Embedded software reinforcement method based on national cryptographic algorithm

Abstract

The invention relates to the technical field of computer security, in particular to an embedded software reinforcement method based on a national cryptographic algorithm. The method comprises the following steps: generating a key pair by using SM2, constructing a code dependency graph in combination with spectral clustering, and optimizing key distribution; carrying out segmented encryption by adopting SM4 symmetric encryption, and identifying sensitive code snippets; the integrity of the embedded software is monitored and responded in real time through SM3 hash check and anomaly detection; analyzing vulnerability distribution based on random forest regression by using an SM4 encryption update package and dynamically adjusting an update frequency; and encrypting an operation log through SM3, and identifying a risk trend and generating an operation report by using a variational auto-encoder. According to the invention, through a plurality of technical means such as hierarchical encryption, real-time monitoring, dynamic key management and risk prediction, an efficient, dynamic and intelligent security reinforcement scheme is provided for embedded software, and the overall security and stability of the system are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to an embedded software reinforcement method based on a national secret algorithm. Background Art

[0002] In the context of the rapid development of information technology, embedded devices have been widely used in smart manufacturing, the Internet of Things, autonomous driving, smart homes and other fields. However, these devices are also facing increasingly severe security threats during their application. Since embedded devices usually have limited resources, relatively low computing power, and most of them run in an open network environment, they are very easy to become targets of network attacks. For example, malware may invade the enterprise network through IoT devices, causing information leakage, business interruption, and even equipment damage. Therefore, how to improve the software security of embedded devices has become a research focus.

[0003] Embedded software hardening is a common means of protection, which mainly introduces security measures in various links of software operation to prevent threats such as reverse engineering, malicious tampering, and data leakage. At present, there are still the following problems: In the existing technology, the key generation and distribution methods are often fixed and lack flexibility, which easily leads to security risks in key management, especially when facing different risk levels, the system cannot be adaptively adjusted, which increases the possibility of system attacks; traditional embedded software hardening methods are difficult to effectively identify high-risk sensitive code fragments, making key codes vulnerable to attacks, causing security risks to the core functions of the system; current embedded software hardening methods lack monitoring and analysis of long-term risk trends, and it is difficult to provide comprehensive operation status reports. Summary of the invention

[0004] To solve the above problems, the present invention provides an embedded software reinforcement method based on the national secret algorithm, which solves the problem of how to flexibly generate and distribute keys in embedded devices with limited resources, adaptively adjust key management strategies, effectively identify high-risk code fragments and realize long-term risk trend monitoring and analysis, thereby improving the overall security and stability of the system.

[0005] To achieve the above object, the technical solution adopted by the present invention is:

[0006] An embedded software reinforcement method based on a national secret algorithm comprises the following steps:

[0007] S1: Generate encryption key pairs using the SM2 algorithm, build a code dependency graph using the spectral clustering algorithm to analyze embedded software risk levels, and adaptively optimize key distribution strategies;

[0008] S2: Use the SM4 symmetric encryption algorithm to perform segmented encryption, and use a graph embedding algorithm based on the code dependency graph to analyze the code dependency path and identify sensitive code fragments;

[0009] S3: Hash verification is performed through the SM3 algorithm, combined with anomaly detection algorithms to monitor the integrity of embedded software, and a real-time detection and response mechanism is implemented for different attack modes, and defense is initiated when anomalies are triggered;

[0010] S4: In the update transmission, the SM4 algorithm is used to encrypt the update package, and the distribution of embedded software vulnerabilities is analyzed through random forest regression to adaptively adjust the update frequency and content;

[0011] S5: Encrypt the operation logs through the SM3 algorithm, and use the variational autoencoder to identify long-term risk trends and provide a comprehensive embedded software operation status report.

[0012] Furthermore, the step S1 includes the following steps:

[0013] Generate a pair of public and private keys through the SM2 algorithm as the key pair required in the encryption and decryption process;

[0014] Use spectral clustering algorithm to classify the risk levels of functional modules and components of embedded software;

[0015] According to the encryption policy configuration table generated by the spectral clustering algorithm, different key update strategies are assigned to each module, more frequent key updates are adopted for high-risk modules to shorten the key life cycle, and the key pairs generated by SM2 are preferentially used for encrypted communication between high-risk modules.

