A firmware emulation method based on data encryption and active defense

Abstract

The application discloses a kind of based on data encryption and active defense's firmware simulation method, comprising the following steps: independent sub-environment of class sandbox is built in system environment, sandbox main program is configured in class sandbox sub-environment;Sandbox main program includes encryption module, access control module, simulation module and fuzz testing module;Security policy is configured in class sandbox sub-environment;Simulation module loads firmware to carry out the simulation of firmware;When certain functional block of emulated firmware needs to access specific resource outside class sandbox sub-environment, whether access is allowed is confirmed by access control module;If access is allowed, then the resource outside class sandbox sub-environment is authenticated and the resource is called;If access is not allowed, then the simulation of next block is carried out by skipping the block, until firmware simulation ends;When data transmission is carried out in simulation process, data is encrypted by encryption module;In simulation process, fuzz testing module is used to carry out the fuzz testing of firmware.

Description

TECHNICAL FIELD

[0001] The embodiment of the application relates to the technical field of fuzzy testing, in particular to a firmware simulation method based on data encryption and active defense. BACKGROUND

[0002] Currently, data encryption and active defense technology are two main pillars in the field of information security, aiming to protect sensitive information and systems from various network threats. The current status of encryption technology shows maturity and wide application, especially the popularity of end-to-end encryption, which has become a standard configuration for communication applications to protect user privacy and security. On the other hand, active defense technology is constantly evolving to cope with increasingly complex security threats, and through analyzing traffic and detecting abnormal behavior, systems can quickly respond. The next-generation firewall (NGFW) combines multiple security measures to enhance the ability to handle complex threats. With the introduction of threat intelligence platforms, security systems can use shared threat data to strengthen defense measures. In the current status of simulation technology, the improvement of computing power and algorithms makes high-fidelity simulation possible, which can accurately simulate the dynamic behavior of complex systems.

[0003] However, the above-mentioned technology still has the following obvious deficiencies:

[0004] Although data encryption technology plays an important role in protecting information security, it has significant shortcomings in performance management. The encryption and decryption process requires additional computing resources, which may cause system performance to decline when handling large amounts of data.

[0005] Active defense tools need to rely on a large amount of data and analysis capabilities, which have relatively high resource requirements, and real-time response capabilities are often limited. Even so, these systems may still have a problem of delayed response when facing advanced persistent threats (APTs), which may result in the inability to quickly respond and handle all potential security incidents.

[0006] Therefore, it is necessary to provide a firmware simulation method based on data encryption and active defense to solve the above problems. SUMMARY

[0007] The purpose of the embodiment of the present application is to provide a firmware simulation method based on data encryption and active defense, which realizes reliable encryption of data in the firmware simulation process and active defense of access control, and improves reliability and security.

[0008] According to one aspect of the application, a firmware simulation method based on data encryption and active defense is provided, comprising the following steps:

[0009] The independent class sandbox sub-environment is constructed in a system environment, and a sandbox main program is configured in the class sandbox sub-environment; the sandbox main program comprises an encryption module, an access control module, an emulation module and a fuzz testing module;

[0010] A security policy is configured in the class sandbox sub-environment, and the security policy is initialized;

[0011] The emulation module loads firmware to perform emulation of the firmware;

[0012] When emulation of a certain functional block of the firmware needs to access a specific resource outside the class sandbox sub-environment, whether the access is allowed is confirmed by the access control module; if the access is allowed, the resource outside the class sandbox sub-environment is authenticated and then called; if the access is not allowed, the emulation of the block is skipped and the emulation of the next block is performed until the firmware emulation is completed;

[0013] When data transmission is performed in the emulation process, the data is encrypted by the encryption module;

[0014] In the emulation process, the firmware is subjected to fuzz testing by the fuzz testing module to mine vulnerabilities of the firmware.

[0015] Preferably, the access control module comprises a program monitor and an access rule engine; the program monitor monitors the running of the sandbox main program in the class sandbox sub-environment, and submits the monitored behavior to the access rule engine; the access rule engine judges whether the sandbox main program is allowed to use the specific resource outside the class sandbox sub-environment according to the set access rule.

[0016] Preferably, when the program monitor finds that the sandbox main program runs for more than a set time or a set memory or finds a dangerous system call, the running of the sandbox main program is terminated and the emulation is stopped.

[0017] Preferably, after the access control module confirms that the access to the specific resource outside the class sandbox sub-environment is allowed, the following steps are included:

[0018] The access control module sends an identity authentication request to the resource outside the class sandbox sub-environment as a data provider, and the resource outside the class sandbox sub-environment sends an identity ID to the access control module;

[0019] The access control module confirms that the identity ID of the resource outside the class sandbox sub-environment is qualified, and sends identity authentication qualification information to the encryption module;

[0020] The encryption module sends an encryption algorithm and a key to the resource, a proxy server and the emulation module as a data user, respectively;

[0021] The resource outside the class sandbox sub-environment encrypts data according to the encryption algorithm and the key and uploads the ciphertext to a cloud server.

