Security all-in-one machine applied to industrial control network and enclave security application deployment method

Abstract

The invention discloses a security all-in-one machine applied to an industrial control network and an enclave security application deployment method. The security all-in-one machine comprises a Kubernetes platform and a plurality of security components. And a containerization deployment tool and an enclave management tool are carried in the Kubernetes platform. The plurality of security components are respectively packaged in respective virtual machines, and the virtual machines comprise virtualization programs in the corresponding security components. And the containerization deployment tool packages the virtualization program into an application in an enclave recognizable format, constructs the application into a container mirror image and deploys the container mirror image into the security all-in-one machine. And the enclave management tool loads the application in the target container mirror image to the enclave for operation. A tool carried by a Kubernetes platform is utilized to enable a virtualization program of a component with a high security level to run in an enclave, so that effective isolation between the virtualization program and other security components is realized, and the security and stability of an industrial control network are improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a security all-in-one machine for industrial control networks and a method for deploying security applications in enclaves. Background Art

[0002] In compliance with the requirements of the National Information Security Level Protection Level 3 Certification, all city gas companies must strengthen the security management of industrial control networks (hereinafter referred to as industrial control networks). In order to achieve the security management of industrial control networks, all-in-one hyper-converged security appliances are generally deployed in industrial control networks to cover multiple key links in security management.

[0003] In the all-in-one hyper-converged security appliance, each key link is configured with a corresponding security component. For example, the asset data collection link is configured with an asset data collection component, the data audit link is configured with a data audit component, the log audit link is configured with a log audit component, and the bastion host control link is configured with a bastion host control component. However, the current design of the all-in-one hyper-converged security appliance has significant security flaws, mainly reflected in the lack of isolation measures between the various security components.

[0004] Specifically, since the asset data processed in the asset data acquisition component is highly sensitive core data, its security level should be higher than other components. However, in the current design of the all-in-one security machine, there is a lack of effective isolation between high-security components such as the asset data acquisition component and other security components. This means that once other security components are attacked, attackers can easily obtain or tamper with the core and higher-security asset data by laterally attacking the memory. This defect in the design architecture of the all-in-one security machine seriously threatens the security and stability of the industrial control network in the energy industry, and it is urgently needed to ensure data security. Summary of the invention

[0005] Based on the above problems, the present application provides a security all-in-one machine and enclave security application deployment method for industrial control networks, with the aim of achieving effective isolation between high-security-level security components and other security components, blocking lateral attack paths, and thereby improving the security and stability of industrial control networks in the energy industry.

[0006] The embodiments of the present application disclose the following technical solutions:

[0007] In a first aspect, the present application provides a security integrated machine applied to an industrial control network, the security integrated machine comprising:

[0008] A Kubernetes platform and multiple security components; the multiple security components include components of a first security level and components of a second security level, wherein the first security level is higher than the second security level; the Kubernetes platform is equipped with a containerized deployment tool and an enclave management tool;

[0009] The multiple security components are respectively encapsulated in respective virtual machines; the virtual machines include virtualization programs in the corresponding security components;

[0010] The containerized deployment tool is used to package the virtualization program into an application in an enclave-recognizable format; construct the application in the enclave-recognizable format into a container image; deploy the container image to the secure integrated machine; the container image contains files and configurations required to run the application in the enclave-recognizable format;

[0011] The enclave management tool is used to load the application in the target container image into the enclave for execution; the target container image is a container image packaged and constructed by the virtualization program corresponding to the component of the first security level through a container deployment tool.

[0012] In an optional implementation, the containerized deployment tool is specifically used to automatically convert the virtualized program into a target format program; automatically generate a configuration code based on the target format program; compile the configuration code; package the target format program and the compiled configuration code into an application in a format recognizable by the enclave; and the configuration code is used to process the target format program.

[0013] In an optional implementation, the containerized deployment tool is further used to generate a signature according to the target format program; put the signature into the packaged application in the enclave-recognizable format; and the signature is used to uniquely identify the target format program.

