RS232 equipment fingerprint extraction method based on free section frequency domain characteristics

Abstract

The invention discloses an RS232 equipment fingerprint extraction method based on free band frequency domain characteristics, which comprises the following steps: aiming at slave equipment of which fingerprints are to be extracted, connecting master equipment and the slave equipment through an RS232 interface, and setting a signal acquisition point on a receiving line of the master equipment; sampling signals are collected at the signal collection points, idle section signals in the sampling signals are extracted, and the idle section signals are processed to obtain the device fingerprints. According to the invention, the RS232 serial port signal sent by the slave device is collected, the idle segment signal is extracted to carry out spectrum feature extraction, the influence of random data and transmission rate is avoided, and even when the slave device does not send data, fingerprint extraction can be carried out.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for extracting RS232 device fingerprints based on idle segment frequency domain features. Background Art

[0002] RS232 is an interface standard widely used in the field of industrial communications, focusing mainly on how to transmit data. In the authentication link, although the standard itself does not directly include this function, some form of identity authentication can be achieved through some additional hardware and software means. At present, there are relatively few studies on RS232 serial port identity authentication. At the network level, in higher-level application protocols such as Modbus or DNP3, access rights can be set so that only authorized devices can connect and communicate. This practice is similar to identity authentication on the network. Devices can also be identified by the unique ID marked on the device (such as MAC address, serial number, etc.), but this is not a strict identity authentication. That is, if a legitimate device is maliciously replaced or changed, it is impossible to determine whether the legitimate device itself has been replaced only from the network-level identity authentication. In the future, with the rapid development of the Industrial Internet and the Internet of Things, the security requirements for serial port devices will become higher and higher.

[0003] Device Finger Information (DFI) mainly comes from the manufacturing tolerance of electronic components and the degradation and aging effects of components. It is generated by the physical characteristics of the device itself. This hardware difference will be reflected in the communication signal. Therefore, by analyzing the RS232 signal, the device fingerprint information can be extracted, which can be used for device access authentication and effectively protect the security of serial port device access network. However, RS232 devices support multiple baud rates, such as 9600bps, 19200bps, 115200bps, etc., and it is necessary to design a device fingerprint extraction method that is independent of the transmission rate. In addition, the data content of each communication is not necessarily the same, and the device fingerprint extraction method also needs to be independent of the data content. Summary of the invention

[0004] Technical purpose: In view of the defects in the prior art, the present invention discloses a RS232 device fingerprint extraction method based on idle segment frequency domain characteristics, which collects RS232 serial port signals sent from the device, extracts idle segment signals for spectrum feature extraction, and is not affected by random data and transmission rate. Fingerprint extraction can be performed even when the slave device does not send data. The method has simple implementation steps, fast calculation, low cost, easy implementation, and high stability, and can be applied to access authentication of RS232 devices.

[0005] Technical solution: In order to achieve the above technical objectives, the present invention adopts the following technical solution.

[0006] A method for extracting RS232 device fingerprint based on idle segment frequency domain features, the method comprising:

[0007] For the slave device whose fingerprint is to be extracted, the master device and the slave device are connected through the RS232 interface, and a signal collection point is set on the receiving line of the master device;

[0008] The sampling signal is collected at the signal collection point, the idle segment signal in the sampling signal is extracted, and the idle segment signal is processed to obtain the device fingerprint.

[0009] Furthermore, extracting the idle segment signal from the sampling signal includes: detecting the idle segment signal by a jump between the idle segment and the data segment, or detecting the idle segment signal by a small level fluctuation of the sampling signal.

[0010] Furthermore, the level fluctuation is within a preset threshold, and an idle segment signal in the sampled signal is determined to be obtained.

[0011] Furthermore, the sampling signal length is greater than the data segment length.

[0012] Furthermore, when processing the idle segment signal to obtain the device fingerprint, for the several idle segment signals detected during a single acquisition, any idle segment signal is selected to process and obtain the device fingerprint, or multiple idle segment signals are spliced ​​and processed to obtain the device fingerprint.

[0013] Furthermore, the idle segment signal is processed to obtain the device fingerprint, including:

[0014] Extracting the idle segment signal from the sampled signal and performing centralization processing to obtain the idle segment signal after centralization processing;

[0015] Perform frequency domain transformation on the idle segment signal after centralization to obtain a frequency domain signal;

[0016] Calculate the amplitude of the frequency domain signal to obtain the amplitude spectrum signal;

[0017] The amplitude spectrum signal is processed by dimension reduction as the RS232 slave device fingerprint.

[0018] Furthermore, the calculation formula for centralized processing is:

[0019]

[0020] in, is the idle segment signal after centralized processing, y s (n) is the idle segment signal, is the mean value of the idle segment signal, n=1, 2, ..., N, and N is the total number of sampling points of the idle segment signal.

[0021] Furthermore, the frequency domain transform calculation formula includes:

[0022]

[0023] Where k = 1, 2, ..., K, is the idle segment signal after centralization processing, n=1, 2, ..., N, and N is the total number of sampling points of the idle segment signal.