[0022] The simulation module decrypts the ciphertext according to the encryption algorithm and the key to obtain the decrypted ciphertext, or obtains the ciphertext through the proxy server and decrypts the ciphertext to send the decrypted ciphertext to the simulation module.

[0023] Preferably, the encryption module sends the encryption key PK to the resources outside the sandbox-like sub-environment, sends the attribute key AA-key to the proxy server, and sends the user global key UGSK to the simulation module.

[0024] Preferably, the encryption module sends the encryption key PK to the resources outside the sandbox-like sub-environment, sends the attribute key AA-key to the proxy server, and sends the user global key UGSK to the simulation module.

[0025] The simulation module sends a partial outsourcing decryption request to the proxy server.

[0026] The proxy server sends a ciphertext obtaining request to the cloud server according to the partial outsourcing decryption request.

[0027] The cloud server sends the ciphertext to the proxy server according to the ciphertext obtaining request.

[0028] The proxy server decrypts the ciphertext and returns the decrypted ciphertext to the simulation module.

[0029] Preferably, the encryption algorithm of the encryption module includes a multi-round calculation process, each round of calculation process includes a plurality of basic operations, and the basic operations include byte substitution, row shift transformation, column confusion transformation or round key addition transformation.

[0030] Preferably, the encryption algorithm of the encryption module adopts a symmetric block cipher algorithm, the block length is 128 bits, the calculation round number of the encryption algorithm corresponds to the key length, the key length is 128 bits, 192 bits or 256 bits, and the corresponding calculation round number of the encryption algorithm is 10 rounds, 12 rounds or 14 rounds.

[0031] Preferably, the row shift transformation and the column confusion transformation operation adopt a Boolean mask, and each round of input is subjected to an exclusive or operation with a mask value; the column confusion transformation operation adopts a combination of a multiplication mask and a Boolean mask.

[0032] Preferably, the access rule is preset in a security policy.

[0033] The application discloses a firmware emulation method based on data encryption and active defense, which comprises the following steps: constructing an independent sub-sandbox environment in a system environment, configuring a sandbox main program in the sub-sandbox environment, and configuring system resources in the sub-sandbox environment to meet the required condition resources of emulation, so that only the system resources required by firmware running exist in the emulation environment, and the remaining resource information of the system cannot be contacted by the firmware, which is safer; the sandbox main program comprises an encryption module, an access control module, an emulation module and a fuzzing test module, when some resources outside the sandbox need to be accessed, the access control module is used to limit the access process, thereby realizing active defense of access control; when data transmission is performed, the data is encrypted by the encryption module, so that the data security is ensured; and the fuzzing test module is used to perform fuzzing test on the firmware during the emulation process, so that the firmware vulnerabilities are mined.

[0034] Further, the emulation module can request the proxy server to perform outsourcing decryption, the proxy server acquires the ciphertext, decrypts the ciphertext and sends the decrypted ciphertext to the emulation module, so that the decryption process does not excessively occupy the computing resources and does not affect the emulation speed.

[0035] Further, the program monitor is used to monitor the running of the sandbox main program in the sub-sandbox environment, and when the program monitor finds that the sandbox main program runs for more than a set time or a set memory or finds a dangerous system call, the running of the sandbox main program is terminated, the emulation is stopped, and active defense of program monitoring is realized. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the present application, not all embodiments. For those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0037] Figure 1 is a flow chart of the firmware emulation method based on data encryption and active defense according to the embodiment of the present application;

[0038] Figure 2 is an architecture diagram of the firmware emulation method based on data encryption and active defense according to the embodiment of the present application. DETAILED DESCRIPTION

[0039] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. According to the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0040] The technical solutions of the present application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and some embodiments may not be described again for the same or similar concepts or processes.

[0041] According to the problems in the prior art, the embodiments of the present application provide a firmware emulation method based on data encryption and active defense. The present application realizes reliable encryption of data in the firmware emulation process and active defense of access control, thereby improving reliability and security.

[0042] Figure 1 is a flowchart of the firmware emulation method based on data encryption and active defense according to the embodiments of the present application; Figure 2 is an architecture diagram of the firmware emulation method based on data encryption and active defense according to the embodiments of the present application.