[0014] In an optional implementation, the enclave management tool is further used to verify the signature in the target container image. If the signature verification is successful, the application in the target container image is loaded into the enclave for execution.

[0015] In an optional implementation, the enclave management tool is further used to verify whether the application in the target container image is running in the enclave.

[0016] A second aspect of the present application provides an enclave security application deployment method, which is applied to the security integrated machine provided in the first aspect, and the method includes:

[0017] Obtaining a virtualization program in a security component encapsulated by a virtual machine;

[0018] Packaging the virtualization program into an application in a format recognizable by the enclave;

[0019] Building the application in the enclave-recognizable format into a container image; the container image contains all files and configurations required to run the application in the enclave-recognizable format;

[0020] Deploy the container image to the security integrated machine;

[0021] The application in the target container image is loaded into the enclave for execution; the target container image is a container image packaged and constructed by a containerized deployment tool using a virtualization program corresponding to a component at a first security level in the security all-in-one device.

[0022] In an optional implementation, packaging the virtualization program into an application in an enclave-recognizable format includes:

[0023] Automatically convert virtualized programs to target format programs;

[0024] Automatically generate configuration code based on the target format program; the configuration code is used to process the target format program;

[0025] Compiling the configuration code;

[0026] The target format program and the compiled configuration code are packaged into an application in a format recognizable by the enclave.

[0027] In an optional implementation, the enclave security application deployment method further includes:

[0028] Generate a signature according to the target format program;

[0029] The signature is placed into the packaged enclave-recognizable application; the signature at least includes the target format program information and the version information of the target format program.

[0030] In an optional implementation, loading the application in the target container image into the enclave for execution includes:

[0031] Verify the signature in the target container image, and if the signature verification succeeds, load the application in the target container image into the enclave for execution.

[0032] In an optional implementation, after loading the application in the target container image into the enclave for execution, the method further includes: verifying whether the application in the target container image is running in the enclave.

[0033] Compared with the prior art, this application has the following beneficial effects:

[0034] The security all-in-one machine proposed in this application includes: a Kubernetes platform and multiple security components. The multiple security components include components of the first security level and components of the second security level, wherein the first security level is higher than the second security level. The Kubernetes platform is equipped with a containerized deployment tool and an enclave management tool. Multiple security components are respectively encapsulated in their respective virtual machines, and the virtual machines contain virtualization programs in the corresponding security components. The containerized deployment tool packages the virtualization program into an application in an enclave-recognizable format, builds the application in the enclave-recognizable format into a container image, and deploys the container image to the security all-in-one machine. The enclave management tool loads the application in the target container image into the enclave for operation. It can be seen that the security all-in-one machine in the technical solution of this application, based on the containerized deployment tool and enclave management tool carried by the k8s platform, enables the virtualization program in the security component deployed in the virtual machine mode to automatically realize containerized deployment, and runs the application corresponding to the high-security-level component in the enclave. The security all-in-one machine in this solution uses an enclave based on hardware isolation to protect high-security-level components, realizes effective isolation between high-security-level components and other security components, and blocks the lateral attack path. It improves the security and stability of the industrial control network, enhances data protection capabilities, and reduces security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0036] Figure 1 A structural diagram of a security integrated machine applied to an industrial control network provided in an embodiment of the present application;

[0037] Figure 2 A schematic diagram of a scenario in which a security all-in-one machine provided in an embodiment of the present application is applied to an industrial control network;

[0038] Figure 3 A flow chart of a method for deploying secure applications in an enclave provided in an embodiment of the present application;

[0039] Figure 4 A flow chart of another method for deploying secure applications in an enclave provided in an embodiment of the present application;

[0040] Figure 5 A scenario diagram of an enclave security application deployment method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] As described above, the isolation measures between the various security components in the hyper-converged security all-in-one machine currently used in industrial control networks are insufficient. Specifically, there is a lack of effective isolation between high-security level components and other security components, so that once other security components are attacked, attackers can easily obtain or tamper with data in security components with higher security levels by laterally attacking the memory. This defect in the architecture of the security all-in-one machine seriously threatens the security and stability of the industrial control network in the energy industry.

