Endogenous safety method and system for realizing relay protection

Abstract

The invention discloses an endogenous security method and system for realizing relay protection, and the method comprises the steps: a trusted hardware module in the endogenous security system receives a UBoot bootstrap program sent by an equipment management mainboard in real time and measures the UBoot bootstrap program to obtain a first measurement value, judges whether the first measurement value is consistent with a first preset expected value or not, and if yes, sends the UBoot bootstrap program to the equipment management mainboard; if yes, the equipment management mainboard starts to operate, and if not, an operation stopping signal is sent to the equipment management mainboard; under the condition of detecting that the equipment management mainboard starts to run, executing an active monitoring step, namely obtaining an execution code currently running by the equipment management mainboard through a hook mechanism and measuring to obtain a second measurement value; and judging whether the second metric value is consistent with a second preset expected value or not, if so, skipping to the active monitoring step, and if not, terminating the current running operation. By implementing the method and the device, the intrusion of malicious software and the execution of unauthorized codes can be effectively prevented, so that the security of the monitoring equipment body is ensured.

Description

Technical Field

[0001] The present invention relates to the field of hardware protection, and in particular to an intrinsic safety method and system for realizing relay protection. Background Art

[0002] The intelligent substation monitoring system is carefully designed in terms of network architecture. It consists of three core layers: station control layer, interval layer and process layer, and builds a hierarchical distributed control system. The entire site network is based on high-speed Ethernet technology, which realizes high-speed and efficient data transmission, providing a solid foundation for real-time monitoring and rapid response. Following the guiding principles of the "Overall Plan for Security Protection of Power Monitoring System", the security strategy of this monitoring system focuses on strengthening the boundary protection mechanism of the substation, which not only strengthens the security control of the physical boundary, but also strictly manages the access rights of personnel, and deepens the internal security operating procedures, ensuring the safety and stability of substation operation in multiple dimensions.

[0003] At present, the security protection architecture of substations focuses on adopting a solution based on structural boundary protection. This solution is relatively mature in technology and practice. It protects important assets by isolating the network, making traditional external network penetration attack methods ineffective. State Grid Corporation of China and China Southern Power Grid Corporation are constantly strengthening the network security technical requirements and testing standards for protecting measurement and control equipment, standardizing the secondary system protection architecture in substations, and specifying the security protection technical requirements of various secondary equipment in terms of identity authentication, security auditing, access control, data security, security monitoring, communication security, security reinforcement, source code security, backup and recovery, etc.

[0004] However, at present, these technical means focus more on protecting the business functions and performance of monitoring equipment, while protecting the security of the monitoring equipment itself is relatively weak. The equipment security protection capability is insufficient and overly dependent on external security equipment and systems. Therefore, solving the problem of protecting the security of the monitoring equipment itself has become a problem of concern to everyone. Summary of the invention

[0005] The embodiments of the present invention provide an intrinsic security method and system for implementing relay protection, which can effectively prevent the intrusion of malicious software and the execution of unauthorized code, thereby ensuring the security of the monitoring device itself.

[0006] An embodiment of the present invention provides an intrinsic safety method for implementing relay protection, which is applicable to a trusted hardware module in an intrinsic safety system, including:

[0007] Receive the UBoot boot program sent by the device management motherboard in real time;

[0008] Measuring the UBoot boot program to obtain a first measurement value;

[0009] Determine whether the first metric value is consistent with the first preset expected value, and if so, send a CPU running signal to the device management mainboard so that the device management mainboard starts running after receiving the CPU running signal; if not, send a first blocking running signal to the device management mainboard so that the device management mainboard blocks the device where the device management mainboard is located from starting;

[0010] When it is detected that the device management mainboard starts to run, an active monitoring step is performed; the active monitoring step includes: obtaining the execution code of the device management mainboard when it is currently running through a hook mechanism, and measuring the execution code to obtain a second measurement value;

[0011] Determine whether the second metric value is consistent with the second preset expected value. If so, jump to the active monitoring step. If not, send a termination signal to the device management mainboard to terminate the current operation of the device management mainboard.

[0012] Furthermore, the device management mainboard includes: a CPU and a switching module;

[0013] Sending a CPU running signal to the device management mainboard so that the device management mainboard starts running after receiving the CPU running signal, including:

[0014] Sending a CPU running signal to the device management mainboard, so that the CPU loads the UBoot boot program to measure the kernel and operating system files, and determining whether the third measurement value of the kernel and operating system files is consistent with the third preset expected value, if so, running the kernel and the operating system, if not, preventing the kernel and the operating system from running;

[0015] When it is detected that the kernel and the operating system start to run, a switching signal is sent to the switching module so that the switching module switches the CPU to start the application program protection;

[0016] The startup protection of the application includes: monitoring the application running request, when the application running request is monitored, measuring the executable file of the current application, and determining whether the fourth measurement value of the executable file of the current application is consistent with the fourth preset expected value, if so, running the current application, if not, preventing the current application from running.

