Method and device for rapidly discriminating electromagnetic information leakage based on time sequence information entropy waveform

Abstract

The present application relates to the field of electromagnetic information leakage identification, and particularly relates to a kind of electromagnetic information leakage fast discrimination method and device based on time sequence information entropy waveform, greatly improve the efficiency and accuracy of electromagnetic information leakage discrimination.Solution includes: collecting electromagnetic leakage signal at different positions on equipment, establishing electromagnetic information leakage signal database;Based on information entropy, the degree of disorder of the time domain signal of the electromagnetic leakage signal is judged, and the time sequence information entropy value of the time domain signal at different positions on the equipment is obtained;The time sequence information entropy values of the time domain signals at different positions on the equipment are sequentially connected to obtain the time sequence information entropy curve of the overall structure of the equipment;The time sequence information entropy curve is analyzed, and if the time sequence information entropy curve is greater than the threshold curve, the electromagnetic information leakage of the equipment is judged by determining whether there is red signal component in the collected electromagnetic leakage signal.The present application is suitable for the rapid identification of electromagnetic information leakage.

Description

Technical Field

[0001] This invention relates to the field of electromagnetic information leakage identification, and specifically to a method and apparatus for rapid identification of electromagnetic information leakage based on time-series information entropy waveforms. Background Technology

[0002] The electromagnetic radiation generated by information technology equipment during operation often contains interpretable information. When the corresponding radiated electromagnetic waves are detected and intercepted, and the carried digital signals are extracted, the original information can be obtained, leading to information leakage. Information leakage caused by electromagnetic radiation is a significant risk to information security. With the rapid development of high-speed devices, the working principles and physical structures of information technology equipment are becoming increasingly different, and their application scenarios are becoming more complex. The uncontrollable conditions for on-site detection of electromagnetic information leakage make it difficult for existing detection methods and means to obtain effective electromagnetic information leakage signals.

[0003] Current methods for detecting electromagnetic information leakage first require analyzing the electromagnetic radiation characteristics and working mechanism of the object being tested; then, identifying characteristic signals from the received electromagnetic leakage signals; and finally, conducting a comprehensive analysis and evaluation in conjunction with other parameters such as energy and power consumption. However, the rapid development of information technology equipment and the increasingly complex electromagnetic environment have presented new challenges to the efficiency and accuracy of traditional detection methods.

[0004] Therefore, there is an urgent need to achieve more accurate analytical capabilities, higher analytical efficiency, more comprehensive evaluation capabilities, and higher-performance rapid discrimination methods to meet the needs of electromagnetic information protection under the new circumstances. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and device for rapid identification of electromagnetic information leakage based on time-series information entropy waveform, which greatly improves the efficiency and accuracy of electromagnetic information leakage identification.

[0006] The present invention achieves the above objectives by adopting the following technical solution: On one hand, the present invention provides a method for rapid identification of electromagnetic information leakage based on time-series information entropy waveforms, the method comprising:

[0007] Collect electromagnetic leakage signals at different locations on the equipment and establish a database of electromagnetic information leakage signals;

[0008] The degree of disorder of the time domain signal of the electromagnetic leakage signal is judged based on information entropy, and the temporal information entropy value of the time domain signal at different locations on the device is obtained.

[0009] By sequentially connecting the temporal entropy values ​​of the time-domain signals at different locations on the device, the temporal entropy curve of the overall device structure can be obtained.

[0010] Analyze the temporal information entropy curve. If the temporal information entropy curve is greater than the threshold curve, it is confirmed that there is a red signal component in the received electromagnetic leakage signal, and the device is determined to have an electromagnetic information leakage risk; otherwise, the device is determined not to have an electromagnetic information leakage risk.

[0011] Furthermore, the electromagnetic leakage signals at different locations on the acquisition device specifically include:

[0012] The device runs various file samples other than the preset text types and collects electromagnetic leakage signals at different locations on the device.

[0013] Furthermore, the temporal information entropy value is:

[0014]

[0015] in, , indicating that in the time record of all events, P( Let X be a random event. The probability of that is the first The proportion of the red signal in the electromagnetic information leakage signal at any given time.

