Embedded security management method based on digital RMB industrial control equipment

Abstract

The invention relates to an embedded safety management method based on digital RMB industrial control equipment, and belongs to the technical field of industrial control system safety. The method comprises the following steps: during first deployment, carrying out information binding on an asymmetric key pair of the industrial control equipment and an equipment identity identifier to generate an equipment digital certificate; the digital signature is verified step by step from a private key of the asymmetric key pair during power-on starting through a safe starting process; when communication is established, performing digital signature on a communication key by calling a signature function of the hardware security module based on a challenge-response mechanism; when a digital RMB transaction is carried out, the trusted execution environment and the digital RMB hardware wallet module carry out secure interaction, and a transaction instruction is analyzed; during the operation period of the equipment, key data streams are continuously collected and analyzed by deploying an exception monitoring module. Reading, querying and related business transactions of the digital RMB on the industrial control equipment are achieved, and it is ensured that the identity is not forged and the instruction is not tampered.

Description

Technical Field

[0001] This invention belongs to the field of industrial control system security technology, specifically relating to an embedded security management method for industrial control equipment based on digital RMB. Background Technology

[0002] Traditional industrial control system security primarily focuses on ensuring the continuity and stability of production processes, with security protection mainly relying on network isolation and access control. However, with the advancement of the Industrial Internet of Things (IIoT), a large number of industrial control devices are beginning to connect to the Internet, exposing them to complex public network attack surfaces.

[0003] Meanwhile, as China's legal digital currency, the digital yuan's characteristics of "controlled anonymity" and "dual offline payment" give it broad application prospects in scenarios such as IoT payments and smart contracts. Embedding the digital yuan's payment function into industrial control equipment is a key step in improving industrial automation and intelligence. However, current technology still faces the following challenges: The massive number of industrial control devices deployed in physically untrusted environments are vulnerable to physical attacks and identity forgery. Digital RMB transaction instructions may be intercepted or tampered with insecure general operating systems. Especially in dual offline payment scenarios, the lack of real-time network verification significantly increases the risk of double-spending attacks. Summary of the Invention

[0004] To address the aforementioned problems in the existing technology, this invention provides an embedded security management method based on digital RMB industrial control equipment. The objective of this invention can be achieved through the following technical solution: S1: When the industrial control equipment is deployed for the first time, a unique asymmetric key pair is generated based on the hardware security module and trusted execution environment that operate collaboratively within the industrial control equipment. The public key of the asymmetric key pair is then bound to the equipment identity identifier and equipment model information to generate a digital certificate for the equipment. S2: Based on the secure boot process, the device power-on boot starts from the private key of the asymmetric key pair and verifies the digital signatures of the bootloader, the operating system kernel, and the secure application running in the trusted execution environment level by level. S3: When the industrial control equipment establishes communication with an external entity, it verifies the user's possession and control rights over the industrial control equipment through a challenge-response mechanism based on the near-field communication protocol; based on the verification result of the challenge-response mechanism, it generates a one-time random number through the hardware random number generator built into the hardware security module, and generates the communication asymmetric session key based on the key negotiation protocol by combining the synchronized timestamp; it digitally signs the communication asymmetric session key by calling the signature function of the hardware security module, and generates a communication log, which is stored in a secure partition within the trusted execution environment; S4: Obtain a transaction instruction related to digital renminbi payment, settlement or smart contract execution, which is routed to the trusted execution environment for processing; the trusted execution environment interacts with the digital renminbi hardware wallet module integrated in the industrial control device, and parses the transaction instruction; based on the challenge-response mechanism verification result, the transaction information is confirmed on the secure user interface in the trusted execution environment; according to the return instruction of the confirmation result, the transaction is digitally signed through the signature function of the hardware security module to generate transaction credentials and transaction logs; S5: During device operation, continuously collect and analyze key data streams including industrial control operation instruction sequences, network traffic characteristics of traditional industrial control protocols, and frequency and amount of digital renminbi transactions by deploying an exception monitoring module inside the trusted execution environment.

[0005] As a preferred technical solution of the present application, the digital binding in S1 is performed in the following manner: A random number is generated by a random number generator of the hardware security module, and the asymmetric key pair is generated based on an asymmetric algorithm called by the trusted execution environment; The device identity identifier, device model and public key are packaged into a certificate subject in a standard format; the device model information is generated into a fingerprint through a hash operation and embedded into the certificate subject as a certificate extension field; The certificate is signed by a vendor root private key pre-stored in the hardware security module, and the signing operation is completed inside the hardware security module, and the private key does not participate in external calculation.