[0017] Furthermore, the device management mainboard also includes: device firmware;

[0018] The first preset expected value, the second preset expected value, the third preset expected value and the fourth preset expected value are determined in the following manner:

[0019] Obtain target image files from device firmware; wherein the target image files include: UBoot image files, kernel and operating system image files, and application image files;

[0020] The UBoot image file is measured to obtain a first preset expected value;

[0021] Measuring the kernel and operating system image files to obtain a third preset expected value;

[0022] Measuring the application image file to obtain a fourth preset expected value;

[0023] Get the instruction code corresponding to the current runtime code area from the CPU's memory;

[0024] The instruction code is measured to obtain a second preset expected value.

[0025] Furthermore, the device management mainboard further includes: a first display light and a second display light;

[0026] The inherent safety method of achieving relay protection also includes:

[0027] In the case where it is detected that the CPU prevents the kernel and the operating system from running, a second blocking signal is sent;

[0028] In the case where it is detected that the CPU prevents the current application from running, a third execution prevention signal is issued;

[0029] Real-time monitoring is performed to determine whether there is a first operation blocking signal, a second operation blocking signal, a third operation blocking signal or an operation termination signal. If so, a high-level signal is sent to the first display light to light up the first display light. If not, a high-level signal is sent to the second display light to light up the second display light.

[0030] Furthermore, the inherent safety method of realizing relay protection also includes:

[0031] When the trusted hardware module sends a first operation blocking signal, a second operation blocking signal, a third operation blocking signal or an operation termination signal, recording a current event and a current system state;

[0032] Generate audit logs based on current events and current system status.

[0033] Based on the above method embodiment, the present invention provides a corresponding system embodiment, including: a trusted hardware module and a device management mainboard;

[0034] The device management mainboard is used to send the UBoot boot program to the trusted hardware module;

[0035] The trusted hardware module is used to measure the UBoot boot program after receiving the UBoot boot program to obtain a first measurement value;

[0036] Determine whether the first metric value is consistent with the first preset expected value, and if so, send a CPU operation signal to the device management mainboard; if not, send a first operation prevention signal to the device management mainboard;

[0037] The device management mainboard is further used to start running after receiving a CPU running signal, and to prevent the device where the device management mainboard is located from starting after receiving a first running prevention signal;

[0038] The trusted hardware module is further used to perform an active monitoring step when it is detected that the device management mainboard starts to run; the active monitoring step includes: obtaining the execution code of the device management mainboard when it is currently running through a hook mechanism, and measuring the execution code to obtain a second measurement value;

[0039] Determine whether the second metric value is consistent with the second preset expected value. If so, jump to the active monitoring step. If not, send a termination signal to the device management mainboard to terminate the current operation of the device management mainboard.

[0040] Furthermore, the device management mainboard includes: a CPU and a switching module;

[0041] The CPU is used to load the UBoot boot program to measure the kernel and operating system files after receiving the CPU running signal, and determine whether the third measurement value of the kernel and operating system files is consistent with the third preset expected value, and if so, run the kernel and the operating system, and if not, prevent the kernel and the operating system from running;

[0042] The trusted hardware module is further used to send a switching signal to the switching module when it is detected that the kernel and the operating system start to run;

[0043] The switching module is used to switch the CPU to perform application startup protection after receiving the switching signal; the application startup protection includes: monitoring the application running request, when the application running request is monitored, measuring the executable file of the current application, and determining whether the fourth measurement value of the executable file of the current application is consistent with the fourth preset expected value, if so, running the current application, if not, preventing the current application from running.

[0044] Furthermore, the device management mainboard also includes: device firmware;

[0045] Device firmware, used to store target image files; wherein the target image files include: UBoot image files, kernel and operating system image files, and application image files;

[0046] The CPU is also used to obtain the target image file from the device firmware;

[0047] The UBoot image file is measured to obtain a first preset expected value;

[0048] Measuring the kernel and operating system image files to obtain a third preset expected value;

[0049] Measuring the application image file to obtain a fourth preset expected value;

[0050] Get the instruction code corresponding to the current runtime code area from the CPU's memory;

[0051] The instruction code is measured to obtain a second preset expected value.

