Trusted starting method for industrial embedded gateway

Abstract

The invention relates to a trusted startup method for an industrial embedded gateway, belongs to the technical field of industrial embedded gateways, and solves the problems that a trusted startup security mechanism in the prior art is complex in operation, inflexible and high in cost. Comprising the following steps: electrifying an industrial embedded gateway, initializing the gateway, and detecting a commercial encryption module; if the commercial encryption module is detected, initializing the commercial encryption module; the method comprises the following steps: reading operation mirror image data of industrial embedded gateway equipment, loading a commercial encryption module to carry out integrity protection calculation on the read operation mirror image data to obtain an integrity check value, and further carrying out credible startup of the industrial embedded gateway according to the integrity check value.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial embedded gateways, and in particular to a trusted startup method for industrial embedded gateways. Background Art

[0002] In industrial control systems, ensuring the safe operation of the system is an important task. Traditional industrial control systems work in a closed network environment, facing very low security threats from the public Internet. Industrial controllers do not have the risk of their own running images being damaged or tampered with, so most industrial controllers do not deploy corresponding security protection mechanisms.

[0003] With the development of the industrial Internet, industrial control systems are now gradually deepening their information interaction with the public Internet, making industrial controllers that do not have traditional security features face various security threats from the Internet. For example, industrial controllers may be upgraded to an unsafe system state by remote attackers through online flashing (OTA), or the industrial controller's own running image software may be tampered with by remote attackers through the implantation of malicious programs. Similar security threats pose serious security risks to users of industrial control systems.

[0004] The current running image integrity verification includes using the method of measuring the integrity of the virtual machine image file to provide a trusted boot security mechanism. On the one hand, this method requires the additional development of an independent virtual machine kernel, and the required computing resources and costs are high. At the same time, a large number of industrial control system equipment currently do not support complex virtual machine functions due to computing resource and cost constraints, which makes this solution have certain limitations; on the other hand, the complexity of the virtual machine itself means that the use of the virtual machine mechanism itself will also bring certain virtual machine-related security risks to industrial control equipment, requiring additional security policies and monitoring mechanisms, which may further increase the management complexity of industrial control equipment.

[0005] Therefore, there is an urgent need for a simple, flexible, and low-cost trusted startup security mechanism for industrial control equipment to reduce some of the security threats faced by industrial control systems from the public Internet and enhance the security protection capabilities of the entire industrial control system. Summary of the invention

[0006] In view of the above analysis, an embodiment of the present invention aims to provide a trusted boot method for an industrial embedded gateway, so as to solve the problems of the existing trusted boot security mechanism being complex, inflexible and costly in operation.

[0007] An embodiment of the present invention provides a trusted startup method for an industrial embedded gateway, comprising the following steps:

[0008] Power on the industrial embedded gateway, initialize the gateway, and test the commercial encryption module;

[0009] If a commercial encryption module is detected, the commercial encryption module is initialized;

[0010] The running image data of the industrial embedded gateway device is read, and a commercial encryption module is loaded to perform integrity protection calculation on the read running image data to obtain an integrity check value, and then the trusted startup of the industrial embedded gateway is performed according to the integrity check value.

[0011] Furthermore, the commercial encryption module includes a commercial encryption algorithm and an application interface; the commercial encryption module initialization includes application interface initialization, specifically:

[0012] Initialize the basic information settings of the commercial encryption module, and configure the read function and write function of the commercial encryption module; wherein the basic information includes the clock, register and power supply of the commercial encryption module; the read function is used to read data of a set length at a storage location specified by the commercial encryption module and save it to a cache area; the write function is used to write data of a set length in the cache area to a storage location specified by the commercial encryption module.

[0013] Furthermore, the operation image data of the industrial embedded gateway device is read as follows:

[0014] Based on the read function, gateway image files of set length are read from the non-volatile memory of the industrial embedded gateway in sequence, and saved in the cache area of ​​the industrial embedded gateway.

[0015] Furthermore, the commercial encryption module performs integrity protection calculation on the read running image data, including:

[0016] If the amount of running image data read is less than the set threshold, a single set of data password hashing is used based on a commercial encryption algorithm to obtain an integrity check value;

[0017] Otherwise, multiple groups of password hashes are used to obtain the integrity check value based on a commercial encryption algorithm.

[0018] Further, the integrity check value obtained by hashing a single set of data based on a commercial encryption algorithm includes:

[0019] Obtaining running image data parameters; wherein the parameters include the first address and data length of the running image data.

[0020] The running image data parameters are passed into the commercial encryption module through the application interface;

[0021] The hash function of the commercial encryption module is called to calculate the hash value of the running image data, and the hash value is used as the integrity check value of the running image data.

