A trusted boot method and system based on a trusted dual architecture

Abstract

The application discloses a trusted boot method and system based on a trusted dual architecture, relates to the technical field of industrial control safety, and comprises the following steps: obtaining a hardware layer, an operating system layer and an application layer of a PLC system, encapsulating an image file, designing a key of the image file, and burning the key and the image file into a storage position corresponding to the PLC system; after the PLC system is powered on, an operating system kernel calls an on-chip Boot Loader and a reference value in ROM data in a trusted CPU, integrity verification is sequentially performed on each system boot component, integrity verification of an application program is performed by the system boot component, and based on the integrity verification, it is judged whether the trusted boot of the PLC system is completed or an alarm prompt is sent. Through the trusted dual architecture CPU, the application overcomes the defect that a trusted computing module in a previous architecture is subordinate to a traditional computing module, improves the trustworthiness and security of core components in a starting stage, and enhances the robustness and trusted starting performance of the system.

Description

Technical Field

[0001] This invention relates to the field of industrial control security technology, specifically a trusted boot method and system based on a trusted dual-system architecture. Background Technology

[0002] With the rapid advancement of cloud computing, the Internet of Things, and 5G communication technologies, the industrial control field is booming under the support of information technology. While users enjoy more convenient services, they also face increasingly serious security issues. PLC (Programmable Logic Controller) systems are a key link in industrial control, and ensuring the reliability of PLC systems is the cornerstone of ensuring the safety of the entire industrial control process.

[0003] TPM (Trusted Platform Module) is one of the most commonly used security defense technologies in trusted computing. However, due to the connection method of traditional TPM chips, the TPM chip cannot start working before the CPU, which brings security risks. In addition, the most widely used trusted computing architecture has another defect: the information transmitted by the TPM chip can be easily stolen by physical probes or caused to fail by plugging and unplugging. Considering the higher trust requirements, PLC systems urgently need to adopt a higher-level hardware root of trust to ensure that the hardware root of trust starts before the traditional computing CPU and achieve trusted boot. Summary of the Invention

[0004] The purpose of this invention is to provide a trusted boot method and system based on a trusted dual-architecture to solve the problems raised in the prior art.

[0005] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0006] A trusted bootstrapping method based on a trusted dual-architecture architecture includes the following steps:

[0007] The hardware layer, operating system layer, and application layer of the PLC system are obtained. The hardware layer of the PLC system includes a trusted CPU, a computing CPU, and peripheral devices. The operating system layer of the PLC system includes the operating system kernel, external device drivers, and trusted security services. The application layer of the PLC system includes trusted applications, function libraries, and feature libraries.

[0008] The program for determining whether a PLC system is trustworthy is packaged into an image file. The installation data of the trustworthy CPU in the PLC system is obtained. Based on the installation data, a key for the image file is designed using a key design algorithm. The designed key and the image file are then burned into the corresponding storage location of the PLC system.

[0009] The operating system kernel uses the trusted CPU as the root of trust. After the PLC system is powered on, the operating system kernel retrieves the ROM data in the trusted CPU, extracts the on-chip Boot Loader and reference value from the ROM data, completes the PLC system initialization and enables basic functions. After that, the trusted CPU performs integrity verification on each system boot component in turn.

[0010] If the integrity verification of each system boot component passes, the computing CPU loads the verified system boot component; then the system boot component performs integrity verification on the application, which includes verifying several check items, thus finally completing the trusted boot of the PLC system; if any integrity verification fails, the PLC system stops the startup process and issues an alarm.

[0011] Preferably, the trusted CPU and the computing CPU operate in complete parallelism and are independent of each other. The trusted CPU is not controlled by the computing CPU, while the computing CPU is controlled by the trusted CPU. Peripheral devices are used to implement the basic control functions of the PLC system. The peripheral devices include I / O modules, communication modules, and storage modules. The storage resources of the storage modules are shared by the trusted CPU and the computing CPU.

