An industrial safety software hardening system

Abstract

The application discloses an industrial safety software solidification system, and technical scheme points are as follows: when the system is prepared, a chip area of a BIOS is identified, the BIOS chip area comprises a BIOS starting boot area, a reserved area, a BIOS program area, a high-end address area and a BIOS ROM area, the reserved area is positioned and a virtual space area is constructed in the reserved area, a safety software system is stored in the virtual space area according to a balanced storage strategy, the safety software system is burned into the virtual space area based on a solidification mode, after the solidification of the safety software system is completed, the safety software system stored in the virtual space area is mapped into a memory space when the system is started, an interface strategy is embedded in the memory space, and the interface strategy is used for calling data in the safety software system or storing data into the safety software system.

Description

Technical Field

[0001] This invention relates to the field of internet security technology, and more specifically to an industrial security software embedding system. Background Technology

[0002] Traditional security software is typically installed under the operating system, but this method is highly susceptible to tampering. Therefore, to ensure the security of security software after deployment, it is deployed on various hardware platforms using hardware hardening to achieve host security. This approach currently has broad application prospects, for example, in industrial field security systems where terminal devices have security requirements while also allowing for the restriction of software program modifications.

[0003] Currently, host security is primarily deployed using two methods: one is operating system installation followed by online upgrades to ensure host security; the other is deployment via USB. Both methods are highly susceptible to source code tampering and have specific deployment requirements. In many scenarios, the security risks inherent in USB usage are extremely high. Worms and viruses inherent in USB, along with USB corruption, make it difficult for maintenance personnel to identify risks before operating system installation, leading to early virus importation. Therefore, an effective method to prevent source code tampering and ensure the reliable operation of industrial security software urgently needs to be developed. Summary of the Invention

[0004] In view of the shortcomings of the existing technology, the purpose of this invention is to provide an industrial security software solidification system to solve the technical problems existing in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] An industrial security software hardening system includes:

[0007] During system preparation, the BIOS chip area is identified. The BIOS chip area includes the BIOS start boot area, the reserved area, the BIOS program area, the high address area, and the BIOS ROM area. The reserved area is located and a virtual space area is constructed within the reserved area. The security software system is stored in the virtual space area according to the balanced storage strategy. The security software system is burned into the virtual space area in a hardening manner.

[0008] After the security software system is solidified, when the system boots up, the security software system stored in the virtual space area is mapped to the memory space. The memory space is embedded with an interface policy, which is used to retrieve data from the security software system or store data in the security software system.

[0009] The security software system includes a protocol encryption area and a code area. The code area is used to store the source code for the security software system to run. The protocol encryption area is configured with an encryption layer, which encrypts the code area. The security software system is burned into the virtual space area in the BIOS layer, so that when modifying the code area, it is necessary to enter the BIOS and obtain authorization through the encryption layer before modifying the code area. When the computer system runs, it automatically obtains the authorization of the encryption layer and runs the security software system.

[0010] As a further improvement of the present invention, the security software system further includes an information area, which includes a software name, memory usage ratio, and security level. The software name represents the name of the security software system and its purpose for security protection. The memory usage ratio represents the ratio of the security software system's memory size to the BIOS system's memory size. The security level represents the security level used for industrial defense, and the security levels include A, S, and T levels. The A level represents a basic defense level for general industrial security use, the S level represents an advanced defense level for special industrial security use, and the T level represents a special defense level for classified industrial security use. The storage strategy includes obtaining information from the information area within the security software system and allocating the required virtual space memory size according to the information in the information area.

[0011] As a further improvement of the present invention, the reserved area is also configured with vacant storage space, which represents the size of the storage space between the virtual space area and the BIOS program area. The storage strategy is as follows:

[0012] The system retrieves the memory ratio of the information area and reads the space size of the reserved area. Based on the memory ratio, it calculates the memory value of the virtual space area that needs to store the security software system and places the virtual space area before the empty space, so that when the computer program runs, it first enters the virtual space area to run the security software system and then runs the BIOS program.