[0052] Furthermore, the device management mainboard further includes: a first display light and a second display light;

[0053] The trusted hardware module is further used to send a second blocking operation signal when it is detected that the CPU blocks the kernel and the operating system from running;

[0054] In the case where it is detected that the CPU prevents the current application from running, a third execution prevention signal is issued;

[0055] Real-time monitoring of whether there is a first operation blocking signal, a second operation blocking signal, a third operation blocking signal or an operation termination signal, and if so, a high level signal is sent to the first display light, and if not, a high level signal is sent to the second display light;

[0056] A first display light, used to control the first display light to light up when receiving a high level signal;

[0057] The second display light is used to control the second display light to light up when receiving a high level signal.

[0058] Furthermore, the trusted hardware module is also used to:

[0059] When the first operation blocking signal, the second operation blocking signal, the third operation blocking signal or the operation termination signal is issued, the current event and the current system status are recorded;

[0060] Generate audit logs based on current events and current system status.

[0061] Compared with the prior art, the beneficial effects of the embodiment of this solution are:

[0062] The present invention receives the UBoot boot program sent by the device management mainboard in real time through the trusted hardware module in the endogenous security system, and measures the UBoot boot program to obtain a first measurement value, and judges whether the first measurement value is consistent with the first preset expected value. If they are consistent, a CPU operation signal is sent to the device management mainboard, and the device management mainboard starts to run after receiving the CPU operation signal. If they are inconsistent, a blocking operation signal is sent to the device management mainboard to prevent the device where the device management mainboard is located from starting. In this way, it can be ensured that the device is under the control of the trusted hardware module during the startup phase, and any startup behavior that does not meet expectations will be detected and blocked in time. In the case of detecting that the device management mainboard starts to run, the trusted hardware module can capture and measure the execution code of the current runtime through the built-in hook mechanism, and measure the execution code to obtain a second measurement value, and judge whether the second measurement value is consistent with the second preset expected value. If they are consistent, the execution code of the current operation will continue to be obtained, and the device operation process will be continuously monitored. If they are inconsistent, the current operation operation will be terminated, and once abnormal behavior or unauthorized code execution is found, action can be taken immediately.

[0063] To sum up, the present invention, through the trusted hardware module in the intrinsic security system, can not only perform security checks when the device is started, but also perform continuous monitoring and protection during the operation of the device, which can effectively prevent the intrusion of malicious software and unauthorized code execution, thereby ensuring the security of the monitoring device itself. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 It is a flow chart of a method for realizing an intrinsic safety of relay protection provided by an embodiment of the present invention;

[0065] Figure 2 It is a schematic diagram of the structure of an intrinsic safety system for implementing relay protection provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0067] In the description of the present invention, it should be understood that the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features.

[0068] like Figure 1As shown, an embodiment of the present invention provides an intrinsic safety method for implementing relay protection, which is applicable to a trusted hardware module in an intrinsic safety system. The method includes at least the following steps:

[0069] Step S1: receiving the UBoot boot program sent by the device management mainboard in real time;

[0070] For step S1, before implementing this method, for computing devices (such as workstations (PCs), servers and relay protection devices, etc.), communication network devices (such as switches) or regional boundary devices (such as firewalls) in the relay protection system, it is necessary to add an independent, universal trusted hardware module to the device management mainboard. The introduction of this module is intended to build an intrinsic security system, and its structure is shown in the figure below: Figure 2 As shown, the system exchanges data via non-Ethernet methods, thereby fundamentally avoiding potential network security threats.

[0071] Based on the intrinsic security system including the trusted hardware module, the trusted hardware module receives the UBoot boot program sent by the device management mainboard in real time. Specifically, the Power good interface (PG interface for short) of the device management mainboard is connected to the GPIO2 interface in the trusted hardware module. When the device is ready to start and enter the pre-startup phase, the PG interface of the device management mainboard sends a high-level PG signal to the trusted hardware module. This signal serves as a sign of startup, indicating that the device is about to enter the startup process.

[0072] At the same time, the device management mainboard sends the UBoot boot program to the trusted hardware module through the SPI1 (master) interface. The UBoot boot program is a key link in the device startup process. It is responsible for initializing the system hardware, configuring the necessary startup parameters, and finally loading the operating system kernel. If the device's UBoot boot program is maliciously attacked or tampered with, the tampered UBoot boot program may contain malicious code, which can be executed when the device starts, thereby bypassing the security mechanism of the operating system, stealing sensitive information, destroying system data, or performing other malicious behaviors, posing a serious threat to the overall security of the device.

