An internet of things device firmware security detection method and device

Abstract

The application belongs to the technical field of safety detection, and provides a kind of Internet of Things equipment firmware safety detection method and device.The method comprises the following steps: obtaining the Internet of Things equipment firmware uploaded by a client;when the Internet of Things equipment firmware is the first uploaded firmware, the format information, file system and instruction set architecture of the Internet of Things equipment firmware are analyzed and identified, the unpacking and extraction of the Internet of Things equipment firmware are completed, and the binary file stored in the Internet of Things equipment firmware is obtained;the binary file is preprocessed to obtain a function file;the function file is analyzed for safety to obtain a safety detection report of the Internet of Things equipment firmware.The application can support multiple mainstream architecture instructions and multiple file systems, and can compatibly and accurately detect the safety of Internet of Things equipment firmware to generate a safety detection report.

Description

Technical Field

[0001] This invention belongs to the field of security testing technology, and in particular relates to a method and apparatus for security testing of firmware for Internet of Things (IoT) devices. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of the Internet of Things (IoT), IoT devices are ubiquitous in various fields such as industry, healthcare, cities, and daily life, greatly improving the automation level of social production and operation. However, IoT devices have also exposed many vulnerabilities, necessitating security testing of firmware before its release.

[0004] Furthermore, due to the different manufacturers, the firmware of IoT devices exhibits heterogeneity in architecture and system. How to conduct unified security testing on the firmware of IoT devices is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] To address the technical problems mentioned above, this invention provides a method and apparatus for security testing of IoT device firmware. This method supports multiple mainstream architecture instructions and multiple file systems, and can perform security testing on IoT device firmware in a compatible and accurate manner, generating a security testing report.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] The first aspect of the present invention provides a method for firmware security detection of Internet of Things (IoT) devices.

[0008] A method for firmware security detection of Internet of Things (IoT) devices, comprising:

[0009] Obtain the firmware of the IoT device uploaded by the client;

[0010] When the firmware of an IoT device is uploaded for the first time, the format information, file system and instruction set architecture of the IoT device firmware are parsed and identified, and the unpacking and extraction of the IoT device firmware are completed to obtain the binary file stored in the IoT device firmware.

[0011] The binary file is disassembled according to its instruction set architecture type. The assembly code of the binary file is then finely segmented to obtain multiple function-level code blocks. It is determined whether the function-level code blocks have a logical order. If so, the function code blocks are sorted according to the logical order to obtain a function file. Otherwise, a correction factor is randomly matched, and the function-level code blocks are offset and corrected according to the correction factor before being sorted according to the logical order to obtain a function file.

[0012] A security analysis is performed on the function file to obtain a security detection report for the IoT device firmware.

[0013] A second aspect of the present invention provides an Internet of Things (IoT) device firmware security detection device.

[0014] An IoT device firmware security detection device, comprising:

[0015] The firmware acquisition module is configured to acquire the firmware of the IoT device uploaded by the client.

[0016] The firmware parsing module is configured to: when the firmware of the IoT device is uploaded for the first time, parse and identify the format information, file system and instruction set architecture of the IoT device firmware, complete the unpacking and extraction of the IoT device firmware, and obtain the binary file stored in the IoT device firmware.

[0017] The binary file encoding module is configured to: disassemble the binary file according to its instruction set architecture type; perform fine-grained segmentation of the assembly code of the obtained binary file to obtain multiple function-level encoding blocks; determine whether the function-level encoding blocks have a logical order; if so, sort the function encoding blocks according to the logical order to obtain a function file; otherwise, randomly match a correction factor, perform offset correction on the function-level encoding blocks according to the correction factor, and then sort them according to the logical order to obtain a function file.

[0018] The firmware analysis module is configured to perform security analysis on the function file to obtain a security detection report of the IoT device firmware.

[0019] A third aspect of the present invention provides a computer-readable storage medium.

[0020] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the IoT device firmware security detection method as described in the first aspect above.

[0021] A fourth aspect of the present invention provides a computer device.

[0022] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the IoT device firmware security detection method as described in the first aspect above.

[0023] Compared with the prior art, the beneficial effects of the present invention are:

[0024] This invention supports multiple mainstream architecture instructions and multiple file systems, and can compatiblely and accurately perform security testing on the firmware of IoT devices and generate their security testing reports. Attached Figure Description

[0025] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0026] Figure 1 This is a flowchart of a firmware security detection method for Internet of Things (IoT) devices provided in Embodiment 1 of the present invention;

[0027] Figure 2 This is a flowchart of step 2 in Embodiment 1 of the present invention;

[0028] Figure 3 This is a flowchart of step 3 in Embodiment 1 of the present invention;

[0029] Figure 4 This is a schematic diagram of the structure of an IoT device firmware security detection device provided in Embodiment 2 of the present invention. Detailed Implementation

[0030] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0031] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0032] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0033] It should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and systems according to various embodiments of this disclosure. It should be noted that each block in a flowchart or block diagram may represent a module, segment, or portion of code, which may include one or more executable instructions for implementing the logical functions specified in the various embodiments. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutively represented blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, may be implemented using a dedicated hardware-based system that performs the specified functions or operations, or using a combination of dedicated hardware and computer instructions.

