistent; if they are consistent, the system controls the processor key hash and the pre-stored startup The firmware key generates a shared key; sends the shared key to the startup firmware; receives an encrypted response message encrypted by the shared key from the startup firmware; decrypts the encrypted response message according to the shared key in the system control processor, After successful decryption, subsequent messages sent to the startup firmware are encrypted based on the shared key. This application can achieve the effect of improving the security and confidentiality of data transmission between the system control processor and the startup firmware.

Description

A data security channel establishment method, system control processor and startup firmware

Technical field

The present application relates to the field of communication security technology, and in particular to a method for establishing a data security channel, a system control processor and startup firmware.

Background technique

In the current Power processor architecture, the startup firmware HostBoot is a module used to initialize the processor and BUS bus and initialize the memory. The system control processor SCP is a module used to load HostBoot and configure the CPU status. However, the system control processor and Data communication between startup firmware is in clear text, which means that an attacker can obtain the data between the system control processor and startup firmware through physical means, or inject illegal attacks to cause misidentification of the system control processor or startup firmware. information, causing serious security vulnerabilities.

Therefore, there is a problem in the existing technology that data communication between the system control processor and the startup firmware is performed in plain text and is vulnerable to illegal attacks, resulting in low data transmission security and poor confidentiality.

Contents of the invention

This application provides a data security channel establishment method, a system control processor and startup firmware, which can improve the security and confidentiality of data transmission between the system control processor and the startup firmware and avoid information leakage.

In the first aspect, embodiments of the present application provide a method for establishing a data security channel, which method includes:

Generate a startup firmware key hash based on the startup firmware key pre-stored in the system control processor, and send a request message for requesting the establishment of a secure channel to the startup firmware;

Receive the response message sent by the startup firmware, the response message includes the real startup firmware key hash of the startup firmware, and determine whether the real startup firmware key hash and the startup firmware key hash are consistent;

If they are consistent, the shared key is generated based on the system control processor key hash in the system control processor and the pre-stored startup firmware key; if they are inconsistent, the secure channel establishment fails;

After generating the shared key, send the shared key to the boot firmware;

Receive an encrypted response message encrypted with a shared key to start the firmware;

The encrypted response message is decrypted according to the shared key in the system control processor, and after the decryption is successful, subsequent messages sent to the startup firmware are encrypted according to the shared key.

Further, the above method of generating a startup firmware key hash based on the startup firmware key pre-stored in the system control processor includes: calling the hash algorithm by calling the trusted platform module hardware algorithm interface on the system control processor. The hash algorithm generates a boot firmware key hash from the boot firmware key prestored in the system control processor.

Further, the above hash algorithm is the sha256 hash algorithm.

Further, the above method of generating a shared key based on the system control processor key hash in the system control processor and the pre-stored startup firmware key includes: based on the system control processor key hash and the pre-stored startup firmware key in the system control processor. The pre-stored boot firmware key generates a shared secret key using a symmetric encryption algorithm.

Further, after generating the shared key above, the shared key is sent to the startup firmware, including:

After the shared key is generated, the shared key is encrypted according to the startup firmware key pre-stored in the system control processor to obtain the ciphertext, and the ciphertext is sent to the startup firmware.

Further, the above-mentioned symmetric encryption algorithm is AES256 symmetric encryption algorithm or Shangmi No. 1 algorithm.

In a second aspect, embodiments of the present application provide a system control processor, which includes:

A hash module, configured to generate a hash of the startup firmware key based on the startup firmware key pre-stored in the system control processor, and send a request message for requesting the establishment of a secure channel to the startup firmware;

The judgment module is used to receive the response message sent by the startup firmware. The response message includes the real startup firmware key hash of the startup firmware, and determines whether the real startup firmware key hash and the startup firmware key hash are consistent;

a shared key generation module for generating a shared key based on the system control processor key hash in the system control processor and the pre-stored startup firmware key;

The sending module is used to send the shared key to the startup firmware after generating the shared key;

The message receiving module is used to receive the encrypted response message encrypted by the shared key for starting the firmware;

The decryption module is used to decrypt the encrypted response message based on the shared key in the system control processor, and after successful decryption, encrypt subsequent messages sent to the startup firmware based on the shared key.

