Anti-secret-stealing device and method based on current fluctuation

Abstract

The invention discloses an anti-theft device and method based on current fluctuation, and relates to the technical field of information security, which can be directly, simply and conveniently connected between target information equipment and an external input power supply, and can skillfully utilize a power resistor to generate interference current on a power line when abnormal current on the power line is detected, so that the anti-theft effect is improved. In this way, current signals needing to be acquired by an attacker are disturbed, the attacker cannot read useful information, and therefore the purposes that technical secret stealing is carried out by using the power line as a covert communication channel and attack behaviors of target information equipment are effectively protected are achieved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an anti-theft device and method based on current fluctuation. Background Art

[0002] Researchers at Israel's Ben-Gurion University wrote a document titled "PowerHammer: Stealing Data from Isolated Computers via Power Lines," which disclosed that spies can steal highly sensitive data from target information devices (computers and other information devices) covertly through current fluctuations transmitted through power lines. The attack method implants malicious programs on target information devices without implanting hardware backdoors, and changes the current changes on the power line by changing the usage rate of high-power components (such as CPUs, graphics cards, etc.) of the target information device, thereby transmitting the stolen sensitive information on the power line. For example, by simply controlling the usage rate of the CPU of the target information device, the signal of current change can be detected on the power line. Figure 6 The CPU usage change graph is shown. Figure 7 The following figure shows the detected current change signal diagram. When the data is modulated into CPU power changes through a carefully designed malicious program, the following can be detected on the power line: Figure 8 The current change signal diagram shown in the figure. At this time, as long as the eavesdropper can directly contact the power cable connected to the power supply of the target information device, he can steal confidential information from the physically isolated target information device through the power line. Moreover, the closer the eavesdropper is to the target information device being attacked, the faster he can receive the target data.

[0003] The power line attack technology cleverly utilizes the characteristics of the power line itself, using electricity as a medium to steal information from physically isolated computers silently, which is extremely harmful. And with the development of malware camouflage technology, attack technology has also changed from single malware attacks and malicious hardware attacks to a combination of malicious software and hardware attacks. The power line attack technology is a product of this combination. It uses malware to control the working conditions of the CPU load of the target information device, and reflects the results of this modulation information on the current consumption of the power line. This combination of software and hardware attack mode is highly concealed and destructive.

[0004] At present, the defense measure against power line attacks is to install some CPU core monitoring software, and immediately terminate the corresponding process if an abnormality is found. However, this defense measure either sacrifices the performance of the target information device to defend against the attack, or compromises with a high false alarm rate to defend against the attack, and neither can guarantee accuracy, so it is less practical. Summary of the invention

[0005] In order to overcome the shortcomings of the prior art, the present invention provides an anti-theft device and method based on current fluctuations. The present invention can be directly, simply and conveniently connected between the target information equipment and the external input power supply, and can cleverly use the power resistor to generate interference current to the power line when abnormal current is detected on the power line, so as to disrupt the current signal that the attacker needs to obtain, making it impossible for the attacker to read useful information, thereby achieving the purpose of effectively protecting against technical theft using the power line as a covert communication channel and attacks on the target information equipment.