[0013] As a further improvement of the present invention, the BIOS is also configured with a decryption program, which is stored in the reserved area. The decryption program is used to decrypt the security software system stored in the virtual space area so that the security software system can complete its operation.

[0014] As a further improvement of the present invention, the encryption layer is configured with an encryption strategy, an encryption level, and conversion logic for encryption. The encryption strategy encrypts the security software system in the following way:

[0015] The security level in the information area of ​​the security system is retrieved, and the corresponding encryption level is matched according to the security level. The encryption level includes level I, level II and level III. Different encryption levels have corresponding jump logic preset.

[0016] The encryption method involves obtaining the software name within the information area and then converting it according to a preset conversion logic to form a pre-encrypted password.

[0017] The encryption method of the first order of magnitude is to mark the last bit of the pre-encrypted code and to jump and swap the last bit according to the preset jump logic to form the encryption code;

[0018] The encryption method of the second level is to mark the first and last bits of the pre-encrypted code to form a mark code, divide the jump priority, prioritize the last bit code for jumping, and perform jump swapping of the last bit code and the first and last bits according to the preset jump logic to form the encryption code.

[0019] The encryption method of the third level is to further perform a deep transformation on the pre-encrypted cipher, form a deep cipher based on the deep transformation, mark the first and last bits of the deep cipher to form a marker code, and perform a jump swap on the last bit and the first and last bits according to a preset jump logic to form an encryption cipher.

[0020] As a further improvement of the present invention, when the security software system is burned into the virtual space area by a hardening method, the encryption password is sent to the BIOS start boot area so that the encryption password of the BIOS start boot area can be decrypted by the decryption program when the computer system runs.

[0021] As a further improvement of the present invention, the decryption procedure performs decryption in the following manner:

[0022] The security level of the security software system is identified and a corresponding decryption key is generated. Based on the decryption key, the marker code in the encryption key is identified, and the marker code is reverse-jumped and reset. After the reverse-jumped and reset, the code is restored and transcoded to obtain the decryption key. When the pre-encryption key matches the pre-encryption key corresponding to the security level of the security software system, the security software system is decrypted.

[0023] As a further improvement of the present invention, the interface strategy is specifically as follows:

[0024] The security software system is also equipped with an execution channel, which is used to connect to the execution instruction terminal generated based on the source code. When data is retrieved from the security software system, the execution channel is opened and an authorization instruction is generated. An authorization pop-up window is generated based on the authorization instruction. The authorization pop-up window is equipped with an input box for entering the corresponding software name. The software name is used as the entry key to enter the execution channel, and authorization to retrieve data from the security software system is obtained after entering the execution channel.

[0025] As a further improvement of the present invention, the interface strategy also includes:

[0026] When data needs to be stored in the security software system, a storage instruction is generated. An authorization pop-up window is generated based on the storage instruction. After entering the software name of the corresponding security software system, the execution channel is opened. The data to be stored is stored in the execution instruction terminal based on the execution channel.

[0027] The beneficial effects of this invention are as follows: By solidifying the software and storing it locally in a timely manner, the software is stored in a read-only storage space, making it difficult for viruses to tamper with. Data updates can only be performed with authorization, improving data reliability and security. Furthermore, the solidification method allows the CPU to quickly and in real-time retrieve data stored in the local hardware storage space. The firmware driver for the security software system uses a specially customized storage space, and its access method is interfaced through an interface strategy. Data within the security software system can only be accessed with explicit authorization, which not only increases data security but also enhances data privacy, making the source code less susceptible to tampering and ensuring the reliable operation of industrial security software. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the BIOS chip. Detailed Implementation

[0029] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Identical components are denoted by the same reference numerals. It should be noted that the terms "front," "rear," "left," "right," "upper," and "lower" used in the following description refer to directions in the accompanying drawings, and the terms "bottom surface," "top surface," "inner," and "outer" refer to directions toward or away from the geometric center of a specific component, respectively.