[0034] Example 1

[0035] like Figure 1 As shown, this embodiment provides a firmware security detection method for IoT devices. This embodiment uses the application of this method to a server as an example for illustration. It is understood that this method can also be applied to terminals, and can also be applied to systems including terminals, servers, and other components, and is implemented through interaction between the terminal and the server. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network servers, cloud communication, middleware services, domain name services, CDN security services, and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet, laptop, desktop computer, etc., but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, which is not limited herein. In this embodiment, the method includes the following steps:

[0036] Step 1: Obtain the IoT device firmware uploaded by the client;

[0037] Step 2: When the IoT device firmware is uploaded for the first time, the format information, file system and instruction set architecture of the IoT device firmware are parsed and identified to complete the unpacking and extraction of the IoT device firmware, and the binary file stored in the IoT device firmware is obtained; the binary file is preprocessed to obtain the function file;

[0038] Step 3: Perform security analysis on the function file to obtain a security detection report of the IoT device firmware.

[0039] This invention provides a method for firmware security testing of IoT devices, which supports multiple mainstream architecture instructions and multiple file systems. It can compatiblely and accurately perform security testing on IoT device firmware and generate its security testing report.

[0040] like Figure 2 As shown, in this embodiment of the invention, step 2 further includes:

[0041] Step 20: When the IoT device firmware is not uploaded for the first time, the decompression plugin is automatically invoked to unpack and extract the IoT device firmware to obtain the target binary file stored in the IoT firmware. The decompression plugin is used to call the pre-stored decompression script.

[0042] Since the IoT device firmware has already been uploaded once and its format information, file system information, etc. have already been parsed, there is no need to parse it again. Only the first parsing script needs to be stored in the decompression plugin. The decompression plugin can directly parse firmware that has been uploaded before, thus improving the efficiency of security detection.

[0043] In this embodiment of the invention, the process of parsing and identifying the format information, file system information, and instruction set architecture information of the IoT device firmware, and unpacking and extracting the IoT device firmware to obtain the binary file stored in the IoT device firmware includes the following steps:

[0044] Step 21: Obtain the format information of the IoT device firmware, and decompress the IoT device firmware according to the format information;

[0045] Step 22: Obtain the file system based on the first file parameter, and obtain the firmware file and binary file stored in the firmware file based on the second file parameter. The first file parameter is determined based on system similarity, and the second file parameter is determined based on the security detection task type.

[0046] Because the firmware is too large, it leads to low upload efficiency. The firmware is compressed once or multiple times before uploading, and the files stored within the firmware are also compressed once or multiple times. Therefore, the firmware needs to be decompressed before obtaining the binary file, involving multiple levels of decompression. Specifically, based on the obtained format information, a decompression plugin calls the corresponding format decompression script contained in that format information to perform decompression, such as decompressing gzip, 7z, bz2, tar, arj, unrar, lzop, srec, and other formats.

[0047] The next step is to extract the binary files from the file system. When decompressing the firmware using the decompression plugin, the firmware is parsed using the first file extraction parameter and the second file extraction parameter to obtain the required binary files. The first file extraction parameter is determined based on the system similarity and is the file system number.

[0048] Specifically, string similarity analysis is performed based on preset operation codes to determine the file system type of the IoT device firmware. The file system number is then determined based on the file system type. The decompression plugin calls the decompression script corresponding to the file system format obtained by the file system number to decompress the file system. For example, it decompresses file system formats such as squashfs, cramfs, linux ext, jffs2, yaffs, ext2, romfs, and cpio. Simultaneously, the storage address of the firmware file used for security testing is retrieved based on the file system number. After removing unnecessary storage addresses according to the security task detection type, the target storage address is obtained. Based on the target storage address, the firmware file and the binary files required for this security test stored in the firmware file are extracted from the system files.

[0049] The instruction set architecture is interpreted through file numbers, which map to storage addresses, instruction structures, compression information, and more.

[0050] like Figure 3 As shown, in this embodiment of the invention, step 2: preprocessing the binary file to obtain the function file includes the following steps:

[0051] Step 201: Disassemble the binary file according to its instruction set architecture type to obtain the assembly code of the binary file;

[0052] Step 202: Perform fine-grained segmentation on the assembly code to obtain multiple function-level coding blocks;

[0053] Step 203: Determine whether the function-level coding blocks have a logical order;

[0054] Step 204: If yes, sort the function encoding blocks according to the logical order to obtain the function file;

[0055] Step 205: If not, randomly match a correction factor, perform offset correction on the function-level coding block according to the correction factor, and then sort it according to the logical order to obtain the function file.

