Security vulnerability detection system

Abstract

The invention relates to the technical field of network security monitoring, and particularly discloses a security vulnerability detection system, which comprises a security detection environment management and control module and a digital simulation operation module, the security detection environment management and control module comprises a FreeRTOS system security test environment module, a VxWorks security test environment module, an embedded Linux security test environment module, an Android system security test environment module, a WinCE system security test environment module and a UC / OS-II system security test environment module. Real-time operating system component operation environments of various processor architectures (such as x86, ARM and MIPS) are supported through the virtualization technology, safety detection environments of six real-time operating systems including FreeRTOS, VxWorks, embedded Linux, Android, WinCE and UC / OS-II are achieved, the problems of complexity and heterogeneous management among different RTOSs are effectively solved through accurate resource scheduling and management control layer design, and the real-time operating system component operation environments of the various processor architectures (such as x86, ARM and MIPS) and the safety detection environment of the six real-time operating systems including the FreeRTOS, the VxWorks, the embedded Linux, the Android, the WinCE and the UC / OS-II are effectively improved. And the resource utilization efficiency and the task management capability of the system are optimized.

Description

Technical Field

[0001] The present invention relates to the technical field of software vulnerability detection, and in particular to a security vulnerability detection system. Background Art

[0002] A real-time operating system is an operating system specifically designed to handle real-time data processing and control tasks. They have strict time constraints and need to respond quickly to events within a predetermined time. They are used in fields that require highly precise time control and response, including but not limited to: aerospace, medical equipment, industrial automation and control, communications equipment, automotive electronics, so system security is critical to real-time operating systems.

[0003] Real-time systems usually run in environments that are extremely time-sensitive. Any unauthorized access or interruption may cause system failure or delayed response. Security vulnerabilities may cause the system to be attacked or infected with malware, which in turn affects the reliability and stability of the real-time operating system. It may also cause data leakage, tampering or destruction, causing serious impact on business and users.

[0004] However, the current system has certain deficiencies and defects in security vulnerability detection, such as:

[0005] 1. Real-time operating systems often face complex management challenges, especially in integrated environments involving multiple different RTOS (such as FreeRTOS, VxWorks, embedded Linux, etc.). Each RTOS has its own characteristics and interfaces, so when integrating and managing these different systems, it is necessary to solve the problems caused by their complexity and heterogeneity;

[0006] 2. The system usually runs in a resource-constrained environment, such as embedded devices or limited computing resources, which limits the ability of the security vulnerability detection system to handle complex tasks. For example, processing large amounts of data or performing complex algorithmic operations may be constrained by resource limitations.

[0007] 3. The system usually relies on software components and libraries provided by third parties, which may have security vulnerabilities or potential backdoors. Managing and reviewing the supply chain to ensure the security of all components used is crucial to ensuring the security of the overall system. However, the complexity of the supply chain and the number of components make this task more difficult. Therefore, the present invention proposes a security vulnerability detection system to solve the problems mentioned in the above background technology. Summary of the invention

[0008] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a security vulnerability detection system.

[0009] In order to achieve the above object, the present invention adopts the following technical solutions:

[0010] A security vulnerability detection system, the detection system comprising a security detection environment management and control module and a digital simulation operation module;

[0011] Among them, the security detection environment control module includes FreeRTOS system security test environment module, VxWorks security test environment module, embedded Linux security test environment module, Android system security test environment module, WinCE system security test environment module, UC / OS-II system security test environment module; it is used for analyzing simulation resources in the system field, extracting features of heterogeneous resources, and describing them with a unified resource description language to establish effective resource import, query, update and scheduling methods. The security vulnerability detection technology based on virtualization technology can provide computing, storage, communication, display and other hardware resources and related general software resources for the normal operation of real-time operating system security detection. The security detection environment control module emphasizes the comprehensive integration of distributed heterogeneous simulation resources, so that resources can be assembled and reused among multi-disciplinary specialties in the field;

[0012] The digital simulation operation module includes three functional modules: firmware management, firmware simulation, and data acquisition and analysis. The simulation test is carried out on the computer by using the system mathematical model, and the verification results are obtained. Simulation is a method or process of establishing a system model (mathematical model, physical effect model, mathematical-physical effect model) and conducting experimental research on the actual or imagined system under study. That is to say, a mathematical model is established for the simulated system, and this model is converted into a simulation model that is acceptable to the computer and equivalent to the original model, and then a simulation program is compiled or relevant simulation software is used to run the model on the computer and obtain the results.