[0073] Step S2: measuring the UBoot boot program to obtain a first measurement value;

[0074] For step S2, the trusted hardware module measures the UBoot boot program. Specifically, the SM3 algorithm is used to calculate the binary file of the UBoot boot program, and the binary data is hashed to obtain a 256-bit integrity summary value. Next, the integrity summary value is signed by the private key using the SM2 signature operation to obtain the signature result. Finally, the integrity summary value and the signature result are stored or transmitted as the first measurement value.

[0075] It should be noted that SM3 is a cryptographic hash algorithm released by the China National Cryptography Administration in 2010. It can convert messages of any length into a fixed-length (256-bit) summary value, which has high security and irreversibility. SM2 is an asymmetric encryption algorithm independently designed by China, which is based on the elliptic curve cryptography (ECC). It generates a pair of keys (private key and public key) to achieve data encryption and decryption, as well as digital signature and signature verification.

[0076] Step S3: determining whether the first metric value is consistent with the first preset expected value; if so, sending a CPU running signal to the device management mainboard so that the device management mainboard starts running after receiving the CPU running signal; if not, sending a first blocking running signal to the device management mainboard so that the device management mainboard blocks the device where the device management mainboard is located from starting;

[0077] In a preferred embodiment, the device management mainboard includes: a CPU and a switching module;

[0078] Sending a CPU running signal to the device management mainboard so that the device management mainboard starts running after receiving the CPU running signal, including:

[0079] Sending a CPU running signal to the device management mainboard, so that the CPU loads the UBoot boot program to measure the kernel and operating system files, and determining whether the third measurement value of the kernel and operating system files is consistent with the third preset expected value, if so, running the kernel and the operating system, if not, preventing the kernel and the operating system from running;

[0080] When it is detected that the kernel and the operating system start to run, a switching signal is sent to the switching module so that the switching module switches the CPU to start the application program protection;

[0081] The startup protection of the application includes: monitoring the application running request, when the application running request is monitored, measuring the executable file of the current application, and determining whether the fourth measurement value of the executable file of the current application is consistent with the fourth preset expected value, if so, running the current application, if not, preventing the current application from running.

[0082] In a preferred embodiment, the device management mainboard further includes: device firmware.

[0083] Regarding step S3, the trusted hardware module of the present invention performs the following operations during the startup and operation of the device, ensuring the security of the entire chain from the beginning of startup to the execution of the application:

[0084] First, the CPU is started and verified to ensure that the device is in a safe state from the beginning of startup, effectively preventing the injection and execution of malicious code. Specifically, the first measurement value obtained in step S2 is compared with the first preset expected value. If the two are consistent, it means that the UBoot boot program has not been tampered with. The trusted hardware module sends a CPU operation signal to the device management motherboard to allow the CPU to continue to perform subsequent operations. If the first measurement value is inconsistent with the first preset expected value, it means that the UBoot boot program may have been tampered with. The trusted hardware module sends a first blocking operation signal to the device management motherboard to prevent the CPU from starting.

[0085] The first preset expected value is determined in the following manner:

[0086] A U-Boot boot program image file is obtained from the device firmware, a hash algorithm (such as SM3) is used to measure the U-Boot boot program image file, and its integrity summary value is calculated to obtain a first preset expected value.

[0087] It should be noted that the device firmware is software embedded in the hardware, which contains various programs and data required for the startup, operation and management of the device. In this embodiment, three types of key image files are stored in the device firmware: UBoot image files, kernel and operating system image files, and application image files. These image files have been burned into the device when it is manufactured to ensure that the device has the basic programs and data required for startup, operation and management when it leaves the factory. Therefore, this embodiment uses these image files as the standard for the device to be invaded or tampered.

[0088] Secondly, when the device management mainboard receives the CPU running signal, the UBoot boot program is loaded through the CPU of the device management mainboard to perform startup verification on the kernel and operating system. Specifically, the kernel and operating system files are measured, and the integrity summary value of the kernel and operating system files is calculated using a similar hash algorithm (such as SM3) to obtain a third measurement value. Then, the device management mainboard compares the third measurement value with the third preset expected value. If the two are consistent, it means that the kernel and operating system files have not been tampered with, and the CPU is allowed to continue running the kernel and operating system. If the third measurement value is inconsistent with the third preset expected value, it means that the kernel and operating system files may have been tampered with, and the CPU prevents the kernel and operating system from running and issues a warning.

[0089] The third preset expected value is determined in the following manner:

[0090] The kernel and operating system image files are obtained from the device firmware, and the kernel and operating system image files are measured using a hash algorithm (such as SM3), and their integrity summary values ​​are calculated to obtain a third preset expected value.