[0056] Specifically, based on the instruction set architecture type of the binary file, the corresponding disassembler engine or plugin is used to disassemble the binary file of that type. For example, disassembling instruction set architectures such as X86, ARM, MIPS, and PPC is performed. The assembly code is then finely segmented into multiple function-level code blocks, which are sorted according to their corresponding logical order to obtain the function file and its corresponding sorted sequence. If there is no logical order, a correction factor is randomly matched, and the function-level code blocks are offset and corrected according to the correction factor so that the offset-corrected function-level code blocks have a logical order. This process continues until the number of function-level code blocks with a logical order exceeds a preset value. At this point, the function file is obtained.

[0057] Specifically, before segmenting the assembly code, it is necessary to preprocess it to remove empty instructions or other irrelevant code blocks. Alternatively, relevant code blocks can be extracted directly according to the type of security detection task to further improve the accuracy of security detection and reduce the amount of computation.

[0058] In this embodiment of the invention, step 3: performing security analysis on the function file to obtain a security detection report for the IoT device firmware includes the following steps:

[0059] Step 31: Detect the function file using either the first security detection tool or the second security detection tool to obtain the combined features of the function file;

[0060] Step 32: Compare the combined features with the combined features of security events pre-stored in the knowledge base to obtain security detection results. Sort the security detection results according to risk level and generate a security detection report.

[0061] Specifically, the first security tool is used to call the security detection script pre-stored in the system, and the second security tool is used to call the security detection script uploaded by the user. Since the firmware of different IoT devices is highly specific, this embodiment of the invention provides a user-defined channel for some special firmware or special firmware detection. Users can upload corresponding security detection scripts according to their own needs, providing more possibilities for security detection.

[0062] When using either the first or second security tool for security detection, similarity matching and pre-classification algorithms are employed, combined with different machine learning models and multiple knowledge graphs, to convert assembly code into intermediate code, achieving an accuracy rate of over 90%. The intermediate code (combined features) is then compared with preset malicious code to obtain security detection results. These results include the security type, the corresponding number of security events, and the risk level. Finally, a visual security detection report is generated based on the results for easy user viewing and improved user experience.

[0063] Example 2

[0064] This embodiment provides an IoT device firmware security detection device.

[0065] like Figure 4 As shown, Figure 4 A schematic diagram of the structure of an IoT device firmware security detection device provided in an embodiment of the present invention includes:

[0066] Firmware upload module 100 is used to obtain the firmware of IoT devices uploaded by the client;

[0067] The firmware parsing module 200 is used to parse and identify the format information, file system, and instruction set architecture of the IoT device firmware, complete the unpacking and extraction of the IoT device firmware, and obtain the binary file stored in the IoT device firmware; and preprocess the binary file to obtain the function file.

[0068] The firmware analysis module 300 is used to perform security analysis on the function file and obtain a security detection report of the IoT device firmware.

[0069] In this embodiment of the invention, the firmware parsing module is further configured to:

[0070] When the firmware of an IoT device is not uploaded for the first time, the decompression plugin is automatically invoked to unpack and extract the firmware of the IoT device to obtain the target binary file stored in the IoT firmware. The decompression plugin is used to call the pre-stored decompression script.

[0071] In this embodiment of the invention, the firmware parsing module is further configured to:

[0072] Obtain the format information of the IoT device firmware, and decompress the IoT device firmware according to the format information;

[0073] The file system is obtained based on the first file parameter, and the firmware file and binary file stored in the firmware file are obtained based on the second file parameter. The first file parameter is determined based on system similarity, and the second file parameter is determined based on the security detection task type.

[0074] In this embodiment of the invention, the firmware parsing module is further configured to:

[0075] Disassemble the binary file according to its instruction set architecture type to obtain the assembly code of the binary file;

[0076] The assembly code is finely segmented to obtain multiple function-level coding blocks;

[0077] Determine whether the function-level encoded blocks have a logical order;

[0078] If so, sort the function encoding blocks according to the logical order to obtain the function file;

[0079] If not, a correction factor is randomly matched, and the function-level coding blocks are offset and corrected according to the correction factor. Then, they are sorted in logical order to obtain the function file.

[0080] In this embodiment of the invention, the firmware analysis module is used for:

[0081] The function file is detected using either a first security detection tool or a second security detection tool to obtain the combined features of the function file. The first security tool is used to call a security detection script pre-stored in the system, and the second security detection script is used to call a security detection script uploaded by the user.

[0082] The combined features are compared with the combined features of security events pre-stored in the knowledge base to obtain security detection results. The security detection results are then sorted according to risk level and a security detection report is generated.