[0030] refer to Figure 1 As shown, this is a specific implementation of an industrial security software hardening system of the present invention. During system preparation, the BIOS chip area is identified. The BIOS chip area includes the BIOS start boot area, the reserved area, the BIOS program area, the high address area, and the BIOS ROM area. The reserved area is located and a virtual space area is constructed within the reserved area. The security software system is stored in the virtual space area according to the balanced storage strategy. The security software system is burned into the virtual space area based on the hardening method.

[0031] After the security software system is solidified, when the system boots up, the security software system stored in the virtual space area is mapped to the memory space. The memory space is embedded with an interface policy, which is used to retrieve data from the security software system or store data in the security software system.

[0032] The security software system includes a protocol encryption area and a code area. The code area is used to store the source code for the security software system to run. The protocol encryption area is configured with an encryption layer, which encrypts the code area. The security software system is burned into the virtual space area in the BIOS layer, so that when modifying the code area, it is necessary to enter the BIOS and obtain authorization through the encryption layer before modifying the code area. When the computer system runs, it automatically obtains the authorization of the encryption layer and runs the security software system.

[0033] The security software system also includes an information area, which contains the software name, memory usage ratio, and security level. The software name represents the name of the security software system and its purpose for security protection. The memory usage ratio represents the ratio of the security software system's memory size to the BIOS system's memory size. The security level represents the security level used for industrial defense, and the security levels include A, S, and T levels. Level A represents the basic defense level for general industrial security use, Level S represents the advanced defense level for special industrial security use, and Level T represents the special defense level for classified industrial security use. The storage strategy includes obtaining information from the information area within the security software system and allocating the required virtual space memory size based on the information in the information area.

[0034] The reserved area also contains vacant storage space, which represents the size of the storage space between the virtual space area and the BIOS program area. The storage strategy is as follows:

[0035] The system retrieves the memory ratio of the information area and reads the space size of the reserved area. Based on the memory ratio, it calculates the memory value of the virtual space area that needs to store the security software system and places the virtual space area before the empty space, so that when the computer program runs, it first enters the virtual space area to run the security software system and then runs the BIOS program.

[0036] The BIOS is also equipped with a decryption program, which is stored in the reserved area. The decryption program is used to decrypt the security software system stored in the virtual space area so that the security software system can run.

[0037] The encryption layer is configured with an encryption strategy, encryption level, and conversion logic for encryption. The encryption strategy encrypts the security software system in the following way:

[0038] The security level in the information area of ​​the security system is retrieved, and the corresponding encryption level is matched according to the security level. The encryption level includes level I, level II and level III. Different encryption levels have corresponding jump logic preset.

[0039] The encryption method involves obtaining the software name within the information area and then converting it according to a preset conversion logic to form a pre-encrypted password. The conversion logic is as follows: based on the software name, the pre-encrypted password is obtained by determining the position of the letters in the software name according to the nine-key input code. For example, if the software name is GDATA, G belongs to the first position of 4 in the nine-key input method, so G corresponds to 41. D belongs to the first position of 3 in the nine-key input method, so D corresponds to 31, and so on. Through the conversion logic, GDATA is converted to: 4131218121.

[0040] The encryption method of the first order of magnitude is to mark the last bit of the pre-encrypted code and perform jump-shifting on the last bit according to the preset jump logic to form the encryption code. Specifically, the last 1 in the pre-encrypted code: 4131218121 is jump-shifted. The jump logic of the first order of magnitude is to shift the last 1 forward and jump 5 times. The encryption code formed by this is: 4131121812.

[0041] The encryption method of the second order is to mark the first and last bits of the pre-encrypted code to form a mark code, and divide the jump priority, with the last bit code jumping first. The last bit code and the first and last bits are jump-switched according to the preset jump logic to form the encryption code. The second order jump logic is to jump the first and last bits towards the middle and stop jumping after forming a cross. The encryption code formed by this is: 1312411812.