In the third aspect, embodiments of the present application provide a method for establishing a data security channel, which method includes:

After receiving a request message sent by the system control processor to request the establishment of a secure channel, send a response message to the system control processor, where the response message includes the hash of the real startup firmware key that starts the firmware;

The response message is used to instruct the system control processor to determine whether the real startup firmware key hash is consistent with the startup firmware key hash in the system control memory. When it is determined that they are consistent, the system control processor in the system control processor Key hash and pre-stored boot firmware key to generate shared secret;

Obtain the shared key sent by the system control processor; use the shared key to encrypt the response message, obtain the encrypted response message, and send the encrypted response message to the system control processor.

Further, the response message is also used to instruct the system control processor to encrypt the shared key according to the startup firmware key pre-stored in the system control processor after generating the shared key, obtain the ciphertext, and send the ciphertext to Start firmware;

The above-mentioned method of obtaining the shared key sent by the system control processor includes:

Receive the ciphertext sent by the system control processor;

Decrypt the ciphertext according to the startup firmware key in the startup firmware to obtain the shared key.

In a fourth aspect, embodiments of the present application provide startup firmware, which includes:

A response module, configured to send a response message to the system control processor after receiving a request message sent by the system control processor for requesting the establishment of a secure channel. The response message includes a hash of the real startup firmware key that starts the firmware. ;

The response message is used to instruct the system control processor to determine whether the real startup firmware key hash is consistent with the startup firmware key hash in the system control memory. When it is determined that they are consistent, the system control processor in the system control processor Key hash and pre-stored boot firmware key to generate shared secret;

The receiving module is used to obtain the shared key sent by the system control processor;

The message encryption module is used to encrypt the response message using the shared key, obtain the encrypted response message, and send the encrypted response message to the system control processor.

To sum up, compared with the existing technology, the beneficial effects brought by the technical solutions provided by the embodiments of the present application at least include:

The embodiment of the present application provides a method for establishing a data security channel. This method generates the same shared key in the system control processor and the startup firmware, thereby establishing a data security channel between the two, so that the system control processor and the startup firmware The shared key can be used to encrypt data packets before transmission when starting the firmware. This prevents the transmitted data from being exposed to attackers in plain text, improves the security and confidentiality of the transmitted data, and avoids the possibility of information leakage. Condition.

Secondly, this application makes the shared key include information on both ends of the system control processor key hash and the boot firmware key, so that when the shared key is attacked or tampered with during transmission, whether it is the system control processor or the boot firmware Errors in the shared key can be discovered during decryption, thereby discarding the attacked data in a timely manner, avoiding decryption of data that may have been tampered with errors, and further improving the security of data transmission between the system control processor and startup firmware.

Description of the drawings

Figure 1 is a flow chart of a method for establishing a data security channel provided by an exemplary embodiment of the present application.

Figure 2 is a schematic structural diagram of a system control processor provided by an exemplary embodiment of the present application.

Figure 3 is a flow chart of a method for establishing a data security channel provided by another exemplary embodiment of the present application.

Figure 4 is a flow chart of decryption steps provided by an exemplary embodiment of the present application.

Figure 5 is a schematic structural diagram of startup firmware provided by an exemplary embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.

Referring to Figure 1, an embodiment of the present application provides a data security channel establishment method. This method is a data security channel establishment method executed by a system control processor. It is described from a subject perspective for the system control processor. The method may include :

Step S11: Generate a startup firmware key hash based on the startup firmware key pre-stored in the system control processor, and send a request message for requesting the establishment of a secure channel to the startup firmware. The request message is used to instruct the startup firmware to generate a response message.

The pre-stored startup firmware key is a key in the startup firmware that is pre-stored in the system control processor. The system control processor and the startup firmware each contain their own keys and key hashes, but they do not have each other's. Therefore, when establishing a data security channel, the key to the startup firmware needs to be stored in the system control processor in advance.

Step S12: Receive the response message sent by the startup firmware. The response message includes the real startup firmware key hash of the startup firmware, and determine whether the real startup firmware key hash and the startup firmware key hash are consistent.