[0013] Preferably, the safety detection environment management and control module includes four logical layers: support layer, simulation resource layer, management control layer and application interface layer;

[0014] The support layer consists of hardware composed of high-performance computing nodes, large-capacity storage arrays and high-speed communication and interconnection equipment, and software composed of underlying database servers, WEB servers and operating systems, which together provide underlying support for the entire simulation integration environment;

[0015] The simulation resource layer consists of four parts: model resource library, data resource library, task resource library, and node resource library;

[0016] The management control layer is used to solve the complexity and heterogeneity problems of the integrated environment and is responsible for managing the simulation resources in the environment;

[0017] The application interface layer provides users with a channel to access the security detection environment management and control module in the form of a WEB page.

[0018] Preferably, the FreeRTOS kernel in the FreeRTOS system security test environment module supports a priority scheduling algorithm, each task can be assigned a certain priority according to its importance, and the CPU always allows the task with the highest priority in the ready state to run first;

[0019] The FreeRTOS kernel also supports a round-robin scheduling algorithm. The system allows different tasks to use the same priority. When no higher priority task is ready, tasks of the same priority share the CPU usage time. The FreeRTOS kernel can be set to a preemptive kernel or a non-preemptive kernel according to user needs. When FreeRTOS is set to a preemptive kernel, a high-priority task in the ready state can deprive low-priority tasks of the right to use the CPU, thus ensuring that the system meets real-time requirements; when FreeRTOS is set to a non-preemptive kernel, a high-priority task in the ready state can only be run after the currently running task actively releases the right to use the CPU, thereby improving the CPU's operating efficiency.

[0020] Preferably, the VxWorks security test environment module includes the following functions:

[0021] a. Efficient code and good scalability. VxWorks uses a microkernel (Wi nd kernel) structure, and the kernel can be reduced to tens of K bytes;

[0022] b. Rich interface resources and a large number of third-party products have laid a solid foundation for the widespread application of VxWorks;

[0023] c. Good portability. VxWorks supports almost all popular CPUs including X86 series, POWERPC series, SPARC series, ARM series, MIPS series, etc., and can be adapted to different hardware platforms;

[0024] In addition, VxWorks provides most of the interfaces specified in the POSIX1003.1b standard (corresponding to the old standard 1003.4), making it very easy to migrate existing systems.

[0025] Good development environment, VxWorks has an excellent integrated development environment Workbench.

[0026] Preferably, the Android simulator in the Android system security test environment module implements multiple conversion libraries, implements the upper layer EGL and GLES, converts the corresponding function calls into the correct host desktop API calls, including GLX (L i nux), AGL (OSX), WGL (Wi ndows), OpenGL2.0 to simulate GLES1.1, GLES2.0, and provides corresponding encoding classes for EGL, GLES1.1, and GLES2.0 under Go l dfi sh-openGL. For each method implemented therein, the IOStream held by the current gl_encoder_context is obtained to write data into the stream for communication;

[0027] The connection between the Android system and the emulator is achieved through HostConnection, and the communication is implemented using QemuPipe.

[0028] Preferably, the embedded Linux security test environment module configures and tailors the Linux operating system originally running on a PC through a kernel, so as to adapt it to an embedded device with limited resources.