[0091] Next, after the CPU loads the kernel and the operating system, the device can enter the operating system interface normally, and then, the application to be run is started and verified. Specifically, the trusted hardware module sends a switching signal to the SPI1 interface of the switching module through the SPI1 (master) interface, and switches the CPU to perform application startup protection. Specifically, the CPU will continuously monitor the application running request. When the application running request is detected, the CPU measures the executable file of the current application. This measurement process usually uses a hash algorithm to calculate the integrity summary value of the file, that is, the fourth measurement value. The fourth measurement value is compared with the fourth preset expected value. If the two are consistent, it means that the current application executable file has not been tampered with, and the CPU allows the current application to run. If the fourth measurement value is inconsistent with the fourth preset expected value, it means that the current application executable file may have been tampered with or damaged, and the CPU prevents the current application from running and issues a warning.

[0092] The fourth preset expected value is determined in the following manner:

[0093] The application image file to be run is obtained from the device firmware, a hash algorithm (such as SM3) is used to measure the application image file, and its integrity summary value is calculated to obtain a fourth preset expected value.

[0094] Through the embedded trusted hardware module, the management motherboard serves as the business computing component to build a dual-system architecture suitable for protecting and controlling embedded devices, realizing the startup verification of the CPU, the kernel and the operating system, and the startup verification of the application, thus forming a complete and strict security startup process.

[0095] Step S4: when it is detected that the device management mainboard starts to run, an active monitoring step is performed; the active monitoring step includes: obtaining the execution code of the device management mainboard when it is currently running through a hook mechanism, and measuring the execution code to obtain a second measurement value;

[0096] For step S4, when it is detected that the device management mainboard starts running, more specifically, after the application passes the startup authentication of the trusted hardware module, that is, after the application starts running normally, the trusted hardware module sends the .ko file, which can be dynamically loaded into the kernel and the operating system as an operating system kernel extension module to support the following active protection operations:

[0097] Through the hook mechanism, the system can intercept the current running operations of the current application on the device management motherboard in real time. Whenever an execution code is triggered, the hook mechanism will immediately intervene to capture and temporarily store the execution code. Then, the system uses a hash algorithm to measure the captured execution code to obtain a second measurement value.

[0098] Step S5: Determine whether the second measurement value is consistent with the second preset expected value. If so, jump to the active monitoring step. If not, send a termination signal to the device management mainboard to terminate the current operation.

[0099] For step S5, after the second measurement value is obtained in step S4, the second measurement value is compared with the reliable second preset expected value, which can quickly and accurately determine whether the currently running application has been tampered with or replaced. If the two are consistent, it means that the current execution operation is correct and reliable, and it can continue to run and monitor; if the second measurement value is inconsistent with the second preset expected value, it means that the current execution operation may have been invaded, tampered with or other forms of malicious interference, and the device management mainboard terminates the current operation and issues a warning.

[0100] The second preset expected value is determined in the following manner:

[0101] First, the instruction code corresponding to the code area at the current runtime is obtained from the CPU's memory. It should be noted that when the application is loaded onto the device, it is stored in the memory ROM. The code area is the memory area that stores the fixed execution code in the program. Next, the instruction code is measured using a hash algorithm to obtain a second preset expected value. Since the instruction code in the code area will not be changed during operation, this second preset expected value can be used as a benchmark value to verify whether the instruction code has been tampered with or replaced.

[0102] In summary, the present invention performs comprehensive startup verification on the CPU, kernel, operating system, and the application to be run through a trusted hardware module. Before the CPU, kernel, operating system, and application are started, their integrity and credibility are verified. Any tampering with the CPU, kernel, operating system, or application will cause its hash value or signature to not match the expected value, which can effectively prevent malware from being loaded and executed during the system or device startup process, thereby triggering a security alarm and preventing the system from further starting. In addition, the present invention also has the ability to perform dynamic verification when the application is running, and obtains the execution code in real time through a hook mechanism and verifies it, ensuring that any execution operation of the application during operation is authorized, thereby further enhancing the security of the system.

[0103] In a preferred embodiment, the device management mainboard further includes: a first display light and a second display light;

[0104] The inherent safety method of achieving relay protection also includes:

[0105] In the case where it is detected that the CPU prevents the kernel and the operating system from running, a second blocking signal is sent;

[0106] In the case where it is detected that the CPU prevents the current application from running, a third execution prevention signal is issued;

[0107] Real-time monitoring is performed to determine whether there is a first operation blocking signal, a second operation blocking signal, a third operation blocking signal or an operation termination signal. If so, a high-level signal is sent to the first display light to light up the first display light. If not, a high-level signal is sent to the second display light to light up the second display light.