Step S13, if they are consistent, generate a shared key based on the system control processor key hash in the system control processor and the pre-stored startup firmware key; if they are inconsistent, the secure channel establishment fails.

The above determination step is to determine whether the startup firmware key pre-stored in the system control processor is trustworthy. Because the startup firmware key is used to generate a shared key, it must be ensured that the pre-stored startup firmware key is the same as the startup firmware key in the startup firmware. are the same. If the shared key generated in this way is attacked or tampered with, the problem will not be noticed until the firmware is started.

Step S14: After generating the shared key, send the shared key to the startup firmware. Specifically, step S14 is to enable the startup firmware to encrypt the response message using the shared key, generate an encrypted response message and send it back to the system control processor.

Step S15: Receive an encrypted response message encrypted by the shared key for starting the firmware.

Step S16: Decrypt the encrypted response message according to the shared key in the system control processor. After the decryption is successful, encrypt subsequent messages sent to the startup firmware according to the shared key.

Specifically, the startup firmware uses the shared key to decrypt the encrypted message sent by the system control processor, thereby completing secure communication between the system control processor and the startup firmware.

The above embodiment provides a method for establishing a data security channel. This method generates the same shared key in the system control processor and the startup firmware, thereby establishing a data security channel between the two, so that the system control processor and the startup firmware The firmware can use this shared key to encrypt data messages before transmitting them, which prevents the transmitted data from being exposed to attackers in plain text, improves the security and confidentiality of the transmitted data, and avoids information leakage. .

Secondly, this application makes the shared key include information on both ends of the system control processor key hash and the boot firmware key, so that when the shared key is attacked or tampered with during transmission, whether it is the system control processor or the boot firmware Errors in the shared key can be discovered during decryption, thereby discarding the attacked data in a timely manner, avoiding decryption of data that may have been tampered with errors, and further improving the security of data transmission between the system control processor and startup firmware.

In some embodiments, generating a boot firmware key hash based on a boot firmware key pre-stored in the system control processor may include the following steps:

The hash algorithm is called by calling the trusted platform module hardware algorithm interface on the system control processor, and the startup firmware key pre-stored in the system control processor is used to generate a startup firmware key hash through the hash algorithm.

Among them, the Trusted Platform Module hardware algorithm interface is the TPM (Trusted Platform Module) hardware algorithm interface, which is an international standard for secure cryptographic processors and is designed to be processed using a dedicated microcontroller integrated in the device. The encryption key in the device; the hash algorithm is an algorithm that can calculate the fixed-length string corresponding to a digital message.

The above embodiment uses a hash algorithm to calculate the hash of the key, thereby achieving comparison of the hash of the pre-stored startup firmware key and the hash of the real startup firmware key, thereby being able to determine the pre-stored startup firmware key Only when the pre-stored key hash is consistent with the real key hash, it means that the pre-stored startup firmware key is consistent with the startup firmware key and can be used to generate a shared key.

In some embodiments, the above hashing algorithm may be a sha256 hashing algorithm.

Specifically, the five algorithms of the hash family are sha1, sha224, sha256, sha384 and sha512. Among them, the sha256 hash algorithm is the most secure.

The above embodiment uses the most secure hash algorithm to generate the key hash in this application, ensuring the accuracy of the comparison between the startup firmware key hash and the real startup firmware key hash.

In some embodiments, the above-mentioned generation of the shared key based on the system control processor key hash and the pre-stored startup firmware key in the system control processor may specifically include:

A shared key is generated through a symmetric encryption algorithm based on a system control processor key hash and a pre-stored boot firmware key in the system control processor.

Specifically, an asymmetric encryption algorithm can also be used to generate the shared key.

The above embodiment uses a symmetric encryption algorithm or an asymmetric encryption algorithm to generate a shared key, which is equivalent to encrypting the data transmission between the system control processor and the startup firmware using a symmetric encryption algorithm or an asymmetric encryption algorithm, thereby improving the The security and confidentiality of data transmission. Even if the transmitted data is stolen by an attacker, because of the protection of the shared key of the encryption algorithm, the attacker cannot obtain the real data from the stolen information, avoiding the possibility of information leakage. Condition.