[0012] Preferably, the trusted application calls the trusted mechanism interface provided by the trusted software. The trusted mechanism interface is a set of standardized interfaces designed for secure interaction between upper-layer applications and services and the trusted CPU. The trusted software includes a trusted management center and a trusted software base. The trusted management center is used to manage and maintain the system's trust state, and the trusted software base is used to ensure that the system can execute based on a trusted starting point during startup and runtime.

[0013] Preferably, the key design for the image file includes: obtaining the installation timestamp and CPU number of the trusted CPU in the PLC system; generating the key for the image file based on the installation timestamp, CPU number, and a random string refreshed according to rules; wherein the image files burned to different PLC systems have different keys; the key design algorithm includes ECDSA algorithm, SHA algorithm, and AES algorithm, wherein the ECDSA algorithm is used to perform the digital signature generation and verification steps, the SHA algorithm is used to perform the password hash generation and integrity verification steps, and the AES algorithm is used to perform the encryption and decryption steps of the key.

[0014] In this scheme, in order to ensure that different PLC systems have unique keys, improve data security, and reduce the risk of tampering, the installation timestamp and CPU number, as well as a random string refreshed by rules, are used for further encryption. The encryption process is based on existing technology and will not be described in detail here.

[0015] Preferably, the refresh rule for the random string includes the following steps:

[0016] Obtain the PLC system S to be programmed, and obtain the user P who logged into the PLC system S. S and login time T S ; Obtain login user P S During working hours, if the login time T S During working hours, the reliability of the obtained time is 1; outside of working hours, the login time T is obtained. S The end time T1 of the previous work period and the start time T2 of the next work period are used to determine the distance from the landing time T between T1 and T2. S The most recent moment, as the target moment, is determined based on the target moment and the landing time T. S Duration D between S The time reliability is obtained as follows: ;

[0017] If the logged-in user P S If a person has permission to access the PLC system S, their reliability is set to 1; otherwise, their reliability is set to 0. The time reliability is multiplied by the personnel reliability to obtain the total reliability. When the total reliability is less than the preset reliability threshold, the random string is refreshed to generate a new key for the image file.

[0018] Preferably, the verification content includes core verification content and adaptation verification content. The core verification content is the basic content that ensures the normal operation of the application. All core verification content is verification content for the integrity of the application. The adaptation verification content is supplementary content that is dynamically adjusted according to the actual use scenario or operating environment.

[0019] Retrieve a specific adaptation verification content X corresponding to an application W, where the normal operation of application W depends on the access of industrial control equipment. Retrieve the time T of a historical value change record R of the adaptation verification content X. R Extract the industrial control equipment connected to application W at time T. R The previous logs were used as baseline logs. The logs included log type and log notes. Based on several value change records and the industrial control equipment connected each time the value changed, multiple baseline logs were extracted and summarized into a log set for adaptation verification content X.

[0020] Preferably, the PLC system S to be programmed is obtained, the industrial control equipment that was last connected to the application program W on the PLC system S is obtained, and several logs before the time of disconnection from the PLC system and industrial control equipment are extracted and used as target logs.

[0021] Obtain the total number of baseline logs in the log set, collect the number of baseline logs corresponding to each log type, divide the number of baseline logs by the total number of baseline logs in the PLC system to obtain the target ratio for each log type; sum the target ratios of the log types corresponding to each current target log as the type similarity.

[0022] Based on the log notes of each target log, extract the keywords from each log note and use them as target keywords; based on the log notes of each baseline log, extract the keywords from each log note and use them as baseline keywords; obtain the word similarity between a target keyword K and each baseline keyword, and take the maximum word similarity as the target value of the target keyword K; obtain the target values ​​of each target keyword, add them up and calculate the average to obtain the note similarity.

[0023] Based on the preset weights of type similarity and note similarity, the change probability of the adaptation verification content X corresponding to the current application W is obtained; if the change probability of the PLC system is greater than the preset probability threshold, the adaptation verification content X is used as the verification content for the integrity verification of application W, and thus all the verification content for the integrity verification of the application is obtained.