[0016] Furthermore, the construction process of the spectral clustering algorithm includes the following steps:

[0017] Build a code dependency graph for embedded software, represent each functional module or component as a node in the graph, and add corresponding edges based on the dependencies between codes to form a complete dependency graph;

[0018] Calculating the Laplacian matrix of the dependency graph to quantify the similarity and dependency between modules;

[0019] Perform eigenvalue decomposition on the Laplace matrix, select the corresponding eigenvectors to construct the feature matrix, and divide each functional module into several clusters based on the clustering characteristics of the eigenvectors;

[0020] The average risk level of each cluster is used as the risk level mark of the modules in the cluster, and an encryption policy configuration table based on the risk level is generated.

[0021] Furthermore, the step S2 includes the following steps:

[0022] The embedded software code is encrypted in segments according to the preset segmentation rules using the SM4 symmetric encryption algorithm, and each code segment is encrypted using a different key;

[0023] Based on the constructed code dependency graph, the dependency paths between code segments are analyzed through the graph embedding algorithm, the dependency relationships and their strengths between code segments are extracted, the high-risk dependency chains in the software are identified, and a code dependency path graph is formed;

[0024] According to the code dependency path diagram, identify key or sensitive code segments, determine the code segments that are potentially vulnerable to attack, and determine the high-risk code segments that need to be encrypted and protected;

[0025] Develop a dynamic key distribution strategy for the identified high-risk code snippets, adopt a periodic key rotation mechanism for these snippets, and adjust the key update frequency according to the risk level of the code snippets;

[0026] Generate access control policies for high-risk code snippets, define access rights according to the policies, monitor the access behavior of each high-risk code snippet, and trigger a security response immediately if unauthorized access operations are detected.

[0027] Furthermore, the formula of the graph embedding algorithm is as follows:

[0028]

[0029] Where hv represents the risk feature of the code segment; N(v) represents the set of code segments that have dependencies with the code segment v; A vu represents the dependency strength between code segments v and u; R u Indicates the risk level coefficient; d v and d u represents the degree of node v and node u, that is, the number of dependencies between code segments; W 1 and W 2 represents the weight matrix; x v represents the initial feature vector of node v, which contains the basic information of the code segment; σ represents the activation function.

[0030] Furthermore, in step S3, the real-time detection and response mechanism is based on the defense mechanism of the generative adversarial network, and generates virtual attack samples by simulating potential attack behaviors; when an anomaly is triggered, the defense mechanism calls a response optimization strategy based on fuzzy logic, and adjusts the response intensity in real time according to the current operating status of the device, its own resource conditions and the detected attack type.

[0031] Furthermore, the update transmission process of step S4 uses a double-layer encryption mechanism, encrypts the update package content in segments through the SM4 algorithm, and securely transmits the key using the dynamic key exchange protocol. At the same time, based on the update strategy of the trust level, the push priority of the update package is dynamically determined by real-time analysis of the vulnerability risk level and usage frequency of the software, and a vulnerability trend chart of the software is generated in combination with the random forest regression algorithm.

[0032] Furthermore, the step S5 includes the following steps:

[0033] The key behavior records in the operation log are encrypted through the SM3 algorithm to generate a highly tamper-resistant log index;

[0034] Use variational autoencoders to analyze behavioral features in logs, combine time series analysis to identify potential high-risk operation trends, and generate security risk reports, including risk change trends and multi-level alarm prompts;

[0035] Based on the risk analysis results, adaptively adjust the key update frequency and access control strategy of high-risk modules.

[0036] The beneficial effect of the present invention is that the present invention ensures the security of data encryption, integrity verification and transmission process through the combined application of SM2, SM3 and SM4 national secret algorithms. The encryption key pair generated by SM2 is adaptively optimized in the distribution strategy, which effectively enhances the flexibility and security of key management. The code dependency graph is constructed based on the spectral clustering algorithm, and the code dependency path is analyzed by the graph embedding algorithm, which helps to identify sensitive code fragments. This method effectively protects high-risk areas through path analysis to prevent key codes from being attacked. The software integrity can be monitored in real time through the hash check of the SM3 algorithm and combined with the anomaly detection algorithm. When an anomaly is detected, the system can respond quickly and start the corresponding defense mechanism, significantly improving the anti-attack capability of the embedded system. During the update transmission process, SM4 encryption ensures the security of the update package, and at the same time uses random forest regression to analyze the vulnerability distribution, and adaptively adjusts the update frequency and content, so that the system can be optimized and updated according to the real-time risk situation, effectively avoiding unnecessary update interference and improving the stability of the system. Through the encryption of the operation log by SM3 and combined with the identification of long-term risk trends by the variational autoencoder, a running status report of the embedded software can be provided. This long-term monitoring and analysis helps managers better understand the system operation and prevent potential risks in advance. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flow chart of an embedded software reinforcement method based on a national encryption algorithm of the present invention.