[0022] Furthermore, the integrity check value is obtained by using multiple groups of password hashes based on the commercial encryption algorithm, including:

[0023] Divide the running image data into multiple data blocks;

[0024] Process each data block in turn, including:

[0025] Determine the parameters of the current data block, and transfer the parameters of the current data block to the commercial encryption module through the application interface; wherein the parameters include the first address and data length of the current data block;

[0026] Call the iterative operation function of the commercial encryption module to calculate the hash value of the current data block;

[0027] The hash values ​​of each data block are concatenated to obtain the integrity check value of the running image data.

[0028] Further, the trusted startup of the industrial embedded gateway is performed according to the integrity check value, including:

[0029] If the integrity check value is consistent with the integrity measurement value pre-stored in the commercial encryption module, the running image of the industrial embedded gateway is started;

[0030] Otherwise, the running image of the industrial embedded gateway will not be started.

[0031] Furthermore, the length of the gateway image file read each time is set to 1K bytes.

[0032] Furthermore, the commercial encryption module is tested in the following ways:

[0033] Obtain a commercial encryption module from the device list of the industrial embedded gateway, and then connect to the obtained commercial encryption module through the device name of the commercial encryption module;

[0034] If the connection with the commercial encryption module is successful, the commercial encryption module is detected.

[0035] Furthermore, if the commercial encryption module is not detected, detection is continued based on set conditions until the commercial encryption module is detected.

[0036] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0037] The present invention provides a trusted startup method for an industrial embedded gateway. The industrial embedded gateway is powered on to initialize the gateway and detect a commercial encryption module. If a commercial encryption module is detected, the commercial encryption module is initialized, and then the running image data of the industrial embedded gateway device is read, and the commercial encryption module is loaded to perform integrity protection calculation on the read running image data to obtain an integrity check value, and then the trusted startup of the industrial embedded gateway is performed according to the integrity check value, thereby providing a better security and trusted startup mechanism, solving the problems of complex operation, inflexibility and high cost, and achieving a better balance between security, cost and flexibility. When the gateway is started, it must pass the integrity check of the gateway's own running image in advance before it can work, thereby ensuring that the operating environment of the industrial embedded gateway itself is controllable, reducing some security threats from the public Internet faced by the industrial control system, and improving the security protection capability of the entire industrial control system; in addition, the method is not limited by the type of industrial control protocol and the operating system of the industrial control equipment itself, and has stronger universality.

[0038] In the present invention, the above-mentioned technical solutions can also be combined with each other to achieve more preferred combination solutions. Other features and advantages of the present invention will be described in the subsequent description, and some advantages can become obvious from the description, or can be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained through the contents particularly pointed out in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The drawings are only for the purpose of illustrating particular embodiments and are not to be considered limiting of the present invention. Like reference symbols denote like components throughout the drawings.

[0040] Figure 1 A flow chart of a trusted startup method for an industrial embedded gateway provided by an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of a specific flow chart of a trusted startup method for an industrial embedded gateway provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0043] A specific embodiment of the present invention discloses a trusted startup method for an industrial embedded gateway, such as Figure 1 and Figure 2 As shown, the following steps are included:

[0044] S1. Power on the industrial embedded gateway, initialize the gateway, and test the commercial encryption module.

[0045] Specifically, after the industrial embedded gateway is powered on, the startup code of the industrial embedded gateway runs to initialize the gateway hardware resources in preparation for the subsequent loading of the gateway running image.

[0046] Exemplarily, the gateway running image includes an upper-layer Linux operating system.

[0047] It should be noted that in industrial control systems, the Modbus protocol is the most widely deployed type of industrial control protocol. According to statistics, the Modbus protocol accounts for as much as 39% of the industrial control protocol deployment. It supports mainstream industrial PLC equipment and other devices to remotely obtain the operating data of PLC equipment and other devices through this protocol, and can also provide a relatively complete remote maintenance function for equipment. The Modbus protocol can also be subdivided into different sub-type protocols such as Modbus TCP. Therefore, in this embodiment, the industrial embedded ModbusTCP gateway is used as an example for explanation.

[0048] Exemplarily, the boot code of the industrial embedded Modbus TCP gateway is Uboot.

[0049] Specifically, the commercial encryption module includes a commercial encryption algorithm and an application interface; the commercial encryption module is a hot-swappable module that can be inserted or removed while the industrial embedded gateway is powered on.

[0050] Preferably, in order to better protect the stability of the encryption module, after the industrial embedded gateway is powered off, the commercial encryption module is removed, and the encrypted data stored in the industrial embedded gateway will not be lost.