[0029] Preferably, the WinCE system security test environment module identifies security vulnerabilities in the code by performing static analysis and dynamic testing on the system, including checking and restricting access rights to system resources (such as files, devices, network interfaces) to prevent unauthorized access, providing data encryption and protection mechanisms, and recording system security events and operations. The WinCE system security test environment module ensures the stability and security of the system through multi-level security measures, including evaluation, management, encryption, auditing and updating.

[0030] Preferably, the UC / OS-II system security test environment module adopts a preemptive scheduling strategy based on task priority and is a customizable kernel. Developers can selectively include or exclude system functions according to specific needs. The kernel manages tasks in a ready state through a ready list of tasks. UC / OS-II has become an important tool in embedded system development with its sophisticated and efficient implementation scheme. It ensures the system's responsiveness to real-time requirements through priority preemptive scheduling and flexible task management, while providing sufficient flexibility and customizability to adapt to different application scenarios and hardware platform requirements.

[0031] Preferably, the digital simulation operation module can perform simulation research by using the firmware image file of the device in a software manner;

[0032] Firmware management can realize the addition, deletion and query operations of firmware. Firmware simulation is to simulate and run device firmware files in the system and support remote access to the device simulation system. Data collection and analysis are used to collect and analyze data during firmware simulation.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] 1. The present invention supports the simulation of the real-time operating system component running environment of the ARM, MIPS, and x86 architectures based on virtualization technology, and realizes the real-time operating system security detection environment based on multiple processor architectures such as x86 and ARM architectures through the management and control of resource scheduling components. The technology supports the construction of 6 real-time operating system security detection environments including FreeRTOS, VxWorks, embedded Linux, Android, WinCE system, UC / OS-II system, and each real-time operating system has multiple processor architectures and software and hardware resources;

[0035] 2. The present invention can provide sufficient computing, storage, communication, display and other hardware resources and related general software resources for the normal operation of professional tools for real-time operating system security detection in key areas, and provide support for further expanding the basic environment and tools of real-time operating systems in key areas and supporting real-time operating systems to effectively improve their security protection level;

[0036] 3. The present invention can effectively solve the management problems of complexity and heterogeneity of real-time operating systems through the design of the management control layer. It provides a unified interface and management functions, so that different RTOS can work together, thereby improving the manageability and efficiency of the entire system, including the optimization of RTOS priority scheduling, task management and CPU utilization efficiency, thereby ensuring that the system can meet real-time and security requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A technical architecture diagram of a security vulnerability detection system proposed by the present invention;

[0038] Figure 2 A technical architecture diagram of a security detection control module in a security vulnerability detection system proposed by the present invention;

[0039] Figure 3 This is a functional architecture diagram of the security test environment modules of each practical system in the security vulnerability detection system proposed by the present invention. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0041] Reference Figure 1-3 A security vulnerability detection system is disclosed, which includes a security detection environment management and control module and a digital simulation operation module.

[0042] Furthermore, referring to Figure 2 ,The security detection environment management and control module includes four logical layers of ,support layer, simulation resource layer, management control layer and application interface layer;

[0043] The support layer consists of hardware consisting of high-performance computing nodes, large-capacity storage arrays, and high-speed communication and interconnection devices, and software consisting of underlying database servers, WEB servers, and operating systems, which together provide underlying support for the entire simulation integration environment. These devices and software are the basis for building a security detection environment control module. Their processing, storage, communication, and service provision capabilities directly determine the management capabilities of simulation resources and the computing capabilities of simulation tasks.

[0044] The simulation resource layer consists of four parts: model resource library, data resource library, task resource library, and node resource library. The model resource library stores the running model used for simulation calculation. The data resource library is used to store the input and output data of the simulation and manages it in units of simulation tasks. The task resource library stores the simulation task resources customized by users using the system integrated model resource combination. The node resource library is used to store the simulation node resource information of the access security detection environment control module.

