Isolation network physical covert channel detection system and method

Abstract

The invention belongs to the technical field of physical covert channel detection, and particularly relates to an isolation network physical covert channel detection system and method.The isolation network physical covert channel detection system comprises a signal generator, a signal transmitting antenna, a notebook computer and a thermal imaging camera; the signal generator is electrically connected with the signal transmitting antenna through a radio frequency coaxial cable, and the thermal imaging camera is electrically connected with the notebook computer through a thermal imaging data transmission board card and a cable. In the sweep frequency detection process, image signals are recorded in a time axis curve mode, and after sweep frequency detection is finished, excitation frequency points of the physical covert channel transceiver can be positioned according to curve peaks. The excitation module and the image acquisition and analysis module operate under the same software, so that the excitation module and the image acquisition and analysis module have good coordination, and real-time detection of excitation and detection of the physical covert channel transceiver is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of physical covert channel detection, and in particular relates to a system and method for detecting physical covert channels in an isolated network. Background Art

[0002] With the development of network and information technology, the information security of computers and networks has attracted people's attention. The causes of information security are divided into software vulnerabilities and hardware vulnerabilities. Hardware vulnerabilities can be divided into two situations: one is the useful information carried by the sound, light, and electromagnetic radiation of information equipment and systems, which is intercepted and reproduced to cause information leakage. This channel for obtaining information is a side channel. The side channel is outside the target system and infers the relevant information inside the system by receiving and analyzing the physical signals from the target system. In this case, shielding, isolation and other means can play a protective role; the second is that the channel for sending and receiving information is illegally used to inject Trojans, steal information or sabotage information equipment and systems. When the information sending and receiving channel is authenticated, it can be protected by artificial cutting or other technical means; when the information sending and receiving channel is not authenticated or unknown, the information security caused by this sending and receiving channel will be unpredictable. This sending and receiving channel is defined as a physical covert channel. By detecting the physical covert channel and cutting off the information interaction channel, the purpose of information protection is achieved.

[0003] At present, there is a demand for physical covert channel detection in national security, confidentiality, commercial and personal fields. Attacks and theft of information systems through physical covert channels occur from time to time both internationally and domestically, but the detection-related technologies and methods in this field only appear in academic exchanges, and usually only the impact of losses and the corresponding technical methods and capabilities can be evaluated from the incidents that have occurred. Domestically, relevant technologies are studied through inversion, but most products are still in the research and laboratory stage, and there are few reports on products that can be directly applied to the detection and identification of physical covert channel transceiver equipment.

[0004] Physical covert channel detection requires a lot of prior technical knowledge. Therefore, its technical requirements are high. Foreign countries have developed related technologies earlier, accumulated a rich database, and are at the leading level of technology. Domestic research time is relatively short and the technology is still relatively backward. Summary of the invention

[0005] In view of the technical problem that in the above-mentioned physical covert channel detection process based on semiconductor device signal reception and transmission, when current is induced under the excitation of electromagnetic signals, the temperature field distribution will undergo local slight changes, which are difficult to be accurately identified and detected due to the excitation frequency and location, the present invention provides an isolated network physical covert channel detection system and method, which integrates advanced real-time thermal imaging image analysis and data statistics technology to solve the problem that physical covert channels implanted in circuit boards are difficult to be discovered and located.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] A physical covert channel detection system for an isolated network includes a signal generator, a signal transmitting antenna, a laptop computer, a thermal imaging camera, a thermal imaging data transmission board and cable, a radio frequency coaxial cable and a network cable. The signal generator is electrically connected to the laptop computer through the network cable, the signal generator is electrically connected to the signal transmitting antenna through the radio frequency coaxial cable, and the thermal imaging camera is electrically connected to the laptop computer through the thermal imaging data transmission board and cable.

[0008] The invention also comprises a circuit board card embedded in the physical covert channel and a USB power supply line. The circuit board card embedded in the physical covert channel is electrically connected to the notebook computer through the USB power supply line.