[0042] After research, the inventor proposed a security all-in-one machine and enclave security application deployment method for industrial control networks.

[0043] The security all-in-one machine includes: a Kubernetes platform and multiple security components. The multiple security components include components of a first security level and components of a second security level, wherein the first security level is higher than the second security level. The Kubernetes platform is equipped with a containerized deployment tool and an enclave management tool. Multiple security components are respectively encapsulated in their respective virtual machines, and the virtual machines contain virtualization programs in the corresponding security components. The containerized deployment tool packages the virtualization program into an application in a format recognizable by the enclave, builds the application in the format recognizable by the enclave into a container image, and deploys the container image to the security all-in-one machine. The enclave management tool loads the application in the target container image into the enclave for execution.

[0044] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] Industrial control network is an important part of industrial automation and control system. It realizes communication and control functions between industrial equipment by integrating multiple technologies, and plays an important role in improving production efficiency, reducing costs and enhancing security. The security all-in-one machine applied to industrial control network provides comprehensive security protection, asset management and monitoring, data audit and compliance, remote operation and management, high availability and fault tolerance, etc., which provides strong guarantee for the security, stability and efficiency of industrial production process.

[0046] See also Figure 1 , which is a structural diagram of a security integrated machine applied to an industrial control network provided by an embodiment of the present application, such as Figure 1 As shown, the security all-in-one machine provided in the embodiment of the present application includes: a Kubernetes platform 101 and multiple security components 102;

[0047] Kubernetes platform 101, used for containerized deployment and management of security components and the applications within them; specifically, used to create, update, and delete containers according to predefined rules and configurations to ensure that applications always remain in the desired state.

[0048] A plurality of security components 102 are used to provide comprehensive protection for the industrial control network, ensuring the smooth progress of production activities and the security of data;

[0049] There are many kinds of security components applied to industrial control networks, each of which can provide different security protections. For example, the asset data collection component is used to collect detailed information of all devices and systems in the industrial control network, including device models, IP addresses, operating systems, software versions, etc. This information is the basis for formulating security policies, conducting risk assessments, and vulnerability management; the data audit component is used to monitor and record the flow and use of data in the industrial control network to ensure the legality and compliance of the data. It can detect abnormal data access, such as unauthorized access, data tampering, etc., and issue alarms in a timely manner; the log audit component is used to collect, store, and analyze log information of various devices and systems in the industrial control network. These log information includes user activities, system operations, security events, etc., which are important bases for security analysis and traceability; the bastion host control component is used to manage and monitor all access to key systems and devices.

[0050] In an embodiment of the present application, multiple security components 102 are divided into components 1021 of the first security level and components 1022 of the second security level. Security components of different security levels correspond to different security requirements. Among them, the first security level is higher than the second security level. For example, the asset data collected by the asset data collection component belongs to the core data, and the data security level is higher than the log, so the asset data collection component belongs to the security component of the first security level. Other components such as data audit components, log audit components, bastion host control components, etc. belong to the security components of the second security level.

[0051] Optionally, the security level of different security components can be adjusted dynamically according to different situations. Specifically, it can be flexibly changed according to business needs, real-time changes in security threats, updates to laws and regulations, or adjustments to the organization's internal security policies. For example, a company re-evaluates the security level of all its components involved in key business processes at regular intervals. After evaluation, it was found that although the original bastion host control component was important, its current security measures were not sufficient to deal with potential advanced threats, so it was decided to increase its security level from the second to the first.

[0052] In the embodiment of the present application, these components with different security levels are respectively encapsulated in respective virtual machines, and each virtual machine contains a virtualization program corresponding to the security component.

[0053] Since the security components are deployed in virtual machine mode, the virtualization programs in the security components deployed in the virtual machine mode cannot be directly run in the enclave. Therefore, it is necessary to use the corresponding deployment tools and management tools on the Kubernetes platform 101 to deploy them in a containerized manner so that they can run in the enclave, thereby achieving more effective isolation between the security components.