[0024] This invention employs a trusted dual-architecture CPU to overcome the shortcomings of previous architectures where the trusted computing module was subordinate to the traditional computing module. This invention not only enhances the trustworthiness and security of core components during the startup phase, ensuring the system is controlled and tamper-proof from the lowest level, but also effectively distributes the workload of the trusted CPU in implementing trusted computing, allowing it to focus more on other critical security tasks. This overall enhances the system's robustness and trusted startup performance, ensuring the security of the entire industrial control process, balancing system trustworthiness and computing performance, and reducing the workload of the trusted CPU.

[0025] A trusted boot system based on a trusted dual-architecture system includes a PLC system extraction module, a key design module, an integrity verification module, and a trusted boot completion module.

[0026] PLC System Extraction Module: Used to obtain the hardware layer, operating system layer and application layer of the PLC system. The PLC system hardware layer includes a trusted CPU, computing CPU and peripheral devices. The PLC system operating system layer includes the operating system kernel, external device drivers and trusted security services. The PLC system application layer includes trusted applications, function libraries and functional libraries.

[0027] Key design module: This module encapsulates a program for determining the trustworthiness of a PLC system into an image file. It obtains the installation data of the trusted CPU in the PLC system, designs the key for the image file based on the installation data and a key design algorithm, and then burns the designed key and the image file into the corresponding storage location of the PLC system.

[0028] Integrity verification module: The operating system kernel uses the trusted CPU as the root of trust. After the PLC system is powered on, the operating system kernel retrieves the ROM data in the trusted CPU, extracts the on-chip Boot Loader and reference value from the ROM data, completes the PLC system initialization and enables basic functions. After that, the trusted CPU performs integrity verification on each system boot component in turn.

[0029] Trusted Boot Completion Module: If the integrity verification of each system boot component passes, the computing CPU loads the verified system boot component; then the system boot component performs integrity verification on the application, which includes verifying several check items, thus finally completing the trusted boot of the PLC system; if the integrity verification of any system boot component fails, the PLC system stops the startup process and issues an alarm.

[0030] Preferably, the key design module includes an image file burning unit and a key design unit;

[0031] Image file burning unit: used to obtain the installation timestamp and CPU number of the trusted CPU in the PLC system, and based on the installation timestamp and CPU number, as well as a string of random strings refreshed according to rules, to design the key of the image file through the key design algorithm, and burn the designed key and image file into the corresponding storage location of the PLC system;

[0032] Key design unit: used to obtain the PLC system S to be programmed, obtain the login personnel and login time of the PLC system S; obtain the time reliability and personnel reliability, calculate the total reliability, and determine whether to refresh the random string to generate a new key for the image file.

[0033] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention provides a trusted booting method and system based on a trusted dual-architecture system, including: acquiring the hardware layer, operating system layer, and application layer of the PLC system; encapsulating an image file; designing a key for the image file; and burning the key and image file into the corresponding storage location of the PLC system. After the PLC system is powered on, the operating system kernel retrieves the on-chip Boot Loader and reference value from the ROM data in the trusted CPU, sequentially performs integrity verification on each system booting component, and the system booting component performs integrity verification on the application program. Based on the integrity verification, it determines whether the trusted booting of the PLC system is complete or issues an alarm. This invention, through a trusted dual-architecture CPU, overcomes the defect of the trusted computing module being subordinate to the traditional computing module in previous architectures, improves the trustworthiness and security of core components during the startup phase, and enhances the robustness and trusted boot performance of the system. Attached Figure Description

[0034] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart illustrating a trusted bootstrapping method based on a trusted dual-system architecture according to the present invention.

[0036] Figure 2 This is a schematic diagram of the structure of the PLC system of the present invention;

[0037] Figure 3 This invention provides a trust structure diagram for a trusted bootstrapping method and system based on a trusted dual-architecture. Detailed Implementation

[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0039] Example: Figure 1 As shown, this invention provides a trusted bootstrapping method based on a trusted dual-architecture architecture, comprising the following steps:

[0040] (1) Obtain the hardware layer, operating system layer, and application layer of the PLC system. The PLC system hardware layer includes a trusted CPU, a computing CPU, and peripheral devices. The PLC system operating system layer includes the operating system kernel, external device drivers, and trusted security services. The PLC system application layer includes trusted applications, function libraries, and functional libraries. A schematic diagram of the specific PLC system structure is attached. Figure 2 As shown.