[0016] Furthermore, the specific methods for obtaining the threshold curve include:

[0017] Data normalization was performed using the maximum standard deviation of the raw data of electromagnetic information leakage signal response sequences collected from multiple measurement points as the normalization parameter:

[0018] , Indicates the maximum standard deviation. Indicates the measuring point Mean of electromagnetic information leakage signal response sequence Indicates the measuring point exist Real-time electromagnetic information leakage signal raw data The normalized value;

[0019] Calculate the autocorrelation coefficients for each measuring point:

[0020] In the formula, Indicates the measuring point exist Electromagnetic information leakage signal at any moment Indicates the measuring point of Autocorrelation coefficient;

[0021] Based on the properties of the autocorrelation coefficient, the time series signal is fitted to obtain the time series information entropy curve of the baseline state, and the time series information entropy curve of the baseline state is used as the threshold curve.

[0022] Furthermore, the acquisition of electromagnetic leakage signals at different locations on the equipment specifically includes: analyzing and determining the frequency range of the electromagnetic information leakage signal of the equipment, and acquiring electromagnetic leakage signals at different locations on the equipment within this frequency range.

[0023] On the other hand, the present invention provides a device for rapid detection of electromagnetic information leakage based on time-series information entropy waveforms, the device comprising:

[0024] A sensor array, comprising multiple sensors arranged on the device, for collecting electromagnetic leakage signals at different locations on the device;

[0025] The data processing module is used to establish a database of electromagnetic information leakage signals based on the collected electromagnetic leakage signals; to judge the degree of disorder of the time-domain signal of the electromagnetic leakage signal based on information entropy, and to obtain the time-series information entropy value of the time-domain signal at different locations on the device; to connect the time-series information entropy values ​​of the time-domain signal at different locations on the device in sequence to obtain the time-series information entropy curve of the overall structure of the device; to analyze the time-series information entropy curve, if the time-series information entropy curve is greater than the threshold curve, it is confirmed that there is a red signal component in the received electromagnetic leakage signal, and the device is determined to have an electromagnetic information leakage risk; otherwise, the device is determined not to have an electromagnetic information leakage risk.

[0026] Furthermore, the data processing module is specifically used to enable the device to run various file samples other than the preset text types and to collect electromagnetic leakage signals at different locations on the device.

[0027] Furthermore, the temporal information entropy value is:

[0028]

[0029] in, , indicating that in the time record of all events, P( Let X be a random event. The probability of that is the first The proportion of the red signal in the electromagnetic information leakage signal at any given time.

[0030] Furthermore, the data processing module is specifically used to obtain the threshold curve, and the specific methods include:

[0031] Data normalization was performed using the maximum standard deviation of the raw data of electromagnetic information leakage signal response sequences collected from multiple measurement points as the normalization parameter:

[0032] , Indicates the maximum standard deviation. Indicates the measuring point Mean of electromagnetic information leakage signal response sequence Indicates the measuring point exist Real-time electromagnetic information leakage signal raw data The normalized value;

[0033] Calculate the autocorrelation coefficients for each measuring point:

[0034]

[0035] In the formula, Indicates the measuring point exist Electromagnetic information leakage signal at any moment Indicates the measuring point of Autocorrelation coefficient;

[0036] Based on the properties of the autocorrelation coefficient, the time series signal is fitted to obtain the time series information entropy curve of the baseline state, and the time series information entropy curve of the baseline state is used as the threshold curve.

[0037] Furthermore, the data processing module is also used to analyze and determine the frequency range of the electromagnetic information leakage signal of the device, and to collect electromagnetic leakage signals at different locations on the device through a sensor array within that frequency range.

