A protection method and device for a security authentication gateway

Abstract

The application provides a protection method and device for a security authentication gateway, and the method comprises the following steps: calling a shared library containing an obfuscation method to compile a security authentication gateway source file multiple times to obtain multiple heterogeneous binary files; selecting at least three heterogeneous binary files with the lowest similarity to activate, to obtain at least three execution bodies; calculating an output result according to input information of the security authentication gateway through the at least three execution bodies; and calling a corresponding strategy to protect the security authentication gateway according to the output result. Through the application, the problem of excessively high hardware cost of the security authentication gateway in improving the active defense capability in the related art is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of power information security, and in particular to a protection method and device for a security authentication gateway. BACKGROUND

[0002] With the development of new businesses such as power Internet of Things, energy Internet construction, photovoltaic cloud, Internet of Vehicles, and integrated energy services, more ubiquitous network security protection boundaries and more flexible and diverse business security access requirements are brought to the network security protection system, and higher requirements are also proposed for various aspects such as border security attack defense. Traditional passive defense technologies such as firewall technology, intrusion detection technology, and intrusion isolation technology are usually effective when targeting viruses or intrusion methods that have been discovered, and the entire system may face collapse once unknown viruses and intrusion methods appear. In addition, attackers can analyze the code of firewalls and gateways using reverse tools, and thus use the vulnerabilities of the defense technology itself as a breakthrough for intrusion.

[0003] As a new generation of protection technology, intrusion tolerance technology maintains the availability of the system by eliminating the impact caused by intrusion, such as mimicry defense technology and mobile target defense technology. These intrusion tolerance technologies mainly serve the security defense of large systems and need to consume a large amount of cost to produce hardware heterogeneity. However, the security authentication gateway, as the first line of defense for system security, has characteristics such as large quantity requirement and difficulty in replacing hardware. Therefore, there is a problem in the prior art that the hardware cost of the security authentication gateway is too high when improving the active defense capability. SUMMARY

[0004] The present application provides a protection method and device for a security authentication gateway to at least solve the problem in the related art that the hardware cost of the security authentication gateway is too high when improving the active defense capability.

[0005] According to a first aspect of an embodiment of the present application, a protection method for a security authentication gateway is provided, which includes: calling a shared library containing a confusion method to compile a security authentication gateway source file multiple times to obtain multiple heterogeneous binary files; selecting at least three heterogeneous binary files with the lowest similarity to activate to obtain at least three execution bodies; calculating an output result according to the input information of the security authentication gateway through the at least three execution bodies; and calling a corresponding strategy according to the output result to protect the security authentication gateway.

[0006] Optionally, the obfuscation method comprises: obtaining a basic block corresponding to the secure authentication gateway source file obtained through the LLVM intermediate representation; calling a basic block segmentation instruction on the basic block, controlling the segmentation times of the basic block according to a first parameter, and obtaining a plurality of segmented basic blocks; selecting a preset number of the segmented basic blocks according to a second parameter, dividing each basic block selected according to the second parameter into an entry block, a main block and a return block, generating a cloned block by deep copying the main block, and generating a false control flow among the entry block, the main block, the return block and the cloned block in each basic block according to a random jump statement; setting a total entry block, a distribution block and a total return block, placing all basic blocks between the distribution block and the total return block, and generating a jump condition between the distribution block and all basic blocks according to a non-repeating random number, wherein the all basic blocks include a plurality of segmented basic blocks with generated false control flow and not generated false control flow.

[0007] Optionally, when the number of execution bodies is three, the protecting the secure authentication gateway according to the output result calling the corresponding strategy comprises: if the output results of the three execution bodies are consistent, determining that the input information passes the authentication; if the output result of one execution body is abnormal, determining that the input information is abnormal, terminating the execution body with the abnormal output result, and dynamically loading a heterogeneous binary file with the smallest similarity to the abnormal execution body to activate, wherein the output result of one execution body is abnormal includes that the output result is inconsistent with the output results of the other two execution bodies or the waiting time for output is too long; if the output results of the three execution bodies are all inconsistent, determining that the input information is abnormal, terminating the execution body with the abnormal output result, and dynamically loading three heterogeneous binary files with the lowest similarity to activate.

[0008] Optionally, the method further comprises: repairing the gateway source file according to the input information with the abnormality and the execution body with the abnormal output result; and protecting the secure authentication gateway by generating new execution bodies according to the repaired gateway source file.

[0009] Optionally, when the number of execution bodies is three, the selecting the at least three heterogeneous binary files with the lowest similarity to activate to obtain at least three execution bodies comprises: calculating the matching degree of any two heterogeneous binary files according to the function name, the function call, the basic block, the jump instruction and the general instruction; calculating the minimum value of the sum of the matching degrees of all combinations of two heterogeneous binary files in any three heterogeneous binary files to obtain the three heterogeneous binary files with the lowest similarity; and starting the three heterogeneous binary files with the lowest similarity in a multithreaded manner to obtain three execution bodies.

[0010] Optionally, the generating the distribution block and the jump conditions between all the basic blocks according to the non-repeating random numbers comprises: generating a random number sequence according to an initialization function of a random number generator and a time module; and generating the distribution block and the jump conditions between all the basic blocks according to the random number sequence.