[0038] Figure 2It is a flowchart of a process of constructing a spectral clustering algorithm provided by an embodiment of the present invention.

[0039] Figure 3 It is a flowchart of step S2 provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0040] See also Figure 1-3 As shown, the present invention relates to an embedded software reinforcement method based on a national encryption algorithm.

[0041] Example

[0042] An embedded software reinforcement method based on a national secret algorithm comprises the following steps:

[0043] S1: Generate encryption key pairs using the SM2 algorithm, build a code dependency graph using the spectral clustering algorithm to analyze embedded software risk levels, and adaptively optimize key distribution strategies;

[0044] Wherein, the step S1 comprises the following steps:

[0045] Generate a pair of public and private keys through the SM2 algorithm as the key pair required in the encryption and decryption process;

[0046] It should be noted that a pair of public and private keys are generated using the national secret algorithm SM2, which will serve as the basic key pair required in the encryption and decryption process. Since the SM2 algorithm has high security and low computational complexity, it is very suitable for use on embedded devices with limited resources. The generated public and private key pairs can not only be used for secure communication between embedded devices, but will also be used in subsequent key distribution and update strategies. The generated public and private keys will be securely stored in the secure storage area of ​​the embedded system to prevent unauthorized access and tampering. In addition, the key pair will be used for encrypted communication between high-risk modules to ensure higher security of data transmission in high-risk areas.

[0047] Use spectral clustering algorithm to classify the risk levels of functional modules and components of embedded software;

[0048] According to the encryption policy configuration table generated by the spectral clustering algorithm, different key update strategies are assigned to each module, more frequent key updates are adopted for high-risk modules to shorten the key life cycle, and the key pairs generated by SM2 are preferentially used for encrypted communication between high-risk modules.

[0049] The construction process of the spectral clustering algorithm includes the following steps:

[0050] Build a code dependency graph for embedded software, represent each functional module or component as a node in the graph, and add corresponding edges based on the dependencies between codes to form a complete dependency graph;

[0051] It should be noted that the node definition is: each functional module or component of the embedded software is regarded as a node in the dependency graph. These nodes may include different software modules, subsystems or independent code components.

[0052] Edge definition: According to the calling relationship, data dependency or shared resource situation between codes, add edges between nodes to represent their dependencies. This forms a complete dependency graph, reflecting the association and dependency between modules.

[0053] Calculating the Laplacian matrix of the dependency graph to quantify the similarity and dependency between modules;

[0054] Specifically, based on the constructed code dependency graph, the corresponding Laplace matrix is ​​calculated. The Laplace matrix is ​​used to quantify the similarity and degree of dependency between modules. Each element in the matrix represents the direct or indirect dependency between two modules. The larger the value, the stronger the dependency between the two modules. During the calculation process, different weights can be set according to the interaction frequency between modules, data sharing sensitivity, etc. to ensure more accurate quantification of dependencies. This step provides basic data for subsequent eigenvalue decomposition and cluster analysis.

[0055] Perform eigenvalue decomposition on the Laplace matrix, select the corresponding eigenvectors to construct the feature matrix, and divide each functional module into several clusters based on the clustering characteristics of the eigenvectors;

[0056] Specifically, the Laplace matrix is ​​decomposed by eigenvalues ​​to extract the first several main eigenvalues ​​and their corresponding eigenvectors. The eigenvectors can capture the implicit structure and similarity between modules, thereby revealing the position and relevance of each module in the overall dependency graph. These eigenvectors are selected to form a feature matrix, mapping each functional module or component to a new feature space. Each row vector in this feature matrix corresponds to the characteristics of a module, which can characterize the similarity and degree of dependence of the module with other modules.

[0057] Based on the feature matrix, the modules of the embedded software are divided into several clusters. Similar modules are grouped into the same cluster, while modules with weaker dependencies are assigned to different clusters. This clustering process can classify modules with similar dependencies into the same category, which is convenient for subsequent risk level classification. Each cluster is assigned an average risk level, which is determined by the risk characteristics of each module in the cluster. Clusters containing more critical modules or sensitive data will be marked as high risk, while clusters containing non-sensitive or basic functional modules will be marked as low risk.