[0038] The beneficial effects of this invention are as follows:

[0039] Compared to traditional detection methods, this invention ignores the adverse effects of environmental noise interference. Traditional detection methods often fail to identify electromagnetic information leakage signals from information technology equipment due to excessive noise interference. This invention overcomes the difficulty of traditional detection methods in timely and effectively extracting red signal features from electromagnetic leakage signals. This invention extracts red signal information from electromagnetic information leakage signals by using a sensor array composed of receiving sensors to obtain the distribution curve of the time-domain information entropy of the overall structure of the information technology equipment. Based on the information entropy, the characteristics of the red signal are isolated. By checking if the distribution curve of the time-domain information entropy is greater than a threshold, it is possible to quickly determine whether there is a red signal component in the received leakage signal, thus judging the electromagnetic information leakage of information technology equipment and greatly improving the efficiency and accuracy of electromagnetic information leakage detection. Attached Figure Description

[0040] Figure 1 This is a schematic diagram of the electromagnetic information leakage transmission process provided in an embodiment of the present invention;

[0041] Figure 2 This is a schematic diagram of the electromagnetic information leakage test environment provided in an embodiment of the present invention;

[0042] Figure 3 This is a flowchart of a method for rapid identification of electromagnetic information leakage based on time-series information entropy waveforms provided in an embodiment of the present invention;

[0043] Figure 4 This is a schematic diagram of the discrimination result provided in an embodiment of the present invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0045] like Figure 1 As shown, compared to intentional information transmission in the usual sense, electromagnetic information leakage from information technology equipment, as unintentional information transmission, refers to the unintentional electromagnetic emission carrying information generated by changes in the operating current during the operation of the equipment. Furthermore, according to electromagnetic compatibility standards, unintentional electromagnetic emissions are often artificially suppressed during the design and use of information technology equipment. Therefore, the useful electromagnetic signals carrying information are mostly weak in energy and easily interfered with during transmission, becoming submerged in environmental noise.

[0046] like Figure 2 The diagram shows a schematic of the electromagnetic information leakage test environment. To avoid interference from external electromagnetic signals, the tests are mainly conducted in an anechoic chamber in the laboratory testing environment. The main equipment for building the experimental platform includes an anechoic chamber, information technology equipment, a keyboard, a biconical antenna, and receiving devices such as a spectrum analyzer.

[0047] This invention provides a fast method for detecting electromagnetic information leakage based on time-series entropy waveforms, comprising:

[0048] Analyze the frequency range of electromagnetic information leakage signals generated during normal operation of information technology equipment to avoid situations where the signal acquisition exceeds the receiving bandwidth when using receiving devices such as spectrum analyzers to receive electromagnetic information leakage signals, resulting in incomplete signal acquisition and affecting the judgment of electromagnetic information leakage of information technology equipment.

[0049] Establish an online detection platform: Deploy a sensor array consisting of multiple receiving sensors on the information technology equipment, enable the information technology equipment to run various file samples other than preset text types, collect electromagnetic leakage signals at different locations on the information technology equipment, and establish a database of electromagnetic information leakage signals;

[0050] Based on the electromagnetic information leakage signals collected at different locations, the information entropy of these signals is calculated, thus obtaining the information entropy values ​​of the time-domain signals at different locations on the information technology equipment. Information entropy, as a measure of the disorder of a random variable, indicates that the smaller the information entropy, the more ordered the random variable; conversely, the larger the information entropy, the more disordered the random variable. Therefore, the degree of disorder in the time-domain signal can be judged based on the magnitude of the information entropy. By connecting the time-series information entropy values ​​sequentially according to the different locations of the receiving sensors, the time-series information entropy curve of the overall structure of the information technology equipment can be obtained.

[0051] By analyzing the time-series information entropy curve, it is possible to determine whether the received electromagnetic information leakage signal contains a red signal component, based on whether the time-series information entropy curve exceeds a threshold line, and thus assessing the potential for electromagnetic information leakage from the information technology equipment. Specifically, if the time-series information entropy curve exceeds the threshold line, it indicates the presence of a red signal component in the received electromagnetic information leakage signal, thus indicating a risk of electromagnetic information leakage from the information technology equipment. Conversely, if the time-series information entropy curve does not exceed the threshold line, it indicates the absence of a red signal component in the received electromagnetic information leakage signal, thus indicating no risk of electromagnetic information leakage from the information technology equipment.

[0052] In one embodiment of the present invention, information technology equipment includes computers, monitors, printers, telephones, etc.; the information leakage frequency range of each type of information technology equipment is defined, and the information leakage frequency band range of information technology equipment is determined by taking the union of the frequency ranges.

[0053] In one embodiment of the present invention, the preset text type file samples include video files, image files, compressed files, and other files with high information entropy.