[0043] As shown in Figures 1-2 , the firmware emulation method based on data encryption and active defense provided by the embodiments of the present application includes the following steps:

[0044] S101: An independent sub-sandbox environment is constructed in a system environment, and a sandbox main program is configured in the sub-sandbox environment. The sandbox main program includes an encryption module, an access control module, an emulation module and a fuzz testing module;

[0045] S102: A security policy is configured in the sub-sandbox environment, and the security policy is initialized;

[0046] S103: The emulation module loads the firmware to emulate the firmware. When a certain functional block of the emulated firmware needs to access a specific resource outside the sub-sandbox environment, it is confirmed through the access control module whether the access is allowed. If the access is allowed, the resource outside the sub-sandbox environment is called after identity authentication. If the access is not allowed, the emulation of the next block is skipped until the firmware emulation is completed. When data transmission is performed in the emulation process, the data is encrypted through the encryption module;

[0047] S104: The fuzz testing module is used to perform fuzz testing on the firmware in the emulation process to find vulnerabilities of the firmware.

[0048] In some embodiments, the access control module comprises a program monitor and an access rule engine; the program monitor monitors the running of the sandbox master program in the class sandbox sub-environment and submits the monitored behavior to the access rule control engine, which judges whether the sandbox master program is allowed to use the specific resource outside the class sandbox sub-environment according to the set access rule.

[0049] In some embodiments, the access rule is set in the security policy in advance.

[0050] In some embodiments, the program monitor terminates the running of the sandbox master program and stops the simulation when it finds that the sandbox master program runs beyond the set time or the set memory or finds a dangerous system call.

[0051] In some embodiments, after the access control module confirms that the access to the specific resource outside the class sandbox sub-environment is allowed, the following steps are included:

[0052] The access control module sends an identity authentication request to the resource outside the class sandbox sub-environment as a data provider, and the resource outside the class sandbox sub-environment sends an identity ID to the access control module.

[0053] The access control module confirms that the identity ID of the resource outside the class sandbox sub-environment is qualified, and sends identity authentication qualified information to the encryption module.

[0054] The encryption module sends the encryption algorithm and the key to the resource, the proxy server and the simulation module as a data user, respectively.

[0055] The resource outside the class sandbox sub-environment encrypts the data according to the encryption algorithm and the key and uploads the ciphertext to the cloud server.

[0056] The simulation module obtains the ciphertext from the cloud server, decrypts it according to the encryption algorithm and the key to obtain the decrypted ciphertext, or obtains the ciphertext through the proxy server and decrypts it to send the decrypted ciphertext to the simulation module.

[0057] If the access control module confirms that the identity ID of the resource outside the class sandbox sub-environment is not qualified, it is determined that the resource outside the class sandbox sub-environment is a malicious user, and the malicious user is tracked.

[0058] In some embodiments, the encryption module sends the encryption key PK to the resource outside the class sandbox sub-environment, sends the attribute key AA-key to the proxy server, and sends the user global key UGSK to the simulation module.

[0059] In some embodiments, the decrypted ciphertext is sent to the simulation module after the ciphertext is obtained through the proxy server and decrypted, including:

[0060] The simulation module makes a partial outsourcing decryption request to the proxy server.

[0061] The proxy server sends a ciphertext obtaining request to the cloud server according to the partial outsourcing decryption request;

[0062] The cloud server sends the ciphertext to the proxy server according to the ciphertext obtaining request;

[0063] The proxy server decrypts the ciphertext and returns the decrypted ciphertext to the simulation module.

[0064] In some embodiments, the encryption algorithm of the encryption module includes a plurality of rounds of calculation processes, each round of calculation process includes a plurality of basic operations, and the basic operations include byte substitution, row shift transformation, column confusion transformation or round key addition transformation.

[0065] In some embodiments, the encryption algorithm of the encryption module adopts a symmetric block cipher algorithm, the block length is 128 bits, the number of calculation rounds of the encryption algorithm corresponds to the key length, the key length is 128 bits, 192 bits or 256 bits, and the number of calculation rounds of the corresponding encryption algorithm is 10 rounds, 12 rounds or 14 rounds.

[0066] In some embodiments, the row shift transformation and the column confusion transformation operation adopt a Boolean mask, and each round of input is subjected to an exclusive or operation with a mask value; and the column confusion transformation operation adopts a combination of a multiplication mask and a Boolean mask.

[0067] In summary, the application discloses a firmware simulation method based on data encryption and active defense, an independent sandbox-like sub-environment is constructed in a system environment, a sandbox main program is configured in the sandbox-like sub-environment, and system resources are configured in the sandbox-like sub-environment to meet the required condition resources for simulation, so that only system resources required for firmware running exist in the simulation environment, and the remaining resource information of the system cannot be contacted by the firmware, which is safer; the sandbox main program includes an encryption module, an access control module, a simulation module and a fuzz testing module, when some resources outside the sandbox need to be accessed, the access control module is used to limit the access process, and active defense of access control is realized; when data transmission is performed, the data is encrypted by the encryption module to ensure data security; and the firmware is subjected to fuzz testing by the fuzz testing module during the simulation process, so as to mine firmware vulnerabilities.