[0058] The average risk level of each cluster is used as the risk level mark of the modules in the cluster, and an encryption policy configuration table based on the risk level is generated.

[0059] Specifically, an encryption policy configuration table is generated based on the module clustering results and risk levels obtained by the spectral clustering algorithm. The configuration table contains the module name, corresponding risk level, key distribution frequency, and encryption policy in each cluster. Modules in high-risk clusters in the configuration table are assigned a higher key update frequency. The key life cycle of these modules is relatively short, ensuring that they update their keys in a shorter time to reduce the risk of key cracking or abuse.

[0060] S2: Use the SM4 symmetric encryption algorithm to perform segmented encryption, and use a graph embedding algorithm based on the code dependency graph to analyze the code dependency path and identify sensitive code fragments;

[0061] Wherein, the step S2 comprises the following steps:

[0062] The embedded software code is encrypted in segments according to the preset segmentation rules using the SM4 symmetric encryption algorithm, and each code segment is encrypted using a different key;

[0063] It should be noted that each code segment is encrypted separately using the SM4 symmetric encryption algorithm. Since SM4 supports efficient symmetric encryption, it can provide high computing efficiency while ensuring the security of embedded systems. Independent keys are assigned to each code segment. These keys can be pre-generated and stored in the secure area of ​​the system to ensure that the encryption keys of different code segments do not affect each other. If the key of a code segment is leaked, the attacker cannot easily decrypt the contents of other code segments, thereby reducing the risk of data leakage.

[0064] Based on the constructed code dependency graph, the dependency paths between code segments are analyzed through the graph embedding algorithm, the dependency relationships and their strengths between code segments are extracted, the high-risk dependency chains in the software are identified, and a code dependency path graph is formed;

[0065] Specifically, the dependency paths between code segments are analyzed using the code dependency graph constructed in the early stage through the graph embedding algorithm. The graph embedding algorithm can convert the dependency relationship of code segments into a low-dimensional feature vector, revealing the potential association and dependency strength between code segments. According to the code dependency graph, the paths between code segments and their dependency strength are extracted. The dependency path can reflect the calling relationship, data transfer relationship and resource sharing of different code segments in the software. The length and strength of the dependency path can be used to measure the risk level of the code segment. Code segments with high dependency strength and long paths often play a key role in the system.

[0066] Risk analysis is performed on the extracted dependency paths, with a focus on paths with high dependency strength and long dependency chains. These paths are considered high-risk dependency chains and may be potential attack targets. Based on graph embedding features, code segments that play a critical role in the system are further identified, such as code segments with high call frequency or large data flow. These code segments are marked as high-risk code segments to provide a basis for subsequent encryption and protection strategies.

[0067] Generate a code dependency path diagram based on the analysis results to clearly visualize the dependency relationships, risk levels, and dependency path structures of all code segments. Each node represents a code segment, and each edge represents the dependency path between code segments, while marking the strength and risk level of each path. In the code dependency path diagram, use color or mark to identify the risk level of each code segment, such as marking high-risk code segments as red nodes, to facilitate the subsequent formulation of encryption and protection strategies.

[0068] According to the code dependency path diagram, identify key or sensitive code segments, determine the code segments that are potentially vulnerable to attack, and determine the high-risk code segments that need to be encrypted and protected;

[0069] Develop a dynamic key distribution strategy for the identified high-risk code snippets, adopt a periodic key rotation mechanism for these snippets, and adjust the key update frequency according to the risk level of the code snippets;

[0070] Generate access control policies for high-risk code snippets, define access rights according to the policies, monitor the access behavior of each high-risk code snippet, and trigger a security response immediately if unauthorized access operations are detected.

[0071] Furthermore, the formula of the graph embedding algorithm is as follows:

[0072]

[0073] Where hv represents the risk feature of the code segment; N(v) represents the set of code segments that have dependencies with the code segment v; A vu represents the dependency strength between code segments v and u; Ru Represents the risk level coefficient, R for high-risk code segments u A higher value affects the embedding representation of its neighboring nodes, thereby improving the recognition accuracy of sensitive codes; d v and d u represents the degree of node v and node u, that is, the number of dependencies between code segments; W 1 and W 2 represents the weight matrix, which controls the feature weights of neighbor nodes and the current node respectively; x v represents the initial feature vector of node v, which contains the basic information of the code segment; σ represents the activation function.