[0045] The management and control layer is used to solve the complexity and heterogeneity of the integrated environment. It is responsible for managing the simulation resources in the environment, shielding the heterogeneity of the underlying resources, organically combining various resources to form simulation computing capabilities, providing user interface interfaces to the upper layer, and proposing resource and task description specifications. Users develop compatible models and formulate simulation tasks based on this specification. Through resource description, resource indexing, task decomposition, resource scheduling and other processes, the underlying simulation resources are paired with the simulation tasks submitted by the upper-level users. The task is completed by the application services built into the WEB system and the applications deployed on each computing node, realizing the control of the task from creation, decomposition, calculation to operation.

[0046] The application interface layer provides users with access to the security detection environment management and control module in the form of WEB pages. It can intuitively, real-time and reliably reflect the system status such as resource integration, internal operation, node load, collaborative management, etc. in the security detection environment management and control module. It has multi-user distributed remote concurrent access capabilities, including model operations, data operating system operations, task operations and other functions.

[0047] Furthermore, referring to Figure 1 The security detection environment management and control module includes FreeRTOS system security test environment module, VxWorks security test environment module, embedded Linux security test environment module, Android system security test environment module, WinCE system security test environment module, and UC / OS-II system security test environment module; it is used for analyzing simulation resources in the system field, extracting features of heterogeneous resources, and describing them in a unified resource description language to establish effective resource import, query, update, and scheduling methods. Security vulnerability detection technology based on virtualization technology can provide computing, storage, communication, display and other hardware resources and related general software resources for the normal operation of real-time operating system security detection. The security detection environment management and control module emphasizes the comprehensive integration of distributed heterogeneous simulation resources, so that resources can be assembled and reused among multiple disciplines in the field.

[0048] Furthermore, the FreeRTOS kernel in the FreeRTOS system security test environment module supports a priority scheduling algorithm. Each task can be assigned a certain priority according to its importance. The CPU always lets the ready-to-run, highest-priority task run first. The FreeRTOS kernel also supports a round-robin scheduling algorithm. The system allows different tasks to use the same priority. When no higher-priority task is ready, tasks of the same priority share the CPU usage time. The FreeRTOS kernel can be set to a preemptive kernel or a non-preemptive kernel according to user needs. When FreeRTOS is set to a preemptive kernel, a high-priority task in the ready state can deprive low-priority tasks of the right to use the CPU, thus ensuring that the system meets real-time requirements. When FreeRTOS is set to a non-preemptive kernel, a high-priority task in the ready state can only be run after the currently running task actively releases the right to use the CPU, thereby improving the CPU's operating efficiency.

[0049] Furthermore, the VxWorks Security Test Environment module includes the following functions:

[0050] a. Efficient code and good scalability. VxWorks adopts a microkernel (Wi nd kernel) structure, and the kernel can be reduced to tens of K bytes, which has very good adaptability to real-time operating systems with relatively tight resources;

[0051] b. Rich interface resources and a large number of third-party products have laid a solid foundation for the widespread application of VxWorks;

[0052] c. Good portability. VxWorks supports almost all popular CPUs including X86 series, POWERPC series, SPARC series, ARM series, MIPS series, etc., and can be adapted to different hardware platforms;

[0053] In addition, VxWorks provides most of the interfaces specified in the POSIX1003.1b standard (corresponding to the old standard 1003.4), making it very easy to migrate existing systems.

[0054] Good development environment, VxWorks has an excellent integrated development environment Workbench.

[0055] Furthermore, the Android simulator in the Android system security test environment module implements multiple conversion libraries, implements the upper-level EGL and GLES, and converts the corresponding function calls into the correct host desktop API calls, including GLX (L i nux), AGL (OSX), WGL (Wi ndows), OpenGL2.0 to simulate GLES1.1, GLES2.0, and provides corresponding encoding classes for EGL, GLES1.1, and GLES2.0 under Go l dfi sh-openGL. For each method implemented in it, the IOStream held by the current gl_encoder_context is obtained to write data into the stream for communication;

[0056] The connection between the Android system and the emulator is achieved through HostConnection, in which the communication is implemented using QemuPipe. The Android emulator implements a special virtual device class to provide a very fast communication channel between the host system and the emulator.