[0011] According to a second aspect of the embodiments of the present application, a protection device for a security authentication gateway is provided, which comprises: a first obtaining module configured to invoke a shared library containing an obfuscation method to compile a source file of the security authentication gateway multiple times to obtain multiple heterogeneous binary files; a second obtaining module configured to select at least three heterogeneous binary files with the lowest similarity to activate to obtain at least three execution bodies; a calculating module configured to calculate an output result according to input information of the security authentication gateway through the at least three execution bodies; and a policy scheduling module configured to invoke a corresponding policy to protect the security authentication gateway according to the output result.

[0012] Optionally, the first obtaining module comprises: an acquisition unit configured to acquire basic blocks corresponding to the source file of the security authentication gateway obtained through an LLVM intermediate representation; a first obtaining unit configured to invoke a basic block segmentation instruction to control a segmentation times of the basic blocks according to a first parameter to obtain multiple segmented basic blocks; a first generating unit configured to select a preset number of the segmented basic blocks according to a second parameter, divide each basic block selected according to the second parameter into an entry block, a main block and a return block, generate a cloned block by deep copying the main block, and generate a false control flow between the entry block, the main block, the return block and the cloned block in each basic block according to a random jump statement; and a second generating unit configured to set a total entry block, a distribution block and a total return block, place all the basic blocks between the distribution block and the total return block, and generate jump conditions between the distribution block and all the basic blocks according to non-repeating random numbers, wherein the all the basic blocks comprise multiple segmented basic blocks with and without the false control flow.

[0013] Optionally, the policy scheduling module comprises: a judging unit, configured to judge that the input information passes authentication if the three execution bodies output consistent results; a first dynamic call-in unit, configured to judge that the input information is abnormal if one execution body outputs an abnormal result, terminate the execution body outputting the abnormal result, and dynamically call in one of the heterogeneous binary files having the least similarity with the abnormal execution body to activate, wherein the one execution body outputting the abnormal result comprises that the output result is inconsistent with the output results of the other two execution bodies or the time of waiting for output is too long; and a second dynamic call-in unit, configured to judge that the input information is abnormal if the output results of the three execution bodies are all inconsistent, terminate the execution body outputting the abnormal result, and dynamically call in the three heterogeneous binary files having the least similarity to activate.

[0014] Optionally, the device further comprises: a repairing unit, configured to repair the gateway source file according to the input information having the abnormality and the execution body outputting the abnormal result; and a third generating unit, configured to generate a new execution body to protect the security authentication gateway according to the repaired gateway source file.

[0015] Optionally, the second obtaining module comprises: a calculating unit, configured to calculate the matching degree of any two heterogeneous binary files according to the function name, the function call, the basic block, the jump instruction and the general instruction; a second obtaining unit, configured to calculate the minimum value of the sum of the matching degrees of all combinations of two heterogeneous binary files in any three heterogeneous binary files, and obtain the three heterogeneous binary files having the least similarity; and a third obtaining unit, configured to start the three heterogeneous binary files having the least similarity in a multithreading manner to obtain the three execution bodies.

[0016] Optionally, the second generating unit comprises: a first generating sub-module, configured to generate a random number sequence according to an initialization function of a random number generator and a time module; and a second generating sub-module, configured to generate the distribution block and the jump condition between all the basic blocks according to the random number sequence.

[0017] According to a third aspect of the embodiments of the present application, an electronic device is further provided, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete communication with each other through the communication bus; the memory is configured to store a computer program; and the processor is configured to execute the method steps in any of the above embodiments by running the computer program stored in the memory.

[0018] According to a fourth aspect of the embodiments of the present application, a computer readable storage medium is further provided, which stores a computer program, wherein the computer program is configured to execute the method steps in any of the above embodiments when running.

[0019] In the embodiment of the present application, the source file of the security authentication gateway is compiled multiple times by calling the shared library containing the obfuscation method, and multiple heterogeneous binary files are obtained; at least three heterogeneous binary files with the lowest similarity are selected to activate, and at least three execution bodies are obtained; the output result is calculated according to the input information of the security authentication gateway through the at least three execution bodies; and the corresponding strategy is called according to the output result to protect the security authentication gateway. Since the shared library containing the obfuscation method is called in the compilation process of the gateway source file, the control flow of the binary file is modified, the purpose of increasing the quasi-state defense program is achieved without using additional hardware, the security authentication gateway has certain active defense capability, and the problem of high hardware cost in improving the active defense capability of the security authentication gateway in the related art is solved.

[0020] In the embodiment of the present application, by multiple segmentation, part of the segmented basic blocks are divided into entry blocks, main blocks and return blocks, the cloned blocks are generated by deep copying the main blocks, the false control flow is generated, and further, the distribution blocks and the jump conditions between all the basic blocks are generated according to the non-repeated random numbers. The purpose of modifying the control flow of the binary file is achieved, the difficulty of reverse engineering cracking is increased, and the effect of protecting the code assets is achieved.

[0021] In the embodiment of the present application, the output results of the multiple execution bodies are compared, and a dynamic scheduling strategy is set to protect the security authentication gateway, and the defense capability of the security authentication gateway is further improved.

[0022] In the embodiment of the present application, the gateway source file is repaired according to the abnormal execution body of the abnormal input information and output result, a new execution body is generated to protect the security authentication gateway, and the active defense for abnormal input is improved.