In some embodiments, after generating the shared key, sending the shared key to the boot firmware includes:

After the shared key is generated, the shared key is encrypted according to the startup firmware key pre-stored in the system control processor to obtain the ciphertext, and the ciphertext is sent to the startup firmware.

Because the shared key is first generated in the system control processor, it must be ensured that it will not be intercepted or tampered with during transmission to the startup firmware. If the shared key is tampered with, it will cause the system control processor and startup firmware to The shared keys in are different. Both parties cannot decrypt the other party's encrypted information through their own shared keys, which affects the data transmission between the two. If the shared key is intercepted, the data transmitted after the secure channel is established cannot be protected. Protection of shared keys.

Therefore, in the above embodiment, the generated shared key is encrypted by the startup firmware key and then sent to the startup firmware, which ensures that the startup firmware can directly decrypt to obtain the shared key and at the same time ensures the security of the shared key, further ensuring security. After the channel is built, the security of data transmission between the system control processor and the boot firmware is ensured.

In some implementations, the above-mentioned symmetric encryption algorithm may be the AES256 symmetric encryption algorithm or the Shangmi No. 1 algorithm.

Among them, the AES256 symmetric encryption algorithm is the most secure encryption algorithm; the Shangmi No. 1 algorithm, or SM1 algorithm, is a commercial cryptographic block standard symmetric algorithm compiled by the State Cryptozoology Administration. The block length and key length are both 128 bits. , the security and confidentiality strength of the algorithm and the implementation performance of related software and hardware are equivalent to AES.

The above implementation manner provides two symmetric encryption algorithms with the highest security. The shared key generated using the above symmetric encryption algorithms will have higher confidentiality for data messages.

Referring to Figure 2, another embodiment of the present application provides a system control processor. The system control processor may include:

The hash module 101 is configured to generate a startup firmware key hash based on the startup firmware key pre-stored in the system control processor, and send a request message for requesting the establishment of a secure channel to the startup firmware.

The judgment module 102 is configured to receive a response message sent by the startup firmware, where the response message includes a real startup firmware key hash of the startup firmware, and determine whether the real startup firmware key hash and the startup firmware key hash are consistent.

The shared key generation module 103 is configured to generate a shared key based on the system control processor key hash and the pre-stored startup firmware key in the system control processor.

The sending module 104 is configured to send the shared key to the startup firmware after generating the shared key.

The message receiving module 105 is configured to receive an encrypted response message encrypted by a shared key for starting the firmware.

The decryption module 106 is used to decrypt the encrypted response message according to the shared key in the system control processor, and after the decryption is successful, encrypt subsequent messages sent to the startup firmware according to the shared key.

The system control processor provided in the above embodiment generates the same shared key in itself and the startup firmware, thereby establishing a data security channel between the two, so that both the system control processor and the startup firmware can use the shared secret key. The key encrypts the data message before transmission, which prevents the transmitted data from being exposed to attackers in plain text, improves the security and confidentiality of the transmitted data, and avoids information leakage.

Secondly, the shared key generated by the system control processor in the above embodiment includes information on both ends of the system control processor key hash and the startup firmware key, so that when the shared key is attacked or tampered with during transmission, whether Both the system control processor and the startup firmware can detect errors in the shared key during decryption, thereby promptly discarding the attacked data and avoiding decryption of data that may have been tampered with errors, further improving the communication between the system control processor and the startup firmware. Security of data transmission.

Please refer to Figure 3. Another embodiment of the present application provides a data security channel establishment method. This method is a data security channel establishment method executed by startup firmware. The startup firmware is described from a subject perspective. Specifically, it may include:

Step S21: After receiving a request message sent by the system control processor for requesting the establishment of a secure channel, a response message is sent to the system control processor. The response message includes a hash of the real startup firmware key for starting the firmware.

The response message is used to instruct the system control processor to determine whether the real startup firmware key hash is consistent with the startup firmware key hash in the system control memory. When it is determined that they are consistent, the system control processor in the system control processor The key hash and the prestored boot firmware key generate a shared secret.