[0054] Specifically, such as Figure 3 As shown, this embodiment of the invention provides a method for rapid identification of electromagnetic information leakage based on time-series information entropy waveforms, specifically including:

[0055] (1) Arrange a sensor array consisting of multiple receiving sensors on the information technology equipment, so that the information technology equipment runs various file samples other than the preset text type, collects electromagnetic leakage signals at different locations on the information technology equipment, and establishes a database of electromagnetic information leakage signals.

[0056] (2) Import the dataset from the database in step (1), judge the degree of disorder of the time domain signal based on the information entropy, and thus obtain the information entropy value of the time domain signal at different locations on the information technology equipment; according to the different locations of the receiving sensor, connect the time entropy values ​​in sequence to obtain the time entropy curve of the overall structure of the information technology equipment.

[0057] The temporal information entropy value is:

[0058] ,in, , indicating that in the time record of all events, P( Let X be a random event. The probability of that is the first The proportion of the red signal in the electromagnetic information leakage signal at any given time.

[0059] (3) By analyzing the temporal information entropy curve, it is found that the information entropy changes when the information technology equipment processes information. When processing sensitive information files, the information entropy will highlight the amount of red signal information, that is, the information entropy value will change abruptly, and the temporal information entropy curve will show a phenomenon greater than the threshold. This determines whether there is a red signal component in the received detection signal, and then judges the electromagnetic information leakage of the information technology equipment.

[0060] The following is a detailed description of the specific implementation methods in conjunction with specific embodiments.

[0061] By running different types of files on information technology equipment and placing measurement points at different locations on the equipment, electromagnetic information leakage signals at different locations on the equipment are recorded. A total of N measurement points are set up, and the electromagnetic information leakage signal response sequence at each measurement point is recorded. ,sequence Indicates the measuring point At the same time interval Downloaded The maximum standard deviation of the raw data of the electromagnetic information leakage signal response sequence collected from N measurement points is given. To normalize the data, use the normalization parameters:

[0062] , Indicates the maximum standard deviation. Indicates the measuring point Mean of electromagnetic information leakage signal response sequence Indicates the measuring point exist Real-time electromagnetic information leakage signal raw data The normalized value;

[0063] Calculate the autocorrelation coefficients for each measuring point:

[0064] In the formula, Indicates the measuring point exist Electromagnetic information leakage signal at any moment Indicates the measuring point of Autocorrelation coefficient;

[0065] Based on the properties of the autocorrelation coefficient, the time series signal is fitted to obtain the time series information entropy curve of the baseline state, and the time series information entropy curve of the baseline state is used as the threshold curve.

[0066] By comparing the original temporal entropy curve with the baseline temporal entropy curve (i.e., the threshold curve), it is possible to determine whether red information signals exist in the electromagnetic information leakage signals of information technology equipment. Figure 4 This is a diagram showing the specific discrimination results of an embodiment of the present invention.

[0067] The above description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the concept described herein through the above teachings or related technologies or knowledge. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A rapid method for identifying electromagnetic information leakage based on time-series information entropy waveforms, characterized in that, The method includes: Collect electromagnetic leakage signals at different locations on the equipment and establish a database of electromagnetic information leakage signals; The degree of disorder of the time domain signal of the electromagnetic leakage signal is judged based on information entropy, and the temporal information entropy value of the time domain signal at different locations on the device is obtained. By sequentially connecting the temporal entropy values ​​of the time-domain signals at different locations on the device, the temporal entropy curve of the overall device structure can be obtained. Analyze the temporal information entropy curve. If the temporal information entropy curve is greater than the threshold curve, it is confirmed that there is a red signal component in the received electromagnetic leakage signal, and the device is determined to have an electromagnetic information leakage risk; otherwise, the device is determined not to have an electromagnetic information leakage risk. The specific methods for obtaining the threshold curve include: Data normalization was performed using the maximum standard deviation of the raw data of electromagnetic information leakage signal response sequences collected from multiple measurement points as the normalization parameter: , Indicates the maximum standard deviation. Indicates the measuring point Mean of electromagnetic information leakage signal response sequence Indicates the measuring point exist Real-time electromagnetic information leakage signal raw data The normalized value; Calculate the autocorrelation coefficients for each measuring point: In the formula, Indicates the measuring point exist Electromagnetic information leakage signal at any moment Indicates the measuring point of Autocorrelation coefficient; Based on the properties of the autocorrelation coefficient, the time series signal is fitted to obtain the time series information entropy curve of the baseline state, and the time series information entropy curve of the baseline state is used as the threshold curve.