[0041] The trusted CPU and the computing CPU operate in complete parallelism and are independent of each other. The trusted CPU has its own independent resources and is not controlled by the computing CPU, while the computing CPU is controlled by the trusted CPU. Peripheral devices are used to implement the basic control functions of the PLC system. Peripheral devices include I / O modules, communication modules, and storage modules. The storage resources of the storage modules are shared by the trusted CPU and the computing CPU.

[0042] Trusted applications call the trusted mechanism interface provided by trusted software. The trusted mechanism interface is a set of standardized interfaces designed for secure interaction between upper-layer applications and services and the trusted CPU. Trusted software includes a trusted management center and a trusted software base. The trusted management center is used to manage and maintain the system's trust state, while the trusted software base is used to ensure that the system can execute based on a trusted starting point during startup and runtime.

[0043] (2) Encapsulate the program for determining whether the PLC system is trustworthy into the image file, obtain the installation data of the trustworthy CPU in the PLC system, design the key of the image file through the key design algorithm based on the installation data, and burn the designed key and image file into the corresponding storage location of the PLC system.

[0044] The system obtains the installation timestamp and CPU number of the trusted CPU in the PLC system. Based on the installation timestamp, CPU number, and a random string refreshed according to rules, it generates a key for the image file. The image files burned to different PLC systems have different keys. The key design algorithms include ECDSA, SHA, and AES algorithms. The ECDSA algorithm is used to perform digital signature generation and verification steps, the SHA algorithm is used to perform password hash generation and integrity verification steps, and the AES algorithm is used to perform key encryption and decryption steps.

[0045] In this scheme, in order to ensure that different PLC systems have unique keys, improve data security, and reduce the risk of tampering, the installation timestamp and CPU number, as well as a random string refreshed by rules, are used for further encryption. The encryption process is based on existing technology and will not be described in detail here.

[0046] The refresh rules for random strings include the following steps:

[0047] Obtain the PLC system S to be programmed, and obtain the user P who logged into the PLC system S. S and login time T S ; Obtain login user P S During working hours, if the login time T S During working hours, the reliability of the obtained time is 1; outside of working hours, the login time T is obtained. S The end time T1 of the previous work period and the start time T2 of the next work period are used to determine the distance from the landing time T between T1 and T2. S The most recent moment, as the target moment, is determined based on the target moment and the landing time T. S Duration D between S The time reliability is obtained as follows: ;

[0048] If the logged-in user P S If a person has permission to access the PLC system S, their reliability is set to 1; otherwise, their reliability is set to 0. The time reliability is multiplied by the personnel reliability to obtain the total reliability. When the total reliability is less than the preset reliability threshold, the random string is refreshed to generate a new key for the image file.

[0049] (3) The operating system kernel uses the trusted CPU as the root of trust. After the PLC system is powered on, the operating system kernel retrieves the ROM data in the trusted CPU, extracts the on-chip Boot Loader and reference value from the ROM data, completes the PLC system initialization and enables basic functions. After that, the trusted CPU performs integrity verification on each system boot component in turn.

[0050] In this embodiment, the trusted CPU sequentially performs integrity verification on each system boot component, the steps of which are: sequentially verifying the integrity of the off-chip Boot Loader, BIOS code, and OS Loader; the system boot component then performs integrity verification on the application, the steps of which are: the OS Loader performs integrity verification on the OS, and the OS performs integrity verification on the application, as shown in the appendix. Figure 3 As shown, if the external Boot Loader is found to be complete after integrity verification, the next step is to verify the integrity of the BIOS code; otherwise, the PLC system stops starting and an alarm is triggered. If the BIOS code is found to be complete after integrity verification, the next step is to verify the integrity of the OS Loader; otherwise, the PLC system stops starting and an alarm is triggered. This process is repeated to obtain the results of each integrity verification, as shown in (3) and (4) of this embodiment.