[0051] Specifically, the commercial encryption algorithms in the commercial encryption module include SM3 and SM4 algorithms.

[0052] Specifically, the application interface of the commercial encryption module is SDIO or UART; the commercial encryption module is connected to the industrial embedded gateway via the SDIO or UART interface. Accordingly, the industrial embedded gateway reserves a connection space for the commercial encryption module and an SDIO or UART interface.

[0053] Preferably, the commercial encryption module is physically connected to the industrial embedded gateway using an SDIO interface, which can provide a higher transmission rate.

[0054] During implementation, commercial encryption modules are tested in the following ways:

[0055] Obtain a commercial encryption module from the device list of the industrial embedded gateway, and then connect to the obtained commercial encryption module through the device name of the commercial encryption module;

[0056] If the connection with the commercial encryption module is successful, the commercial encryption module is detected.

[0057] It can be understood that the detection of commercial encryption modules is achieved by enumerating devices and connecting devices; wherein the device list of the industrial embedded gateway is obtained through the startup code.

[0058] S2. If a commercial encryption module is detected, initialize the commercial encryption module.

[0059] During implementation, the commercial encryption module initialization includes application interface initialization, specifically:

[0060] Initialize the basic information settings of the commercial encryption module, and configure the read function and write function of the commercial encryption module; wherein the basic information includes the clock, register and power supply of the commercial encryption module; the read function is used to read data of a set length at a storage location specified by the commercial encryption module and save it to a cache area; the write function is used to write data of a set length in the cache area to a storage location specified by the commercial encryption module.

[0061] During specific implementation, the application interface initialization is performed by setting corresponding codes in the startup program of the industrial embedded gateway.

[0062] For example, taking the embedded Modbus TCP gateway as an example, the commercial encryption module is a peripheral device of the main control CPU of the embedded Modbus TCP gateway. At this stage, the embedded Modbus TCP gateway must first complete the initialization of the clock, register and power supply of the commercial encryption module in the Uboot driver; add a read function of the commercial encryption module in the Uboot driver to read data content of a specific length from the storage location specified by the encryption module and save it to the cache area; add a write function in the Uboot driver to write data content of a certain length in the buffer into the specified storage location.

[0063] Preferably, if no commercial encryption module is detected, detection is continued based on set conditions until a commercial encryption module is detected. The set conditions may be detection time intervals, such as 1 minute, 1 second, etc., or detection may be performed at fixed time periods.

[0064] It can be understood that the commercial encryption module is a hot-swappable module. When the commercial encryption module is inserted into the industrial embedded gateway, the commercial encryption module is detected; otherwise, the commercial encryption module is not connected, and it is necessary to wait for the commercial encryption module to be inserted.

[0065] Preferably, the commercial encryption module is provided with verification data for verifying whether the commercial encryption module stores the verification information of the corresponding gateway. If the verification fails, a prompt is given.

[0066] Exemplarily, a device name and a password may be selected, and the gateway determines whether the verification is successful based on whether the device name and the password are correct.

[0067] S3. Read the running image data of the industrial embedded gateway device, and load the commercial encryption module to perform integrity protection calculation on the read running image data to obtain an integrity check value, and then perform trusted startup of the industrial embedded gateway according to the integrity check value.

[0068] During implementation, the operation image data of the industrial embedded gateway device is read as follows:

[0069] Based on the read function, gateway image files of set length are read from the non-volatile memory of the industrial embedded gateway in sequence, and saved in the cache area of ​​the industrial embedded gateway.

[0070] Specifically, the length of the gateway image file read each time is set to 1K bytes. It is understandable that setting the read length to 1K can effectively extract and temporarily store the gateway image file; and when reading the gateway image file, the last data length can be less than 1K bytes.

[0071] During implementation, the commercial encryption module performs integrity protection calculation on the read running image data, including:

[0072] If the amount of running image data read is less than the set threshold, a single set of data password hashing is used based on a commercial encryption algorithm to obtain an integrity check value;

[0073] Otherwise, multiple groups of password hashes are used to obtain the integrity check value based on a commercial encryption algorithm.

[0074] Exemplarily, the threshold value of the running image data volume is set to 1K bytes.

[0075] In a specific implementation, the integrity check value obtained by hashing a single set of data based on a commercial encryption algorithm includes:

[0076] Obtaining running image data parameters; wherein the parameters include the first address and data length of the running image data.

[0077] The running image data parameters are passed into the commercial encryption module through the application interface;

[0078] The hash function of the commercial encryption module is called to calculate the hash value of the running image data, and the hash value is used as the integrity check value of the running image data.