[0054] In the embodiment of the present application, the Kubernetes platform 101 is equipped with a containerized deployment tool 1011 and an enclave management tool 1012;

[0055] The containerized deployment tool 1011 is used to package the virtualized program into an application in a format recognizable by the enclave; the containerized deployment tool 1011 is used to convert the original virtualized program that cannot be directly run in the enclave into a format that can be recognized and executed by the enclave.

[0056] The enclave is a secure computing technology that can run code in an isolated and protected execution environment to ensure that the code and data are not tampered with or leaked during the execution process.

[0057] The containerized deployment tool 1011 builds the application in the enclave-recognizable format into a container image; after the application is converted into the enclave-recognizable format, the next step is to package these applications and their dependencies into a container image.

[0058] The container image is a lightweight, executable, independent software package that contains everything needed to run a piece of software, such as code, runtime environment, system tools, system libraries, and settings, etc. By using container images, you can ensure that the application runs in the same way everywhere.

[0059] The containerized deployment tool 1011 deploys the container image to the secure integrated machine; the container image contains the files and configurations required to run the application in the format recognizable by the enclave; these files and configurations are essential to ensure that the application runs correctly in the enclave environment. The container image is deployed to the secure integrated machine, realizing the containerized deployment of the virtualized program.

[0060] In the embodiment of the present application, the containerized deployment tool 1011 realizes the containerized deployment and management process of virtualized applications by automatically converting the virtualized program into an application in an enclave-recognizable format, and containerizing and deploying it into the secure integrated machine. The original virtualized programs in these security components are converted into formats and deployed in the secure integrated machine in the form of container images, which provides a basis for running the virtualized programs of the high-security-level security components that need to be protected in the enclave to achieve hardware isolation.

[0061] The enclave management tool 1012 is used to load the application in the target container image into the enclave for execution.

[0062] The target container image is a container image that is packaged and built by a virtualization program corresponding to the component at the first security level through a containerized deployment tool.

[0063] For security components with a higher security level, the enclave management tool 1012 first identifies and obtains the target container image corresponding to the security component with a higher security level. The target container image contains all the files, configurations, and dependencies required for the high-security-level security component to run in the enclave. Then, using the interface or mechanism provided by the enclave, the application and related resources in the target container image are securely loaded into the enclave environment.

[0064] In the embodiment of the present application, the enclave management tool 1012 ensures that the application in the security component with a high security level runs in the enclave, and the enclave can resist external attacks and internal tampering.

[0065] The security all-in-one machine in the embodiment of the present application is based on the containerized deployment tool and enclave management tool carried by the Kubernetes platform, so that the virtualization program in the security component deployed in the virtual machine mode can be automatically deployed in a container, and the application corresponding to the high-security level component is run in the enclave. The security all-in-one machine in this solution uses the enclave protection based on hardware isolation to protect the high-security level components, realizes the effective isolation between the high-security level components and other security components, and blocks the lateral attack path. It improves the security and stability of the industrial control network, enhances the data protection capability, and reduces security risks.

[0066] Figure 2 A schematic diagram of a scenario in which a security all-in-one machine is applied to an industrial control network provided in an embodiment of the present application.

[0067] like Figure 2As shown in the figure, in the industrial control network scenario, the security all-in-one machine is connected to the industrial control network through a network gate as the core protection layer, ensuring the physical isolation and data security of the system. Among them, in order to further improve data security, the security all-in-one machine places high-security level security components in the enclave through its Kubernetes platform. For example, the asset data collection component is used to collect core asset data in the industrial control network. Running it in the enclave can store all the asset data collected in the running state in the secure memory. As an independent security environment, the enclave provides an exclusive secure execution space for high-security level security components, realizing effective isolation from other security components.