[0057] Furthermore, the embedded Linux security test environment module configures and tailors the Linux operating system originally running on the PC to adapt it to resource-constrained embedded devices. According to the hardware configuration of the embedded device, the size of the modified embedded Linux is usually very small, generally only a few KB or a few MB in size. Based on a series of advantages of embedded Linux, more than half of the embedded application products on the market use the Linux operating system, and more and more developers use embedded Linux as the first choice of operating system in the real-time operating system. The development of the embedded Linux system is different from that of ordinary PC systems. When developing a real-time operating system, the functional modules included in the real-time operating system need to be compiled to finally generate a single image file. In the image file, from bottom to top, they are: Boot loader, Linux kernel, device driver, root file system and application. When developing an embedded Linux system, the system configuration development method will change with different application requirements.

[0058] Furthermore, the WinCE system security test environment module identifies security vulnerabilities in the code by performing static analysis and dynamic testing on the system, including checking and restricting access rights to system resources (such as files, devices, network interfaces) to prevent unauthorized access, providing data encryption and protection mechanisms, and recording system security events and operations. The WinCE system security test environment module ensures the stability and security of the system through multi-level security measures, including assessment, management, encryption, auditing and updating.

[0059] Furthermore, the UC / OS-II system security test environment module adopts a preemptive scheduling strategy based on task priority. It is a customizable kernel, and developers can selectively include or exclude system functions according to specific needs. The kernel manages tasks in the ready state through the task ready list. UC / OS-II has become an important tool in embedded system development with its sophisticated and efficient implementation scheme. It ensures the system's responsiveness to real-time requirements through priority preemptive scheduling and flexible task management, while providing sufficient flexibility and customizability to adapt to different application scenarios and hardware platform requirements.

[0060] Furthermore, the digital simulation operation module includes three functional modules: firmware management, firmware simulation, and data acquisition and analysis. By using the system mathematical model to perform simulation experiments on a computer and obtain verification results, simulation is a method or process of establishing a system model (mathematical model, physical effect model, mathematical-physical effect model) and conducting experimental research on the actual or imagined system under study, that is, establishing a mathematical model for the simulated system, and converting this model into a simulation model that is acceptable to the computer and equivalent to the original model, and then compiling a simulation program or using relevant simulation software to run the model on the computer and obtain the results. The digital simulation operation module can use the firmware image file of the device to perform simulation research through software, wherein firmware management can realize the addition, deletion, and query operations of firmware, firmware simulation is to simulate and run the device firmware file in the system, and support remote access to the device simulation system, and data acquisition and analysis are used to realize the acquisition and analysis of data during firmware simulation;

[0061] The relationship between digital simulations in various fields is reflected through a structure tree. There are many ways to classify digital simulations. They can be classified according to the nature of the simulated object, simulation implementation methods and means, simulation running time, model distribution in space, etc. However, these are classifications of simulation technology itself and are not suitable for the study of digital simulation application standards. Therefore, from the perspective of engineering application, we first divide digital simulation into two categories: single-domain simulation and multi-domain collaborative simulation, and then divide single-domain simulation according to different application fields. The specific classification is shown in the table below:

[0062] Digital policy categories

[0063]

[0064] For some larger hardware devices or test objects that cannot provide physical entities, it is not conducive to the development of detection and research work. There is currently a lack of simulation operation platforms. The digital simulation operation module can use the firmware image file of the device to perform simulation research through software.

[0065] Furthermore, referring to Figure 3, for large-scale batch testing of a single product, there is a lack of management of the tested equipment, which is not conducive to the statistics of relevant data. A real-time operating system security detection and evaluation environment subsystem in key areas is established. By calling the security detection environment management and control module, the tested product is entered into the system as an asset and resources are scheduled according to the operating system type of the tested asset. The asset information is passed to FreeRTOS / VxWorks / embedded li nux / Android / Wi nCE system / UC / 0S-II system. It consists of 4 functional modules: asset list, asset registration, asset editing and asset deletion. The asset list can display the resource list in the system and support query. Asset registration supports adding asset information to the system and supports editing and deleting it.