[0023] In the embodiment of the present application, according to the function name, function call, basic block, jump instruction and general instruction in the compiled binary file, three heterogeneous binary files with the lowest similarity are selected as execution bodies, the difference between the execution bodies is improved, and the purpose of better resisting external attacks is achieved.

[0024] In the embodiment of the present application, the jump condition is randomly generated based on time sequence, so that the jump conditions of the heterogeneous bodies generated at different time are different and have no rules, and the effect of increasing the heterogeneity between the execution bodies is achieved. BRIEF DESCRIPTION OF DRAWINGS

[0025] The accompanying drawings, which are incorporated into and form a part of the specification, illustrate an embodiment consistent with the present application and, together with the description, serve to explain the principles of the application.

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, for those of ordinary skill in the art, other drawings can be obtained based on these drawings without any creative effort.

[0027] Figure 1 is a schematic diagram of an optional hardware environment of a protection method for a security authentication gateway according to an embodiment of the present application;

[0028] Figure 2 is a flowchart of an optional protection method for a security authentication gateway according to an embodiment of the present application;

[0029] Figure 3 is a flowchart of an optional LLVM compilation framework execution for a security authentication gateway according to an embodiment of the present application;

[0030] Figure 4 is a schematic diagram of an optional generation of a false control flow for a security authentication gateway according to an embodiment of the present application;

[0031] Figure 5 is a schematic diagram of an optional control flow flattening for a security authentication gateway according to an embodiment of the present application;

[0032] Figure 6 is a schematic diagram of an optional dynamic heterogeneous redundancy framework for a security authentication gateway according to an embodiment of the present application;

[0033] Figure 7 is a structural block diagram of an optional protection device for a security authentication gateway according to an embodiment of the present application;

[0034] Figure 8 is a structural block diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the technical personnel in the art better understand the present application scheme, the following will combine the drawings in the embodiments of the present application, and the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without any creative effort should belong to the scope of protection of the present application.

[0036] It is to be understood that the terms "first", "second", and the like, used in the description and in the claims of the present application are used as identifiers for distinguished objects and do not necessarily have to follow a specific sequential order or a particular chronological order. It is to be understood that the use of the terms so used herein is merely intended to distinguish the objects for reasons of convenience, and is not meant in a restrictive sense. Further, it is to be understood that the use of the terms "including", "comprising", or "having" and variations thereof herein is meant to encompass the inclusion of one or more elements, steps, units, components, or the like, but not the exclusion of any elements, steps, units, components, or the like. Further, it is to be understood that the use of the terms "including", "comprising", or "having" and variations thereof herein is meant to encompass the inclusion of one or more elements, steps, units, components, or the like, but not the exclusion of any elements, steps, units, components, or the like.

[0037] According to an aspect of the embodiments of the present application, there is provided a method for protecting a secure authentication gateway. Optionally, in the embodiments, the method for protecting a secure authentication gateway can be applied in a hardware environment as shown in Figure 1 As shown in Figure 1 The terminal 102 can include a memory 104, a processor 106, and a display 108 (optional component). The terminal 102 can be communicatively connected to a server 112, which can be configured to provide services (e.g., application services) for the terminal or a client installed on the terminal. A database 114 can be configured on the server 112 or independently of the server 112 to provide data storage services for the server 112. In addition, the server 112 can run a processing engine 116, which can be configured to perform steps performed by the server 112.

[0038] Optionally, the terminal 102 can be, but is not limited to, a terminal capable of computing data, such as a mobile terminal (e.g., a mobile phone, a tablet computer), a notebook computer, a PC (Personal Computer), and the like. The network can include, but is not limited to, a wireless network or a wired network. The wireless network includes Bluetooth, WIFI (Wireless Fidelity), and other networks that enable wireless communication. The wired network can include, but is not limited to, a wide area network, a metropolitan area network, and a local area network. The server 112 can include, but is not limited to, any hardware device capable of computing.

[0039] In addition, in the embodiments, the method for protecting a secure authentication gateway can be, but is not limited to, applied in a standalone processing device with strong processing capability without data interaction. For example, the processing device can be, but is not limited to, a terminal device with strong processing capability, i.e., each operation in the method for protecting a secure authentication gateway can be integrated in a standalone processing device. The foregoing is merely an example, and the embodiments are not limited in this regard.

[0040] Optionally, in the embodiment, the protection method for the secure authentication gateway can be executed by the server 112, can also be executed by the terminal 102, and can also be executed by the server 112 and the terminal 102 jointly. The terminal 102 executing the protection method for the secure authentication gateway according to the embodiment of the application can also be executed by the client installed thereon.

[0041] Taking the application of the protection method for the secure authentication gateway to the central processing unit as an example, Figure 2 is a flowchart of an optional protection method for a secure authentication gateway according to an embodiment of the application, as Figure 2 shown, the flow of the method can include the following steps:

[0042] Step S201, calling a shared library containing an obfuscation method to compile the secure authentication gateway source file multiple times to obtain multiple heterogeneous binary files, i.e., binary programs. Optionally, the embodiment realizes the heterogeneous redundant construction of the gateway source code through the LLVM compilation framework, as Figure 3 shown, in the compilation process, the intermediate representation IR stage calls the shared library containing the obfuscation method to compile the secure authentication gateway source file to generate the obfuscated heterogeneous binary file. It can be understood that multiple heterogeneous binary files can be obtained by compiling the gateway source file multiple times.