[0009] The circuit board card embedded in the physical covert channel is arranged in the optical path direction of the thermal imaging camera, and the circuit board card embedded in the physical covert channel is arranged in the signal radiation direction of the signal transmitting antenna.

[0010] The circuit board card embedded in the physical covert channel is provided with a normal module in the circuit board card and an abnormal module in the circuit board card embedded in the physical covert channel. The normal module in the circuit board card and the abnormal module in the circuit board card embedded in the physical covert channel are both electrically connected to the notebook computer through a USB power supply line.

[0011] The laptop computer comprises a thermal imaging data transmission board card slot, and the thermal imaging data transmission board card and the cable are connected to the laptop computer via the thermal imaging data transmission board card slot.

[0012] The signal output frequency range of the signal generator is 9kHz-3GHz, the signal transmission frequency coverage range of the signal transmitting antenna is 9kHz-3GHz, the thermal sensitivity of the thermal imaging camera is 40mK at 30°C, and the matrix resolution of the thermal imaging camera is a microbolometer 640x480 pixels with a step size of 17 microns.

[0013] A detection method for an isolated network physical covert channel detection system comprises the following steps:

[0014] S1, application programming platform, design software drive control function, control signal generator through laptop computer to generate sweep frequency output signal;

[0015] S2. Application programming platform, design software real-time image receiving function, through which the thermal imaging camera can be connected and the collected thermal imaging images can be received in real time, and the thermal imaging camera can be aimed at the surface of the circuit board card embedded in the physical covert channel to form a complete and clear image;

[0016] S3. Through the design of real-time image processing algorithm, the real-time collected thermal imaging image signal is converted into a real-time thermal imaging digital signal, and a real-time analysis image is formed; wherein, the analysis image formed by the real-time thermal imaging digital signal before the test environment temperature reaches a stable state and the signal generator is turned on is intercepted as the background image, and the digital signal of each pixel block in the background image is used as the initial value, and the initial value of the background image is displayed in the software interface as a black pixel block;

[0017] S4, controlling the signal generator to output a frequency sweep signal through the drive control function described in S1, and radiating the signal on the surface of the circuit board embedded in the physical covert channel through the signal transmitting antenna; performing digital signal comparison between the real-time analysis image and the background image through the real-time image processing algorithm design described in S3, and displaying the real-time analysis image formed by the comparison in the software interface, wherein the portion where the temperature rises above the threshold is indicated by a white pixel block in the image;

[0018] S5, through the design of real-time data statistical algorithm, based on the signal generator sweep output signal to form a time axis, to form the real-time number statistical curve of the white pixel blocks as the frequency changes, and the real-time ratio statistical curve of the white pixel blocks to the black pixel blocks as the frequency changes;

[0019] S6. Locate the excitation frequency of the covert channel in the circuit board embedded with the physical covert channel through the peak value of the curve in S5, and locate the position of the covert channel under the excitation frequency in combination with the position of the white pixel block of the image in S4, so as to detect the covert channel of the circuit board.

[0020] The start frequency of the frequency sweep output signal in S1 is 9 kHz, the cut-off frequency is 3 GHz, and the reference level is -10 dBm.

[0021] The thermal imaging image signal in S3 is 640x480 pixels, and the step length is 17 microns.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] The present invention controls the frequency sweep output of the signal source through the detection control software, and uses the antenna to radiate the signal on the surface of the sample to be tested for the excitation of the physical hidden channel transceiver. Because it is a frequency sweep, the physical hidden channel transceiver must be excited to work at a certain moment. At the same time, the detection control software controls the thermal imaging camera to capture the surface temperature change of the sample to be tested in real time. When the physical hidden channel transceiver is excited, an instantaneous temperature change will occur, and different from the image before excitation, the high-sensitivity thermal imaging camera will capture the slight temperature change to produce an obvious image signal, which will realize the positioning of the physical hidden channel transceiver in the information system. In the process of frequency sweep detection, the image signal will also be recorded in the form of a time axis curve. After the frequency sweep detection is completed, the excitation frequency of the physical hidden channel transceiver can be located according to the peak of the curve. Because the excitation module and the image acquisition and analysis module are run under the same software, the two have good coordination, thereby realizing the real-time detection of the excitation and detection of the physical hidden channel transceiver. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0025] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0026] Figure 1 It is a schematic diagram of the overall structure of the present invention;