[0066] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A security vulnerability detection system, characterized in that: The detection system includes a safety detection environment control module and a digital simulation operation module; The security detection environment control module includes FreeRTOS system security test environment module, VxWorks security test environment module, embedded Linux security test environment module, Android system security test environment module, WinCE system security test environment module, and UC / OS-II system security test environment module; it is used for analyzing simulation resources in the system field, extracting features of heterogeneous resources, and describing them in a unified resource description language to establish effective resource import, query, update and scheduling methods; The digital simulation operation module includes three functional modules: firmware management, firmware simulation, and data acquisition and analysis. The simulation test is carried out on the computer by using the system mathematical model, and the verification result is obtained.

2. The security vulnerability detection system according to claim 1, characterized in that: The safety detection environment management and control module includes four logical layers: support layer, simulation resource layer, management control layer and application interface layer; The support layer consists of hardware composed of high-performance computing nodes, large-capacity storage arrays and high-speed communication and interconnection equipment, and software composed of underlying database servers, WEB servers and operating systems, which together provide underlying support for the entire simulation integration environment; The simulation resource layer consists of four parts: model resource library, data resource library, task resource library, and node resource library; The management control layer is used to solve the complexity and heterogeneity problems of the integrated environment and is responsible for managing the simulation resources in the environment; The application interface layer provides users with a channel to access the security detection environment management and control module in the form of a WEB page.

3. The security vulnerability detection system according to claim 1, characterized in that: The FreeRTOS kernel in the FreeRTOS system security test environment module supports a priority scheduling algorithm. Each task can be assigned a certain priority according to its importance. The CPU always lets the task with the highest priority in the ready state run first. The FreeRTOS kernel also supports a round-robin scheduling algorithm. The system allows different tasks to use the same priority. If no higher priority task is ready, tasks of the same priority share the CPU usage time.

4. The security vulnerability detection system according to claim 1, characterized in that: The VxWorks security test environment module includes the following functions: a. Efficient code and good scalability. VxWorks uses a microkernel (Wind kernel) structure, and the kernel can be reduced to tens of K bytes; b. Rich interface resources and a large number of third-party products; c. Good portability. VxWorks supports X86 series, POWERPC series, SPARC series, ARM series, and MIPS series.

5. The security vulnerability detection system according to claim 1, characterized in that: The Android simulator in the Android system security test environment module implements multiple conversion libraries, implements the upper layer EGL and GLES, and converts the corresponding function calls into the correct host desktop API calls, including GLX (Linux), AGL (OSX), and WGL (Windows); The connection between the Android system and the emulator is achieved through HostConnection, and the communication is implemented using QemuPipe.

6. The security vulnerability detection system according to claim 1, characterized in that: The embedded Linux security test environment module configures and tailors the Linux operating system originally running on a PC through kernel configuration to make it suitable for embedded devices with limited resources.

7. The security vulnerability detection system according to claim 1, characterized in that: The WinCE system security test environment module identifies security vulnerabilities in the code by performing static analysis and dynamic testing on the system, including checking and restricting access rights to system resources (such as files, devices, and network interfaces) to prevent unauthorized access, providing data encryption and protection mechanisms, and recording system security events and operations.

8. The security vulnerability detection system according to claim 1, characterized in that: The UC / OS-II system security test environment module adopts a preemptive scheduling strategy based on task priority and is a cuttable kernel. The kernel manages tasks in a ready state through a ready list of tasks.

9. The security vulnerability detection system according to claim 1, characterized in that: The digital simulation operation module can use the firmware image file of the device to perform simulation research through software; Firmware management can realize the addition, deletion and query operations of firmware. Firmware simulation is to simulate and run device firmware files in the system and support remote access to the device simulation system. Data collection and analysis are used to collect and analyze data during firmware simulation.

Images