[0043] Step S202, selecting at least three heterogeneous binary files with the lowest similarity to activate to obtain at least three execution bodies. Optionally, considering the function calls, jump instructions, etc. in the heterogeneous binary files, at least three heterogeneous binary files with the lowest similarity are selected to activate to obtain at least three execution bodies.

[0044] Step S203, calculating the output result according to the input information of the secure authentication gateway through the at least three execution bodies. Optionally, the input information of the gateway is calculated through the multiple execution bodies obtained in the previous step to obtain the corresponding output result.

[0045] Step S204, calling the corresponding strategy to protect the secure authentication gateway according to the output result. Optionally, according to the output result obtained in the previous step, the execution body is dynamically scheduled according to the preset strategy to protect the secure authentication gateway.

[0046] In the embodiment of the present application, the source file of the security authentication gateway is compiled multiple times by calling the shared library containing the obfuscation method, and multiple heterogeneous binary files are obtained; at least three heterogeneous binary files with the lowest similarity are selected to activate, and at least three execution bodies are obtained; the output result is calculated according to the input information of the security authentication gateway through the at least three execution bodies; and the corresponding strategy is called according to the output result to protect the security authentication gateway. Since the shared library containing the obfuscation method is called in the compilation process of the gateway source file, the control flow of the binary file is modified, which achieves the purpose of increasing the quasi-state defense program without using additional hardware, so that the security authentication gateway has certain active defense capability, thereby solving the problem of high hardware cost in improving the active defense capability of the security authentication gateway in the related art. In addition, the present embodiment adopts the LLVM architecture, and LLVM is an open framework that supports front-end compilers of multiple languages. The present embodiment is developed based on the intermediate code of the LLVM intermediate layer IR, so that heterogeneous redundant compilation of multiple languages (such as C, C++, ActionScript, Ada, and Java bytecode) can be supported by replacing different front-end compilers.

[0047] As an optional embodiment, the obfuscation method comprises: obtaining the basic blocks corresponding to the source file of the security authentication gateway obtained through the LLVM intermediate representation; calling a basic block splitting instruction on the basic blocks, and controlling the number of times of splitting the basic blocks according to a first parameter to obtain a plurality of split basic blocks; selecting a preset number of split basic blocks according to a second parameter, dividing each basic block selected according to the second parameter into an entry block, a main block, and a return block, generating a cloned block by deep copying the main block, and generating a false control flow among the entry block, the main block, the return block, and the cloned block in each basic block according to a random jump statement; setting a total entry block, a distribution block, and a total return block, placing all the basic blocks between the distribution block and the total return block, and generating a jump condition between the distribution block and all the basic blocks according to a non-repeating random number, wherein all the basic blocks include a plurality of split basic blocks with generated false control flow and a plurality of split basic blocks without generated false control flow.

[0048] Optionally, in the LLVM intermediate representation IR stage, the gateway source code is split into basic blocks, and first, the basic blocks are obtained, a basic block splitting instruction is called on the basic blocks, and the number of times of splitting the basic blocks is controlled according to a split_num parameter, i.e., a first parameter, to obtain a plurality of split basic blocks. Then, a preset number of split basic blocks are selected according to a bcf_prob parameter, i.e., a second parameter. For example, if the bcf_prob parameter is set to 50%, the central processing unit randomly selects 50% of the split basic blocks for the next step. Figure 4As shown in the figure, each basic block selected according to the bcf_prob parameter is divided into an entry block, a main block and a return block, and a cloned block is generated by deep copying the main block, wherein deep copying means opening a new memory space, and from the perspective of memory, the main block copied by deep copying is not the same as the original main block, and it will generate new data and increase the difficulty of reverse engineering. Then, according to the random jump statement, the false control flow between the entry block, the main block, the return block and the cloned block in each basic block is generated, such as Figure 4 As shown in the figure, True indicates execution, and False indicates non-execution, so the false control flow in the basic block is from the entry block to the main block to the return block. After generating the false control flow for the randomly selected basic block, as shown in the figure Figure 5 As shown in the figure, the total entry block, the distribution block and the total return block are set, assuming that all basic blocks are n basic blocks, including multiple segmented basic blocks with generated false control flow and not generated false control flow, all basic blocks are placed between the distribution block and the total return block, and the jump condition between the distribution block and all basic blocks is generated according to the non-repeating random number. It should be noted that the switch statement is used to control the jump of all basic blocks according to the non-repeating random number, to hide the real program flow and to flatten the basic blocks of the program.

[0049] As an optional embodiment, generating the jump condition between the distribution block and all basic blocks according to the non-repeating random number includes: generating a random number sequence according to an initialization function of a random number generator and a time module; and generating the jump condition between the distribution block and all basic blocks according to the random number sequence. Optionally, the non-repeating random number is created by the srand() function in the c language library and the time module, that is, a random number sequence is established with the system time at the compilation time as a seed, which ensures the correctness of the control flow and the differentiation of the jump condition at each compilation. In the embodiment of the application, the jump condition is randomly generated based on the time sequence, so that the jump conditions of isomers generated at different times are all different and have no rules, achieving the effect of increasing the heterogeneity between the execution bodies.