[0027] Figure 2 This is a schematic diagram of an actual thermal imaging signal acquisition test of the present invention;

[0028] Figure 3 This is a schematic diagram of the physical covert channel excitation test of the present invention;

[0029] Figure 4 It is a schematic diagram of a circuit board with a physical covert channel of the present invention;

[0030] Figure 5 It is the system detection flow chart;

[0031] Figure 6 Flowchart of covert channel excitation principle.

[0032] Among them: 1 is a signal generator, 2 is a signal transmitting antenna, 3 is a laptop computer, 301 is a thermal imaging data transmission board slot, 4 is a thermal imaging camera, 5 is a thermal imaging data transmission board and cable, 6 is a radio frequency coaxial cable, 7 is a network cable, 8 is a circuit board embedded in a physical covert channel, 9 is a USB power supply line, 801 is a normal module in the circuit board, and 802 is an abnormal module in the circuit board that is embedded in a physical covert channel. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. These descriptions are only to further illustrate the features and advantages of the present invention, rather than to limit the claims of the present invention. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0034] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0035] A physical covert channel detection system for an isolated network, such as Figure 1 As shown, the signal generator 1 is electrically connected to the laptop computer 3 through the network cable 7. Insert one end of the network cable 7 into the LAN port of the signal generator 1, and the other end into the LAN port or router of the laptop computer 3. The signal generator 1 is electrically connected to the signal transmitting antenna 2 through the RF coaxial cable 6. The RF coaxial cable 6 is composed of a central conductor, an insulating layer, an outer conductor and a sheath, and is used to transmit radio frequency signals. It has the advantages of low transmission loss, wide bandwidth, and strong anti-interference ability. The thermal imaging camera 4 is electrically connected to the laptop computer 3 through the thermal imaging data transmission board and cable 5. Insert the data transmission board into the PCIe slot of the laptop computer 3, and use a cable to connect the thermal imaging camera 4 to the board. Insert one end of the USB power supply line 9 into the USB interface of the circuit board card 8 embedded in the physical covert channel, and insert the other end into the USB interface of the laptop computer 3. As shown Figure 2 As shown, the circuit board card 8 embedded in the physical covert channel is arranged in the optical path direction of the thermal imaging camera 4 to receive the data of the thermal imaging camera 4. Figure 3 As shown, the circuit board card 8 is also arranged in the signal radiation direction of the signal transmitting antenna 2 to receive the signal of the signal transmitting antenna.

[0036] Further, if Figure 4 As shown, the normal module 801 and the abnormal module 802 on the circuit board card 8 are electrically connected to the laptop computer 3 through the USB power supply line 9. The function of the USB power supply line 9 is to provide power to the circuit board card and allow data transmission. The USB power supply line 9 usually provides a 5V power supply to ensure that the modules in the circuit board card can work normally. When designing the USB interface, it is designed according to the 500mA standard, so the entire USB interface can provide a current of about 2A. Through the USB connection, the module in the circuit board card can exchange data with the laptop computer. The USB cable is not only used for power supply, but also for data transmission, so that the laptop computer can read or control the module in the circuit board card. The laptop computer can send operation codes and control signals to the modules in the circuit board card through the USB interface. These signals are transmitted to the corresponding modules through the USB line to perform specific functions, such as data storage or processing. The laptop computer can detect the behavior of abnormal modules by monitoring the USB data stream and take corresponding measures to deal with these abnormal situations.

[0037] Furthermore, the laptop computer 3 includes a thermal imaging data transmission board card slot 301 , and the thermal imaging data transmission board card and the cable 5 are connected to the laptop computer 3 via the thermal imaging data transmission board card slot 301 .

