RS232 device fingerprint extraction method based on idle segment frequency domain characteristics

Abstract

The present invention discloses a method for extracting RS232 device fingerprints based on idle segment frequency domain features. The method comprises: connecting a master device and a slave device via an RS232 interface for a slave device whose fingerprint is to be extracted; setting a signal acquisition point on the master device's receiving line; collecting a sampled signal at the signal acquisition point, extracting the idle segment signal from the sampled signal, and processing the idle segment signal to obtain the device fingerprint. The method collects RS232 serial port signals transmitted by the slave device, extracts the idle segment signal for spectral feature extraction, and is unaffected by random data and transmission rate. Fingerprint extraction can be performed even when the slave device is not transmitting data.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for extracting RS232 device fingerprints based on idle segment frequency domain features. Background Art

[0002] RS232 is a widely used interface standard in industrial communications, primarily focusing on how data is transmitted. While authentication isn't directly covered by the standard itself, it can be achieved through additional hardware and software. Currently, relatively little research exists on RS232 serial port authentication. At the network level, in higher-layer application protocols like Modbus or DNP3, access rights can be set to ensure only authorized devices can connect and communicate, similar to network authentication. Devices can also be identified by their unique IDs (such as MAC addresses and serial numbers), but this isn't strict authentication. If a legitimate device is maliciously replaced or altered, network-level authentication alone won't be able to determine whether the legitimate device itself has been replaced. In the future, with the rapid development of the Industrial Internet and the Internet of Things, security requirements for serial devices will continue to rise.

[0003] Device Finger Information (DFI) primarily stems from manufacturing tolerances of electronic components and the degradation and aging effects of components. It is generated by the physical characteristics of the device itself, and these hardware differences are reflected in the communication signal. Therefore, by analyzing the RS232 signal, device fingerprint information can be extracted and used for device access authentication, effectively protecting the security of serial port device access networks. However, RS232 devices support multiple baud rates, such as 9600bps, 19200bps, and 115200bps, necessitating the design of a device fingerprint extraction method that is independent of the transmission rate. Furthermore, the data content of each communication may not be identical, so the device fingerprint extraction method also needs to be independent of the data content. Summary of the Invention

[0004] Technical Objective: To address the shortcomings of existing technologies, this invention discloses a method for extracting RS232 device fingerprints based on idle-segment frequency domain features. This method collects RS232 serial port signals transmitted by slave devices and extracts the idle-segment signals for spectral feature extraction. This method is unaffected by random data and transmission rates, and can even extract fingerprints when the slave device is not transmitting data. This method features simple implementation steps, fast computation, low cost, ease of implementation, and high stability, making it suitable for access authentication of RS232 devices.

[0005] Technical solution: In order to achieve the above technical objectives, the present invention adopts the following technical solution.

[0006] A method for extracting RS232 device fingerprint based on idle segment frequency domain features, the method comprising:

[0007] For the slave device whose fingerprint is to be extracted, connect the master device and the slave device through the RS232 interface, and set a signal collection point on the receiving line of the master device;

[0008] The sampling signal is collected at the signal collection point, the idle segment signal in the sampling signal is extracted, and the idle segment signal is processed to obtain the device fingerprint.

[0009] Furthermore, extracting the idle segment signal from the sampled signal includes: detecting the idle segment signal by a jump between the idle segment and the data segment, or detecting the idle segment signal by a small level fluctuation of the sampled signal.

[0010] Furthermore, if the level fluctuation is within a preset threshold, it is determined that an idle segment signal in the sampled signal is obtained.

[0011] Furthermore, the sampling signal length is greater than the data segment length.

[0012] Furthermore, when processing the idle segment signal to obtain the device fingerprint, for several idle segment signals detected during a single acquisition, any idle segment signal is selected to process and obtain the device fingerprint, or multiple idle segment signals are spliced ​​and processed to obtain the device fingerprint.

[0013] Furthermore, the idle segment signal is processed to obtain the device fingerprint, including:

[0014] Extracting the idle segment signal from the sampled signal and performing centralization processing to obtain the idle segment signal after centralization processing;

[0015] Perform frequency domain transformation on the idle segment signal after centralization to obtain a frequency domain signal;

[0016] Perform amplitude calculation on the frequency domain signal to obtain the amplitude spectrum signal;

[0017] The amplitude spectrum signal is processed by dimensionality reduction as the fingerprint of the RS232 slave device.

[0018] Furthermore, the calculation formula for centralized processing is:

[0019]

[0020] in, is the idle segment signal after centralized processing, y s (n) is the idle segment signal, is the mean value of the idle segment signal, n=1, 2, ..., N, and N is the total number of sampling points of the idle segment signal.

[0021] Furthermore, the frequency domain transform calculation formula includes:

[0022]

[0023] Where k = 1, 2, ..., K, is the idle segment signal after centralization processing, n=1, 2, ..., N, where N is the total number of sampling points of the idle segment signal.

[0024] Furthermore, the amplitude calculation formula includes:

[0025]

[0026] Among them, abs(·) represents the amplitude, is the spectrum signal.