[0050] In the embodiment of the application, by multiple segmentation, part of the segmented basic blocks are divided into an entry block, a main block and a return block, a cloned block is generated by deep copying the main block, a false control flow is generated, and further, a jump condition between the distribution block and all basic blocks is generated according to the non-repeating random number. The purpose of modifying the control flow of the binary file is achieved, the difficulty of reverse engineering and cracking is increased, and the effect of protecting the code assets is achieved.

[0051] As an optional embodiment, when the number of the execution bodies is three, the protecting the security authentication gateway according to the output result calling the corresponding strategy comprises: if the output results of the three execution bodies are consistent, determining that the input information passes the authentication; if the output result of one execution body is abnormal, determining that the input information is abnormal, terminating the execution body with the abnormal output result, and dynamically loading a heterogeneous binary file with the minimum similarity to the abnormal execution body to activate, wherein the abnormal output result of one execution body comprises that the output result is inconsistent with the output results of the other two execution bodies or the waiting time for the output is too long; if the output results of the three execution bodies are all inconsistent, determining that the input information is abnormal, terminating the execution body with the abnormal output result, and dynamically loading three heterogeneous binary files with the minimum similarity to activate.

[0052] Optionally, the embodiment takes the number of the execution bodies as three as an example. After the three execution bodies calculate the output results according to the input information of the security authentication gateway, if the output results of the three execution bodies are consistent, it is determined that the input information passes the authentication, and the subsequent request of the security authentication gateway will be executed normally; if the output result of one execution body is abnormal, which comprises that the output result is inconsistent with the output results of the other two execution bodies or the waiting time for the output is too long, it is determined that the input information is abnormal, the execution body with the abnormal output result is terminated, and a heterogeneous binary file with the minimum similarity to the abnormal execution body is dynamically loaded to activate, so as to ensure the defense ability of the gateway; if the output results of the three execution bodies are all inconsistent, it is determined that the input information is abnormal, the execution body with the abnormal output result is terminated, three heterogeneous binary files with the minimum similarity are dynamically loaded to activate, and the MAC and IP address contained in the input information are suspended to access the security authentication gateway. In the embodiment of the application, the output results of the multiple execution bodies are compared, the dynamic scheduling strategy is set to protect the security authentication gateway, and the defense ability of the security authentication gateway is further improved.

[0053] As an optional embodiment, the method further comprises: repairing the gateway source file according to the abnormal input information and the abnormal execution body of the output result; and generating new execution bodies according to the repaired gateway source file to protect the security authentication gateway. Optionally, the problematic input is archived, the abnormal condition is repaired, and if the simple repair of the central processing unit cannot achieve the repair of the gateway source file, an engineer can be notified to analyze and repair the abnormal problem. After the repair is completed, a plurality of heterogeneous binary files are generated according to the repaired gateway source file, and a plurality of new execution bodies are activated to protect the security authentication gateway. In the embodiment of the application, the gateway source file is repaired according to the abnormal input information and the abnormal execution body of the output result, and new execution bodies are generated to protect the security authentication gateway, thereby improving the active defense of abnormal input.

[0054] As an optional embodiment, when the number of execution bodies is three, the at least three heterogeneous binary files with the lowest similarity are selected and activated to obtain at least three execution bodies, comprising: calculating the matching degree of any two heterogeneous binary files according to the function name, function call, basic block, jump instruction and general instruction; calculating the minimum value of the sum of the matching degrees of all combinations of two heterogeneous binary files in any three heterogeneous binary files to obtain the three heterogeneous binary files with the lowest similarity; and starting the three heterogeneous binary files with the lowest similarity in a multi-threaded manner to obtain three execution bodies.

[0055] Optionally, the characteristic values for calculating the similarity are defined as: function name F, function call C, basic block B, jump instruction J and general instruction I, and for two heterogeneous binary files E1 and E2, the formula for calculating the matching degree M(E1, E2) is:

[0056]

[0057] After the matching degrees between all the heterogeneous binary files are obtained, the three heterogeneous binary files initially activated are obtained by calculating the minimum value of the matching degrees, that is, the three heterogeneous binary files initially activated are obtained by calculating the sum of the matching degrees between any two of the three heterogeneous binary files. Defining n as the number of all the heterogeneous bodies and S as the similarity of the three heterogeneous binary files, the formula for calculating the minimum similarity S min is:

[0058]

[0059] wherein Ei, Ej and Ek are any three heterogeneous binary files and i≠j≠k.

[0060] The three heterogeneous binary files are started in a multi-threaded manner to obtain the three execution bodies.min Three isomeric binary files get three executors. In the embodiment of the present application, the three isomeric binary files with the lowest similarity are selected as the executors according to the function name, function call, basic block, jump instruction and general instruction in the compiled binary file, so that the difference between the executors is improved, and the external attack is better resisted.