[0006] Specifically, the secure boot process includes: The public key of the asymmetric key pair is used to verify the signature of the first-level bootloader, and the signature public key is pre-stored in the read-only storage area of the hardware security module; Based on the signature verification result of the first-level bootloader, the hash value of the operating system kernel image is calculated and compared with the reference value pre-stored in the hardware security module, and the integrity and authenticity of the operating system kernel are verified based on the comparison result; Based on the kernel verification of the operating system, the trusted execution environment loads a security application, performs hash check on the application code through dynamic measurement technology, and generates a remote attestation report; Based on the hardware fuse mechanism of the hardware security module, if any stage fails, the trusted execution environment clears the temporary session key and running memory, writes a security event log and outputs an alarm signal through a physically tamper-proof interface.

[0007] Specifically, the challenge-response mechanism specifically performs the following process: The user submits an encrypted identity credential through a near-field communication device, and the trusted execution environment verifies the identity credential based on a preset certificate; The hardware random number generator generates a 256-bit one-time random number, which is combined with a nanosecond-level timestamp obtained based on the Beidou timing system as a challenge value, and the user uses a mobile wallet bound to the device to digitally sign the challenge value; Based on a key agreement protocol, a private key component is derived internally by the hardware security module, and the trusted execution environment verifies the validity of the signature using the public key in the device digital certificate.

[0008] Specifically, the digital renminbi hardware wallet in S4 includes: Based on double transaction signature, the first signature is generated by the user's private key, and the second signature is generated by the device's private key, which is encrypted and verified by the hardware chip to block transaction forgery; Based on a network-free environment, direct transactions between devices are realized through near-field communication, transaction data is temporarily stored in the trusted execution environment, and is automatically uploaded and verified after networking; Based on the anti-double-spending mechanism, each transaction is embedded with a unique serial number + timestamp structure identifier; through global ledger verification, the background system compares transaction records to intercept duplicate payments; the upper limit of single transaction amount is limited, which is enforced through chip-level register and cannot be bypassed by industrial control main program.

[0009] Specifically, the secure interaction process of the digital renminbi hardware wallet module includes: The trusted execution environment and the digital renminbi hardware wallet establish a communication channel through a physically isolated secure bus, and the digital renminbi hardware wallet sends an authentication code generated by key hash message authentication to the trusted execution environment when powered on, and the trusted execution environment verifies the validity using the preset digital renminbi hardware wallet root certificate; The transaction instruction is converted into ciphertext payload inside the trusted execution environment, and based on the ciphertext received by the digital renminbi hardware wallet, decryption and format verification are performed inside the secure chip; based on the passing of the verification, the trusted execution environment calls the quasi-account type hardware wallet to verify the balance and generates a temporary transaction token; The digital renminbi hardware wallet signs the transaction hash value twice through a transaction-specific key, the first signature generates a basic transaction credential, and the second signature combines the basic transaction credential with the Beidou timing clock value for combined signing, and the results of the two signatures are written into the tamper-proof memory together with the transaction counter.

[0010] Specifically, the management method of the transaction-specific key in S4 includes: The hardware security module internally allocates an independent key slot to store a transaction signature private key; meanwhile, a key usage quota register is provided, which is used to record the number of key usages, and when the number of key usages exceeds a threshold value, a key update process is automatically triggered; each transaction is based on a transaction counter and a timestamp output by a secure real-time clock to derive a transaction session key, and the transaction session key is chained with a device digital certificate; based on device networking, data synchronization is automatically triggered, and offline transaction records are uploaded to a digital renminbi system to complete transaction confirmation and fund clearing.

[0011] Specifically, the method for log management in S4 includes: Recording system full life cycle events, encrypting through a session key, and deriving the key by the hardware security module, writing the encrypted log into a secure storage area exclusive to the trusted execution environment, and only the trusted execution environment kernel can read and write; The log in the startup phase needs to be hashed with the trusted execution environment startup code; by hashing the previous log for each log record, a chain structure is formed, and based on the chain structure, tampering will cause subsequent hash failure; after batch generation of logs, the hardware security module uses the device private key to sign and generate a remote proof; The log encryption key is bound to the trusted execution environment running state, and cannot be decrypted when the environment is abnormal; every 24 hours or when the log volume exceeds a threshold, the hardware security module automatically derives a new log encryption key; The log time binding is based on the nanosecond-level timestamp obtained from the Beidou time system, and the hardware security module performs anti-forgery signature, and external auditors can verify the integrity of the log through the remote proof.