[0083] In summary, the IoT device firmware security detection device provided in this embodiment of the invention and the IoT device firmware security detection method provided in the above embodiments are based on the same inventive concept. For more specific workflows of each module in this embodiment, please refer to the above embodiments, which will not be repeated here.

[0084] Example 3

[0085] This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the IoT device firmware security detection method described in Embodiment 1 above.

[0086] Example 4

[0087] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the IoT device firmware security detection method described in Embodiment 1 above.

[0088] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0089] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0090] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0091] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0092] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0093] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for firmware security detection in Internet of Things (IoT) devices, characterized in that, include: Obtain the firmware of the IoT device uploaded by the client; When the firmware of an IoT device is uploaded for the first time, the format information, file system and instruction set architecture of the IoT device firmware are parsed and identified, and the unpacking and extraction of the IoT device firmware are completed to obtain the binary file stored in the IoT device firmware. The process of obtaining the binary file stored in the firmware of the IoT device includes: Obtain the format information of the IoT device firmware, and decompress the IoT device firmware according to the format information; The file system is obtained based on the first file parameter, and the firmware file and binary file stored in the firmware file are obtained based on the second file parameter. The first file parameter is determined based on the system similarity, and the second file parameter is determined based on the security detection task type. The binary file is disassembled according to its instruction set architecture type. The assembly code of the binary file is then finely segmented to obtain multiple function-level code blocks. It is determined whether the function-level code blocks have a logical order. If so, the function-level code blocks are sorted according to the logical order to obtain a function file. Otherwise, a correction factor is randomly matched, and the function-level code blocks are offset and corrected according to the correction factor before being sorted according to the logical order to obtain a function file. A security analysis is performed on the function file to obtain a security detection report for the IoT device firmware; The specific process for obtaining the security detection report of the IoT device firmware includes: The function file is detected using either a first security detection tool or a second security detection tool to obtain the combined features of the function file. The first security tool is used to call a security detection script pre-stored in the system, and the second security detection script is used to call a security detection script uploaded by the user. The combined features are compared with the combined features of security events pre-stored in the knowledge base to obtain security detection results. The security detection results are then sorted according to risk level and a security detection report is generated.

2. The method for firmware security detection of IoT devices according to claim 1, characterized in that, When the firmware of an IoT device is not uploaded for the first time, the decompression plugin is automatically invoked to unpack and extract the firmware of the IoT device to obtain the target binary file stored in the IoT firmware. The decompression plugin is used to call the pre-stored decompression script.

3. The method for firmware security detection of IoT devices according to claim 1, characterized in that, The specific process of obtaining the file system based on the first file parameter, and obtaining the firmware file and the binary file stored in the firmware file based on the second file parameter includes: The file system type of the IoT device firmware is determined, and the file system number is determined based on the file system type. The decompression plugin calls the decompression script corresponding to the file system format of the obtained file system number to decompress the file system. The system retrieves the storage address of the firmware file used for security detection pre-stored in the system based on the file system number. After removing unnecessary storage addresses according to the security task detection type, the target storage address is obtained. Based on the target storage address, the firmware file and the binary file required for this security detection stored in the firmware file are extracted from the system file.

4. The method for firmware security detection of IoT devices according to claim 1, characterized in that, The function file is obtained when the number of logically ordered function-level code blocks exceeds a preset value.

5. The method for firmware security detection of IoT devices according to claim 1, characterized in that, When performing security testing using the first or second security tool, the assembly code is converted into a combined feature. The combined feature is then compared with the combined features of security events pre-stored in the knowledge base to obtain the security testing result. The combined code is an intermediate code.

6. An IoT device firmware security detection device employing the IoT device firmware security detection method as described in any one of claims 1-5, characterized in that, include: The firmware acquisition module is configured to acquire the firmware of the IoT device uploaded by the client. The firmware parsing module is configured to: when the firmware of the IoT device is uploaded for the first time, parse and identify the format information, file system and instruction set architecture of the IoT device firmware, complete the unpacking and extraction of the IoT device firmware, and obtain the binary file stored in the IoT device firmware. The binary file encoding module is configured to: disassemble the binary file according to its instruction set architecture type; perform fine-grained segmentation of the assembly code of the obtained binary file to obtain multiple function-level encoding blocks; determine whether the function-level encoding blocks have a logical order; if so, sort the function encoding blocks according to the logical order to obtain a function file; Otherwise, a correction factor is randomly matched, and the function-level coding blocks are offset and corrected according to the correction factor before being sorted in logical order to obtain the function file; The firmware analysis module is configured to perform security analysis on the function file to obtain a security detection report of the IoT device firmware.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the IoT device firmware security detection method as described in any one of claims 1-5.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the IoT device firmware security detection method as described in any one of claims 1-5.

Images