[0068] like Figure 2 In the security all-in-one machine in the scenario diagram shown, although security components such as security component c and security component d are not directly placed in the enclave, they are still closely integrated with the Kubernetes platform. These security components may be responsible for auxiliary security functions such as data auditing and logging. Although they are not the core data collection link, they are also indispensable for ensuring the overall security of the industrial control network.

[0069] These security components that are not running in the enclave are also deployed in containers through the corresponding tools on the Kubernetes platform, so their security level can be increased and run in the enclave at any time according to needs.

[0070] All security components in the security all-in-one machine jointly participate in data processing and monitoring of the industrial control network.

[0071] In addition, if Figure 2 As shown, a variety of industrial control devices are also configured in the industrial control network scenario, such as scada, PLC and other industrial control devices, as well as multiple sensors such as sensor 1 and sensor 2. These sensors can be environmental monitoring devices such as pressure sensors and temperature sensors.

[0072] These industrial control devices work together with the security components in the security all-in-one machine to build an efficient and secure industrial control network environment.

[0073] In an optional implementation of the technical solution of the present application, the containerized deployment tool 1011 is specifically used to automatically convert the virtualized program into a target format program; automatically generate a configuration code based on the target format program; compile the configuration code; package the target format program and the compiled configuration code into an application in a format recognizable by the enclave; and the configuration code is used to process the target format program.

[0074] In an example implementation, the target format may be an Open Virtualization Appliance (OVA) format, where an OVA format file is a virtual machine disk image file commonly used in a virtualization environment, and contains all necessary components required for a virtual machine to run;

[0075] Automatically generate configuration codes based on the OVA format program, the configuration codes are used to process the OVA format program to ensure that it can run and configure correctly in the new environment;

[0076] Compile the generated configuration code to generate an executable format to facilitate packaging and deployment in subsequent steps;

[0077] Package the OVA format program and the compiled configuration code into a format that can be recognized by the enclave. Optionally, it can be packaged through the base image gramine. Enclave is a secure execution environment used to protect sensitive data and code from external threats. Packaging the application into an enclave-recognizable format can achieve secure isolation of the application and further improve the security of the application.

[0078] In an optional implementation of the technical solution of the present application, the containerized deployment tool 1011 is further used to generate a signature according to the target format program; and put the signature into the packaged application in the enclave-recognizable format.

[0079] The signature is used to uniquely identify the target format program.

[0080] In an example implementation, the process of generating a signature by the containerized deployment tool 1011 can be implemented by performing a hash calculation on the target format program. Specifically, the hash function can convert the target format program into a hash value of a fixed length. This hash value is a unique representation of the target format program, including but not limited to representing the target format program information and the version information of the target format program. The hash value can then be encrypted using a private key to generate a signature. The signature can be used to ensure the authenticity and integrity of the target format program.

[0081] In the embodiment of the present application, when the containerized deployment tool 1011 packages the target format program and the compiled configuration code into an application in a format recognizable by the enclave, the generated signature is embedded into the packaged application.

[0082] In an example implementation, this process may be implemented by adding a metadata file or field containing the signature to the packaged application.

[0083] Optionally, the signature can be associated with the corresponding hash value to facilitate retrieval during the verification process.

[0084] In an optional implementation of the technical solution of the present application, the enclave management tool 1012 is further used to verify the signature in the target container image, and if the signature verification is successful, the application in the target container image is loaded into the enclave for execution.

[0085] The enclave management tool 1012 is responsible for verifying the signature in the target container image to ensure that only verified and trusted applications can be loaded into the enclave for execution.

[0086] In an example implementation, this verification process can be performed by the enclave management tool 1012 first extracting the embedded signature from the target container image, such as parsing the metadata of the container image to find data related to the signature; and then obtaining the public key corresponding to the signature in order to verify the signature.

[0087] The contents of the target container image are hashed using the same hash function used to generate the signature to produce a hash value for comparison.

[0088] Decrypt the extracted signature using the public key to get the original hash value.

[0089] The decrypted hash value is then compared with the calculated hash value. If the two match, the signature verification succeeds, indicating that the target container image has not been tampered with after signing; if they do not match, the signature verification fails, indicating that the target container image may have been tampered with.