Step S22: Obtain the shared key sent by the system control processor.

Step S23: Use the shared key to encrypt the response message to obtain an encrypted response message, and send the encrypted response message to the system control processor.

In the specific implementation process, after sending the encrypted response message, the subsequent messages sent by the startup firmware to the system control processor are encrypted using the shared key, and the messages and data received by the system control processor are also encrypted using the shared key. If the received data cannot be decrypted using the shared key, it means that the data is likely to have been attacked during transmission. The data that cannot be decrypted will be discarded directly to avoid identifying errors after being attacked or even tampered with. Information; for the system control processor, the shared key is also used to decrypt the received messages and data for starting the firmware. If it cannot be decrypted, it is discarded directly.

The above embodiment provides a method for establishing a data security channel. This method generates the same shared key in the system control processor and the startup firmware, thereby establishing a data security channel between the two, so that the system control processor and the startup firmware The shared key can be used to encrypt data messages before transmission when starting the firmware. This prevents the transmitted data from being exposed to attackers in plain text, improves the security and confidentiality of the transmitted data, and avoids the possibility of information leakage. Condition.

Referring to Figure 4, in some embodiments, the response message is also used to instruct the system control processor to encrypt the shared key according to the startup firmware key pre-stored in the system control processor after generating the shared key, to obtain The ciphertext is sent to the startup firmware; the above step S22 is to obtain the shared key sent by the system control processor, which may include the following steps:

Step S221: Receive the ciphertext sent by the system control processor.

Step S222: Decrypt the ciphertext according to the startup firmware key in the startup firmware to obtain the shared key.

For the situation where the system control processor encrypts the generated shared key before sending it, the above embodiment ensures that the startup firmware can directly decrypt to obtain the shared key, while also ensuring the security of the shared key, further ensuring the establishment of a secure channel. Security of data transfers between the rear system control processor and boot firmware.

Referring to Figure 5, another embodiment of the present application provides a startup firmware. The startup firmware may specifically include:

The response module 201 is configured to send a response message to the system control processor after receiving a request message sent by the system control processor for requesting the establishment of a secure channel. The response message includes the real startup firmware key for starting the firmware. hope.

The response message is used to instruct the system control processor to determine whether the real startup firmware key hash is consistent with the startup firmware key hash in the system control memory. If it is determined to be consistent, the system control processor will The key hash and the prestored boot firmware key generate a shared secret.

The receiving module 202 is used to obtain the shared key sent by the system control processor.

The message encryption module 203 is used to encrypt the response message using the shared key to obtain the encrypted response message, and send the encrypted response message to the system control processor.

The startup firmware provided in the above embodiment obtains the same shared key as the system control processor, thereby establishing a data security channel between the two, so that both the system control processor and the startup firmware can use the shared key Encrypting data packets before transmitting them prevents the transmitted data from being exposed to attackers in plain text, improves the security and confidentiality of the transmitted data, and avoids information leakage.

The technical features of the above embodiments can be combined in any way. To simplify the description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, all possible combinations should be used. It is considered to be within the scope of this manual.

The above-described embodiments only express several implementation modes of the present application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be noted that, for those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all fall within the protection scope of the present application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims (8)