[0042] The encryption method of the third order involves further deep transformation of the pre-encrypted cipher to form a deep cipher. The first and last digits of the deep cipher are marked to form a marker code. The last digit and the first digit are then swapped according to a preset jump logic to form an encryption cipher. The deep transformation method involves transforming the pre-encrypted cipher 4131218121 according to the order of the corresponding 24 letters to form DACABAHABA. The jump logic of the third order involves jumping the first and last digits towards the middle and stopping the jump after forming a cross. The resulting encryption cipher is: ACABDAAHAB.

[0043] When the security software system is burned into the virtual space area via a hard drive method, the encryption password is sent to the BIOS boot sector so that the encryption password can be decrypted by the decryption program when the computer system runs. The decryption program performs the decryption in the following way:

[0044] The security level of the security software system is identified and a corresponding decryption key is generated. Based on the decryption key, the marker code in the encryption key is identified, and the marker code is reverse-jumped and reset. After the reverse-jumped and reset, the code is restored and transcoded to obtain the decryption key. When the pre-encryption key matches the pre-encryption key corresponding to the security level of the security software system, the security software system is decrypted.

[0045] The specific interface strategy is as follows:

[0046] The security software system is also equipped with an execution channel, which is used to connect to the execution instruction terminal generated based on the source code. When data is retrieved from the security software system, the execution channel is opened and an authorization instruction is generated. An authorization pop-up window is generated based on the authorization instruction. The authorization pop-up window is equipped with an input box for entering the corresponding software name. The software name is used as the entry key to enter the execution channel, and authorization to retrieve data from the security software system is obtained after entering the execution channel.

[0047] The interface strategy also includes:

[0048] When data needs to be stored in the security software system, a storage instruction is generated. An authorization pop-up window is generated based on the storage instruction. After entering the software name of the corresponding security software system, the execution channel is opened. The data to be stored is stored in the execution instruction terminal based on the execution channel.

[0049] Working principle and its effects:

[0050] By embedding the software locally and storing it in a read-only storage space, it is not easily tampered with by viruses. Data updates can only be performed with authorization, improving data reliability and security. Furthermore, the embedding method allows the CPU to quickly and in real-time retrieve data stored in local hardware storage. The firmware driver for the security software system uses a specially customized storage space, and its access method is interfaced through an interface policy. Only with explicit authorization can data within the security software system be accessed, which not only increases data security but also enhances data privacy, making the source code less susceptible to tampering and ensuring the reliable operation of industrial security software.

[0051] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. An industrial security software embedding system, characterized in that, include: During system preparation, the BIOS chip area is identified. The BIOS chip area includes the BIOS start boot area, the reserved area, the BIOS program area, the high address area, and the BIOS ROM area. The reserved area is located and a virtual space area is constructed within the reserved area. The security software system is stored in the virtual space area according to the balanced storage strategy. The security software system is burned into the virtual space area in a hard drive method. After the security software system is solidified, when the system boots up, the security software system stored in the virtual space area is mapped to the memory space. The memory space is embedded with an interface policy, which is used to retrieve data from the security software system or store data in the security software system. The security software system includes a protocol encryption area and a code area. The code area is used to store the source code for the security software system to run. The protocol encryption area is configured with an encryption layer, which encrypts the code area. The security software system is burned into the virtual space area in the BIOS layer, so that when modifying the code area, it is necessary to enter the BIOS and obtain authorization through the encryption layer before modifying the code area. When the computer system runs, it automatically obtains the authorization of the encryption layer and runs the security software system.