[0012] Specifically, the exception monitoring module in S5 includes: The exception monitoring module directly runs in the isolated space of the trusted execution environment and is physically isolated from the main operating system; By continuously learning the legal operations of the industrial control system, a whitelist security model is established; based on six attributes of the identity, time, location, method, operation type and resource object of the behavior person, a complete behavior feature is defined, a behavior model is constructed, illegal instructions are identified through the behavior model and the whitelist security model, and malicious operations are terminated in combination with the isolation capability of the trusted execution environment.

[0013] Specifically, the exception monitoring module responds to risks in stages, including: Based on the hierarchical response strategy, in the face of low risk, the signed log record is encrypted and the management platform is notified by running in the trusted execution environment; in the face of medium risk, the suspicious transaction is required to be suspended by calling the trusted execution environment security interface, and the biometric secondary authentication is forced; in the face of high risk, the device certificate state is updated to limited by linking the blockchain, and the account is frozen by fusing the device private key, triggering the smart contract.

[0014] The beneficial effects of the present application are: The random number generator of the hardware security module creates an asymmetric key pair, meets the requirements of the national standard for trusted random sources, binds the device ID, model and public key, is signed by the vendor root private key, and is consistent with the tamper-proof feature of the hardware security module; the device model is hashed as a certificate extension field, enhancing uniqueness and realizing ''one machine one certificate, factory trusted''.

[0015] The operating system kernel compares the hash value with the pre-stored benchmark to ensure integrity; at the same time, a security startup mechanism of progressive signing + dynamic measurement is adopted, cooperating with the fusing and anti-disassembly sensors of the hardware security module, to achieve immediate key zeroing and alarm upon failure of verification at any stage, preventing traditional industrial control attacks such as ''malicious flashing'' or ''debug port injection''.

[0016] The near field communication challenge-response mechanism combined with Beidou nanosecond timestamp blocks malicious operations such as relay, replay and tampering; the session key is derived from the random number + timestamp in the hardware security module, with one-time key, chain signature of communication log, enabling offline audit and post-tracing.

[0017] Double signature + double offline mechanism ensures that payment can still be completed in a network-free environment, and is automatically synchronized for clearing after networking; anti-double spending, upper limit of amount, and transaction counter triple control to prevent excessive payment or fake transactions; the transaction session key is chain-associated with the device certificate, and any transaction can be traced back to a specific device, specific user and specific time, enhancing control over transaction security.

[0018] The independent key slot inside the hardware security module + usage quota register realizes automatic update when reaching the threshold, reducing the leakage risk caused by long-term use; the transaction-specific key is derived from the counter + timestamp, truly achieving ''one transaction one key'', and the update process is transparent to the upper layer application.

[0019] The log encryption key is bound to the trusted execution environment running state, and is invalid in the event of an exception; chain hash + Beidou time signature ensures ''time-content-sequence'' trinity non-repudiation; supports remote batch audit, and the audit party can quickly locate the tampering point through the signature chain, meeting the compliance evidence collection requirements. BRIEF DESCRIPTION OF DRAWINGS

[0020] For the convenience of those skilled in the art to understand, the present application is further described below in conjunction with the drawings.

[0021] Figure 1 A flowchart of an embedded security management method based on a digital renminbi industrial control device of the present application. DETAILED DESCRIPTION

[0022] In order to further illustrate the technical means and effects adopted by the present application to achieve the predetermined invention purpose, the specific embodiments, structures, features and effects according to the present application are described in detail below in conjunction with the drawings and preferred embodiments.