[0074] S3: Hash verification is performed through the SM3 algorithm, and the integrity of the embedded software is monitored in combination with the anomaly detection algorithm. A real-time detection and response mechanism is implemented for different attack modes, and defense is initiated when an anomaly is triggered. The real-time detection and response mechanism is based on the defense mechanism of the generative adversarial network, and virtual attack samples are generated by simulating potential attack behaviors. When an anomaly is triggered, the defense mechanism calls a response optimization strategy based on fuzzy logic, and adjusts the response intensity in real time according to the current operating status of the device, its own resource conditions, and the detected attack type.

[0075] In some embodiments, when the system is started and running, the hash value of the embedded software is first calculated using the SM3 algorithm. As a collision-resistant hash algorithm, SM3 ensures that the generated hash value has unique and tamper-proof characteristics. By comparing the currently calculated hash value with the expected hash value, it is possible to detect whether the code has been tampered with or whether the data has been illegally changed. To ensure the integrity of the software throughout its life cycle, the mechanism triggers hash verification regularly or before and after key operations. When inconsistencies are detected, it can be determined that there may be tampering or malicious attacks. The running status of the software is monitored using multiple detection algorithms, such as rule detection based on statistical analysis, behavioral pattern detection based on time series analysis, and feature pattern recognition based on machine learning. For example, when abnormal fluctuations in the use of resources such as the system's CPU, memory, and network bandwidth are detected, the source of the abnormality can be further analyzed in combination with the behavioral model of the embedded system to identify potential attacks. GAN is used to generate virtual attack samples to simulate possible attack behaviors. GAN can effectively improve the accuracy and robustness of the detection model by generating adversarial samples and combining them with actual detected abnormalities. The generative network and discriminative network of GAN interact with each other, enabling the system to prevent known attacks and identify potential unknown threats, thereby enhancing the comprehensiveness of protection.

[0076] When an anomaly or attack is detected, the system immediately triggers a real-time response mechanism. First, possible threat events are recorded and the attack mode and impact range are further analyzed. Then, defensive measures are initiated, such as restricting access to sensitive resources, isolating affected code segments, or suspending functional modules that may be tampered with. When triggering a response, the system uses a fuzzy logic mechanism to determine the intensity of the response based on the current operating status of the device (such as resource usage, real-time performance requirements, etc.), system resource status, and attack type. For example, in scenarios with tight resources or high performance requirements, the system will choose a moderate response strategy to reduce the impact of defensive measures on system operation. In high-risk attack scenarios, if a serious threat is detected, the system will choose a high-intensity response, including enabling comprehensive isolation and resource protection measures. The system continuously monitors the current status of the device and adjusts the response measures based on the dynamic operating status and attack detection results. For example, when the attack intensity increases or the attack mode changes, the system can upgrade the response intensity in real time, including encrypting sensitive data, enabling additional defense modules, and even shutting down some non-essential functions to ensure the security of the core modules.

[0077] The defense mechanism will record all detected attack samples and anomalies, and regularly update the GAN model to continuously adapt to new attack patterns and complex environments. This process continuously optimizes the GAN model's adversarial capabilities through analysis of actual data and virtual samples, thereby improving the system's defense effect. The system automatically selects the corresponding defense strategy for different attack modes and threat levels. For example, for low-threat abnormal behaviors, a lightweight detection and response mechanism can be used to reduce system resource consumption. When a high-risk threat is detected, the system will enable a higher level of protection, including full encryption and isolation of key modules, and increased monitoring frequency of network and storage access to ensure the continued security of embedded software.

[0078] S4: In the update transmission, the update package is encrypted using the SM4 algorithm, the embedded software vulnerability distribution is analyzed through random forest regression, and the update frequency and content are adaptively adjusted; the update transmission process of step S4 uses a double-layer encryption mechanism, the update package content is segmented encrypted using the SM4 algorithm, and the key is securely transmitted using a dynamic key exchange protocol. At the same time, based on the update strategy of the trust level, the push priority of the update package is dynamically determined by real-time analysis of the vulnerability risk level and usage frequency of the software, and a vulnerability trend chart of the software is generated in combination with the random forest regression algorithm.

[0079] In some embodiments, when transmitting the update package, the SM4 symmetric encryption algorithm is used to encrypt the update content in segments. Each segment of data uses a different encryption key to improve the security of the overall encryption. If a segment of data is tampered with or leaked during transmission, the segmented encryption mechanism can limit the scope of impact, making it difficult for attackers to restore the contents of the entire update package. To further enhance transmission security, the update package adopts a double-layer encryption mechanism. The first layer is encrypted using a preset static key, and the second layer is encrypted using a key generated by a dynamic key exchange protocol. Double-layer encryption not only improves transmission security, but also effectively prevents the risks brought by key leakage.