[0061] As an optional embodiment, Figure 6 is a schematic diagram of an optional dynamic isomeric redundancy framework for a security authentication gateway, as Figure 6 shown, a plurality of isomeric binary files E1, E2, E3…EK generated by calling the shared library containing the obfuscated method are stored in an isomeric set, and three isomeric binary files with the lowest similarity are selected from the isomeric set to be activated as executors A1, A2, A3. The executors A1, A2, A3 are started in a multithreaded manner, and after receiving the input information of the security authentication gateway, the input information is collated through an input proxy module and then synchronously sent to the three executors A1, A2, A3, and the executors A1, A2, A3 obtain the output result through calculation. The calculation result is sent to a decider, the decider makes a voting decision according to the calculation result, and a scheduling strategy is executed according to the result of the decision, which can refer to the strategy in the previous embodiment. In the embodiment of the present application, a plurality of isomeric binary files are obtained by calling the shared library containing the obfuscated method, at least three isomeric binary files with the lowest similarity are selected to be activated, at least three executors are obtained, the output result is calculated by the at least three executors according to the input information of the security authentication gateway, and a scheduling strategy is executed according to the decision result, so that the active defense capability of the security authentication gateway is improved.

[0062] According to another aspect of the embodiment of the present application, a protection device for a security authentication gateway is also provided for implementing the above-mentioned protection method for a security authentication gateway. Figure 7 is a structural block diagram of an optional protection device for a security authentication gateway according to the embodiment of the present application, as Figure 7 shown, the device can include: a first obtaining module 701 configured to call the shared library containing the obfuscated method to compile the source file of the security authentication gateway multiple times to obtain a plurality of isomeric binary files; a second obtaining module 702 configured to select at least three isomeric binary files with the lowest similarity to be activated to obtain at least three executors; a calculation module 703 configured to calculate an output result by the at least three executors according to the input information of the security authentication gateway; and a strategy scheduling module 704 configured to call a corresponding strategy to protect the security authentication gateway according to the output result.

[0063] It should be noted that the first obtaining module 701 in the embodiment can be configured to perform the step S201, the second obtaining module 702 in the embodiment can be configured to perform the step S202, the calculating module 703 in the embodiment can be configured to perform the step S203, and the policy scheduling module 704 in the embodiment can be configured to perform the step S204.

[0064] By the above modules, the shared library containing the obfuscation method is called to compile the security authentication gateway source file multiple times to obtain multiple heterogeneous binary files; at least three heterogeneous binary files with the lowest similarity are selected to activate to obtain at least three executors; the output result is calculated according to the input information of the security authentication gateway through the at least three executors; and the corresponding policy is called according to the output result to protect the security authentication gateway. Since the shared library containing the obfuscation method is called in the compilation process of the gateway source file, the control flow of the binary file is modified, the purpose of increasing the quasi-state defense program is achieved without using additional hardware, the security authentication gateway has certain active defense capability, and thus the problem of excessively high hardware cost of the security authentication gateway in improving the active defense capability in the related art is solved.

[0065] As an optional embodiment, the first obtaining module includes: an acquisition unit, configured to acquire basic blocks corresponding to the security authentication gateway source file obtained through the LLVM intermediate representation; a first obtaining unit, configured to call a basic block splitting instruction on the basic blocks, control the splitting times of the basic blocks according to a first parameter, and obtain multiple split basic blocks; a first generating unit, configured to select a preset number of split basic blocks according to a second parameter, divide each basic block selected according to the second parameter into an entry block, a main block and a return block, generate a cloned block by deep copying the main block, and generate a false control flow among the entry block, the main block, the return block and the cloned block in each basic block according to a random jump statement; and a second generating unit, configured to set a total entry block, a distribution block and a total return block, place all the basic blocks between the distribution block and the total return block, and generate a jump condition between the distribution block and all the basic blocks according to a non-repeating random number, wherein all the basic blocks include multiple split basic blocks with and without the generated false control flow.

[0066] As an optional embodiment, the policy scheduling module comprises: a judging unit configured to judge that the input information passes authentication if the three execution bodies output consistent results; a first dynamic loading unit configured to, if one of the execution bodies outputs an abnormal result, judge that the input information is abnormal, terminate the execution body outputting the abnormal result, and dynamically load a heterogeneous binary file having minimum similarity with the abnormal execution body to activate; and a second dynamic loading unit configured to, if the three execution bodies output inconsistent results, judge that the input information is abnormal, terminate the execution body outputting the abnormal result, and dynamically load three heterogeneous binary files having minimum similarity to activate.

[0067] As an optional embodiment, the device further comprises: a repairing unit configured to repair the gateway source file according to the abnormal input information and the execution body outputting the abnormal result; and a third generating unit configured to generate a new execution body to protect the security authentication gateway according to the repaired gateway source file.

[0068] As an optional embodiment, the second obtaining module comprises: a calculating unit configured to calculate the matching degree of any two heterogeneous binary files according to the function name, the function call, the basic block, the jump instruction and the general instruction; a second obtaining unit configured to calculate the minimum value of the sum of the matching degrees of all combinations of two heterogeneous binary files in any three heterogeneous binary files to obtain the three heterogeneous binary files having minimum similarity; and a third obtaining unit configured to start the three heterogeneous binary files having minimum similarity in a multithreading manner to obtain the three execution bodies.

[0069] As an optional embodiment, the second generating unit comprises: a first generating sub-module configured to generate a random number sequence according to an initialization function of a random number generator and a time module; and a second generating sub-module configured to generate a distribution block and a jump condition between all basic blocks according to the random number sequence.

[0070] It should be noted that the above modules have the same examples and application scenarios as the corresponding steps, but are not limited to the content disclosed in the above embodiments. It should be noted that the above modules as part of the device can run in the hardware environment as shown in Figure 1 The hardware environment includes a network environment.

