Trusted DCS (Distributed Control System) controller executable file security measurement method and related equipment

Abstract

The invention provides a credible DCS (Distributed Control System) controller executable file security measurement method and related equipment, and the method comprises the following steps: a credible DCS controller performs credible verification on a process corresponding to an executable file at a process execution control point to obtain a verification result; the trusted DCS controller periodically performs trusted verification on a process corresponding to the executable file to obtain a verification result; the trusted DCS controller performs corresponding processing on the process according to the verification result; wherein the trusted DCS controller completes a trusted verification task based on the real-time operating system, the real-time operating system uses a priority scheduling algorithm to manage the task, and the priority of the trusted verification task is the lowest priority. According to the invention, credibility verification is carried out on the running process based on the real-time operating system, malicious tampering caused by the credible state of the process is avoided, and the DCS controller is ensured to maintain high real-time performance and has strong security protection capability at the same time.

Description

Technical Field

[0001] The present invention belongs to the field of distributed control system (DCS) security protection, and in particular relates to a security measurement method and system for executable files of a trusted DCS controller based on a real-time operating system. Background Art

[0002] Trusted DCS controllers are computer control systems used in the power industry. Their reliability, security, and real-time performance are crucial to the stable operation of the production process. In recent years, major security incidents such as "Flame", "Mirai", "Dark Power", "WannaCry", and "Ransomware" have occurred frequently. The passive defense of traditional firewalls, intrusion detection, and virus prevention is no longer sufficient, and cyberspace security is facing severe challenges. The reliability and security of trusted DCS controllers are also threatened, and they need to be protected. Trusted management platforms have emerged as the times require, playing a vital role in the security protection of trusted DCS controllers.

[0003] At present, most of the trusted verification in the trusted management platform adopts static methods. Before the verification entity is started and the control is transferred, the hash algorithm is used to calculate the summary value of the static file of the verification object, and compared with the previously recorded benchmark value to determine whether the entity to be run meets expectations. However, when the entity obtains control and runs in the form of a process in the system, the trusted state of its process may also be subject to dynamic malicious tampering, making the actions and results of the process execution untrustworthy, posing a threat to the security of the trusted DCS controller. Summary of the invention

[0004] In order to solve the problems existing in the above-mentioned prior art, the present invention provides a trusted DCS controller executable file security measurement method and related equipment, which performs trusted verification on the running process based on the real-time operating system, avoids the threat to the security of the trusted DCS controller caused by malicious tampering of the trusted state of the process, and ensures that the DCS controller has strong security protection capabilities while maintaining high real-time performance.

[0005] The present invention is achieved through the following technical solutions: Trusted DCS controller executable file security measurement method, including: The trusted DCS controller performs trusted verification on the process corresponding to the executable file at the process execution control point and obtains the verification result; The trusted DCS controller periodically performs trusted verification on the process corresponding to the executable file and obtains the verification result; The trusted DCS controller processes the process accordingly according to the verification result; The trusted DCS controller completes the trusted verification task based on a real-time operating system, the real-time operating system manages tasks using a priority scheduling algorithm, and the priority of the trusted verification task is the lowest priority.

[0006] Preferably, the trusted verification is specifically as follows: reading the code segment and read-only data segment of the dynamic link library used by the process, and calculating the measurement value of the code segment and the read-only data segment; comparing the measurement value with a pre-stored trusted reference value, if the measurement value matches the trusted reference value, the verification result is trusted, otherwise the verification result is untrustworthy.

[0007] Preferably, the trusted DCS controller performs corresponding processing on the process according to the verification result, specifically: If the verification result is credible, the process continues to run normally; If the verification result is untrustworthy, the untrustworthy processing flow is triggered.

[0008] Furthermore, the untrusted processing flow is: restricting permissions of the process or terminating execution of the process.

[0009] Preferably, when performing task switching, the real-time operating system saves state information necessary for task execution and does not save state information not necessary for task execution, wherein the non-essential state information refers to state information that can be recalculated or restored when the task is restored.