[0024] Furthermore, the amplitude calculation formula includes:

[0025]

[0026] Where abs(·) represents the amplitude. is the spectrum signal.

[0027] Furthermore, the dimensionality reduction process includes: selecting a spectrum signal within a specific frequency band as the device fingerprint RFF(k), or obtaining the device fingerprint RFF(k) through principal component analysis and linear discriminant analysis.

[0028] Beneficial effect: The present invention utilizes the idle segment signal on the RS232 slave device to send the signal line, and obtains the device fingerprint by calculating the amplitude spectrum characteristics after centralized processing. The method has simple steps, fast calculation, easy implementation, and low cost. The extracted fingerprint is independent of data and transmission rate, has high stability, and can realize access authentication of RS232 devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0030] Figure 2 This is a schematic diagram of RS232 device signal collection method;

[0031] Figure 3 This is a schematic diagram of the RS232 signal frame format;

[0032] Figure 4 This is a schematic diagram of a frame of RS232 signal waveform;

[0033] Figure 5 This is a schematic diagram of the RS232 idle segment signal waveform;

[0034] Figure 6 This is a schematic diagram of the RS232 idle segment signal waveform after centralization;

[0035] Figure 7 It is a schematic diagram of the idle segment frequency domain characteristic curve extracted multiple times at different rates of the same device;

[0036] Figure 8Schematic diagram of idle band frequency domain characteristic curves of different devices. DETAILED DESCRIPTION

[0037] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0038] Example

[0039] As attached Figure 1 As shown, this embodiment provides a RS232 device fingerprint extraction method based on idle segment frequency domain features, comprising the following steps:

[0040] (1) For the slave device whose fingerprint is to be extracted, the master device and the slave device are connected through the RS232 interface, and a signal collection point A is set on the receiving line of the master device;

[0041] The master and slave devices of RS232 are cross-connected through the serial port line. The slave device is used as the device to be authenticated, that is, the slave device whose fingerprint is to be extracted. The sending pin of the slave device is connected to the receiving pin of the master device. A signal collection point A is set on the receiving line of the master device for signal collection to realize fingerprint extraction and authentication of the slave device.

[0042] In this embodiment, the RS232 device with a baud rate of 115200 Hz is mainly selected to implement fingerprint extraction. The master device (Master) and the slave device (Slave) are cross-connected through a serial port line, such as Figure 2 As shown, the sending pin of the master device is connected to the receiving pin of the slave device, the sending pin of the slave device is connected to the receiving pin of the master device, and a signal collection point A is set on the receiving line of the master device for signal collection to realize fingerprint extraction and authentication of the slave device.

[0043] (2) A sampling signal of a specific length is collected at the signal collection point A, and the idle segment signal in the sampling signal is extracted and centralized to obtain the idle segment signal after centralization; a sampling signal of a length of L is collected at the signal collection point A at a sampling rate of Fs. The sampling length of the sampling signal is required to be greater than the data segment length to ensure that the idle segment signal is collected each time.

[0044] In this embodiment, a sampling signal is collected at a sampling rate of 31.25Msps at the signal collection point A, and the number of sampling points of the sampling signal is 40K. Figure 3As shown in the figure, the signal on the RS232 serial line includes the idle state and the data transmission state. It starts in the idle state (TTL high level), then pulls low to indicate the start bit, followed by 8 data bits, then the check bit, and finally pulls high to indicate the stop bit, and enters the idle state, waiting for the next data transmission. The sampling length of the sampling signal is required to be greater than the data segment length to ensure that the idle segment signal can be collected in the sampling signal each time.

[0045] The idle segment is detected by the jump between the idle segment and the data segment, or the idle segment is detected by the small level fluctuation of the idle segment signal. The level fluctuation is within the preset threshold, and the idle segment signal in the sampled signal is determined; for example, the standard deviation is less than 0.1V. Figure 4 As shown, there is an idle segment signal before and after the data segment. The idle segment signal voltage is relatively stable. There is a jump from the idle segment to the start bit, and there is also a jump from the data segment back to the idle segment. The idle segment can be determined by rising edge detection.

[0046] In this embodiment, for several idle signal segments detected during a single acquisition, one idle signal segment can be selected, or multiple idle signals can be extracted from the time domain and spliced ​​for subsequent processing. Figure 5 As shown, the idle segment signal y s (n) The voltage fluctuates around -4.6V. However, during long-term testing, the average level will drift to a certain extent. The following centralization processing is required to improve the fingerprint stability. The idle segment signal after centralization processing is as follows: Figure 6 The calculation formula for centralized processing is:

[0047]

[0048] in, is the idle segment signal after centralized processing, is the mean value of the idle segment signal, n=1, 2, ..., N, N is the total number of sampling points of the idle segment signal;

[0049] (3) Performing frequency domain transformation on the idle segment signal after the centralization processing to obtain a frequency domain signal;

[0050] In this embodiment, Perform K-point FFT transformation to obtain the spectrum signal K = 2048, the frequency domain transform calculation formula is as follows:

[0051]

[0052] Among them, k=1, 2, ..., K.