[0023] Please refer to Figure 1 An embedded security management method based on a digital renminbi industrial control device, comprising: S1: When the industrial control device is first deployed, generate a unique asymmetric key pair of the industrial control device based on the hardware security module and the trusted execution environment running cooperatively in the industrial control device, bind the public key of the asymmetric key pair with the device identity identifier and the device model information to generate a device digital certificate; S2: Based on the secure boot process, start with the private key of the asymmetric key pair when the device is powered on, and verify the digital signatures of the bootloader, the operating system kernel and the security application running in the trusted execution environment step by step; S3: When the industrial control device establishes communication with an external entity, verify the possession and control of the industrial control device by the user based on the challenge-response mechanism based on the near field communication protocol; based on the challenge-response mechanism verification result, generate a one-time random number through the hardware random number generator built in the hardware security module, combine the synchronous time stamp, generate the communication asymmetric session key based on the key agreement protocol; generate a communication log by digitally signing the communication asymmetric session key through the signature function of the hardware security module, and store the communication log in the secure partition in the trusted execution environment; S4: Obtain transaction instructions related to digital renminbi payment, settlement or smart contract execution, which are routed to the trusted execution environment for processing; the trusted execution environment and the digital renminbi hardware wallet module integrated in the industrial control device interact safely and analyze the transaction instructions; based on the challenge-response mechanism verification result, confirm the transaction information in the secure user interface in the trusted execution environment; according to the return instruction of the confirmation result, generate transaction credentials and transaction logs by digitally signing the transaction through the signature function of the hardware security module; S5: During the operation of the device, the key data streams including the industrial control operation instruction sequence, the network traffic characteristics of the traditional industrial control protocol, and the frequency and amount of digital renminbi transactions are continuously collected and analyzed by deploying an exception monitoring module inside the trusted execution environment.

[0024] Specifically, the digital binding is performed in the following manner: A random number is generated by a random number generator of the hardware security module, and the asymmetric key pair is generated based on an asymmetric algorithm called by the trusted execution environment; The device identity identifier, the device model, and the public key are packaged into a certificate subject in a standard format; the device model information is generated into a fingerprint through a hash operation and embedded into the certificate subject as a certificate extension field; The certificate is signed by a vendor root private key pre-stored in the hardware security module, and the signing operation is completed inside the hardware security module, and the private key does not participate in external calculation.

[0025] In this embodiment, a 256-bit high-strength random number seed is generated by a random number generator built in the hardware security module. This process meets the physical entropy source standard and eliminates the risk of pseudo-randomness. The trusted execution environment calls an asymmetric encryption algorithm such as the SM2 national encryption algorithm to generate a unique asymmetric key pair based on the random number seed. The private key is securely stored in a tamper-proof key slot by the hardware security module, and the public key is output to the temporary buffer area of the trusted execution environment. The key generation is completed inside the hardware security module throughout, and the private key handle is isolated from the external system by specifying the key type and length.

[0026] The device identity identifier such as the MAC address + serial number, the device model, and the public key are packaged in a standard format to form a certificate subject; SM3 hash operation is performed on the device model information to generate a 256-bit unique fingerprint as a certificate extension field; the vendor root private key pre-stored in the hardware security module is called, the key is stored in a non-exportable mode, and only signature operation is allowed, and the certificate subject is digitally signed inside the hardware security module to generate a signature value and attach it to the tail of the certificate to form a complete device digital certificate.

[0027] The complete certificate is written in DER binary format to the secure storage area of the trusted execution environment, and access requires authorization of the trusted execution environment kernel. External entities can verify the authenticity of the device certificate based on the vendor root public key through the certificate structure analysis, device fingerprint hash comparison, and signature value verification process.

[0028] Specifically, the secure boot process includes: The public key of the asymmetric key pair is used to verify the signature of the first-level bootloader, and the signature public key is pre-stored in the read-only storage area of the hardware security module; Based on the signature verification result of the first level boot loader, the hash value of the operating system kernel image is calculated and compared with the reference value pre-stored in the hardware security module, and the integrity and authenticity of the operating system kernel are verified based on the comparison result; Based on the kernel verification of the operating system, the trusted execution environment loads a secure application, performs hash checking on the application code through dynamic measurement technology, and generates a remote attestation report; Based on the hardware fuse mechanism of the hardware security module, if any stage verification fails, the trusted execution environment clears the temporary session key and running memory, writes a security event log, and outputs an alarm signal through a physically tamper-proof interface.

[0029] In this embodiment, through dynamic integrity measurement and other technologies, key data in memory is measured during program execution, and the measurement result is compared with the reference value to detect tampering behavior. When measuring the code segment of the kernel or user state process, the address range of the code segment can be obtained, hash calculation is performed, and address data that may change is excluded to improve applicability; a measurement engine is designed in the trusted execution environment to measure specific data services after program instrumentation, including static code, execution process and results, and to construct a proof report to ensure the credibility of the measurement process; remote attestation based on the trusted platform module is implemented through a challenge-response protocol, the attester returns the trusted platform module signature, measurement log and random number to the verifier, and the verifier verifies the platform integrity by signature verification and comparison of the measurement log; when deploying software, import the digest list, load the digest value into the hash table as a whitelist after kernel signature verification; when the application program is running, trigger the digest list measurement, calculate the file hash value and compare it with the baseline value, if they are consistent, access is allowed, otherwise, log is recorded or access is denied; when remote attestation, the client returns the digest list measurement log, the server reports the result to the security center after verification.