[0080] Before each update transmission, the system generates a one-time key through a dynamic key exchange protocol to ensure the security of the update package during transmission. The protocol combines asymmetric key exchange (such as SM2 key exchange) and session key generation mechanism, making the key unique in each update transmission, reducing the risk of key replay or man-in-the-middle attacks. On the receiving end, the system verifies the key through an authentication process to confirm that the update package is indeed from a trusted update source. If the verification fails, the system will abort the update transmission and issue a security warning to indicate the potential risk of attack.

[0081] The trust level of each update package is dynamically evaluated based on its working environment and usage scenarios. For example, key function modules or modules with high security will be classified as high trust levels, while general function modules will be classified as medium and low trust levels. Modules with high trust levels will enjoy more security protection measures during the update transmission process, including more frequent integrity checks and strict key management. When pushing updates, the push priority of update packages is dynamically determined based on the trust level. For modules with high trust levels, update packages will be pushed first to ensure the security and latest functions of important modules; for modules with medium and low trust levels, the update push frequency will be relatively reduced to reduce bandwidth consumption and system resource usage.

[0082] The historical vulnerability data of embedded software is analyzed using the random forest regression algorithm to identify the distribution pattern of vulnerabilities. The random forest regression algorithm can extract key features that affect vulnerabilities from multi-dimensional data, build a vulnerability distribution model, and predict future vulnerability risk areas and new vulnerabilities that may appear. After analyzing the vulnerability distribution, the update frequency and content are adaptively adjusted according to the risk level of different modules. For example, the update frequency and security patch content will be increased in high-risk vulnerability areas, while the update frequency of low-risk areas will be appropriately reduced. This mechanism ensures efficient use of system resources and effectively concentrates maintenance resources on the areas where they are most needed. The system generates a vulnerability trend chart through the random forest regression algorithm to show the time distribution of vulnerabilities and the trend of risk changes. The trend chart can predict the rising or falling trend of vulnerability risks, thereby guiding the adjustment of update strategies. The trend chart can also help maintenance personnel identify the weakest areas in the system and possible potential attack paths. Combined with the analysis results of the vulnerability trend chart, the system can dynamically adjust the push frequency of update packages. For example, when the trend chart shows that the vulnerability risk of a module may increase in the future, the system will increase the update frequency of the module in advance, push security patches or increase encryption strength to ensure that it is protected from potential attacks.

[0083] S5: Encrypt the operation logs through the SM3 algorithm, and use the variational autoencoder to identify long-term risk trends and provide a comprehensive embedded software operation status report.

[0084] Wherein, the step S5 comprises the following steps:

[0085] The key behavior records in the operation log are encrypted through the SM3 algorithm to generate a highly tamper-resistant log index;

[0086] Specifically, key behavior records are extracted from the operation log, including user operation records, system event records, data transmission records, and security-related system call information. These key behavior records are encrypted to ensure that the log content will not be tampered with during storage and transmission. A hash value is generated for each key behavior record using the national secret SM3 algorithm. The SM3 algorithm is a high-intensity collision-resistant hash algorithm. The generated hash value can prevent the log content from being tampered with and has high collision resistance. The generated hash value serves as an index for each record, providing a fast and secure log verification method.

[0087] The encrypted hash value is used to generate an independent index for each log record to facilitate subsequent verification and quick location of the log. Each index corresponds to an operation log record, and these indexes are stored in the secure area of ​​the system. When reading or transmitting logs, the integrity of the log is verified by recalculating the hash value of the log content and comparing it with the index. Once a hash value mismatch is detected, the system will record the tampering event and initiate corresponding security protection measures.

[0088] Use variational autoencoders to analyze behavioral features in logs, combine time series analysis to identify potential high-risk operation trends, and generate security risk reports, including risk change trends and multi-level alarm prompts;

[0089] Specifically, the key behavior records extracted from the operation log are used as input and input into the variational autoencoder (VAE) model after preprocessing. Through the encoder part of the VAE, the log data is mapped to a low-dimensional latent space to extract the core features and behavior patterns of the log data. Subsequently, the data is restored through the decoder and compared with the original data to determine whether the encoded features fully characterize the behavior patterns of the logs. The latent space distribution of VAE is able to characterize the behavior patterns in the log data. Normal behaviors will form a concentrated distribution in the latent space, while abnormal or potentially high-risk behaviors will deviate from the normal distribution, which will help to identify subsequent risk trends.