[0071] According to another aspect of the embodiments of the present application, an electronic device for implementing the above-mentioned protection method for a security authentication gateway is provided, which can be a server, a terminal, or a combination thereof.

[0072] Figure 8is a structural block diagram of an optional electronic device according to an embodiment of the present application, as shown in Figure 8 The processor 801, the communication interface 802 and the memory 803 can communicate with each other through the communication bus 804. The memory 803 is configured to store a computer program. The processor 801 is configured to execute the computer program stored in the memory 803 to implement the following steps:

[0073] The shared library containing the obfuscated method is called to compile the security authentication gateway source file multiple times to obtain multiple heterogeneous binary files. At least three heterogeneous binary files with the lowest similarity are selected to activate to obtain at least three execution bodies. The output result is calculated according to the input information of the security authentication gateway through the at least three execution bodies. The security authentication gateway is protected according to the output result and the corresponding strategy.

[0074] Optionally, in the embodiment, the communication bus can be a PCI (Peripheral Component Interconnect) bus, an EISA (Extended Industry Standard Architecture) bus or the like. The communication bus can be divided into an address bus, a data bus and a control bus. For the convenience of representation, Figure 8 Only one thick line is used in the figure to represent the communication bus, but it does not mean that there is only one bus or only one type of bus.

[0075] The communication interface is configured to communicate between the electronic device and other devices.

[0076] The memory can include a RAM and a non-volatile memory such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the processor.

[0077] As an example, as shown in Figure 8 The memory 803 can include, but is not limited to, the first obtaining module 701, the second obtaining module 702, the calculating module 703 and the strategy scheduling module 704 in the protection device for the security authentication gateway. In addition, other module units in the protection device for the security authentication gateway can also be included, but not limited to, which will not be described in detail in the example.

[0078] The processor can be a general processor, which can include but is not limited to a CPU (Central Processing Unit), a NP (Network Processor), etc. The processor can also be a DSP (Digital Signal Processing), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0079] Optionally, the specific examples in the embodiment can refer to the examples described in the above embodiments, and the embodiment will not be described here.

[0080] Those skilled in the art can understand that the above-mentioned apparatuses for implementing the protection method for the security authentication gateway can be terminal devices, which can be smart phones (such as Android phones, iOS phones, etc.), tablet computers, palmtop computers, mobile Internet devices (MID), PAD, etc. Figure 8 The structure shown is only schematic, and the apparatus for implementing the protection method for the security authentication gateway can be a terminal device, which can be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a palmtop computer, a mobile Internet device (MID), a PAD, etc. Figure 8 The structure of the above-mentioned electronic device is not limited. For example, the terminal device can further include more or fewer components (such as a network interface, a display device, etc.) than those shown in the above-mentioned structure, or have a different configuration from that shown in the above-mentioned structure. Figure 8 The structure of the above-mentioned electronic device is not limited. For example, the terminal device can further include more or fewer components (such as a network interface, a display device, etc.) than those shown in the above-mentioned structure, or have a different configuration from that shown in the above-mentioned structure. Figure 8 The structure of the above-mentioned electronic device is not limited. For example, the terminal device can further include more or fewer components (such as a network interface, a display device, etc.) than those shown in the above-mentioned structure, or have a different configuration from that shown in the above-mentioned structure.

[0081] Those skilled in the art can understand that all or part of the steps in the above-mentioned embodiments can be completed by programs instructing the hardware of the terminal device, and the programs can be stored in a computer-readable storage medium, which can include a flash disk, a ROM, a RAM, a magnetic disk or an optical disk, etc.

[0082] According to another aspect of the embodiment of the present application, a storage medium is also provided. Optionally, in the embodiment, the storage medium can be used to store program codes for implementing the protection method for the security authentication gateway.

[0083] Optionally, in the embodiment, the storage medium can be located on at least one of the network devices in the network shown in the above-mentioned embodiments.

[0084] Optionally, in the embodiment, the storage medium is configured to store program codes for implementing the following steps:

[0085] The shared library containing the obfuscated method is compiled multiple times to obtain multiple heterogeneous binary files; at least three heterogeneous binary files with the lowest similarity are selected to be activated to obtain at least three execution bodies; the output result is calculated according to the input information of the security authentication gateway through the at least three execution bodies; and the security authentication gateway is protected according to the corresponding strategy called according to the output result.

[0086] Optionally, specific examples in the embodiment can refer to the examples described in the above embodiments, and details are not described herein.

[0087] Optionally, in the embodiment, the storage medium can include but is not limited to a U disk, a ROM, a RAM, a mobile hard disk, a magnetic disk or an optical disk, and various storage program code media.

[0088] According to another aspect of the embodiment of the application, a computer program product or computer program is also provided, which includes computer instructions stored in a computer readable storage medium; the processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computer device to perform the protection method steps for the security authentication gateway in any one of the above embodiments.

[0089] The above embodiment numbers are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0090] The integrated units in the above embodiments, if realized in the form of software function units and sold or used as independent products, can be stored in the above computer readable storage medium. Based on this understanding, the technical solutions of the application or the whole or part of the technical solutions that make essential contributions to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for enabling one or more computer devices (which can be personal computers, servers or network devices, etc.) to execute all or part of the steps of the protection method for the security authentication gateway according to the embodiments of the application.