[0010] Furthermore, the state information necessary for task execution includes register values, stack pointers and state flags.

[0011] Furthermore, the register values ​​include general registers, program counters, and status flag registers; the real-time operating system uses a task context structure to save status information necessary for task execution, and the task context structure is: program counter, stack pointer, status flag register, priority, status flag, and general register.

[0012] Furthermore, the real-time operating system uses interrupt nesting to manage interrupt service programs. For interrupt nesting, the context of each layer of interrupt is saved; the interrupt service program is counted by an interrupt nesting depth counter, and the recovery point is determined according to the count of the interrupt nesting depth counter when exiting interrupt nesting.

[0013] The present invention provides a trusted DCS controller, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned trusted DCS controller executable file security measurement method are implemented.

[0014] The present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned trusted DCS controller executable file security measurement method are implemented.

[0015] Compared with the prior art, the present invention has the following beneficial effects: The trusted DCS controller executable file security measurement method of the present invention performs dynamic trusted verification on the process corresponding to the executable file, thereby avoiding threats to the security of the trusted DCS controller caused by malicious tampering of the trusted state of the running process. At the same time, the present invention is based on a real-time operating system that uses a priority scheduling algorithm to manage tasks to complete the trusted verification task, and the priority of the trusted verification task is the lowest priority, thereby ensuring the normal execution of the process, avoiding the influence of trusted verification on the normal execution of the process, and ensuring that the DCS controller maintains high real-time performance while also having a strong security protection capability.

[0016] Furthermore, when performing task switching, the real-time operating system of the present invention only saves the status information necessary for task execution and does not save the status information not necessary for task execution, thereby streamlining task status storage, optimizing task switching time, improving real-time performance, and further avoiding the impact of dynamic trusted verification on the real-time performance of the DCS controller.

[0017] Furthermore, the present invention designs a compact task context structure to store necessary state information, thereby reducing memory usage and the amount of data movement during context switching.

[0018] Furthermore, the present invention optimizes the processing logic of interrupt nesting for real-time operating systems, ensuring that the context that needs to be restored can be quickly and accurately determined when interrupt nesting occurs, thereby further improving the real-time performance of the DCS controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 The figure is a flow chart of the implementation of the security measurement method of the trusted DCS controller executable file of the present invention. DETAILED DESCRIPTION

[0021] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention.

[0022] It should be noted that the process equipment or devices not specifically specified in the following embodiments are all conventional equipment or devices in the art.

[0023] It should be noted that the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. Moreover, unless otherwise specified, the numbering of each method step is only a convenient tool for identifying each method step, and is not intended to limit the order of arrangement of each method step or to define the scope of the present invention. Changes or adjustments in their relative relationships should also be regarded as the scope of the present invention without substantially changing the technical content.

[0024] The combination of real-time performance and security is an important key point in the security measurement method of the executable file of the trusted DCS controller based on the real-time operating system (RTOS). The method of the present invention aims to ensure that the DCS controller has strong security protection capabilities while maintaining high real-time performance. Therefore, the security measurement method of the executable file of the trusted DCS controller of the present invention is implemented based on the following real-time operating system.

[0025] In a real-time operating system, efficient task scheduling and fast interrupt response are the key to achieving real-time performance. The following will introduce the specific implementation methods of these functions.

[0026] 1. Efficient task scheduling (1) Priority Scheduling Algorithm RTOS uses a priority scheduling algorithm to manage tasks, and the priority scheduling algorithm adopts a preemptive scheduling algorithm to improve real-time performance.

[0027] Preemptive scheduling algorithm: When a higher priority task becomes ready, the currently executing task (regardless of its remaining execution time) is suspended and processor resources are immediately allocated to the newly ready high priority task.

[0028] The priority of the trusted verification task in the trusted DCS controller executable file security measurement method of the present invention is limited to the lowest priority, ensuring the normal execution of the business process.