1. A method for establishing a data security channel, characterized in that the method includes: Generate a startup firmware key hash based on the startup firmware key pre-stored in the system control processor, and send a request message for requesting the establishment of a secure channel to the startup firmware; Receive a response message sent by the startup firmware, where the response message includes a real startup firmware key hash of the startup firmware; determine whether the real startup firmware key hash and the startup firmware key hash are consistent; consistent; If they are consistent, generate a shared key based on the system control processor key hash in the system control processor and the pre-stored startup firmware key; if they are inconsistent, the secure channel establishment fails; After the shared key is generated, the shared key is sent to the startup firmware; specifically, after the shared key is generated, the startup firmware password is pre-stored in the system control processor. Encrypt the shared key with the key to obtain ciphertext, and send the ciphertext to the startup firmware; Receive an encrypted response message encrypted by the shared key using the shared key to start the firmware; The encrypted response message is decrypted according to the shared key in the system control processor, and after the decryption is successful, subsequent messages sent to the startup firmware are encrypted according to the shared key. 2. The method of claim 1, wherein generating a startup firmware key hash based on a startup firmware key pre-stored in the system control processor includes: The hash algorithm is called by calling the trusted platform module hardware algorithm interface on the system control processor, and the startup firmware key pre-stored in the system control processor is generated by the hash algorithm. Start firmware key hashing. 3. The method according to claim 2, characterized in that the hash algorithm is a sha256 hash algorithm. 4. The method of claim 1, wherein generating a shared key based on a system control processor key hash in the system control processor and the pre-stored startup firmware key includes: : A shared key is generated through a symmetric encryption algorithm based on the system control processor key hash and the pre-stored boot firmware key in the system control processor. 5. The method according to claim 4, characterized in that the symmetric encryption algorithm is AES256 symmetric encryption algorithm or Shangmi No. 1 algorithm. 6. A system control processor, characterized in that the system control processor includes: A hash module, configured to generate a hash of the startup firmware key based on the startup firmware key pre-stored in the system control processor, and send a request message for requesting the establishment of a secure channel to the startup firmware; A judgment module, configured to receive a response message sent by the startup firmware, the response message including a real startup firmware key hash of the startup firmware, and judge the real startup firmware key hash and the startup firmware Whether the key hash is consistent; A shared key generation module configured to generate a shared key based on the system control processor key hash in the system control processor and the pre-stored startup firmware key; A sending module, configured to send the shared key to the startup firmware after generating the shared key; specifically, the sending module is configured to send the shared key to the startup firmware according to the system control after generating the shared key. The startup firmware key pre-stored in the processor encrypts the shared key to obtain ciphertext, and sends the ciphertext to the startup firmware; A message receiving module, configured to receive an encrypted response message encrypted by the shared key of the startup firmware; A decryption module, configured to decrypt the encrypted response message according to the shared key in the system control processor, and after successful decryption, pair subsequent messages sent to the startup firmware according to the shared key. Encrypt. 7. A method for establishing a data security channel, characterized in that the method includes: After receiving a request message sent by the system control processor for requesting the establishment of a secure channel, sending a response message to the system control processor; the response message includes a hash of the real startup firmware key for starting the firmware; The response message is used to instruct the system control processor to determine whether the real startup firmware key hash and the startup firmware key hash in the system control memory are consistent. When it is determined that they are consistent, according to the The system control processor key hash and the pre-stored startup firmware key in the system control processor generate a shared key; the response message is also used to instruct the system control processor to generate the shared key after generating the shared key. , encrypt the shared key according to the startup firmware key pre-stored in the system control processor, obtain ciphertext, and send the ciphertext to the startup firmware; Obtain the shared key sent by the system control processor; specifically, receive the ciphertext sent by the system control processor; decrypt the ciphertext according to the startup firmware key in the startup firmware to obtain the shared key; The shared key is used to encrypt the response message to obtain an encrypted response message, and the encrypted response message is sent to the system control processor. 8. A kind of startup firmware, characterized in that the startup firmware includes: A response module, configured to send a response message to the system control processor after receiving a request message sent by the system control processor for requesting the establishment of a secure channel, where the response message includes the true value of the startup firmware. Start firmware key hashing; The response message is used to instruct the system control processor to determine whether the real startup firmware key hash and the startup firmware key hash in the system control memory are consistent. When it is determined that they are consistent, according to the The system control processor key hash and the pre-stored startup firmware key in the system control processor generate a shared key; the response message is also used to instruct the system control processor to generate the shared key after generating the shared key. , encrypt the shared key according to the startup firmware key pre-stored in the system control processor, obtain ciphertext, and send the ciphertext to the startup firmware; A receiving module, configured to obtain the shared key sent by the system control processor; specifically, the receiving module is configured to receive the ciphertext sent by the system control processor; according to the startup firmware secret key in the startup firmware Use the key to decrypt the ciphertext to obtain the shared key; A message encryption module is configured to use the shared key to encrypt the response message, obtain an encrypted response message, and send the encrypted response message to the system control processor.