[0090] Use time series analysis methods (such as sliding windows, time series anomaly detection, etc.) to further analyze the output results of VAE to identify operation trends and change patterns in log data. For example, build a time series model based on factors such as operation frequency and behavior fluctuations to detect abnormally frequent operations or gradually increasing potential risk behaviors. Combine the results of time series analysis with the potential feature distribution of VAE to identify long-term trends of high-risk operations, such as a significant increase in access frequency, an increase in abnormal call behavior, or a concentration of access to a specific module. High-risk trends may indicate potential attack attempts or system vulnerabilities.

[0091] Based on the results of VAE analysis and time series detection, the system generates a security risk report. The report shows the risk change trend in detail, including the frequency of high-risk operations, the growth of risk levels, and the distribution characteristics of abnormal behaviors. According to the risk level of the analysis, the system generates multi-level alarm prompts. The alarm levels are divided into low, medium, and high, corresponding to different degrees of security risks. Low risk is an information reminder, medium risk requires administrator attention, and high risk triggers an emergency alarm, prompting immediate security protection measures.

[0092] Based on the risk analysis results, adaptively adjust the key update frequency and access control strategy of high-risk modules.

[0093] In summary, the present invention not only provides high-intensity encryption and data protection for embedded software, but also realizes real-time integrity monitoring and dynamic protection through the combination of SM2, SM3, SM4 and other national secret algorithms with spectral clustering, graph embedding and GAN algorithms, significantly improving the security and stability of the system in the face of various attacks. In the process of generating, distributing and updating keys, the key strategy is adaptively adjusted, especially more frequent key updates are implemented for high-risk modules, the key life cycle is shortened, and the risk of key leakage is reduced. The refined control of key management helps to ensure the secure communication of each functional module in the embedded system.

[0094] The present invention realizes hierarchical encryption of embedded software modules through the application of spectral clustering algorithm, focusing resources mainly on high-risk modules and reducing the key management pressure on low-risk modules. This method achieves a good balance between security and resource consumption in embedded devices with limited resources. Through the generated code dependency path diagram and vulnerability trend diagram, the system realizes visual tracking of potential risks, which helps operation and maintenance personnel to intuitively understand the risk distribution and vulnerability trends, so as to take effective countermeasures in time and enhance the long-term protection capabilities of the software. When an anomaly or attack is detected, the adaptive response mechanism based on fuzzy logic can flexibly adjust the response strategy according to the attack intensity and system resource status, ensuring that the normal operation efficiency of the system is not affected while ensuring the protection effect.

[0095] The present invention uses variational autoencoders (VAE) to perform long-term trend analysis on operation log data, which can identify high-risk operation trends early, generate security risk reports and alarm prompts, and provide predictive protection support for the continuous security of embedded devices. Through double-layer encryption and dynamic key exchange protocol encryption update package transmission, combined with random forest regression algorithm to analyze vulnerability distribution, dynamically adjust update frequency and push priority, ensure that high-trust modules are updated first, and improve the overall security of the system.

[0096] The above implementation modes are merely descriptions of the preferred implementation modes of the present invention, and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary engineering and technical personnel in the field shall fall within the protection scope determined by the claims of the present invention.

Claims

1. An embedded software reinforcement method based on a national secret algorithm, characterized in that: The following steps are involved: S1: Generate encryption key pairs using the SM2 algorithm, build a code dependency graph using the spectral clustering algorithm to analyze embedded software risk levels, and adaptively optimize key distribution strategies; S2: Use the SM4 symmetric encryption algorithm to perform segmented encryption, and use a graph embedding algorithm based on the code dependency graph to analyze the code dependency path and identify sensitive code fragments; S3: Hash verification is performed through the SM3 algorithm, combined with anomaly detection algorithms to monitor the integrity of embedded software, and a real-time detection and response mechanism is implemented for different attack modes, and defense is initiated when anomalies are triggered; S4: In the update transmission, the SM4 algorithm is used to encrypt the update package, and the distribution of embedded software vulnerabilities is analyzed through random forest regression to adaptively adjust the update frequency and content; S5: Encrypt the operation logs through the SM3 algorithm, and use the variational autoencoder to identify long-term risk trends and provide a comprehensive embedded software operation status report.