[0029] (2) Streamlining task status preservation Streamlining task state preservation is an important strategy for optimizing task switching time. Determine the necessary state information so that the task can be restored to the correct execution point when it regains the CPU, and ignore unnecessary or recalculated state information. The following is a detailed description of implementing this strategy: 1) Required status information First, analyze the state information required for task execution in RTOS. The state information required for task execution includes: Register values: The CPU's general registers, status registers (such as the program counter, status flag registers (which contain CPU status information such as condition codes (used for comparison or test results), interrupt mask bits (which determine which interrupts are enabled or disabled), and may also include task priorities, etc.) save the current execution status of the task and the instruction address.

[0030] Stack pointer: points to the top of the task stack, which contains key information such as function calls, local variables, and return addresses.

[0031] Status flags (not in registers): interrupt mask bit, priority, status code (such as ready, running, suspended, etc.) of the task. These flags are used for task management and scheduling decisions.

[0032] 2) Non-essential status information Excludes state information that can be recalculated or restored. For example: Local variables: If local variables are calculated based on input parameters or global state, and these input parameters or global state do not change during task switching, then these local variables can be recalculated when the task resumes.

[0033] Cached data: If a task uses a cache to speed up data access, but this data may become invalid after a task switch (such as CPU cache), you can reload this data when the task resumes.

[0034] Temporary files or data structures: If the data is temporary and can be rebuilt by re-executing the necessary operations when the task is resumed, it can also be ignored.

[0035] 3) Design a compact task context structure Design a compact task context structure to store necessary state information, reducing memory usage and data movement during context switching.

[0036] The task context structure designed by the present invention is: program counter, stack pointer, status flag register (including interrupt mask bit, etc.), priority, status code (such as ready, running, suspended, etc.), and general register.

[0037] 2. Rapid interrupt response RTOS is designed with a dedicated interrupt handling mechanism to ensure a quick response when an interrupt occurs.

[0038] (1) Optimize interrupt processing 1) Quick interrupt entry and exit Fast interrupt entry and exit: Reduce the amount of code in the interrupt service routine (ISR), perform only lightweight operations such as clearing interrupt flags and setting status variables, and defer complex processing logic to the task level.

[0039] Change the time-consuming operations such as complex loops and conditional judgments in ISR into fast-executing instructions.

[0040] 2) Interrupt nesting management The concept of interrupt nesting: Interrupt nesting means that when the interrupt system is executing an interrupt service program L, another interrupt service program H with a higher priority is triggered. At this time, the interrupt system will suspend the currently executing low-priority interrupt service program L and process the high-level interrupt service program H. After the processing is completed, it will return to the interrupted interrupt service program L to continue execution.

[0041] (2) Optimize processing logic Optimize the processing logic of interrupt nesting to ensure that the context that needs to be restored can be quickly and accurately determined when interrupt nesting occurs. For interrupt nesting, the context of each layer of interrupt needs to be saved so that it can be restored layer by layer when exiting interrupt nesting.

[0042] Quickly determine the recovery point: By maintaining an interrupt nesting depth counter (global variable), the value of the variable increases when entering a new interrupt service routine; when returning from the interrupt service routine, the value of the variable decreases. When the nesting depth is 0, it means that no interrupt is currently being processed.

[0043] The method for measuring the security of the executable file of the trusted DCS controller of the present invention is implemented based on the real-time operating system as described above, and performs dynamic trust verification on the process when the executable file is running, so as to avoid threats to the security of the trusted DCS controller caused by malicious tampering of the trusted state of the process. The dynamic trust verification function of the process of the present invention performs trust verification on the process in two dimensions, namely, the execution path of the process and the periodicity, for the dynamic execution process of the process, and verifies the code segments and read-only data segments of all dynamic link libraries used by the object process.