[0053] (4) Calculate the amplitude of the frequency domain signal to obtain an amplitude spectrum signal;

[0054] In this embodiment, Perform the following amplitude calculation to obtain the amplitude spectrum signal F(k):

[0055]

[0056] Where abs(·) represents the amplitude;

[0057] (5) Perform dimensionality reduction processing on the amplitude spectrum signal as the RS232 slave device fingerprint; the dimensionality reduction processing can manually select a spectrum signal in a specific frequency band as the device fingerprint RFF(k), or it can be processed through dimensionality reduction methods such as principal component analysis and linear discriminant analysis to obtain the device fingerprint RFF(k).

[0058] In this embodiment, the amplitude spectrum signal of a specific segment is intercepted as the RS232 slave device fingerprint; the amplitude spectrum signal corresponding to the frequency band range of 300 to 1400 Hz is selected as the RS232 slave device fingerprint feature RFF(k);

[0059] RFF(k)=F(k+19),k=1,2,…,71

[0060] Since this solution selects idle segment signals for fingerprint extraction, the device fingerprint feature is both data-independent and rate-independent. Figure 7 As shown in the figure, the same device sends different data at 9600Hz and 115200Hz respectively, and the four extracted slave device fingerprints are basically the same, especially the peak positions, which are completely consistent. The fluctuations in the lower amplitude part are mainly caused by noise fluctuations.

[0061] Figure 8 The fingerprints of three devices are extracted. As can be seen from the figure, the method can significantly distinguish different devices. The fingerprint extraction method provided by the present invention realizes the identity authentication of legitimate devices from a physical level and prevents malicious device replacement, such as replacing a legitimate device with an attacking device.

[0062] The present invention also discloses an electronic device, which includes: a memory for storing a computer program; a processor for executing the computer program so that the device executes the aforementioned RS232 device fingerprint extraction method based on idle segment frequency domain characteristics.

[0063] The present invention also provides a computer storage medium, on which a computer program is stored. When the computer program is executed, the device executing the computer program implements the aforementioned RS232 device fingerprint extraction method based on idle segment frequency domain characteristics.

[0064] The above is only an example and does not limit the application field of the RS232 device fingerprint extraction method based on idle segment frequency domain characteristics provided by the present invention.

[0065] The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of the present application are only used as name identifiers and do not represent the first or second in order.

[0066] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, and the computer software product can be stored in a storage medium, and the memory can be various types of memory, which can be a random access memory, a read-only memory, a flash memory, etc., such as a read-only memory (English: read-only memory, ROM) / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0067] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for extracting RS232 device fingerprint based on idle segment frequency domain features, characterized in that: The method comprises: For the slave device whose fingerprint is to be extracted, the master device and the slave device are connected through the RS232 interface, and a signal collection point is set on the receiving line of the master device; The sampling signal is collected at the signal collection point, the idle segment signal in the sampling signal is extracted, and the idle segment signal is processed to obtain the device fingerprint.

2. According to claim 1, a RS232 device fingerprint extraction method based on idle segment frequency domain characteristics is characterized in that: Extracting the idle segment signal from the sampling signal includes: detecting the idle segment signal through the transition between the idle segment and the data segment, or detecting the idle segment signal through the level fluctuation of the sampling signal.

3. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 2 is characterized in that: The level fluctuation is within the preset threshold, and an idle segment signal in the sampled signal is determined.

4. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 1 is characterized in that: The sampling signal length is greater than the data segment length.

5. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 1 is characterized in that: When processing the idle segment signal to obtain the device fingerprint, for the several idle segment signals detected during a single acquisition, any idle segment signal is selected to process and obtain the device fingerprint, or multiple idle segment signals are spliced ​​and processed to obtain the device fingerprint.

6. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 1 is characterized in that: Process the idle segment signal to obtain the device fingerprint, including: Extracting the idle segment signal from the sampled signal and performing centralization processing to obtain the idle segment signal after centralization processing; Perform frequency domain transformation on the idle segment signal after centralization to obtain a frequency domain signal; Calculate the amplitude of the frequency domain signal to obtain the amplitude spectrum signal; The amplitude spectrum signal is processed by dimension reduction as the RS232 slave device fingerprint.

7. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 6 is characterized in that: The calculation formula for centralized processing is: in, is the idle segment signal after centralized processing, y s (n) is the idle segment signal, is the mean value of the idle segment signal, n=1, 2, ..., N, and N is the total number of sampling points of the idle segment signal.

8. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 6 is characterized in that: The frequency domain transform calculation formula includes: Where k = 1, 2, ..., K, is the idle segment signal after centralization processing, n=1, 2, ..., N, and N is the total number of sampling points of the idle segment signal.

9. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 6 is characterized in that: The amplitude calculation formula includes: F(k)=abs(Y s c (k)) Where abs(·) represents the amplitude, Y S c (k) is the spectrum signal.

10. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 6 is characterized in that: The dimension reduction process includes: selecting a spectrum signal within a specific frequency band as the device fingerprint RFF(k), or obtaining the device fingerprint RFF(k) through principal component analysis and linear discriminant analysis.

Images