[0079] In a specific implementation, the commercial encryption algorithm is based on using multiple groups of password hashes to obtain the integrity check value, including:

[0080] Divide the running image data into multiple data blocks;

[0081] Process each data block in turn, including:

[0082] Determine the parameters of the current data block, and transfer the parameters of the current data block to the commercial encryption module through the application interface; wherein the parameters include the first address and data length of the current data block;

[0083] Call the iterative operation function of the commercial encryption module to calculate the hash value of the current data block;

[0084] The hash values ​​of each data block are concatenated to obtain the integrity check value of the running image data.

[0085] Specifically, the length of each data block is set according to specific requirements.

[0086] Exemplarily, the integrity check value is a hash value.

[0087] Exemplarily, Uboot reads the gateway's running image (such as an upper-layer Linux operating system, etc.) from the embedded Modbus TCP gateway's built-in non-volatile memory (such as FLASH, etc.) to the gateway's built-in volatile memory (such as RAM, etc.) space; Uboot calls the commercial cryptographic algorithm provided in the commercial encryption module to perform integrity verification on the gateway's running image, and calculates the corresponding integrity verification value.

[0088] It should be noted that the integrity check value of the running image data is calculated and saved to the execution buffer area through the write function.

[0089] During implementation, the trusted startup of the industrial embedded gateway is performed according to the integrity check value, including:

[0090] If the integrity check value is consistent with the integrity measurement value pre-stored in the commercial encryption module, the running image of the industrial embedded gateway is started;

[0091] Otherwise, the running image of the industrial embedded gateway will not be started.

[0092] Specifically, the integrity measurement value pre-stored in the commercial encryption module is a value calculated in advance by the same encryption algorithm of the commercial encryption module during the kernel image compilation process of the industrial embedded gateway, and is written to a specific storage area inside the commercial encryption module through a dedicated auxiliary device. It can be understood that the commercial encryption module is used to protect the system image integrity check value to prevent attackers from obtaining the check value.

[0093] More specifically, the dedicated auxiliary device is a TF card reader.

[0094] Specifically, the running image of the industrial embedded gateway is started through the startup code.

[0095] Exemplarily, the commercial encryption module compares the calculated integrity check value of the gateway image (such as hash value HASH) with the integrity measurement value of the gateway running image pre-stored in the commercial encryption module (such as hash value HASH). If they are consistent, the verification value success status is returned to Uboot, and if they are inconsistent, the verification value failure status is returned to Uboot. Uboot judges the returned prompt. If the verification is consistent, the upper-layer operating system image of the gateway is started and the subsequent normal application programs of the gateway are run; if the verification is inconsistent, the integrity of the gateway kernel image is destroyed, and the startup of the upper-layer operating system image of the gateway is stopped.

[0096] Preferably, while stopping the startup of the upper operating system image of the gateway, the GPIO pin is controlled by the control program of the general input and output module (GPIO) in the startup code, and then the alarm light of the industrial embedded gateway is controlled to flash at a set frequency to issue an alarm prompt so that the user is aware of the trusted startup failure of the gateway.

[0097] Exemplarily, a flashing frequency of once every 500 milliseconds is employed.

[0098] Exemplarily, during the trusted startup process, the embedded Modbus TCP gateway prompts the trusted startup status through hardware peripherals such as embedded LED lights / buzzers, so that the user can obtain the trusted startup status of the industrial embedded Modbus TCP gateway in a timely manner.

[0099] Preferably, the commercial encryption module also performs local data encryption based on a commercial encryption algorithm, specifically:

[0100] When the data of the industrial embedded gateway needs to be encrypted and protected for storage, the commercial encryption module encrypts and stores the local data based on the commercial encryption algorithm; correspondingly, when the industrial embedded gateway reads the locally encrypted and stored data, the commercial encryption module is required to decrypt the data.

[0101] It is understandable that when the gateway performs trusted startup, it must first pass the integrity check of the gateway's own running image before it can work, thereby ensuring that the operating environment of the industrial embedded gateway itself is controllable. If the running image of the device is tampered with by means of network attacks, such security risks can also be reduced by re-powering on or resetting. In addition, the trusted startup method in this embodiment is not limited by the type of industrial control protocol, and can be used in industrial control equipment that implements industrial control protocols such as PROFIBUS and CAN; and is not limited by the operating system running on the industrial control equipment itself, and can be used in industrial control equipment with different operating systems such as Linux, Windows, and VxWorks.