[0006] To achieve the above purpose, the technical solution adopted by the present invention is as follows: In a first aspect, the present invention provides an anti-theft device based on current fluctuation, which is connected between a target information device and an external input power supply, and specifically comprises: Power input terminal, used to connect external input power; Power output terminal, used to connect to the protected target information equipment; A power line connected between a power input terminal and a power output terminal; The coupled current clamp is clamped and fixed on the power line, and is used to embed the current characteristic signal on the power line into the coil of the coupled current clamp's own sensor through inductive coupling of the magnetic field, and convert the current characteristic signal into a voltage signal; A current detection circuit is used to receive the current characteristic signal and the voltage signal obtained by the coupled current clamp, and is used to convert the voltage signal into a digital signal through AD conversion, and convert the digital signal into a current value; An ARM data processor is connected to the power line through a power module, and is used to receive a current characteristic signal and a current value obtained by a current detection circuit, and is used to determine whether the received current value is an abnormal current, and is used to control a random number controller to generate a random number sequence signal when the received current value is determined to be an abnormal current, and is used to control a scrambling code modulation circuit to modulate the current characteristic signal and the random number sequence signal and generate a scrambling code signal; A power driving circuit is connected to the power resistor and the scrambling code modulation circuit respectively, and is used to provide a driving voltage and current for the power resistor according to the scrambling code signal modulated by the scrambling code modulation circuit; The power resistor includes a power supply end and a control end. The power supply end is connected to the power module through a power supply, and the control end is connected to the power driving circuit. It is used to control the on and off of the current output according to the scrambling code signal, and consumes the current on the power line in the control mode of turning on the current output, so as to disturb the current on the power line.

[0007] The anti-theft device also includes a shell made of aluminum alloy, and a power input terminal, a power output terminal, a power cord, a coupled current clamp, a current detection circuit, an ARM data processor, a power module, a random number controller, a scrambling code modulation circuit, a power resistor and a power supply are all fixed in the shell.

[0008] The size of the shell is 350㎜×240㎜×70㎜.

[0009] The power resistor comprises an aluminum alloy radiator and a plurality of groups of cement resistors, and the plurality of groups of cement resistors are evenly fixed on the aluminum alloy radiator.

[0010] The current detection circuit can detect current in the range of 0-100A.

[0011] The power supply module includes a switching power supply and a digital power supply. The switching power supply is connected between the coupled current clamp and the power output terminal, the digital power supply is connected between the ARM data processor and the switching power supply, and the power resistor is connected to the switching power supply through the power supply.

[0012] The ARM data processor is also connected to a network communication interface and a fault detection alarm circuit. When the ARM data processor determines that the received current value is an abnormal current, the fault detection alarm circuit activates an audible and visual alarm; when the ARM data processor detects that there is no disturbance to the abnormal current in the control mode of turning on the current output by the power resistor, the audible and visual alarm is activated through the fault detection alarm circuit.

[0013] The power driving circuit, the power resistor, the random number controller and the scrambling code modulation circuit do not work when no abnormal current occurs.

[0014] The power driving circuit adopts the MOS tube NCE60P10K chip, which supports a maximum driving capacity of 60V 10A. A single chip can provide a maximum driving capacity of 600W.

[0015] In a second aspect, the present invention provides an anti-theft method based on current fluctuation, which detects the current fluctuation of the power input terminal of the target information device to prevent theft, and includes the following process: Step 1: Obtain the current characteristic signal of the power input terminal of the target information device through a coupled current clamp, and convert the obtained current characteristic signal into a voltage signal; Step 2: Obtain the current characteristic signal and voltage signal through the current detection circuit, convert the voltage signal into a digital signal through AD conversion, and convert the digital signal into a current value; Step 3: Receive the current characteristic signal and current value obtained by the current detection circuit through the ARM data processor, and judge whether the current on the power line is an abnormal current according to the received current value. If so, control the random number controller to generate a random number sequence signal, and control the scrambling code modulation circuit to modulate the current characteristic signal and the random number sequence signal to generate a scrambling code signal; Step 4: The power driving circuit provides driving voltage and current to the power resistor according to the scrambling signal, controls the on and off of the current output of the power resistor, and consumes the current on the power line in the control mode of turning on the current output, thereby disturbing the current on the power line.

[0016] The advantages of adopting the present invention are: 1. The present invention can be directly, simply and conveniently connected between the target information device and the external input power supply, and when abnormal current is detected on the power line, it can modulate and generate a scrambling signal that combines the abnormal current characteristic signal with a random number sequence signal, and then cleverly control the power resistor to generate interference current on the power line through the scrambling signal, thereby disrupting the current signal that the attacker needs to obtain, making it impossible for the attacker to read useful information, thereby achieving the purpose of effectively protecting against technical theft using the power line as a covert communication channel and attacking the target information device.