[0038] Further, preferably, the signal output frequency range of the signal generator 1 is 9kHz-3GHz, the signal transmission frequency coverage range of the signal transmitting antenna 2 is 9kHz-3GHz, the thermal sensitivity of the thermal imaging camera 4 is 40mK at 30°C, and the matrix resolution of the thermal imaging camera 4 is a microbolometer 640x480 pixels with a step size of 17 microns.

[0039] A detection method for isolating a network physical covert channel detection system, such as Figure 5 , Figure 6 As shown, the following steps are included:

[0040] Step 1: Use the programming platform to design a software-driven control function, and control the signal generator 1 to generate a frequency sweep output signal through a laptop computer 3.

[0041] Step 2: Use the programming platform to design a software with real-time image receiving function. Through this software, the thermal imaging camera 4 can be connected and the collected thermal imaging images can be received in real time. The thermal imaging camera 4 is aimed at the surface of the circuit board card 8 embedded in the physical covert channel to form a complete and clear image.

[0042] Step 3: Through the design of real-time image processing algorithm, the real-time collected thermal imaging image signal is converted into a real-time thermal imaging digital signal, and a real-time analysis image is formed. Among them, the analysis image formed by the real-time thermal imaging digital signal before the test environment temperature reaches a stable state and the signal generator 1 is turned on is intercepted as the background image, and the digital signal of each pixel block in the background image is used as the initial value. The initial value of the background image is displayed in the software interface as a black pixel block.

[0043] Step 4, through the driving control function of step 1, the signal generator 1 is controlled to output the sweep signal, and the signal is radiated on the surface of the circuit board card 8 embedded in the physical covert channel through the signal transmitting antenna 2; through the real-time image processing algorithm design of step 3, the real-time analysis image and the background image are compared by digital signals, and the real-time analysis image formed by the comparison is displayed in the software interface, wherein the portion where the temperature rises above the threshold value is indicated by a white pixel block in the image.

[0044] Step 5: By designing a real-time data statistical algorithm, a time axis is formed based on the frequency sweep output signal of signal generator 1 to form a real-time quantity statistical curve of the white pixel blocks in step 4 as the frequency changes, and a statistical curve of the real-time ratio of the white pixel blocks to the black pixel blocks as the frequency changes.

[0045] Step 6: locate the covert channel excitation frequency in the circuit board 8 embedded in the physical covert channel through the peak value of the curve in step 5, and locate the covert channel position under the frequency excitation combined with the position of the white pixel block in the image in step 4, so as to detect the covert channel of the circuit board.

[0046] Furthermore, in step 1, the start frequency of the frequency sweep output signal is 9 kHz, the cutoff frequency is 3 GHz, and the reference level is -10 dBm.

[0047] Furthermore, in step 3, the thermal imaging image signal is 640x480 pixels, and the step length is 17 microns.

[0048] Only the preferred embodiments of the present invention are described in detail above, but the present invention is not limited to the above embodiments. Various changes can be made within the knowledge scope of ordinary technicians in this field without departing from the purpose of the present invention, and various changes should be included in the protection scope of the present invention.

Claims

1. An isolated network physical covert channel detection system, characterized by: The invention comprises a signal generator (1), a signal transmitting antenna (2), a laptop computer (3), a thermal imaging camera (4), a thermal imaging data transmission board and cable (5), a radio frequency coaxial cable (6) and a network cable (7), wherein the signal generator (1) is electrically connected to the laptop computer (3) via the network cable (7), the signal generator (1) is electrically connected to the signal transmitting antenna (2) via the radio frequency coaxial cable (6), and the thermal imaging camera (4) is electrically connected to the laptop computer (3) via the thermal imaging data transmission board and cable (5).

2. The isolated network physical covert channel detection system according to claim 1, characterized in that: It also comprises a circuit board card (8) embedded in the physical covert channel and a USB power supply line (9), wherein the circuit board card (8) embedded in the physical covert channel is electrically connected to the notebook computer (3) via the USB power supply line (9).