2. The method for rapid detection of electromagnetic information leakage based on time-series information entropy waveforms according to claim 1, characterized in that, The electromagnetic leakage signals at different locations on the acquisition device specifically include: The device runs various file samples other than the preset text types and collects electromagnetic leakage signals at different locations on the device.

3. The method for rapid detection of electromagnetic information leakage based on time-series information entropy waveforms according to claim 1, characterized in that, The temporal information entropy value is: ,in, , indicating that in the time record of all events, P( Let X be a random event. The probability of that is the first The proportion of the red signal in the electromagnetic information leakage signal at any given time.

4. The method for rapid detection of electromagnetic information leakage based on time-series information entropy waveforms according to claim 1, characterized in that, The specific steps for collecting electromagnetic leakage signals at different locations on the equipment include: analyzing and determining the frequency range of the electromagnetic information leakage signal of the equipment, and collecting electromagnetic leakage signals at different locations on the equipment within that frequency range.

5. A device for rapid detection of electromagnetic information leakage based on time-series entropy waveforms, used to implement the method for rapid detection of electromagnetic information leakage based on time-series entropy waveforms as described in any one of claims 1-4, characterized in that, The device includes: A sensor array, comprising multiple sensors arranged on the device, for collecting electromagnetic leakage signals at different locations on the device; The data processing module is used to establish a database of electromagnetic information leakage signals based on the collected electromagnetic leakage signals; to judge the degree of disorder of the time-domain signal of the electromagnetic leakage signal based on information entropy, and to obtain the time-series information entropy value of the time-domain signal at different locations on the device; to connect the time-series information entropy values ​​of the time-domain signal at different locations on the device in sequence to obtain the time-series information entropy curve of the overall structure of the device; to analyze the time-series information entropy curve, if the time-series information entropy curve is greater than the threshold curve, it is confirmed that there is a red signal component in the received electromagnetic leakage signal, and the device is determined to have an electromagnetic information leakage risk; otherwise, the device is determined not to have an electromagnetic information leakage risk.

6. The rapid electromagnetic information leakage detection device based on time-series information entropy waveform according to claim 5, characterized in that, The data processing module is specifically used to enable the device to run various file samples other than the preset text types and to collect electromagnetic leakage signals at different locations on the device.

7. The rapid electromagnetic information leakage detection device based on time-series information entropy waveform according to claim 5, characterized in that, The temporal information entropy value is: ,in, , indicating that in the time record of all events, P( Let X be a random event. The probability of that is the first The proportion of the red signal in the electromagnetic information leakage signal at any given time.

8. The rapid electromagnetic information leakage detection device based on time-series information entropy waveform according to claim 5, characterized in that, The data processing module is specifically used to obtain the threshold curve, and the specific methods include: Data normalization was performed using the maximum standard deviation of the raw data of electromagnetic information leakage signal response sequences collected from multiple measurement points as the normalization parameter: , Indicates the maximum standard deviation. Indicates the measuring point Mean of electromagnetic information leakage signal response sequence Indicates the measuring point exist Real-time electromagnetic information leakage signal raw data The normalized value; Calculate the autocorrelation coefficients for each measuring point: In the formula, Indicates the measuring point exist Electromagnetic information leakage signal at any moment Indicates the measuring point of Autocorrelation coefficient; Based on the properties of the autocorrelation coefficient, the time series signal is fitted to obtain the time series information entropy curve of the baseline state, and the time series information entropy curve of the baseline state is used as the threshold curve.

9. The rapid electromagnetic information leakage detection device based on time-series information entropy waveform according to claim 5, characterized in that, The data processing module is also used to analyze and determine the frequency range of the electromagnetic information leakage signal of the device, and to collect electromagnetic leakage signals at different locations on the device through a sensor array within that frequency range.

Images