[0090] After the signature verification is successful, the enclave management tool 1012 will create an enclave and initialize the enclave, and then load the target container image into the initialized enclave. Since the enclave is a hardware-protected secure execution environment, the loading process needs to ensure the integrity and security of the target container image to prevent tampering or leakage during the loading process.

[0091] Once the target container image is successfully loaded into the enclave, the enclave management tool 1012 can start the application therein. The programs corresponding to the security components with high security levels will run in an isolated and protected manner in the enclave, thereby ensuring the security of sensitive data and critical tasks.

[0092] In an optional implementation of the technical solution of the present application, the enclave management tool 1012 is further used to verify whether the application in the target container image is running in the enclave.

[0093] In an embodiment of the present application, verification of whether the application in the target container image is actually running in the enclave to which it belongs is usually implemented through local authentication and remote authentication to ensure that the execution environment of the application meets security requirements.

[0094] The local authentication means that the enclave management tool 1012 performs a check directly inside the enclave environment to confirm whether the application in the target container image is running. This method relies on the internal monitoring and management mechanism provided by the enclave environment.

[0095] The remote authentication refers to the enclave management tool 1012 verifying whether the application is running in the enclave through an interface or mechanism outside the enclave environment. This method involves a remote service or application programming interface (API) that interacts with the enclave environment.

[0096] In the embodiment of the present application, the enclave management tool 1012 enhances the security and credibility of the application by effectively verifying whether the application in the target container image is actually running in the enclave environment.

[0097] Based on the security integrated machine applied to the industrial control network provided in the above embodiments, the present application also provides an enclave security application deployment method, which is applied to any of the security integrated machines described in the above embodiments. Figure 3 A flow chart of a method for deploying secure applications in an enclave provided by an embodiment of the present application. Figure 3 As shown, the method comprises the following steps:

[0098] S301: Obtain a virtualization program in a security component encapsulated by a virtual machine.

[0099] In an embodiment of the present application, the process of obtaining the virtualization program in the security component encapsulated by the virtual machine in the security all-in-one device can be achieved by first determining the virtualization technology used in the security component, and then extracting the corresponding virtualization program and its dependent libraries and configuration files from the file system of the security component according to different virtualization technologies.

[0100] S302: Package the virtualized program into an application in a format recognizable by the enclave.

[0101] In the embodiment of the present application, the virtualized program obtained in the above step is converted into an application in a format recognizable by the enclave by converting the format, so that the program can be run in the enclave later.

[0102] S303: Build the application in the format recognizable by the enclave into a container image.

[0103] The container image contains all files and configurations required to run the application in the format recognizable by the enclave;

[0104] S304: Deploy the container image to the security integrated machine.

[0105] In an example implementation, the container image can be uploaded to the image repository of the security appliance.

[0106] S305: Load the application in the target container image into the enclave for execution.

[0107] The target container image is a container image that is packaged and constructed by a virtualization program corresponding to a component of the first security level in the security all-in-one machine through a containerized deployment tool.

[0108] In the embodiment of the present application, by automatically converting the virtualization program into an application in an enclave-recognizable format, the virtualization program in the security component of the virtual machine deployment mode can be run in the enclave, thereby realizing the loading of the virtualization program corresponding to the security component with a high security level into the enclave for execution, thereby realizing the deployment of the enclave security application and the effective isolation of the security component with a high security level.

[0109] Figure 4 Another flow chart of an enclave security application deployment method provided in an embodiment of the present application. In the embodiment introduced by this figure, a more detailed description is provided for the implementation of the enclave security application deployment method.

[0110] like Figure 4 The enclave security application deployment method shown includes the following steps:

[0111] S401: Obtain a virtualization program in a security component encapsulated by a virtual machine.

[0112] S402: Automatically convert the virtualized program into a target format program.