[0017] 2. The present invention adopts intelligent design. When abnormal current is detected on the power line, current interference is started. When there is no abnormality on the power line, the current interference circuit does not work, thereby reducing energy consumption. The whole process does not require human intervention and has high reliability.

[0018] 3. The present invention cleverly uses the energy consumption of the power resistor to generate interference current on the power line, disrupting the current of the attacker, so that the attacker cannot read useful information. The device has low cost and small size, which is convenient for promotion and application.

[0019] 4. The device of the present invention is plug-and-play, easy to use and does not require special training.

[0020] 5. The present invention has a wide range of applications and can be widely used in the protection of power line current fluctuations of all information processing equipment using alternating current against theft.

[0021] 6. The present invention adopts an integrated aluminum alloy shell, which has the advantages of stable overall structure and good heat dissipation effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a principle block diagram of the present invention; Figure 2 It is a schematic diagram of the explosion structure of the present invention; Figure 3 It is a schematic diagram of the planar structure of the present invention; Figure 4 This is a signal diagram when abnormal current is detected on the power line; Figure 5 is a current signal diagram after the current on the power line is disturbed; Figure 6 It is a graph showing the change in CPU usage of the target information device; Figure 7 is a current variation signal diagram detected on the power line; Figure 8 This is a current change signal diagram obtained by detecting on the power line after controlling the change in CPU usage.

[0023] The markings in the figure are: 1. Upper cover, 2. Heat dissipation base, 3. Air inlet side panel, 4. Interface side panel, 5. Air outlet front side panel, 6. Air outlet rear side panel, 7. Cooling fan, 8. PCB board, 9. Power input terminal, 10. Power output terminal, 11. Power cord, 12. Coupled current clamp, 13. Current detection circuit, 14. ARM data processor, 15. Power module, 16. Random number controller, 17. Scrambling code modulation circuit, 18. Power resistor, 19. Power supply, 20. Power switch, 21. Network communication interface, 22. Alarm indicator light, 23. Fault indicator light, 24. Operation indicator light. DETAILED DESCRIPTION

[0024] like Figure 1-3 As shown, the present invention provides an anti-theft device based on current fluctuation, which is connected between the target information device and the external input power supply, and specifically includes: The power input terminal 9 may be a 220V power plug for connecting an external input power source.

[0025] The power output terminal 10 may be a 220V power socket for connecting the protected target information device. For example, the plug of the protected target device may be plugged into the power output terminal 10 .

[0026] The power line 11 , including a live line, a neutral line and a ground line, is connected between the power input terminal 9 and the power output terminal 10 .

[0027] The coupled current clamp 12 is clamped and fixed on the power line 11, and is used to embed the current characteristic signal on the power line 11 into the coil of the sensor of the coupled current clamp 12 itself through inductive coupling of the magnetic field, and convert the current characteristic signal into a voltage signal.

[0028] The current detection circuit 13 is connected to the coupled current clamp 12, and is used to receive the current characteristic signal and voltage signal obtained by the coupled current clamp 12, and is used to convert the voltage signal into a digital signal through AD conversion, and convert the digital signal into a current value. The current detection circuit 13 preferably uses a high-performance, low-power single-phase energy metering SoC chip, and the integrated analog front end and energy metering module can provide a single-chip solution for a single-phase multi-function energy meter. The current detection circuit 13 can detect the current change in the circuit in real time through the coupled current clamp 12, and can detect the current range of 0-100A, which is conducive to meeting the target information equipment with different power requirements.

[0029] The ARM data processor 14 is connected to the power line 11 through the power module 15, and is respectively connected to the current detection circuit 13, the random number controller 16 and the scrambling code modulation circuit 17. The random number controller 16 is controlled by the ARM data processor 14 to generate a random number sequence signal for debugging the interference current consumption. Specifically, the ARM data processor 14 is used to receive the current characteristic signal and the current value obtained by the current detection circuit 13, to determine whether the received current value is an abnormal current, to control the random number controller 16 to generate a random number sequence signal when it is determined that the received current value is an abnormal current, and to control the scrambling code modulation circuit 17 to modulate the current characteristic signal and the random number sequence signal and generate a scrambling code signal.