[0044] The following is an explanation of the security measurement method of the trusted DCS controller executable file of the present invention: 1. Add checks at the process execution control point A process execution control point refers to a path point that a process passes through during its running. For example, when a process opens a file, it passes through the open system call. Trust verification policies can be set at these path points. When the process executes to these process execution control points and meets the preset trust verification policies, the trust verification of the process will be triggered.

[0045] 2. Obtaining Trustworthy Reference Values When the trusted DCS controller is powered on for the first time, the trusted agent module will use the national secret algorithm SM3 to calculate the HASH value of important files and the HASH value of the code segment and read-only data segment of the program's dynamic link library. This value is used as a trusted reference value to determine whether important files, programs, and the processes corresponding to the programs are trustworthy.

[0046] Specifically, when the trusted DCS controller of the present invention is powered on for the first time, the trusted proxy module uses the national secret algorithm SM3 to calculate the HASH value of the code segment and the read-only data segment of the program's dynamic link library as the trusted reference value.

[0047] 3. Periodicity Measurement Set up a periodic scheduled task to trigger the measurement of dynamic link libraries used by the process.

[0048] During the measurement process, the contents of the code segment and the read-only data segment of the dynamic link library are read and their measurement values ​​are calculated.

[0049] The trusted proxy module will periodically use the national encryption algorithm SM3 to calculate the HASH value of the code segment and read-only data segment of the dynamic link library at this moment. The value at this time is called the measurement value.

[0050] 4. Comparison of credible benchmark values The calculated metric value is compared with a pre-stored trusted reference value.

[0051] 5. Verification result processing If the validation passes (that is, the measurement value matches the trusted reference value), the process continues normally.

[0052] If the verification fails (that is, the measurement value does not match the trusted reference value), the untrusted processing flow is triggered.

[0053] 6. Untrusted Processing Control the process according to the policy of the process execution control point, including limiting the permissions of the process (such as prohibiting write operations) or completely terminating the execution of the process.

[0054] At the same time, abnormal information can be recorded and uploaded to the trusted management platform for further analysis.

[0055] Example like Figure 1 As shown, the specific implementation of the security measurement method of the trusted DCS controller executable file of the present invention is as follows: (1) The trusted DCS controller performs trusted verification on the process corresponding to the executable file at the process execution control point and obtains the verification result.

[0056] Specifically, when the process executes to the process execution control point, the code segment and read-only data segment of the dynamic link library used by the process are read, and the measurement value of the code segment and the read-only data segment is calculated; the measurement value is compared with the pre-stored trusted reference value. If the measurement value matches the trusted reference value, the verification result is trusted, otherwise the verification result is untrustworthy.

[0057] (2) The trusted DCS controller periodically performs trusted verification on the process corresponding to the executable file and obtains the verification result.

[0058] Specifically, at preset intervals, the code segment and read-only data segment of the dynamic link library used by the process are read, and the measurement values ​​of the code segment and the read-only data segment are calculated; the measurement values ​​are compared with the pre-stored trusted reference values, and if the measurement values ​​match the trusted reference values, the verification result is trusted, otherwise the verification result is untrustworthy.

[0059] (3) The trusted DCS controller processes the process accordingly based on the verification result.

[0060] Specifically: If the verification result is credible, the process continues to run normally; If the verification result is untrustworthy, the untrustworthy processing flow is triggered to restrict the permissions of the process or terminate the execution of the process.

[0061] The trusted DCS controller of the present invention completes the trusted verification task as described above based on a real-time operating system. The real-time operating system uses a priority scheduling algorithm to manage tasks. The priority of the trusted verification task is the lowest priority, thereby ensuring the security of the trusted DSC controller without affecting the normal operation of the business process.

[0062] When switching tasks, the real-time operating system saves the state information necessary for task execution and does not save the state information not necessary for task execution, wherein the non-essential state information refers to the state information that can be recalculated or restored when the task is restored. Thus, when the task regains the CPU, it can be restored to the correct execution point, and the task switching time is reduced, thereby avoiding the reduction of the real-time performance of the DCS controller due to the increase of trusted verification tasks.