[0068] Further, the simulation module can request the proxy server to perform outsourcing decryption, the proxy server obtains ciphertext, decrypts the ciphertext and sends the decrypted ciphertext to the simulation module, so that the decryption process does not excessively occupy computing resources and does not affect the simulation speed.

[0069] Further, the program monitor is used to monitor the running of the sandbox main program in the sandbox-like sub-environment, and when the program monitor finds that the sandbox main program runs for more than a set time or a set memory or finds a dangerous system call, the running of the sandbox main program is terminated, the simulation is stopped, and active defense of program monitoring is realized.

[0070] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit the present application; although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions recorded in the above embodiments can still be modified, or some or all of the technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A firmware emulation method based on data encryption and proactive defense, characterized in that, Includes the following steps: Build an independent sandbox-like environment within the system environment, and configure the sandbox main program within the sandbox-like environment; the sandbox main program includes an encryption module, an access control module, a simulation module, and a fuzzing module; Configure and initialize the security policy in a sandbox-like environment; The simulation module loads the firmware and performs firmware simulation; When a functional block of the simulated firmware needs to access a specific resource outside the sandbox environment, the access control module confirms whether access is allowed. If access is allowed, the resource outside the sandbox environment is authenticated and then the resource is invoked. If access is not allowed, the block is skipped and the simulation of the next block is performed until the firmware simulation ends. During data transmission in the simulation process, the encryption module encrypts the data. During the simulation, the firmware is fuzzed using a fuzzing module to uncover firmware vulnerabilities. After the access control module confirms that access to specific resources outside the sandbox environment is permitted, it includes the following steps: The access control module sends an authentication request to the sandbox-like external resource that is acting as a data provider, and the sandbox-like external resource sends its identity ID to the access control module. The access control module confirms that the identity ID of the resource outside the sandbox environment is valid and sends the identity authentication information to the encryption module. The encryption module sends the encryption algorithm and key to the resource, the proxy server, and the simulation module that is the data user, respectively. Resources outside the sandbox-like environment are encrypted using encryption algorithms and keys, and the ciphertext is uploaded to the cloud server. The simulation module obtains the ciphertext from the cloud server and decrypts it according to the encryption algorithm and key to obtain the decrypted ciphertext; alternatively, it obtains the ciphertext through the proxy server, decrypts it, and then sends the decrypted ciphertext to the simulation module. The encryption module sends the encryption key PK to resources outside the sandbox environment, the attribute key AA-key to the proxy server, and the user global key UGSK to the simulation module.

2. The firmware emulation method based on data encryption and active defense according to claim 1, characterized in that, The access control module includes a program monitor and an access rule engine. The program monitor monitors the operation of the sandbox main program in the sandbox-like environment and submits the monitored behavior to the access rule control engine. The access rule control engine determines whether to allow the sandbox main program to use specific resources outside the sandbox-like environment according to the set access rules.

3. The firmware emulation method based on data encryption and active defense according to claim 2, characterized in that, When the program monitor detects that the sandbox main program has been running for longer than the set time or memory limit, or detects a dangerous system call, it terminates the sandbox main program and stops the simulation.

4. The firmware emulation method based on data encryption and active defense according to claim 1, characterized in that, After obtaining and decrypting the ciphertext through the proxy server, the decrypted ciphertext is sent to the simulation module, including: The simulation module sends a partial outsourced decryption request to the proxy server; The proxy server sends a ciphertext retrieval request to the cloud server based on a portion of the outsourced decryption request. The cloud server sends the ciphertext to the proxy server according to the ciphertext retrieval request; The proxy server decrypts the ciphertext and returns the decrypted ciphertext to the simulation module.

5. The firmware emulation method based on data encryption and active defense according to claim 1, characterized in that, The encryption algorithm of the encryption module includes a multi-round calculation process, and each round of calculation includes a variety of basic operations, including byte substitution, row shift transformation, column confusion transformation, or round key addition transformation.

6. The firmware emulation method based on data encryption and active defense according to claim 5, characterized in that, The encryption module uses a symmetric block cipher algorithm with a block length of 128 bits. The number of computation rounds of the encryption algorithm corresponds to the key length, which is 128 bits, 192 bits, or 256 bits. The corresponding number of computation rounds of the encryption algorithm is 10, 12, or 14.

7. The firmware emulation method based on data encryption and active defense according to claim 5, characterized in that, The row shift transformation and column scrambling transformation operations use Boolean masks, performing an XOR operation between the input and the mask value for each round; the column scrambling transformation operation uses a combination of multiplication masks and Boolean masks.

8. The firmware emulation method based on data encryption and active defense according to claim 2, characterized in that, The access rules are pre-set in the security policy.

Images