[0027] Furthermore, the dimensionality reduction process includes: selecting a spectrum signal within a specific frequency band as the device fingerprint RFF(k), or obtaining the device fingerprint RFF(k) through principal component analysis or linear discriminant analysis.

[0028] Beneficial effects: The present invention utilizes the idle segment signal on the RS232 slave device to send the signal line, and obtains the device fingerprint by calculating the amplitude spectrum characteristics after centralized processing. The method has simple steps, fast calculation, easy implementation, and low cost. The extracted fingerprint is independent of data and transmission rate, has high stability, and can realize access authentication of RS232 devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0030] Figure 2 This is a schematic diagram of the RS232 device signal collection method;

[0031] Figure 3 This is a schematic diagram of the RS232 signal frame format;

[0032] Figure 4 This is a schematic diagram of a frame of RS232 signal waveform;

[0033] Figure 5 This is a schematic diagram of the RS232 idle segment signal waveform;

[0034] Figure 6 This is a schematic diagram of the RS232 idle segment signal waveform after centralization;

[0035] Figure 7 This is a schematic diagram of the idle segment frequency domain characteristic curve extracted multiple times at different rates for the same device;

[0036] Figure 8Schematic diagram of the idle segment frequency domain characteristic curve of different devices. DETAILED DESCRIPTION

[0037] In order to help those skilled in the art better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0038] Example

[0039] As attached Figure 1 As shown, this embodiment provides a method for extracting RS232 device fingerprints based on idle segment frequency domain features, including the following steps:

[0040] (1) For the slave device whose fingerprint is to be extracted, connect the master device and the slave device through the RS232 interface, and set the signal collection point A on the receiving line of the master device;

[0041] The master and slave devices of RS232 are cross-connected through serial port lines. The slave device is used as the device to be authenticated, that is, the slave device whose fingerprint is to be extracted. The sending pin of the slave device is connected to the receiving pin of the master device. A signal collection point A is set on the receiving line of the master device for signal collection to realize fingerprint extraction and authentication of the slave device.

[0042] In this embodiment, the RS232 device with a baud rate of 115200 Hz is mainly selected to implement fingerprint extraction. The master device (Master) and the slave device (Slave) are cross-connected through a serial line. Figure 2 As shown, the sending pin of the master device is connected to the receiving pin of the slave device, and the sending pin of the slave device is connected to the receiving pin of the master device. A signal collection point A is set on the receiving line of the master device to collect signals, so as to realize fingerprint extraction and authentication of the slave device.

[0043] (2) A sampling signal of a specific length is collected at the signal acquisition point A, and the idle segment signal in the sampling signal is extracted and centralized to obtain the idle segment signal after centralization; a sampling signal of a length of L is collected at the signal acquisition point A at a sampling rate of Fs. The sampling length of the sampling signal is required to be greater than the data segment length to ensure that the idle segment signal is collected each time.

[0044] In this embodiment, a sampling signal is collected at a sampling rate of 31.25Msps at the signal collection point A, and the number of sampling points of the sampling signal is 40K. Figure 3As shown in the figure, the signal on the RS232 serial line includes an idle state and a data transmission state. It starts in the idle state (TTL high level), then pulls low to indicate the start bit, followed by 8 data bits, then the check bit, and finally pulls high to indicate the stop bit. The signal then enters the idle state, waiting for the next data transmission. The sampling length of the sampled signal must be greater than the data segment length to ensure that the idle segment signal is captured in each acquisition.

[0045] The idle segment is detected by the jump between the idle segment and the data segment, or the idle segment can be detected by the small level fluctuation of the idle segment signal. The level fluctuation is within the preset threshold, and the idle segment signal in the sampled signal is determined; for example, the standard deviation is less than 0.1V. Figure 4 As shown, there is an idle segment signal before and after the data segment. The idle segment signal voltage is relatively stable. There is a jump from the idle segment to the start bit, and there is also a jump from the data segment back to the idle segment. The idle segment can be determined by rising edge detection.

[0046] In this embodiment, for several idle segment signals detected during a single acquisition, one idle segment signal can be selected, or multiple idle segments can be extracted from the time domain and spliced ​​together for subsequent processing. Figure 5 As shown, the idle segment signal y s (n) The voltage fluctuates around -4.6V. However, during long-term testing, the average level will drift to a certain extent. The following centralization processing is required to improve the fingerprint stability. The idle segment signal after centralization processing is as follows: Figure 6 The calculation formula for centralized processing is:

[0047]

[0048] in, is the idle segment signal after centralized processing, is the mean value of the idle segment signal, n=1, 2, ..., N, N is the total number of sampling points of the idle segment signal;

[0049] (3) Performing frequency domain transformation on the idle segment signal after the centralized processing to obtain a frequency domain signal;

[0050] In this embodiment, Perform K-point FFT transformation to obtain spectrum signal K = 2048, the frequency domain transform calculation formula is as follows:

[0051]

[0052] Wherein, k=1, 2, ..., K.