[0091] In the above embodiments of the application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0092] In several embodiments provided by the present application, it should be understood that the disclosed client can be implemented in other manners. For example, the described unit embodiments are merely schematic and the division of units is merely logical function division. There can be other division manners in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, units or modules, and can be in electrical, mechanical or other forms.

[0093] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place or distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the solutions provided in the embodiments.

[0094] In addition, each functional unit in the various embodiments of the present application can be integrated in a processing unit, or each unit can exist physically as a separate unit, or two or more units can be integrated in one unit. The integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0095] The above only describes the preferred embodiments of the present application. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A protection method for a security authentication gateway, characterized by, The method comprises: The method comprises: The method comprises: The method comprises: The method comprises: When the number of execution bodies is three, the selecting and activating at least three heterogeneous binary files with the lowest similarity comprises: According to the function name, function call, basic block, jump instruction and general instruction, the matching degree of any two heterogeneous binary files is calculated. According to the following formula, the matching degree M(E1, E2) of two heterogeneous binary files E1 and E2 is calculated: The minimum value of the sum of the matching degrees of all combinations of two heterogeneous binary files in any three heterogeneous binary files is calculated to obtain the three heterogeneous binary files with the lowest similarity. wherein E i , E j , and E k are any three isomeric binary files and i≠j≠k; According to the following formula, the minimum similarity Smin is calculated.

2. The protection method for a security authentication gateway according to claim 1, characterized in that, The three execution bodies are obtained by starting the three heterogeneous binary files with the lowest similarity in a multi-threaded manner. The method comprises: The method comprises: The method comprises: According to the second parameter, a preset number of the segmented basic blocks are selected, each basic block selected according to the second parameter is divided into an entry block, a main block and a return block, a cloned block is generated by deep copying the main block, and a false control flow among the entry block, the main block, the return block and the cloned block in each basic block is generated according to a random jump statement.

3. The protection method for a security authentication gateway according to claim 1, characterized by, A total entry block, a distribution block and a total return block are set, all basic blocks are arranged between the distribution block and the total return block, and a jump condition between the distribution block and all basic blocks is generated according to a non-repeating random number, wherein the all basic blocks include a plurality of segmented basic blocks with generated false control flow and without generated false control flow. When the number of execution bodies is three, the protecting the security authentication gateway according to the corresponding strategy comprises: If the output results of the three execution bodies are consistent, it is determined that the input information passes the authentication; If the output result of one execution body is abnormal, it is determined that the input information is abnormal, the execution body with the abnormal output result is terminated, and a heterogeneous binary file with the smallest similarity to the abnormal execution body is dynamically called and activated, wherein the output result of one execution body is abnormal includes that the output result is inconsistent with the output results of the other two execution bodies or the waiting time for the output is too long; If the output results of the three executors are all inconsistent, it is determined that the input information is abnormal, the executor with abnormal output result is terminated, and the three heterogeneous binary files with the lowest similarity are dynamically loaded and activated.

4. The protection method for a security authentication gateway according to claim 3, characterized in that, The method further comprises: repairing the gateway source file according to the abnormal input information and the executor with abnormal output result; generating a new executor according to the repaired gateway source file to protect the security authentication gateway.

5. The protection method for a security authentication gateway according to claim 2, characterized in that, The generation of the distribution block and the jump condition between the all basic blocks according to the non-repeated random number comprises: generating a random number sequence according to an initialization function of a random number generator and a time module; generating the distribution block and the jump condition between the all basic blocks according to the random number sequence.

6. A protection apparatus for a security authentication gateway, characterized by, The device comprises: a first obtaining module configured to compile a security authentication gateway source file multiple times by calling a shared library containing an obfuscation method to obtain multiple heterogeneous binary files; a second obtaining module configured to select at least three heterogeneous binary files with the lowest similarity to activate to obtain at least three executors; a calculation module configured to calculate output results according to input information of the security authentication gateway by the at least three executors; a policy scheduling module configured to protect the security authentication gateway by calling corresponding policies according to the output results; when the number of executors is three, the second obtaining module is specifically configured to: calculate the matching degree of any two heterogeneous binary files according to function names, function calls, basic blocks, jump instructions and general instructions; calculate the matching degree M(E1, E2) of two heterogeneous binary files E1 and E2 according to the following formula: calculate the minimum value of the sum of the matching degrees of all combinations of two heterogeneous binary files in any three heterogeneous binary files to obtain three heterogeneous binary files with the lowest similarity, calculate the sum of the matching degrees between the three heterogeneous binary files to obtain the three heterogeneous binary files for initial activation, n is the number of all heterogeneous bodies, S is the similarity of the three heterogeneous binary files, and the minimum similarity Smin is calculated according to the following formula: wherein E i , E j , E k are any three isomeric binary files and i≠j≠k; start the three heterogeneous binary files with the lowest similarity in a multithreaded manner to obtain three executors.

7. An electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein, The processor, the communication interface and the memory complete communication with each other through the communication bus, and the device further comprises: the memory is configured to store a computer program; the processor is configured to execute the method steps of any one of claims 1 to 5 by running the computer program stored on the memory.

8. A computer readable storage medium, characterized in that, The storage medium stores a computer program, and the computer program is executed by the processor to implement the method steps in any one of claims 1 to 5. The storage medium stores a computer program, and the computer program is executed by the processor to implement the method steps in any one of claims 1 to 5.

Images