3. The isolated network physical covert channel detection system according to claim 2, characterized in that: The circuit board card (8) embedded in the physical covert channel is arranged in the optical path direction of the thermal imaging camera (4), and the circuit board card (8) embedded in the physical covert channel is arranged in the signal radiation direction of the signal transmitting antenna (2).

4. The isolated network physical covert channel detection system according to claim 3, characterized in that: The circuit board card (8) embedded in the physical covert channel is provided with a normal module (801) in the circuit board card and an abnormal module (802) embedded in the physical covert channel in the circuit board card. Both the normal module (801) in the circuit board card and the abnormal module (802) embedded in the physical covert channel in the circuit board card are electrically connected to the notebook computer (3) via a USB power supply line (9).

5. The isolated network physical covert channel detection system according to claim 1, characterized in that: The laptop computer (3) comprises a thermal imaging data transmission board card slot (301), and the thermal imaging data transmission board card and the cable (5) are connected to the laptop computer (3) via the thermal imaging data transmission board card slot (301).

6. The isolated network physical covert channel detection system according to claim 1, characterized in that: The signal output frequency range of the signal generator (1) is 9kHz-3GHz, the signal transmission frequency coverage range of the signal transmission antenna (2) is 9kHz-3GHz, the thermal sensitivity of the thermal imaging camera (4) is 40mK at 30°C, and the matrix resolution of the thermal imaging camera (4) is a microbolometer 640x480 pixels with a step size of 17 microns.

7. A detection method for an isolated network physical covert channel detection system according to any one of claims 1 to 6, characterized in that: The following steps are involved: S1, application programming platform, designing software drive control function, controlling signal generator (1) to generate frequency sweep output signal through laptop computer (3); S2, application programming platform, design software real-time image receiving function, through which the thermal imaging camera (4) can be connected and the collected thermal imaging image can be received in real time, and the thermal imaging camera (4) is aimed at the surface of the circuit board card (8) embedded in the physical covert channel to form a complete and clear image; S3, through the design of real-time image processing algorithm, based on the real-time collected thermal imaging image signal, convert it into a real-time thermal imaging digital signal, and form a real-time analysis image; wherein, the analysis image formed by the real-time thermal imaging digital signal before the test environment temperature reaches a stable state and the signal generator (1) is turned on is intercepted as the background image, and the digital signal of each pixel block in the background image is used as the initial value, and the initial value of the background image is displayed in the software interface as a black pixel block; S4, controlling the signal generator (1) to output a frequency sweep signal through the drive control function described in S1, and radiating the signal to the surface of the circuit board (8) embedded in the physical covert channel through the signal transmitting antenna (2); performing digital signal comparison between the real-time analysis image and the background image through the real-time image processing algorithm design described in S3, and displaying the real-time analysis image formed by the comparison in the software interface, wherein the portion where the temperature rises above the threshold value is indicated by a white pixel block in the image; S5, through the design of a real-time data statistical algorithm, based on the time axis formed by the frequency sweep output signal of the signal generator (1), a real-time number statistical curve of the white pixel blocks changing with frequency and a statistical curve of the real-time ratio of the white pixel blocks to the black pixel blocks changing with frequency are formed; S6, locating the concealed channel excitation frequency in the circuit board (8) embedded in the physical concealed channel through the peak value of the curve in S5, locating the position of the concealed channel under the frequency excitation in combination with the position of the white pixel block of the image in S4, thereby detecting the concealed channel of the circuit board.

8. The detection method of the isolated network physical covert channel detection system according to claim 7, characterized in that: The start frequency of the frequency sweep output signal in S1 is 9 kHz, the cut-off frequency is 3 GHz, and the reference level is -10 dBm.

9. The detection method of the isolated network physical covert channel detection system according to claim 7, characterized in that: The thermal imaging image signal in S3 is 640x480 pixels, and the step length is 17 microns.

Images