[0030] Specifically, the challenge-response mechanism specifically performs the following process: The user submits an encrypted identity credential through a near field communication device, and the trusted execution environment verifies the validity of the identity credential based on a preset certificate; The hardware random number generator generates a 256-bit one-time random number, which is combined with a nanosecond-level timestamp obtained based on the Beidou time system as a challenge value, and the user uses the mobile wallet bound to the device to digitally sign the challenge value; Based on the key agreement protocol, the private key component is derived internally by the hardware security module, and the trusted execution environment uses the public key in the device digital certificate to verify the validity of the signature.

[0031] In this embodiment, the user holds a mobile device supporting near field communication close to the near field communication induction area of the industrial control device, with a distance less than five meters. The mobile wallet calls the trusted execution environment security module, encrypts the identity certificate using the device pre-shared public key, and generates an encrypted data packet; the encryption uses the national SM2 algorithm, and the private key is stored in the mobile wallet security chip to prevent man-in-the-middle theft.

[0032] After the industrial control device trusted execution environment receives the encrypted certificate, it retrieves the pre-set root certificate chain from the hardware security module secure storage area, verifies the validity of the mobile wallet certificate, including revocation status and validity period; at the same time, it uses the device private key to decrypt the data packet and extracts the user's unique identifier, compares it with the device's local registered binding relationship library, and if the comparison fails, the process is terminated and a security event log is recorded.

[0033] Specifically, the digital RMB hardware wallet module comprises: Based on double transaction signature, the first signature is generated by the user's private key, and the second signature is generated by the device's private key, which is encrypted and verified by the hardware chip to block transaction forgery; Based on a network-free environment, direct transactions between devices are realized through near field communication, and transaction data is temporarily stored in the trusted execution environment and automatically uploaded and verified after networking; Based on the anti-double-spending mechanism, each transaction is embedded with a unique serial number + timestamp structure identifier; through global ledger verification, the background system compares transaction records to intercept duplicate payments; the upper limit of single transaction amount is limited, and the chip-level register is used to enforce it, which cannot be bypassed by the industrial control main program.

[0034] In this embodiment, the digital RMB hardware wallet module is connected to the hardware security module through a serial peripheral device high-speed interface, and the interface is in a closed state by default after power-on; after receiving the transaction instruction, the trusted execution environment first generates a transaction-specific key through the key derivation function built-in the hardware security module, and the validity period of the transaction-specific key only covers a single transaction; then the trusted execution environment drives the serial peripheral device interface enable signal, and immediately pulls down the enablement after completing a transaction, and the serial peripheral device interface memory is cleared; after completing the transaction, the signature is performed, and the signature result is encoded and packaged into a transaction certificate structure body conforming to the Digital RMB Wallet Application Interface Specification; the trusted execution environment simultaneously calls the random mask generator of the hardware security module to perform random mask processing on the transaction-specific key to prevent side channel energy analysis.

[0035] Specifically, the digital RMB hardware wallet module security interaction process comprises: The trusted execution environment and the digital RMB hardware wallet establish a communication channel through a physically isolated secure bus. When the digital RMB hardware wallet is powered on, it sends an authentication code generated through key hash message authentication to the trusted execution environment. The trusted execution environment verifies the validity using a preset root certificate of the digital RMB hardware wallet. The transaction instruction is converted into a ciphertext payload inside the trusted execution environment. Based on the ciphertext received by the digital RMB hardware wallet, decryption and format verification are performed inside the secure chip. Based on the passing of the verification, the trusted execution environment calls the quasi-account type hardware wallet to verify the balance and generate a temporary transaction token. The digital RMB hardware wallet signs the transaction hash value twice through a transaction-specific key. The first signature generates a basic transaction voucher, and the second signature combines the basic transaction voucher with a Beidou time clock value for signing. The results of the two signatures are written together with a transaction counter into a tamper-proof memory.