[0108] In one embodiment of the present invention, the trusted hardware module can also monitor the running status of the CPU, kernel, operating system and application program. When it is detected that the CPU blocks the kernel and operating system from running, that is, when the CPU issues a warning, the trusted hardware module issues a second blocking operation signal. Similarly, when it is detected that the CPU blocks the current application program from running, a third blocking operation signal is issued. Then, it is monitored in real time whether there is a first blocking operation signal, a second blocking operation signal, a third blocking operation signal or a termination operation signal. If the system detects any of the above signals, a high-level signal is sent to the first display light to light up the first display light, wherein the first display light in this embodiment corresponds to Figure 2 The LED in the LED-red usually indicates that the system is in an abnormal or warning state and requires the attention of the administrator or user. If the system does not detect any of the above signals, a high level signal is sent to the second display light to make the second display light light up, wherein the first display light corresponds to Figure 2 The LED in the green light indicates that the system is currently in normal operation.

[0109] The first display light and the second display light are visual indicators of the system status, and provide information about the current status of the system to the user or administrator by lighting up or going out.

[0110] In a preferred embodiment, the method for realizing the intrinsic safety of relay protection further includes:

[0111] When the trusted hardware module sends a first operation blocking signal, a second operation blocking signal, a third operation blocking signal or an operation termination signal, recording a current event and a current system state;

[0112] Generate audit logs based on current events and current system status.

[0113] In one embodiment of the present invention, when the trusted hardware module sends a first blocking operation signal, a second blocking operation signal, a third blocking operation signal or a termination operation signal, it indicates that different types of exceptions or errors have occurred in the device, wherein the first blocking operation signal indicates that an exception occurs in the CPU during startup, and the CPU may be tampered with, the second blocking operation signal indicates that an exception occurs in the kernel and the operating system during startup, and the kernel and the operating system may be tampered with, the third blocking operation signal indicates that an exception occurs in the application during startup, and the application may be tampered with, and the termination operation signal indicates that an exception occurs during the operation of the application, and the application is invaded during the operation.

[0114] When the trusted hardware module sends any of the above signals, the system will immediately record the current event, which may include the type of event, the time of occurrence, the components or applications involved, etc. At the same time, the system will also record the current system status, which may include the operating status of each component, memory usage, network connection status, security settings, etc.

[0115] Based on the recorded events and system status, the system will generate a detailed audit log, which may contain a detailed description of the event, a timestamp of the occurrence, a snapshot of the system status, possible cause analysis, and recommended solutions. By reviewing the log, administrators or security experts can understand the cause of the system anomaly and take appropriate measures to solve the problem or prevent similar incidents from happening again.

[0116] like Figure 2 As shown, based on the above method embodiment, a corresponding system embodiment is provided;

[0117] An embodiment of the present invention provides an intrinsic safety system for implementing relay protection, including: a trusted hardware module and a device management mainboard;

[0118] The device management mainboard is used to send the UBoot boot program to the trusted hardware module;

[0119] The trusted hardware module is used to measure the UBoot boot program after receiving the UBoot boot program to obtain a first measurement value;

[0120] Determine whether the first metric value is consistent with the first preset expected value, and if so, send a CPU operation signal to the device management mainboard; if not, send a first operation prevention signal to the device management mainboard;

[0121] The device management mainboard is further used to start running after receiving a CPU running signal, and to prevent the device where the device management mainboard is located from starting after receiving a first running prevention signal;

[0122] The trusted hardware module is further used to perform an active monitoring step when it is detected that the device management mainboard starts to run; the active monitoring step includes: obtaining the execution code of the device management mainboard when it is currently running through a hook mechanism, and measuring the execution code to obtain a second measurement value;

[0123] Determine whether the second metric value is consistent with the second preset expected value. If so, jump to the active monitoring step. If not, send a termination signal to the device management mainboard to terminate the current operation of the device management mainboard.

[0124] In a preferred embodiment, the device management mainboard includes: a CPU and a switching module;

[0125] The CPU is used to load the UBoot boot program to measure the kernel and operating system files after receiving the CPU running signal, and determine whether the third measurement value of the kernel and operating system files is consistent with the third preset expected value, and if so, run the kernel and the operating system, and if not, prevent the kernel and the operating system from running;

[0126] The trusted hardware module is further used to send a switching signal to the switching module when it is detected that the kernel and the operating system start to run;

[0127] The switching module is used to switch the CPU to perform application startup protection after receiving the switching signal; the application startup protection includes: monitoring the application running request, when the application running request is monitored, measuring the executable file of the current application, and determining whether the fourth measurement value of the executable file of the current application is consistent with the fourth preset expected value, if so, running the current application, if not, preventing the current application from running.