[0030] The power module 15 includes a switching power supply and a digital power supply. The switching power supply is connected between the coupling current clamp 12 and the power output terminal 10, and the digital power supply is connected between the ARM data processor 14 and the switching power supply.

[0031] The power driving circuit is connected to the power resistor 18 and the scrambling code modulation circuit 17 respectively, and is used to provide driving voltage and current for the power resistor 18 according to the scrambling code signal modulated by the scrambling code modulation circuit 17. The power driving circuit adopts the MOS tube NCE60P10K chip, which supports a maximum driving capacity of 60V 10A. A single chip can provide a maximum driving capacity of 600W.

[0032] The power resistor 18 includes a power supply end and a control end. The power supply end is connected to the power module 15 through the power supply 19, specifically connected to the switching power supply through the power supply 19. The control end is connected to the power driving circuit and is used to perform on-off control of the current output according to the scrambling code signal, and consume the current on the power line 11 in the control mode of turning on the current output, thereby disrupting the current on the power line 11 to achieve the purpose of preventing theft.

[0033] It should be noted that the power driving circuit, the power resistor 18, the random number controller 16 and the scrambling code modulation circuit 17 do not work when no abnormal current occurs.

[0034] According to a preferred embodiment of the present invention, the power resistor 18 includes an aluminum alloy radiator and multiple groups of cement resistors, and the multiple groups of cement resistors are evenly fixed on the aluminum alloy radiator. When the ARM data processor 14 starts the current interference, the power resistor 18 generates interference current under the control of the power drive circuit. When the current detection circuit 13 does not detect the abnormal current on the power line 11, the power resistor 18 does not work to reduce energy loss. When the cement resistor is working, the aluminum alloy radiator plays a role in dissipating heat for the cement resistor. In addition, the power resistor 18 controls the output of the current according to the scrambling code signal, and the size of its output current is adjusted and controlled by the ARM data processor 14 according to the actual situation.

[0035] According to another preferred embodiment of the present invention, the anti-theft device also includes a housing made of aluminum alloy, the housing includes an upper cover 1, a heat dissipation base 2, an air inlet side plate 3, an interface side plate 4, an air outlet rear side plate 6 and an air outlet front side plate 5 fixed into one body, a heat dissipation fan 7 is fixed to the air inlet side plate 3 for heat dissipation, and a power switch 20 connected to the power module 15 is fixed on the interface side plate 4. The size of the housing can be 350㎜×240㎜×70㎜, which has the advantages of small size and easy to carry. Of course, in practical applications, the size of the housing can also be adjusted accordingly according to different needs. The power input terminal 9, the power output terminal 10, the power cord 11, the coupled current clamp 12, the current detection circuit 13, the ARM data processor 14, the power module 15, the random number controller 16, the scrambling code modulation circuit 17, the power resistor 18 and the power supply 19 are all fixed in the housing. In addition, a PCB board 8 is fixed in the shell, and an ARM data processor 14, a current detection circuit 13, a power driving circuit, a scrambling code modulation circuit 17, a random number controller 16, a power resistor 18, etc. are all installed on the PCB board 8.

[0036] According to another preferred embodiment of the present invention, the ARM data processor 14 is also connected to a network communication interface 21 and a fault detection alarm circuit fixed on the interface side panel 4, the fault detection alarm circuit includes a fault indicator light 23, an alarm indicator light 22 and an operation indicator light 24 fixed on the interface side panel 4, when the ARM data processor 14 determines that the received current value is an abnormal current, the sound and light alarm is activated through the fault detection alarm circuit, and the operation indicator light 24 is switched to the fault indicator light 23 and the alarm indicator light; when the ARM data processor 14 detects that there is no disturbance to the abnormal current in the control mode in which the power resistor 18 turns on the current output, the sound and light alarm is activated through the fault detection alarm circuit.