[0036] In this embodiment, the trusted execution environment and the hardware wallet establish a communication channel through a physically isolated secure bus. When the hardware wallet is powered on, it sends a device identity authentication code encrypted based on a symmetric block cipher encryption mode to the trusted execution environment. The authentication code is generated by a wallet chip unique identifier and a device digital certificate hash value through a key hash message authentication code. The trusted execution environment verifies the validity using a preset root certificate of the hardware wallet, and disconnects the physical connection if the verification fails.

[0037] The transaction instruction is converted into a standard data structure inside the trusted execution environment. Key fields such as the payee address and the amount are obfuscated using white-box encryption technology to generate a ciphertext payload resistant to side-channel attacks. After receiving the ciphertext, the hardware wallet performs SM2 decryption and format verification inside the secure chip. If the verification fails, a voltage glitch attack detection is triggered.

[0038] The hardware wallet signs the transaction hash value twice using a transaction-specific key. The first signature generates a basic transaction voucher, and the second signature combines the basic voucher with a Beidou time clock value for signing. The double signature result and the transaction counter are written together into a tamper-proof non-volatile read-write memory.

[0039] After the device restores network connection, the trusted execution environment automatically initiates offline transaction synchronization, extracts the triplets of <double signature, transaction counter, timestamp> of unsynchronized transactions in the hardware wallet, uploads them to the digital RMB blockchain node through the trusted execution environment secure channel, and verifies the global uniqueness of the transaction counter and the reasonableness of the timestamp. The node rejects double-spend transactions and initiates local transaction tracing when detecting transaction counter conflicts.

[0040] Specifically, the management method of the transaction-specific key includes: The hardware security module internally allocates independent key slot to store transaction signature private key; meanwhile, a key usage quota register is arranged, which is used to record the usage times of the key, and when the usage times of the key exceed a threshold value, a key update process is automatically triggered; each transaction is based on a transaction counter and a timestamp output by a secure real-time clock to derive a transaction session key, and the transaction session key is chained with a device digital certificate; based on device networking, data synchronization is automatically triggered, and offline transaction records are uploaded to a digital renminbi system to complete transaction confirmation and fund clearing.

[0041] Specifically, the log management includes: Recording system full life cycle events, encrypted by session key, the key is dynamically derived by the hardware security module, and the log is written into the trusted execution environment exclusive security storage area after encryption, and only the trusted execution environment kernel can read and write; The log in the starting stage needs to be bound with the hash value of the trusted execution environment starting code; the hash value of the previous log is recorded for each log record to form a chain structure, and based on the chain structure, tampering will cause subsequent hash failure; after batch generation of logs, the hardware security module uses the device private key to sign to generate a remote proof; The log encryption key is bound with the trusted execution environment running state, and decryption cannot be performed when the environment is abnormal, and a new log encryption key is automatically derived by the hardware security module every 24 hours or when the log amount exceeds a threshold value; The log time binding is based on the nanosecond-level timestamp obtained from the Beidou time system, and the hardware security module is used for anti-fake signature, and an external auditing party can verify the integrity of the log through the remote proof.

[0042] In the embodiment, the hardware security module generates a root key based on a physically unclonable function, and derives a session key in combination with a trusted execution environment runtime measurement value; the log is in blocks of 512 bytes, and the initialization vector is provided by a hardware security module random number generator, and an authentication tag is attached to the tail of the log.

[0043] When the device is powered on, the trusted execution environment calculates the hash value of the starting code immediately after loading the starting code, which is used as the "forward hash" anchor point of the first log: the hash value of the previous log is recorded for the subsequent log to form a chain of cryptography, and tampering with any log will cause verification failure and chain breakage. When every 50 logs or the capacity reaches 4KB, the trusted execution environment calls the signature engine of the hardware security module to sign the log batch using the device private key to generate a remote proof report, which contains the log batch hash, the trusted execution environment running measurement value, and the timestamp of the Beidou time signature.

[0044] The audit party verifies the accuracy of the log by checking the device certificate chain, log integrity, recalculating the hash chain, extracting the Beidou time signature, verifying the time real-time by satellite public key, and comparing the timestamp sequence to confirm that there is no rollback or jump anomaly.

[0045] Specifically, the abnormality monitoring module includes: The abnormality monitoring module is directly run in the isolated space of the trusted execution environment and is physically isolated from the main operating system. By continuously learning the legal operation of the industrial control system, a whitelist security model is established; based on the six attributes of the identity, time, location, method, operation type and resource object of the behavior person, a complete behavior feature is defined, a behavior model is constructed, illegal instructions are identified through the behavior model and the whitelist security model, and malicious operations are terminated in combination with the isolation capability of the trusted execution environment.