[0128] In a preferred embodiment, the device management mainboard further includes: device firmware;

[0129] Device firmware, used to store target image files; wherein the target image files include: UBoot image files, kernel and operating system image files, and application image files;

[0130] The CPU is also used to obtain the target image file from the device firmware;

[0131] The UBoot image file is measured to obtain a first preset expected value;

[0132] Measuring the kernel and operating system image files to obtain a third preset expected value;

[0133] Measuring the application image file to obtain a fourth preset expected value;

[0134] Get the instruction code corresponding to the current runtime code area from the CPU's memory;

[0135] The instruction code is measured to obtain a second preset expected value.

[0136] In a preferred embodiment, the device management mainboard further includes: a first display light and a second display light;

[0137] The trusted hardware module is further used to send a second blocking operation signal when it is detected that the CPU blocks the kernel and the operating system from running;

[0138] In the case where it is detected that the CPU prevents the current application from running, a third execution prevention signal is issued;

[0139] Real-time monitoring of whether there is a first operation blocking signal, a second operation blocking signal, a third operation blocking signal or an operation termination signal, and if so, a high level signal is sent to the first display light, and if not, a high level signal is sent to the second display light;

[0140] A first display light, used to control the first display light to light up when receiving a high level signal;

[0141] The second display light is used to control the second display light to light up when receiving a high level signal.

[0142] In a preferred embodiment, the trusted hardware module is further used for:

[0143] When the first operation blocking signal, the second operation blocking signal, the third operation blocking signal or the operation termination signal is issued, the current event and the current system status are recorded;

[0144] Generate audit logs based on current events and current system status.

[0145] It can be understood that the above-mentioned system item embodiments correspond to the method item embodiments of the present invention, which can implement the intrinsic safety method for realizing relay protection provided by any one of the above-mentioned method item embodiments of the present invention.

[0146] It should be noted that the system embodiments described above are merely illustrative, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the system embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement the present invention without creative work.

[0147] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for realizing intrinsic safety of relay protection, applicable to a trusted hardware module in an intrinsic safety system, characterized in that: include: Receive the UBoot boot program sent by the device management motherboard in real time; Measuring the UBoot boot program to obtain a first measurement value; Determine whether the first metric value is consistent with the first preset expected value, and if so, send a CPU running signal to the device management mainboard so that the device management mainboard starts running after receiving the CPU running signal; if not, send a first blocking running signal to the device management mainboard so that the device management mainboard blocks the device where the device management mainboard is located from starting; When the device management mainboard is detected to start running, active monitoring steps are performed; The active monitoring step includes: obtaining the execution code of the device management mainboard when it is currently running through a hook mechanism, and measuring the execution code to obtain a second measurement value; Determine whether the second metric value is consistent with the second preset expected value. If so, jump to the active monitoring step. If not, send a termination signal to the device management mainboard to terminate the current operation of the device management mainboard.

2. The method for realizing the intrinsic safety of relay protection according to claim 1, characterized in that: The device management mainboard includes: a CPU and a switching module; The sending of the CPU operation signal to the device management mainboard so that the device management mainboard starts to operate after receiving the CPU operation signal includes: Sending a CPU running signal to the device management mainboard, so that the CPU loads the UBoot boot program to measure the kernel and operating system files, and determines whether the third measurement value of the kernel and operating system files is consistent with the third preset expected value, if so, running the kernel and the operating system, if not, preventing the kernel and the operating system from running; When it is detected that the kernel and the operating system start to run, a switching signal is sent to the switching module so that the switching module switches the CPU to perform startup protection of the application program; The startup protection of the application includes: monitoring the application running request, when the application running request is monitored, measuring the executable file of the current application, and determining whether the fourth measurement value of the executable file of the current application is consistent with the fourth preset expected value, if so, running the current application, if not, preventing the current application from running.

3. The method for realizing the intrinsic safety of relay protection according to claim 2, characterized in that: The device management mainboard further includes: device firmware; The first preset expected value, the second preset expected value, the third preset expected value, and the fourth preset expected value are determined in the following manner: Obtain a target image file from the device firmware; wherein the target image file includes: a UBoot image file, a kernel and operating system image file, and an application image file; Measuring the UBoot image file to obtain a first preset expected value; Measuring the kernel and operating system image files to obtain a third preset expected value; Measuring the application image file to obtain a fourth preset expected value; Get the instruction code corresponding to the current runtime code area from the CPU's memory; The instruction code is measured to obtain a second preset expected value.