[0037] It should be noted that the above-mentioned ARM data processor 14, current detection circuit 13, fault detection alarm circuit, power drive circuit, scrambling code modulation circuit 17, and random number controller 16 can all be implemented using existing conventional technologies and will not be described in detail.

[0038] The present invention also provides an anti-theft method based on current fluctuation, which detects the current fluctuation of the power input terminal of the target information device to prevent theft, and includes the following process: Step 1: Obtain the current characteristic signal of the power input terminal of the target information device through the coupled current clamp 12, convert the obtained current characteristic signal into a voltage signal, and then output the current characteristic signal and the voltage signal.

[0039] Step 2: Receive the current characteristic signal and voltage signal obtained by the coupled current clamp 12 through the current detection circuit 13, convert the voltage signal into a digital signal through AD conversion, convert the digital signal into a current value, and then output the current characteristic signal and current value.

[0040] Step 3: Receive the current characteristic signal and current value obtained by the current detection circuit 13 through the ARM data processor 14, and judge whether the current on the power line 11 is an abnormal current according to the received current value. If so, it means that there is an abnormal current on the power line 11 at this time, and there is a possibility of being attacked, then control the random number controller 16 to generate a random number sequence signal, and control the scrambling code modulation circuit 17 to modulate the current characteristic signal and the random number sequence signal and generate a scrambling code signal. If not, it means that there is no abnormal current on the power line 11 at this time, and the random number controller 16 and the scrambling code modulation circuit 17 do not work. Accordingly, the subsequent power drive circuit and power resistor 18 do not work, so as to reduce energy loss.

[0041] Step 4: The power driving circuit provides driving voltage and current to the power resistor 18 according to the scrambling signal, controls the on and off of the current output of the power resistor 18, and consumes the current on the power line 11 in the control mode of turning on the current output, thereby disrupting the current on the power line 11 to achieve the purpose of preventing theft.

[0042] In addition, the applicant also used a computer to conduct actual testing of the present invention, as shown in the following example: Figure 4 , 5 As shown, Figure 4 The signal diagram when abnormal current appears on the power line 11 of the computer when it is in use is not shown. Figure 5 The disturbed current signal is shown in Figure 1. Figure 5 It can be seen that, since the disturbance can prevent the attacker from reading useful information, the purpose of effectively protecting against technical theft using the power line 11 as a covert communication channel and attacking the target information device is achieved.

[0043] The above description is only a specific implementation mode of the present invention. Any feature disclosed in this specification, unless otherwise stated, can be replaced by other alternative features that are equivalent or have similar purposes; all the disclosed features, or all the steps in the methods or processes, except for mutually exclusive features and / or steps, can be combined in any way.

Claims

1. An anti-theft device based on current fluctuation, the anti-theft device is connected between the target information device and the external input power supply, characterized in that include: A power input terminal (9), used for connecting an external input power source; A power output terminal (10) for connecting to a protected target information device; A power line (11) connected between the power input terminal (9) and the power output terminal (10); A coupled current clamp (12) is clamped and fixed on the power line (11) and is used to embed a current characteristic signal on the power line (11) into a coil of a sensor of the coupled current clamp (12) itself through inductive coupling of a magnetic field, and convert the current characteristic signal into a voltage signal; A current detection circuit (13) is used to receive a current characteristic signal and a voltage signal acquired by the coupled current clamp (12), to convert the voltage signal into a digital signal through AD conversion, and to convert the digital signal into a current value; An ARM data processor (14) is connected to the power line (11) via a power module (15), and is used to receive a current characteristic signal and a current value obtained by a current detection circuit (13), and is used to determine whether the received current value is an abnormal current, and is used to control a random number controller (16) to generate a random number sequence signal when the received current value is determined to be an abnormal current, and is used to control a scrambling code modulation circuit (17) to modulate the current characteristic signal and the random number sequence signal and generate a scrambling code signal; A power driving circuit, connected to the power resistor (18) and the scrambling code modulation circuit (17) respectively, for providing a driving voltage and current to the power resistor (18) according to a scrambling code signal modulated by the scrambling code modulation circuit (17); The power resistor (18) comprises a power supply end and a control end, wherein the power supply end is connected to the power module (15) via a power supply (19), and the control end is connected to a power drive circuit, and is used to perform on-off control of current output according to a scrambling code signal, and consume current on the power line (11) in a control mode in which current output is turned on, thereby disturbing the current on the power line (11).