[0051] (4) If the integrity verification of each system boot component passes, the computing CPU loads the verified system boot component; then the system boot component performs integrity verification on the application, which includes verifying several check contents, so as to finally complete the trusted boot of the PLC system; if any integrity verification fails, the PLC system stops the startup process and issues an alarm.

[0052] The verification content includes core verification content and adaptation verification content. Core verification content is the basic content that ensures the normal operation of the application. All core verification content is the verification content for the integrity of the application. Adaptation verification content is supplementary content that is dynamically adjusted according to the actual use scenario or operating environment.

[0053] Core verification content refers to fundamental aspects that affect the normal operation of the application, such as access control and the accuracy of industrial algorithm calculations. Core verification is mandatory. Adaptation verification content, on the other hand, is supplementary content that dynamically adjusts according to the actual usage scenario or operating environment, such as process threshold adaptation and data format conversion adaptation. Since some adaptation verification content remains unchanged while others do, to ensure data reliability and reduce verification steps, this solution obtains the probability of change for each adaptation verification content. This allows only those verification contents with a higher probability of change to be used for application integrity verification. The reason for identifying adaptation verification contents with a higher probability of change is that changes to these contents are more likely to cause compatibility failures between the application and industrial control equipment, damage data transmission integrity, and ultimately compromise the legitimacy and stability of the program's operation.

[0054] Retrieve a specific adaptation verification content X corresponding to an application W, where the normal operation of application W depends on the access of industrial control equipment. Retrieve the time T of a historical value change record R of the adaptation verification content X. R Extract the industrial control equipment connected to application W at time T. R The previous logs were used as baseline logs. The logs included log type and log notes. Based on several value change records and the industrial control equipment connected each time the value changed, multiple baseline logs were extracted and summarized into a log set for adaptation verification content X.

[0055] Obtain the PLC system S to be programmed, obtain the industrial control equipment that the application W on the PLC system S was last connected to, extract several logs before the time of disconnection from the PLC system and industrial control equipment, and use them as the target logs.

[0056] Obtain the total number of baseline logs in the log set, collect the number of baseline logs corresponding to each log type, divide the number of baseline logs by the total number of baseline logs in the PLC system to obtain the target ratio for each log type; sum the target ratios of the log types corresponding to each current target log as the type similarity.

[0057] Based on the log notes of each target log, extract the keywords from each log note and use them as target keywords; based on the log notes of each baseline log, extract the keywords from each log note and use them as baseline keywords; obtain the word similarity between a target keyword K and each baseline keyword, and take the maximum word similarity as the target value of the target keyword K; obtain the target values ​​of each target keyword, add them up and calculate the average to obtain the note similarity.

[0058] Based on the preset weights of type similarity and note similarity, the change probability of the adaptation verification content X corresponding to the current application W is obtained; if the change probability of the PLC system is greater than the preset probability threshold, the adaptation verification content X is used as the verification content for the integrity verification of application W, and thus all the verification content for the integrity verification of the application is obtained.

[0059] This invention employs a trusted dual-architecture CPU to overcome the shortcomings of previous architectures where the trusted computing module was subordinate to the traditional computing module. This invention not only enhances the trustworthiness and security of core components during the startup phase, ensuring the system is controlled and tamper-proof from the lowest level, but also effectively distributes the workload of the trusted CPU in implementing trusted computing, allowing it to focus more on other critical security tasks. This overall enhances the system's robustness and trusted startup performance, ensuring the security of the entire industrial control process, balancing system trustworthiness and computing performance, and reducing the workload of the trusted CPU.

[0060] This embodiment also provides a trusted boot system based on a trusted dual-architecture system, including a PLC system extraction module, a key design module, an integrity verification module, and a trusted boot completion module. The key design module includes an image file burning unit and a key design unit. When the system executes a computer program, it implements the aforementioned trusted boot method based on a trusted dual-architecture system. Since this trusted boot method based on a trusted dual-architecture system has been described in detail above, it will not be repeated here.