[0063] The state information necessary for task execution includes register values, stack pointers and status flags. The register values ​​include general registers, program counters and status flag registers; the real-time operating system uses a task context structure to save the state information necessary for task execution, and the task context structure includes: program counters, stack pointers, status flag registers, priorities, status flags and general registers.

[0064] The real-time operating system adopts interrupt nesting to manage interrupt service programs. For interrupt nesting, the context of each layer of interrupt is saved; the interrupt service program is counted by an interrupt nesting depth counter, and the recovery point is determined according to the count of the interrupt nesting depth counter when exiting interrupt nesting.

[0065] In another embodiment of the present invention, a trusted DCS controller is provided, the trusted DCS controller includes a processor and a memory, the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions in a computer storage medium to implement a corresponding method flow or a corresponding function; the processor described in the embodiment of the present invention can be used for the operation of the security measurement method of the executable file of the trusted DCS controller.

[0066] In another embodiment of the present invention, the present invention further provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium here can include both built-in storage media in the computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the security measurement method for the executable file of the trusted DCS controller in the above embodiment.

[0067] The above contents are only for explaining the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A security measurement method for executable files of a trusted DCS controller, characterized in that: include: The trusted DCS controller performs trusted verification on the process corresponding to the executable file at the process execution control point and obtains the verification result; The trusted DCS controller periodically performs trusted verification on the process corresponding to the executable file and obtains the verification result; The trusted DCS controller processes the process accordingly according to the verification result; The trusted DCS controller completes the trusted verification task based on a real-time operating system, the real-time operating system manages tasks using a priority scheduling algorithm, and the priority of the trusted verification task is the lowest priority.

2. The trusted DCS controller executable file security measurement method according to claim 1, characterized in that: The trusted verification specifically includes: reading the code segment and read-only data segment of the dynamic link library used by the process, and calculating the measurement value of the code segment and the read-only data segment; comparing the measurement value with a pre-stored trusted reference value, if the measurement value matches the trusted reference value, the verification result is trusted, otherwise the verification result is untrustworthy.

3. The trusted DCS controller executable file security measurement method according to claim 1, characterized in that: The trusted DCS controller processes the process accordingly according to the verification result, specifically: If the verification result is credible, the process continues to run normally; If the verification result is untrustworthy, the untrustworthy processing flow is triggered.

4. The trusted DCS controller executable file security measurement method according to claim 3 is characterized in that: The untrusted processing flow is: limiting the authority of the process or terminating the execution of the process.

5. The trusted DCS controller executable file security measurement method according to claim 1, characterized in that: When performing task switching, the real-time operating system saves state information necessary for task execution and does not save state information not necessary for task execution. The non-essential state information refers to state information that can be recalculated or restored when the task is restored.

6. The trusted DCS controller executable file security measurement method according to claim 5 is characterized in that: The state information necessary for task execution includes register values, stack pointers and state flags.

7. The trusted DCS controller executable file security measurement method according to claim 6, characterized in that: The register values ​​include general registers, program counters, and status flag registers; the real-time operating system uses a task context structure to save the status information necessary for task execution, and the task context structure includes: program counter, stack pointer, status flag register, priority, status flag, and general register.

8. The trusted DCS controller executable file security measurement method according to claim 7, characterized in that: The real-time operating system adopts interrupt nesting to manage interrupt service programs. For interrupt nesting, the context of each layer of interrupt is saved; the interrupt service program is counted by an interrupt nesting depth counter, and the recovery point is determined according to the count of the interrupt nesting depth counter when exiting interrupt nesting.

9. A trusted DCS controller, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the trusted DCS controller executable file security measurement method as claimed in any one of claims 1 to 8 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the trusted DCS controller executable file security measurement method according to any one of claims 1 to 8 are implemented.

Images