2. The industrial security software solidification system according to claim 1, characterized in that: The security software system also includes an information area, which contains the software name, memory usage ratio, and security level. The software name represents the name of the security software system and its purpose for security protection. The memory usage ratio represents the ratio of the security software system's memory size to the BIOS system's memory size. The security level represents the security level used for industrial defense, and the security levels include A, S, and T levels. Level A represents the basic defense level for general industrial security use, Level S represents the advanced defense level for special industrial security use, and Level T represents the special defense level for classified industrial security use. The storage strategy includes obtaining information from the information area within the security software system and allocating the required virtual space memory size based on the information in the information area.

3. The industrial security software solidification system according to claim 2, characterized in that: The reserved area also contains vacant storage space, which represents the size of the storage space between the virtual space area and the BIOS program area. The storage strategy is as follows: The system retrieves the memory ratio of the information area and reads the space size of the reserved area. Based on the memory ratio, it calculates the memory value of the virtual space area that needs to store the security software system and places the virtual space area before the empty space, so that when the computer program runs, it first enters the virtual space area to run the security software system and then runs the BIOS program.

4. The industrial security software solidification system according to claim 3, characterized in that: The BIOS is also equipped with a decryption program, which is stored in the reserved area. The decryption program is used to decrypt the security software system stored in the virtual space area so that the security software system can run.

5. The industrial security software solidification system according to claim 4, characterized in that: The encryption layer is configured with an encryption strategy, encryption level, and conversion logic for encryption. The encryption strategy encrypts the security software system in the following way: The security level in the information area of ​​the security system is retrieved, and the corresponding encryption level is matched according to the security level. The encryption level includes level I, level II and level III. Different encryption levels have corresponding jump logic preset. The encryption method involves obtaining the software name within the information area and then converting it according to a preset conversion logic to form a pre-encrypted password. The encryption method of the first order of magnitude is to mark the last bit of the pre-encrypted code and to jump and swap the last bit according to the preset jump logic to form the encryption code; The encryption method of the second order is to mark the first and last bits of the pre-encrypted cipher to form a marker code, divide the jump priority, prioritize the last bit code for jumping, and perform jump swapping of the last bit code and the first and last bits according to the preset jump logic to form the encryption cipher. The encryption method of the third level is to further perform a deep transformation on the pre-encrypted cipher, form a deep cipher based on the deep transformation, mark the first and last bits of the deep cipher to form a marker code, and perform a jump swap on the last bit and the first and last bits according to a preset jump logic to form an encryption cipher.

6. The industrial security software solidification system according to claim 5, characterized in that: When the security software system is burned into the virtual space area via a hard drive, the encryption password is sent to the BIOS start boot area so that the encryption password of the BIOS start boot area can be decrypted by the decryption program when the computer system runs.

7. The industrial security software solidification system according to claim 6, characterized in that: The decryption procedure performs decryption in the following way: The security level of the security software system is identified and a corresponding decryption key is generated. Based on the decryption key, the marker code in the encryption key is identified, and the marker code is reverse-jumped and reset. After the reverse-jumped and reset, the code is restored and transcoded to obtain the decryption key. When the pre-encryption key matches the pre-encryption key corresponding to the security level of the security software system, the security software system is decrypted.

8. The industrial security software solidification system according to claim 7, characterized in that: The specific interface strategy is as follows: The security software system is also equipped with an execution channel, which is used to connect to the execution instruction terminal generated based on the source code. When data is retrieved from the security software system, the execution channel is opened and an authorization instruction is generated. An authorization pop-up window is generated based on the authorization instruction. The authorization pop-up window is equipped with an input box for entering the corresponding software name. The software name is used as the entry key to enter the execution channel, and authorization to retrieve data from the security software system is obtained after entering the execution channel.

9. The industrial security software solidification system according to claim 8, characterized in that: The interface strategy also includes: When data needs to be stored in the security software system, a storage instruction is generated. An authorization pop-up window is generated based on the storage instruction. After entering the software name of the corresponding security software system, the execution channel is opened. The data to be stored is stored in the execution instruction terminal based on the execution channel.

Images