[0061] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, specific embodiments have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired result. Additionally, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0062] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0063] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A trusted bootstrapping method based on a trusted dual-architecture architecture, characterized in that, Includes the following steps: The hardware layer, operating system layer, and application layer of the PLC system are obtained. The hardware layer includes a trusted CPU, a computing CPU, and peripheral devices. The operating system layer includes an operating system kernel, external device drivers, and trusted security services. The application layer includes trusted applications, function libraries, and feature libraries. The program for determining whether a PLC system is trustworthy is packaged into an image file. The installation data of the trustworthy CPU in the PLC system is obtained. Based on the installation data, a key for the image file is designed using a key design algorithm. The designed key and the image file are then burned into the corresponding storage location of the PLC system. The operating system kernel uses the trusted CPU as the root of trust. After the PLC system is powered on, the operating system kernel retrieves the ROM data in the trusted CPU, extracts the on-chip Boot Loader and reference value from the ROM data, completes the PLC system initialization and enables basic functions. After that, the trusted CPU performs integrity verification on each system boot component in turn. If the integrity verification of each system boot component passes, the computing CPU loads the verified system boot component; then the system boot component performs integrity verification on the application, which includes verifying several check items, thus finally completing the trusted boot of the PLC system; if any integrity verification fails, the PLC system stops the startup process and issues an alarm.

2. The trusted bootstrapping method based on a trusted dual-architecture system according to claim 1, characterized in that, The trusted CPU and the computing CPU operate in complete parallel and independent manner. The trusted CPU is not controlled by the computing CPU, while the computing CPU is controlled by the trusted CPU. Peripheral devices are used to implement the basic control functions of the PLC system. Peripheral devices include I / O modules, communication modules, and storage modules. The storage resources of the storage modules are shared by the trusted CPU and the computing CPU.

3. The trusted bootstrapping method based on a trusted dual-architecture system according to claim 1, characterized in that, Trusted applications call the trusted mechanism interface provided by trusted software. The trusted mechanism interface is a set of standardized interfaces designed for secure interaction between upper-layer applications and services and the trusted CPU. Trusted software includes a trusted management center and a trusted software base. The trusted management center is used to manage and maintain the system's trust state, while the trusted software base is used to ensure that the system can execute based on a trusted starting point during startup and runtime.

4. The trusted bootstrapping method based on a trusted dual-architecture system according to claim 1, characterized in that, The design of the key for the image file includes: obtaining the installation timestamp and CPU number of the trusted CPU in the PLC system; generating the key for the image file based on the installation timestamp, CPU number, and a random string refreshed according to rules; wherein the image files burned to different PLC systems have different keys; the key design algorithms include ECDSA algorithm, SHA algorithm, and AES algorithm, wherein the ECDSA algorithm is used to perform digital signature generation and verification steps, the SHA algorithm is used to perform password hash generation and integrity verification steps, and the AES algorithm is used to perform key encryption and decryption steps.

5. A trusted bootstrapping method based on a trusted dual-architecture system according to claim 4, characterized in that, The refresh rules for random strings include the following steps: Obtain the PLC system S to be programmed, and obtain the user P who logged into the PLC system S. S and login time T S ; Obtain login user P S During working hours, if the login time T S During working hours, the reliability of the obtained time is 1; outside of working hours, the login time T is obtained. S Given the end time T1 of the previous work period and the start time T2 of the next work period, the distance from the landing time T between T1 and T2 is calculated. S The most recent moment, as the target moment, is determined based on the target moment and the landing time T. S Duration D between S The time reliability is obtained as follows: ; If the logged-in user P S If a person has permission to access the PLC system S, their reliability is set to 1; otherwise, their reliability is set to 0. The time reliability is multiplied by the personnel reliability to obtain the total reliability. When the total reliability is less than the preset reliability threshold, the random string is refreshed to generate a new key for the image file.