[0102] Compared with the prior art, this embodiment provides a trusted startup method for an industrial embedded gateway, which powers on the industrial embedded gateway, initializes the gateway, and detects the commercial encryption module. If the commercial encryption module is detected, the commercial encryption module is initialized, and then the running image data of the industrial embedded gateway device is read, and the commercial encryption module is loaded to perform integrity protection calculation on the read running image data to obtain an integrity check value, and then the industrial embedded gateway is trusted to start according to the integrity check value, providing a better security and trusted startup mechanism, solving the problems of complex operation, inflexibility and high cost, and achieving a better balance between security, cost and flexibility. When the gateway is started, it must pass the integrity check of the gateway's own running image in advance before it can work, thereby ensuring that the operating environment of the industrial embedded gateway itself is controllable, reducing some security threats from the public Internet faced by the industrial control system, and improving the security protection capability of the entire industrial control system; in addition, the method is not limited by the type of industrial control protocol and the operating system of the industrial control equipment itself, and is more universal.

[0103] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0104] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A trusted startup method for an industrial embedded gateway, characterized in that: The following steps are involved: Power on the industrial embedded gateway, initialize the gateway, and test the commercial encryption module; If a commercial encryption module is detected, the commercial encryption module is initialized; The running image data of the industrial embedded gateway device is read, and a commercial encryption module is loaded to perform integrity protection calculation on the read running image data to obtain an integrity check value, and then the trusted startup of the industrial embedded gateway is performed according to the integrity check value.

2. The trusted startup method for an industrial embedded gateway according to claim 1, characterized in that: The commercial encryption module includes a commercial encryption algorithm and an application interface; the commercial encryption module initialization includes application interface initialization, specifically: Initialize the basic information settings of the commercial encryption module, and configure the read function and write function of the commercial encryption module; wherein the basic information includes the clock, register and power supply of the commercial encryption module; the read function is used to read data of a set length at a storage location specified by the commercial encryption module and save it to a cache area; the write function is used to write data of a set length in the cache area to a storage location specified by the commercial encryption module.

3. The trusted startup method for an industrial embedded gateway according to claim 2, characterized in that: The operation image data of the industrial embedded gateway device is read as follows: Based on the read function, gateway image files of set length are read from the non-volatile memory of the industrial embedded gateway in sequence, and saved in the cache area of ​​the industrial embedded gateway.

4. The trusted startup method for an industrial embedded gateway according to claim 2, characterized in that: The commercial encryption module performs integrity protection calculation on the read running image data, including: If the amount of running image data read is less than the set threshold, a single set of data password hashing is used based on a commercial encryption algorithm to obtain an integrity check value; Otherwise, multiple groups of password hashes are used to obtain the integrity check value based on a commercial encryption algorithm.

5. The trusted startup method for an industrial embedded gateway according to claim 4, characterized in that: The integrity check value obtained by hashing a single set of data based on a commercial encryption algorithm includes: Obtaining running image data parameters; wherein the parameters include the first address and data length of the running image data. The running image data parameters are passed into the commercial encryption module through the application interface; The hash function of the commercial encryption module is called to calculate the hash value of the running image data, and the hash value is used as the integrity check value of the running image data.

6. The trusted startup method for an industrial embedded gateway according to claim 4, characterized in that: The method of obtaining an integrity check value by using multiple groups of password hashes based on a commercial encryption algorithm includes: Divide the running image data into multiple data blocks; Process each data block in turn, including: Determine the parameters of the current data block, and transfer the parameters of the current data block to the commercial encryption module through the application interface; wherein the parameters include the first address and data length of the current data block; Call the iterative operation function of the commercial encryption module to calculate the hash value of the current data block; The hash values ​​of each data block are concatenated to obtain the integrity check value of the running image data.

7. The trusted startup method for an industrial embedded gateway according to claim 4, characterized in that: Performing a trusted startup of the industrial embedded gateway according to the integrity check value includes: If the integrity check value is consistent with the integrity measurement value pre-stored in the commercial encryption module, the running image of the industrial embedded gateway is started; Otherwise, the running image of the industrial embedded gateway will not be started.

8. The trusted startup method for an industrial embedded gateway according to claim 3, characterized in that: The length of the gateway image file read each time is set to 1K bytes.

9. The trusted startup method for an industrial embedded gateway according to claim 1, characterized in that: Commercial encryption modules are tested in the following ways: Obtain a commercial encryption module from the device list of the industrial embedded gateway, and then connect to the obtained commercial encryption module through the device name of the commercial encryption module; If the connection with the commercial encryption module is successful, the commercial encryption module is detected.

10. The trusted startup method for an industrial embedded gateway according to claim 1, characterized in that: If the commercial encryption module is not detected, detection continues based on the set conditions until the commercial encryption module is detected.

Images