[0113] In an example implementation, the target format is an OVA format. An OVA format file is a virtual machine disk image file commonly used in a virtualization environment, which contains all the necessary components required for the virtual machine to run.

[0114] S403: Automatically generate configuration code based on the target format program.

[0115] The configuration code is used to process the target format program.

[0116] In an exemplary implementation, configuration codes are automatically generated based on the OVA format program, and the configuration codes are used to process the OVA format program to ensure that it can run and configure correctly in the new environment.

[0117] S404: Compile configuration code.

[0118] In the embodiment of the present application, the generated configuration code is compiled to generate an executable format to facilitate packaging and deployment in subsequent steps.

[0119] S405: Package the target format program and the compiled configuration code into an application in a format recognizable by the enclave.

[0120] In an exemplary implementation, the target format program and the compiled configuration code may be packaged into an application in an enclave-recognizable format through a base image gramine.

[0121] S406: Generate a signature according to the target format program.

[0122] Generating a signature can be achieved in a variety of ways, for example, by performing a hash calculation on the target format program. The hash function can convert the target format program into a fixed-length hash value. This hash value is a unique representation of the target format program, including but not limited to the target format program information and the target format program version information. The hash value can then be encrypted using a private key to generate a signature. The signature can be used to ensure the authenticity and integrity of the target format program.

[0123] S407: Put the signature into the packaged application in a format recognizable by the enclave.

[0124] The signature includes at least the target format program information and version information of the target format program.

[0125] In an embodiment of the present application, in the process of packaging the target format program and the compiled configuration code into an application in a format recognizable by the enclave, the generated signature is embedded into the packaged application.

[0126] In an example implementation, this step may be implemented by adding a metadata file or field containing the signature to the packaged application.

[0127] S408. Build the application in the format recognizable by the enclave into a container image.

[0128] The container image contains all files and configurations required to run the application in a format recognizable by the enclave.

[0129] S409: deploy the container image to the security integrated machine.

[0130] In an example implementation, the container image can be uploaded to the image repository of the security appliance.

[0131] S410: Verify the signature in the target container image. If the signature verification succeeds, load the application in the target container image into the enclave for execution.

[0132] In an embodiment of the present application, the target container image is a container image that is packaged and constructed by a containerized deployment tool using a virtualization program corresponding to a component of the first security level in the security all-in-one machine.

[0133] In an example implementation, the verification process may be performed by first extracting the embedded signature from the target container image, such as parsing metadata of the container image to find data related to the signature; and then obtaining a public key corresponding to the signature.

[0134] The contents of the target container image are hashed using the same hash function used to generate the signature to generate a hash value for comparison. The extracted signature is decrypted using the public key to obtain the original hash value.

[0135] The decrypted hash value is then compared with the calculated hash value. If the two match, the signature verification succeeds, indicating that the target container image has not been tampered with after signing; if they do not match, the signature verification fails, indicating that the target container image may have been tampered with.

[0136] In the implementation of this application, once the target container image is successfully loaded into the enclave, the application in it can be started. The program corresponding to the high-security level security component in the target container image will run in an isolated and protected manner in the enclave, thereby ensuring the security of sensitive data and critical tasks.

[0137] S411. Verify whether the application in the target container image is running in the enclave.

[0138] In the embodiment of the present application, local authentication and remote authentication are usually used to verify whether the application in the target container image is running in the enclave.

[0139] The local authentication refers to performing a check directly inside the enclave environment to confirm whether the application in the target container image is running. This method relies on the internal monitoring and management mechanism provided by the enclave environment.

[0140] The remote authentication refers to verifying whether the application is running in the enclave through an interface or mechanism outside the enclave environment. This method may involve remote services or APIs that interact with the enclave environment.

[0141] Figure 5 A scenario diagram of an enclave security application deployment method provided in an embodiment of the present application.