6. The trusted bootstrapping method based on a trusted dual-architecture system according to claim 1, characterized in that: The verification content includes core verification content and adaptation verification content. Core verification content is the basic content that ensures the normal operation of the application. All core verification content is the verification content for the integrity of the application. Adaptation verification content is supplementary content that is dynamically adjusted according to the actual use scenario or operating environment. Retrieve a specific adaptation verification content X corresponding to an application W, where the normal operation of application W depends on the access of industrial control equipment. Retrieve the time T of a historical value change record R of the adaptation verification content X. R Extract the industrial control equipment connected to application W at time T. R The previous logs were used as baseline logs. The logs included log type and log notes. Based on several value change records and the industrial control equipment connected each time the value changed, multiple baseline logs were extracted and summarized into a log set for adaptation verification content X.

7. A trusted bootstrapping method based on a trusted dual-architecture system according to claim 6, characterized in that: Obtain the PLC system S to be programmed, obtain the industrial control equipment that the application W on the PLC system S was last connected to, extract several logs before the time of disconnection from the industrial control equipment, and use them as target logs; Obtain the total number of baseline logs in the log set, collect the baseline log counts for each log type, and divide the baseline log counts by the total number of baseline logs to obtain the target ratio for each log type. The sum of the target similarity values ​​for the log types corresponding to each target log is used as the type similarity score. Based on the log notes of each target log, extract the keywords from each log note and use them as target keywords; based on the log notes of each baseline log, extract the keywords from each log note and use them as baseline keywords; obtain the word similarity between a target keyword K and each baseline keyword, and take the maximum word similarity as the target value of the target keyword K. The target value of each target keyword is obtained, and the average value is calculated to obtain the similarity score. Based on the preset weights of type similarity and note similarity, the probability of change of the adaptation verification content X corresponding to the current application W is obtained; If the change probability is greater than a preset probability threshold, then the adapted verification content X is used as the verification content for the integrity verification of application W, thereby obtaining the verification content for the integrity verification of all applications.

8. A trusted boot system based on a trusted dual-architecture architecture, used to execute a trusted boot method based on a trusted dual-architecture architecture as described in any one of claims 1-7, characterized in that, The system includes a PLC system extraction module, a key design module, an integrity verification module, and a trusted boot completion module; PLC system extraction module: used to obtain the hardware layer, operating system layer and application layer of the PLC system. The hardware layer includes a trusted CPU, a computing CPU and peripheral devices. The operating system layer includes an operating system kernel, external device drivers and trusted security services. The application layer includes trusted applications, function libraries and functional libraries. Key design module: This module encapsulates a program for determining the trustworthiness of a PLC system into an image file. It obtains the installation data of the trusted CPU in the PLC system, designs the key for the image file based on the installation data and a key design algorithm, and then burns the designed key and the image file into the corresponding storage location of the PLC system. Integrity verification module: The operating system kernel uses the trusted CPU as the root of trust. After the PLC system is powered on, the operating system kernel retrieves the ROM data in the trusted CPU, extracts the on-chip Boot Loader and reference value from the ROM data, completes the PLC system initialization and enables basic functions. After that, the trusted CPU performs integrity verification on each system boot component in turn. Trusted Boot Completion Module: If the integrity verification of each system boot component passes, the computing CPU loads the verified system boot component; then the system boot component performs integrity verification on the application, which includes verifying several check items, thus finally completing the trusted boot of the PLC system; if the integrity verification of any system boot component fails, the PLC system stops the startup process and issues an alarm.

9. A trusted boot system based on a trusted dual-architecture system according to claim 8, characterized in that, The key design module includes an image file burning unit and a key design unit; Image file burning unit: used to obtain the installation timestamp and CPU number of the trusted CPU in the PLC system, and based on the installation timestamp and CPU number, as well as a string of random strings refreshed according to rules, to design the key of the image file through the key design algorithm, and burn the designed key and image file into the corresponding storage location of the PLC system; Key design unit: used to obtain the PLC system S to be programmed, obtain the login personnel and login time of the PLC system S; obtain the time reliability and personnel reliability, calculate the total reliability, and determine whether to refresh the random string to generate a new key for the image file.

Images