[0046] Specifically, the abnormality monitoring module responds to risks in stages, including: Based on the graded response strategy, when facing low risk, the signed log record running in the trusted execution environment is used to encrypt the log and notify the management platform; when facing medium risk, the suspicious transaction is suspended by calling the security interface of the trusted execution environment, and the biological feature is forced to be authenticated twice; when facing high risk, the device certificate state is updated to limited by linking the blockchain, the device private key is fused, and the account is frozen by triggering the smart contract.

[0047] The above is only a preferred embodiment of the present application, and does not limit the present application in any form. Although the present application has been disclosed as above, it is not intended to limit the present application. Any person skilled in the art can make some changes or modifications to the above disclosed technical content without departing from the scope of the technical solution of the present application, and any simple modification, equivalent change and modification of the above embodiments based on the technical essence of the present application are still within the scope of the technical solution of the present application.

Claims

1. An embedded security management method based on a digital renminbi industrial control device, characterized by, Comprise: S1: when the industrial control device is first deployed, generate a unique asymmetric key pair of the industrial control device based on the hardware security module and the trusted execution environment running cooperatively in the industrial control device, bind the public key of the asymmetric key pair with the device identity identifier and the device model information to generate a device digital certificate; S2: based on the secure boot process, the device starts from the private key of the asymmetric key pair, and verifies the digital signatures of the bootloader, the operating system kernel and the security application running in the trusted execution environment level by level; S3: when the industrial control device establishes communication with external entities, based on the near field communication protocol, the challenge-response mechanism is used to verify the possession and control of the user of the industrial control device; based on the challenge-response mechanism verification result, a one-time random number is generated by the random number generator built in the hardware security module, and the time stamp is combined to generate the communication asymmetric session key based on the key agreement protocol; the communication asymmetric session key is digitally signed by calling the signature function of the hardware security module to generate the communication log, which is stored in the secure partition of the trusted execution environment; S4: obtain transaction instructions related to digital renminbi payment, settlement or smart contract execution, which are routed to the trusted execution environment for processing; the trusted execution environment interacts with the digital renminbi hardware wallet module integrated in the industrial control device, and analyzes the transaction instructions; based on the challenge-response mechanism verification result, the transaction information is confirmed in the secure user interface in the trusted execution environment; according to the return instruction of the confirmation result, the transaction is digitally signed by the signature function of the hardware security module to generate transaction credentials and transaction logs; S5: during the device operation, an abnormality monitoring module is deployed in the trusted execution environment to continuously collect and analyze key data streams including industrial control operation instruction sequence, network traffic characteristics of traditional industrial control protocol, and frequency and amount of digital renminbi transactions.

2. The method of claim 1, wherein, The method for information binding in S1 is: Generate a random number through the random number generator of the hardware security module, and generate the asymmetric key pair based on the asymmetric algorithm called by the trusted execution environment; The device identity identifier, device model and public key are packaged into a certificate subject in a standard format; the device model information is generated into a fingerprint through hash operation and embedded into the certificate subject as a certificate extension field; The certificate is signed by the manufacturer's root private key preinstalled in the hardware security module, and the signature operation is completed in the hardware security module, and the private key does not participate in external calculation.

3. The method of claim 1, wherein, The secure boot process in S2 comprises: The public key of the asymmetric key pair is used to verify the signature of the first level bootloader, and the signature public key is preinstalled in the read-only storage area of the hardware security module; Based on the signature verification result of the first level bootloader, the hash value of the operating system kernel image is calculated, compared with the pre-stored reference value in the hardware security module, and the integrity and authenticity of the operating system kernel are verified based on the comparison result; Based on the kernel verification of the operating system, the trusted execution environment loads the secure application, performs hash verification on the application code through dynamic measurement technology, and generates a remote attestation report; Based on the hardware fuse mechanism of the hardware security module, if any stage fails to verify, the trusted execution environment clears the temporary session key and running memory, writes a security event log, and outputs an alarm signal through a physically tamper-proof interface.

4. The method of claim 1, wherein, The challenge-response mechanism described in S3 has the following specific implementation process: The user submits encrypted identity credentials through a near-field communication device, and the trusted execution environment verifies the validity of the identity credentials based on a preset certificate; The hardware random number generator generates a 256-bit one-time random number, which is combined with a nanosecond-level timestamp obtained based on the Beidou timing system as a challenge value. The user uses the mobile wallet bound to the device to digitally sign the challenge value; Based on the key agreement protocol, the private key component is derived internally by the hardware security module, and the trusted execution environment verifies the validity of the signature using the public key in the device digital certificate.