[0142] In the embodiment of the present application, the method is applied to the security integrated machine in the aforementioned embodiment, and the Kubernetes platform therein is used to realize containerized deployment, and the virtualization program in the security component deployed in the virtual machine mode is automatically converted into an enclave-recognizable format, and deployed in the security integrated machine, ensuring a high level of isolation and protection of key applications. The signature verification mechanism ensures the authenticity and integrity of the application image and prevents tampering. Combined with local and remote authentication, it ensures that the running status of the application in the enclave can be verified.

[0143] It should be noted that each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the method embodiment, since it is basically similar to the embodiment of the aforementioned security integrated machine, the description is relatively simple, and the relevant parts can refer to the partial description of the embodiment of the aforementioned security integrated machine. The embodiment of the security integrated machine described above is merely schematic, in which the unit described as a separate component may or may not be physically separated, and the component prompted as a unit may or may not be a physical unit, that is, it may be located in one place, or it may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0144] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A security integrated machine applied to an industrial control network, characterized in that: The safety integrated machine comprises: A Kubernetes platform and multiple security components; the multiple security components include components of a first security level and components of a second security level, wherein the first security level is higher than the second security level; the Kubernetes platform is equipped with a containerized deployment tool and an enclave management tool; The multiple security components are respectively encapsulated in respective virtual machines; the virtual machines include virtualization programs in the corresponding security components; The containerized deployment tool is used to package the virtualization program into an application in an enclave-recognizable format; construct the application in the enclave-recognizable format into a container image; deploy the container image to the secure integrated machine; the container image contains files and configurations required to run the application in the enclave-recognizable format; The enclave management tool is used to load the application in the target container image into the enclave for execution; the target container image is a container image packaged and constructed by the virtualization program corresponding to the component of the first security level through a container deployment tool.

2. The security integrated machine according to claim 1, characterized in that: The containerized deployment tool is specifically used to automatically convert a virtualized program into a target format program; automatically generate a configuration code based on the target format program; compile the configuration code; package the target format program and the compiled configuration code into an application in a format recognizable by the enclave; and the configuration code is used to process the target format program.

3. The safety integrated machine according to claim 2, characterized in that: The containerized deployment tool is further used to generate a signature according to the target format program; and put the signature into a packaged application in an enclave-recognizable format; The signature is used to uniquely identify the target format program.

4. The integrated safety machine according to claim 3, characterized in that: The enclave management tool is further used to verify the signature in the target container image. If the signature verification is successful, the application in the target container image is loaded into the enclave for execution.

5. The integrated safety machine according to any one of claims 1 to 4, characterized in that: The enclave management tool is further used to verify whether the application in the target container image is running in the enclave.

6. A method for deploying secure applications in an enclave, characterized in that: Applied to the security integrated machine according to any one of claims 1 to 5, the method comprises: Obtaining a virtualization program in a security component encapsulated by a virtual machine; Packaging the virtualization program into an application in a format recognizable by the enclave; Building the application in the enclave-recognizable format into a container image; the container image contains all files and configurations required to run the application in the enclave-recognizable format; Deploy the container image to the security integrated machine; The application in the target container image is loaded into the enclave for execution; the target container image is a container image packaged and constructed by a containerized deployment tool using a virtualization program corresponding to a component at a first security level in the security all-in-one device.

7. The method according to claim 6, characterized in that The application for packaging the virtualization program into an enclave-recognizable format includes: Automatically convert virtualized programs to target format programs; Automatically generate configuration code based on the target format program; the configuration code is used to process the target format program; Compiling the configuration code; The target format program and the compiled configuration code are packaged into an application in a format recognizable by the enclave.

8. The method according to claim 6, characterized in that The method further comprises: Generate a signature according to the target format program; The signature is placed into the packaged enclave-recognizable application; the signature at least includes the target format program information and the version information of the target format program.

9. The method according to claim 8, characterized in that The step of loading the application in the target container image into the enclave for execution includes: Verify the signature in the target container image, and if the signature verification succeeds, load the application in the target container image into the enclave for execution.

10. The method according to any one of claims 6 to 9, characterized in that: After loading the application in the target container image into the enclave for execution, the method further includes: verifying whether the application in the target container image is running in the enclave.

Images