[0053] (4) Calculate the amplitude of the frequency domain signal to obtain the amplitude spectrum signal;

[0054] In this embodiment, Perform the following amplitude calculation to obtain the amplitude spectrum signal F(k):

[0055]

[0056] Where, abs(·) represents the amplitude;

[0057] (5) Perform dimensionality reduction processing on the amplitude spectrum signal as the RS232 slave device fingerprint; the dimensionality reduction processing can manually select a spectrum signal in a specific frequency band as the device fingerprint RFF(k), or it can be processed through dimensionality reduction methods such as principal component analysis and linear discriminant analysis to obtain the device fingerprint RFF(k).

[0058] In this embodiment, the amplitude spectrum signal of a specific segment is intercepted as the RS232 slave device fingerprint; the amplitude spectrum signal corresponding to the frequency band of 300 to 1400 Hz is selected as the RS232 slave device fingerprint feature RFF(k);

[0059] RFF(k)=F(k+19),k=1,2,…,71

[0060] Since this solution selects idle segment signals for fingerprint extraction, the device fingerprint feature is both data-independent and rate-independent. Figure 7 As shown in the figure, the same device sends different data at 9600Hz and 115200Hz respectively. The four extracted slave fingerprints are essentially the same, especially the peak positions, which are exactly the same. The fluctuations in the lower amplitude are mainly caused by noise fluctuations.

[0061] Figure 8 The fingerprints of three devices are extracted. As can be seen from the figure, this method can significantly distinguish different devices. The fingerprint extraction method provided by the present invention physically authenticates legitimate devices and prevents malicious device substitution, such as replacing a legitimate device with an attacking device.

[0062] The present invention also discloses an electronic device, which includes: a memory for storing a computer program; a processor for executing the computer program, so that the device performs the aforementioned RS232 device fingerprint extraction method based on idle segment frequency domain characteristics.

[0063] The present invention also provides a computer storage medium, on which a computer program is stored. When the computer program is executed, the device executing the computer program implements the aforementioned RS232 device fingerprint extraction method based on idle segment frequency domain characteristics.

[0064] The above description is merely an example and does not limit the application field of the RS232 device fingerprint extraction method based on idle segment frequency domain features provided by the present invention.

[0065] The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of this application are only used as name identifiers and do not represent the first or second in order.

[0066] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment methods can be implemented by means of software plus a general hardware platform. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, and the computer software product can be stored in a storage medium. The memory can be various types of memory, which can be a random access memory, a read-only memory, a flash memory, etc., such as a read-only memory (English: read-only memory, ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or certain parts of the embodiments.

[0067] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for extracting RS232 device fingerprint based on idle segment frequency domain features, characterized in that: The method comprises: For the slave device whose fingerprint is to be extracted, connect the master device and the slave device through the RS232 interface, and set a signal collection point on the receiving line of the master device; Collect sampling signals at the signal collection point, extract idle segment signals from the sampling signals, and process the idle segment signals to obtain device fingerprints; Extracting the idle segment signal from the sampled signal includes: detecting the idle segment signal by a jump between the idle segment and the data segment, or detecting the idle segment signal by a level fluctuation of the sampled signal; When processing the idle segment signal to obtain the device fingerprint, for several idle segment signals detected during a single acquisition, any idle segment signal is selected to process and obtain the device fingerprint, or multiple idle segment signals are spliced ​​and processed to obtain the device fingerprint.

2. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 1 is characterized in that: If the level fluctuation is within a preset threshold, it is determined that an idle segment signal in the sampled signal is obtained.

3. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 1 is characterized in that: The sampling signal length is greater than the data segment length.

4. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 1 is characterized in that: Process the idle segment signal to obtain the device fingerprint, including: Extracting the idle segment signal from the sampled signal and performing centralization processing to obtain the idle segment signal after centralization processing; Perform frequency domain transformation on the idle segment signal after centralization to obtain a frequency domain signal; Perform amplitude calculation on the frequency domain signal to obtain the amplitude spectrum signal; The amplitude spectrum signal is processed by dimensionality reduction as the fingerprint of the RS232 slave device.

5. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 4 is characterized in that: The calculation formula for centralized processing is: in, is the idle segment signal after centralized processing, y s (n) is the idle segment signal, is the mean value of the idle segment signal, n=1, 2, ..., N, and N is the total number of sampling points of the idle segment signal.

6. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 4 is characterized in that: The frequency domain transform calculation formula includes: Where k = 1, 2, ..., K, is the idle segment signal after centralization processing, n=1, 2, ..., N, where N is the total number of sampling points of the idle segment signal.

7. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 6 is characterized in that: The amplitude calculation formula includes: F(k)=abs(Y s c (k)) Where abs(·) represents the amplitude, Y s c (k) is the spectrum signal.

8. The RS232 device fingerprint extraction method based on idle segment frequency domain characteristics according to claim 7 is characterized in that: Dimensionality reduction processing includes: selecting a spectrum signal within a specific frequency band as the device fingerprint RFF(k), or obtaining the device fingerprint RFF(k) through principal component analysis and linear discriminant analysis.

Images