2. The anti-theft device based on current fluctuation according to claim 1, characterized in that: The anti-theft device also includes a housing made of aluminum alloy, wherein a power input terminal (9), a power output terminal (10), a power line (11), a coupled current clamp (12), a current detection circuit (13), an ARM data processor (14), a power module (15), a random number controller (16), a scrambling code modulation circuit (17), a power resistor (18) and a power supply (19) are all fixed in the housing.

3. The anti-theft device based on current fluctuation according to claim 2, characterized in that: The size of the shell is 350㎜×240㎜×70㎜.

4. The anti-theft device based on current fluctuation according to claim 1, characterized in that: The power resistor (18) comprises an aluminum alloy heat sink and multiple groups of cement resistors, and the multiple groups of cement resistors are evenly fixed on the aluminum alloy heat sink.

5. The anti-theft device based on current fluctuation according to claim 1, characterized in that: The current detection circuit (13) can detect a current in the range of 0-100A.

6. The anti-theft device based on current fluctuation according to claim 1, characterized in that: The power supply module (15) comprises a switching power supply and a digital power supply, the switching power supply is connected between the coupled current clamp (12) and the power output terminal (10), the digital power supply is connected between the ARM data processor (14) and the switching power supply, and the power resistor (18) is connected to the switching power supply via the power supply (19).

7. The anti-theft device based on current fluctuation according to claim 1, characterized in that: The ARM data processor (14) is also connected to a network communication interface (21) and a fault detection alarm circuit. When the ARM data processor (14) determines that the received current value is an abnormal current, an audible and visual alarm is activated through the fault detection alarm circuit. When the ARM data processor (14) detects that no disturbance is caused to the abnormal current in a control mode in which the power resistor (18) turns on the current output, an audible and visual alarm is activated through the fault detection alarm circuit.

8. The anti-theft device based on current fluctuation according to claim 1, characterized in that: The power drive circuit, the power resistor (18), the random number controller (16) and the scrambling code modulation circuit (17) do not operate when no abnormal current occurs.

9. The anti-theft device based on current fluctuation according to claim 1, characterized in that: The power driving circuit adopts the MOS tube NCE60P10K chip, which supports a maximum driving capacity of 60V 10A. A single chip can provide a maximum driving capacity of 600W.

10. A method for preventing theft based on current fluctuation, which detects the current fluctuation at the power input end of the target information device to prevent theft, characterized in that: The process includes: Step 1: obtaining a current characteristic signal at the power input terminal of the target information device through a coupled current clamp (12), and converting the obtained current characteristic signal into a voltage signal; Step 2: obtaining a current characteristic signal and a voltage signal through a current detection circuit (13), converting the voltage signal into a digital signal through AD conversion, and converting the digital signal into a current value; Step 3: receiving the current characteristic signal and current value obtained by the current detection circuit (13) through the ARM data processor (14), and judging whether the current on the power line (11) is an abnormal current according to the received current value; if so, controlling the random number controller (16) to generate a random number sequence signal, and controlling the scrambling code modulation circuit (17) to modulate the current characteristic signal and the random number sequence signal and generate a scrambling code signal; Step 4: The power driving circuit provides a driving voltage and current to the power resistor (18) according to the scrambling signal, performs on-off control of the current output of the power resistor (18), and consumes the current on the power line (11) in the control mode of turning on the current output, thereby disturbing the current on the power line (11).

Images