4. The method for realizing the intrinsic safety of relay protection according to claim 3, characterized in that: The device management mainboard further includes: a first display light and a second display light; The method for realizing the intrinsic safety of relay protection further includes: In the case where it is detected that the CPU prevents the kernel and the operating system from running, a second blocking signal is sent; In the case where it is detected that the CPU prevents the current application from running, a third execution prevention signal is issued; Real-time monitoring is performed to determine whether there is a first operation blocking signal, a second operation blocking signal, a third operation blocking signal or an operation termination signal. If so, a high-level signal is sent to the first display light to light up the first display light. If not, a high-level signal is sent to the second display light to light up the second display light.

5. The method for realizing the intrinsic safety of relay protection according to claim 4, characterized in that: Also includes: When the trusted hardware module sends a first operation blocking signal, a second operation blocking signal, a third operation blocking signal or an operation termination signal, recording a current event and a current system state; An audit log is generated based on the current event and the current system status.

6. An intrinsic safety system for implementing relay protection, characterized in that: include: Trusted hardware module and device management mainboard; The device management mainboard is used to send a UBoot boot program to the trusted hardware module; The trusted hardware module is used to measure the UBoot boot program after receiving the UBoot boot program to obtain a first measurement value; Determine whether the first metric value is consistent with the first preset expected value, and if so, send a CPU operation signal to the device management mainboard; if not, send a first operation prevention signal to the device management mainboard; The device management mainboard is further configured to start running after receiving a CPU running signal, and to prevent the device where the device management mainboard is located from starting after receiving a first running prevention signal; The trusted hardware module is further used to perform active monitoring steps when it is detected that the device management mainboard starts to run; The active monitoring step includes: obtaining the execution code of the device management mainboard when it is currently running through a hook mechanism, and measuring the execution code to obtain a second measurement value; Determine whether the second metric value is consistent with the second preset expected value. If so, jump to the active monitoring step. If not, send a termination signal to the device management mainboard to terminate the current operation of the device management mainboard.

7. The intrinsic safety system for implementing relay protection according to claim 6, characterized in that: The device management mainboard includes: a CPU and a switching module; The CPU is used to load the UBoot boot program to measure the kernel and operating system files after receiving the CPU running signal, and determine whether the third measurement value of the kernel and operating system files is consistent with the third preset expected value, and if so, run the kernel and the operating system, and if not, prevent the kernel and the operating system from running; The trusted hardware module is further configured to send a switching signal to the switching module when detecting that the kernel and the operating system start to run; The switching module is used to switch the CPU to perform application startup protection after receiving the switching signal; the application startup protection includes: monitoring the application running request, when the application running request is monitored, measuring the executable file of the current application, and determining whether the fourth measurement value of the executable file of the current application is consistent with the fourth preset expected value, if so, running the current application, if not, preventing the current application from running.

8. The intrinsic safety system for implementing relay protection according to claim 7, characterized in that: The device management mainboard further includes: device firmware; The device firmware is used to store target image files; wherein the target image files include: UBoot image files, kernel and operating system image files, and application image files; The CPU is also used to obtain a target image file from the device firmware; Measuring the UBoot image file to obtain a first preset expected value; Measuring the kernel and operating system image files to obtain a third preset expected value; Measuring the application image file to obtain a fourth preset expected value; Get the instruction code corresponding to the current runtime code area from the CPU's memory; The instruction code is measured to obtain a second preset expected value.

9. The intrinsic safety system for implementing relay protection according to claim 8, characterized in that: The device management mainboard further includes: a first display light and a second display light; The trusted hardware module is further configured to send a second blocking operation signal when detecting that the CPU blocks the kernel and the operating system from running; In the case where it is detected that the CPU prevents the current application from running, a third execution prevention signal is issued; Real-time monitoring of whether there is a first operation blocking signal, a second operation blocking signal, a third operation blocking signal or an operation termination signal, and if so, a high level signal is sent to the first display light, and if not, a high level signal is sent to the second display light; The first display light is used to control the first display light to light up when receiving a high level signal; The second display light is used to control the second display light to light up when receiving a high level signal.

10. The intrinsic safety system for implementing relay protection according to claim 9, characterized in that: The trusted hardware module is further used for: When the first operation blocking signal, the second operation blocking signal, the third operation blocking signal or the operation termination signal is issued, the current event and the current system status are recorded; An audit log is generated based on the current event and the current system status.

Images