2. According to claim 1, a method for reinforcing embedded software based on a national secret algorithm is characterized in that: The step S1 comprises the following steps: Generate a pair of public and private keys through the SM2 algorithm as the key pair required in the encryption and decryption process; Use spectral clustering algorithm to classify the risk levels of functional modules and components of embedded software; According to the encryption policy configuration table generated by the spectral clustering algorithm, different key update strategies are assigned to each module, more frequent key updates are adopted for high-risk modules to shorten the key life cycle, and the key pairs generated by SM2 are preferentially used for encrypted communication between high-risk modules.

3. According to claim 2, the embedded software reinforcement method based on the national secret algorithm is characterized in that: The construction process of the spectral clustering algorithm includes the following steps: Build a code dependency graph for embedded software, represent each functional module or component as a node in the graph, and add corresponding edges based on the dependencies between codes to form a complete dependency graph; Calculating the Laplacian matrix of the dependency graph to quantify the similarity and dependency between modules; Perform eigenvalue decomposition on the Laplace matrix, select the corresponding eigenvectors to construct the feature matrix, and divide each functional module into several clusters based on the clustering characteristics of the eigenvectors; The average risk level of each cluster is used as the risk level mark of the modules in the cluster, and an encryption policy configuration table based on the risk level is generated.

4. According to claim 1, the embedded software reinforcement method based on the national secret algorithm is characterized in that: The step S2 comprises the following steps: The embedded software code is encrypted in segments according to the preset segmentation rules using the SM4 symmetric encryption algorithm, and each code segment is encrypted using a different key; Based on the constructed code dependency graph, the dependency paths between code segments are analyzed through the graph embedding algorithm, the dependency relationships and their strengths between code segments are extracted, the high-risk dependency chains in the software are identified, and a code dependency path graph is formed; According to the code dependency path diagram, identify key or sensitive code segments, determine the code segments that are potentially vulnerable to attack, and determine the high-risk code segments that need to be encrypted and protected; Develop a dynamic key distribution strategy for the identified high-risk code snippets, adopt a periodic key rotation mechanism for these snippets, and adjust the key update frequency according to the risk level of the code snippets; Generate access control policies for high-risk code snippets, define access rights according to the policies, monitor the access behavior of each high-risk code snippet, and trigger a security response immediately if unauthorized access operations are detected.

5. According to claim 4, a method for reinforcing embedded software based on a national secret algorithm is characterized in that: The formula of the graph embedding algorithm is as follows: Where hυ represents the risk feature of the code segment; N(υ) represents the set of code segments that have a dependency relationship with the code segment v; A υu represents the dependency strength between code segments v and u; R u Indicates the risk level coefficient; d υ and d u represents the degree of node v and node u, that is, the number of dependencies of the code segment; W1 and W2 represent weight matrices; x υ represents the initial feature vector of node v, which contains the basic information of the code segment; σ represents the activation function.

6. The method for reinforcing embedded software based on the national secret algorithm according to claim 1 is characterized in that: In step S3, the real-time detection and response mechanism is based on the defense mechanism of the generative adversarial network, and generates virtual attack samples by simulating potential attack behaviors; when an anomaly is triggered, the defense mechanism calls a response optimization strategy based on fuzzy logic, and adjusts the response intensity in real time according to the current operating status of the device, its own resource conditions and the detected attack type.

7. The embedded software reinforcement method based on the national secret algorithm according to claim 1 is characterized in that: The update transmission process of step S4 uses a double-layer encryption mechanism, encrypts the update package content in segments through the SM4 algorithm, and securely transmits the key using the dynamic key exchange protocol. At the same time, based on the update strategy of the trust level, the push priority of the update package is dynamically determined by real-time analysis of the vulnerability risk level and usage frequency of the software, and a vulnerability trend chart of the software is generated in combination with the random forest regression algorithm.

8. The method for reinforcing embedded software based on a national secret algorithm according to claim 1 is characterized in that: The step S5 comprises the following steps: The key behavior records in the operation log are encrypted through the SM3 algorithm to generate a highly tamper-resistant log index; Use variational autoencoders to analyze behavioral features in logs, combine time series analysis to identify potential high-risk operation trends, and generate security risk reports, including risk change trends and multi-level alarm prompts; Based on the risk analysis results, adaptively adjust the key update frequency and access control strategy of high-risk modules.

Images