5. The method of claim 1, wherein, The digital RMB hardware wallet in S4 includes: Based on double transaction signature, the first signature is generated by the user's private key, and the second signature is generated by the device's private key. Through hardware chip encryption verification, transaction forgery is blocked; Based on a network-free environment, direct transactions between devices are realized through near-field communication. Transaction data is temporarily stored in the trusted execution environment and automatically uploaded for verification after networking. Based on the anti-double-spending mechanism, each transaction is embedded with a unique serial number + timestamp structure identifier. Through global ledger verification, the background system compares transaction records to intercept duplicate payments. The upper limit of single transaction amount is restricted and enforced through chip-level registers, which cannot be bypassed by the industrial control main program.

6. The method of claim 1, wherein, The secure interaction process of the digital RMB hardware wallet in S4 includes: The trusted execution environment and the digital RMB hardware wallet establish a communication channel through a physically isolated secure bus. When the digital RMB hardware wallet is powered on, it sends an authentication code generated through key hash message authentication to the trusted execution environment. The trusted execution environment verifies the validity using the preset root certificate of the digital RMB hardware wallet; The transaction instruction is converted to ciphertext payload inside the trusted execution environment. Based on the ciphertext received by the digital RMB hardware wallet, decryption and format verification are performed inside the secure chip. Based on the passing of the verification, the trusted execution environment calls the quasi-account type hardware wallet to verify the balance and generates a temporary transaction token; The digital RMB hardware wallet signs the transaction hash value twice through a transaction-specific key. The first signature generates a basic transaction voucher, and the second signature combines the basic transaction voucher with the Beidou timing clock value. The results of the two signatures are written to the tamper-proof memory along with the transaction counter.

7. The method of claim 1, wherein, The management method of the transaction-specific key in S4 includes: The hardware security module internally allocates independent key slot to store transaction signature private key; meanwhile, a key usage quota register is arranged, which is used to record the usage times of the key, and when the usage times of the key exceed a threshold value, a key update process is automatically triggered; each transaction is based on a transaction counter and a timestamp output by a secure real-time clock to derive a transaction session key, and the transaction session key is chained with the device digital certificate; based on device networking, data synchronization is automatically triggered, and offline transaction records are uploaded to the digital renminbi system to complete transaction confirmation and fund settlement.

8. The method of claim 1, wherein, The log management in S4 comprises: Recording system full life cycle events, encrypted by session key, the key is dynamically derived by the hardware security module, and the encrypted log is written into the trusted execution environment exclusive security storage area, which can only be read and written by the trusted execution environment kernel; The log in the starting stage needs to be bound with the trusted execution environment starting code by hash; by taking the hash value of the previous log for each log record, a chain structure is formed, based on the chain structure, tampering will cause subsequent hash failure; after batch generation of the log, the hardware security module uses the device private key to sign to generate a remote proof; The log encryption key is bound with the trusted execution environment running state, and cannot be decrypted when the environment is abnormal, and a new log encryption key is automatically derived by the hardware security module every 24 hours or when the log amount exceeds a threshold value; The log time binding is based on the nanosecond level timestamp obtained from the Beidou time system, and the hardware security module is used for anti-fake signature, and the external auditing party can verify the integrity of the log through the remote proof.

9. The method of claim 1, wherein, The abnormality monitoring module in S5 comprises: The abnormality monitoring module directly runs in the isolated space of the trusted execution environment, and is physically isolated from the main operating system; By continuously learning the legal operation of the industrial control system, a whitelist security model is established; based on the six attributes of the behavior identity, time, location, method, operation type and resource object, a complete behavior feature is defined, a behavior model is constructed, illegal instructions are identified through the behavior model and the whitelist security model, and malicious operations are terminated in combination with the isolation capability of the trusted execution environment.

10. The method of claim 9, wherein, The abnormality monitoring module responds to risks in stages, including: Based on the staged response strategy, when facing low risk, the signature log record in the trusted execution environment is encrypted and the management platform is notified; when facing medium risk, the suspicious transaction is suspended by calling the security interface of the trusted execution environment, and the biological feature is forced to be authenticated twice; when facing high risk, the device certificate state is updated to limited by linking the blockchain, the device private key is fused to trigger the smart contract to freeze the account.

Images