Industrial control logic tamper-proofing method and device based on binary program obfuscation

Abstract

The application relates to an industrial control logic tamper-proofing method and device based on binary program confusion, wherein the method comprises the following steps: acquiring a control logic binary program, and performing analysis to construct a logic flow graph and a data dependency graph, performing semantic layer transformation on the control logic, generating multiple logic paths, and performing dependency intersection and recombination on control variables; performing confusion processing on the logic paths at a binary instruction layer; dynamically selecting one of the multiple confused logic paths to execute by using a pseudo-random path scheduler, and generating a confused program; introducing a real-time constraint detection mechanism in the confused program generation process, performing simulation evaluation on the generated paths, and automatically adjusting the confusion processing strategy if the execution time or instruction statistics of each path exceeds a threshold; and performing function equivalence verification on the generated confused program, and automatically adjusting the confusion processing strategy if the verification fails. Compared with the prior art, the application does not need to change the PLC hardware structure, and has the advantages of high safety, low overhead, easy deployment and the like.

Description

Technical Field

[0001] This invention relates to the field of industrial control system security protection technology, and in particular to a method and device for preventing tampering of industrial control logic based on binary program obfuscation. Background Technology

[0002] With the rapid development of industrial automation and intelligent manufacturing, industrial control systems (ICS) are widely used in key fields such as power, chemical, metallurgy, transportation, and equipment manufacturing. Industrial control logic is typically deployed in the form of programmable logic controllers (PLCs) or embedded control units, with its core control logic stored and executed as binary programs. Since these control programs directly determine the operating state of the production process, malicious modification or tampering could lead to production interruptions, equipment damage, or even safety accidents; therefore, their security is paramount.

[0003] Existing industrial control program protection methods mostly rely on source code-level encryption, verification, or digital signature mechanisms. However, in real-world industrial scenarios, control programs often exist only as binary files, lacking usable source code, making source code-based protection methods inapplicable. On the other hand, attackers can use reverse engineering techniques to disassemble, reconstruct, and analyze the data flow of PLC binary programs, thereby extracting critical control logic or inserting malicious logic instructions to interfere with and manipulate the control process. Traditional integrity verification methods primarily target static file tampering, proving ineffective against runtime logic replacement or dynamic tampering.

[0004] In recent years, some studies have proposed protecting control logic at the binary level. However, most methods only encrypt or detect control instructions or specific jump structures, resulting in coarse-grained protection and significant operational overhead, making them unsuitable for industrial control systems with strict real-time requirements. For example, Chinese patent CN116880343A discloses a method and system for detecting runtime attacks on PLCs in industrial control systems. This method acquires the PLC's initial control logic, performs binary static instrumentation to construct a control flow graph, and detects the execution path of control flow instructions in real-time during runtime to determine if the PLC is under attack, ensuring the integrity of the control flow. However, this method only detects attacks and does not provide protection. Furthermore, existing methods generally lack comprehensive protection at the semantic layer, allowing attackers to recover critical control flows through semantic equivalent substitution or path reorganization.

[0005] Therefore, there is an urgent need for an effective, lightweight, and tamper-proof method for binary-level industrial control logic. Summary of the Invention

[0006] The purpose of this invention is to address the problem of insufficient security protection for control logic in industrial control systems by providing a method and device for preventing tampering of industrial control logic based on binary program obfuscation. This method can enhance the complexity and dynamic diversity of the logic structure by combining path-level obfuscation and semantic-level perturbation without source code, thereby fundamentally increasing the difficulty of reverse analysis and tampering attacks, while maintaining the real-time performance and functional correctness of the program.

[0007] The objective of this invention can be achieved through the following technical solutions: A method for preventing tampering of industrial control logic based on binary program obfuscation includes the following steps: Obtain the control logic binary program of the industrial logic controller and parse it to construct a logic flow graph and a data dependency graph; Based on the aforementioned logic flow graph and data dependency graph, semantic layer transformation is performed on the control logic to generate multiple semantically equivalent but different execution flows of the logic path, and dependency cross-combination and reorganization are performed on the control variables. Obfuscation is performed on the logical path at the binary instruction level. The obfuscation includes equivalent instruction replacement, invalid instruction insertion, self-modifying code segment insertion, and path order adjustment. During the runtime phase, a pseudo-random path scheduler is used to dynamically select one of multiple obfuscated logical paths for execution, achieving polymorphic execution and generating an obfuscated program. A real-time constraint detection mechanism is introduced during the obfuscation program generation process to simulate and evaluate the generated path. If the execution time or instruction statistics of each path exceed the threshold, the obfuscation strategy is automatically adjusted to ensure that the obfuscated control logic meets the requirements of periodicity and real-time operation. The generated obfuscated program is functionally equivalent. If the verification fails, the obfuscation strategy is automatically adjusted to ensure that the output of the obfuscated program is consistent with the original program.

[0008] The semantic layer transformation includes generating multiple equivalent transformation paths for the output variables and using path crossing technology to integrate the computational logic of different output variables into several execution paths.

[0009] The dependency crossover and recombination of control variables are achieved by constructing intermediate variables, algebraic equivalent substitution, and reordering of assignment sequences, in order to increase the length and coupling of the data flow dependency chain.

[0010] The insertion of invalid instructions includes inserting redundant calculations, no-operation instructions, or pseudo-conditional jumps that do not change the logical result, in order to interfere with static analysis and reverse engineering.

[0011] The self-modifying code segment is a logical unit that dynamically decrypts or rewrites some instructions before or during execution.

[0012] The pseudo-random path scheduler uses a pseudo-random function based on timestamps or hardware random sources to generate path indexes, and selects a confused logical path to execute in each control cycle.

[0013] The real-time constraint detection mechanism obtains the execution time or instruction statistics of each path through simulation or measurement. If the simulation execution time or instruction statistics of a certain path exceeds a preset threshold, the obfuscation items in the path are reduced or simplified or replaced with a lighter equivalent implementation according to the strategy until the threshold requirement is met.

[0014] The instruction statistics include the number of instructions, the number of jumps, and register usage.

[0015] The functional equivalence verification employs simulation comparison of a preset input set or local path equivalence checks based on symbolic execution to ensure that the obfuscated program outputs the same as the original program output under all expected inputs.

[0016] An anti-tampering device for industrial control logic based on binary program obfuscation, comprising: The parsing module is used to obtain the control logic binary program of the industrial logic controller and parse it to construct a logic flow graph and a data dependency graph. The transformation module is used to perform semantic layer transformation on the control logic based on the logic flow graph and data dependency graph, generate multiple semantically equivalent but execution flow different logic paths, and perform dependency cross-reorganization on the control variables; The obfuscation module performs obfuscation processing on the logical path at the binary instruction layer. The obfuscation processing includes equivalent instruction replacement, invalid instruction insertion, self-modifying code segment insertion, and path order adjustment. The scheduling module uses a pseudo-random path scheduler to dynamically select one of multiple obfuscated logical paths for execution during the runtime phase, achieving polymorphic execution and generating obfuscated programs. The verification module is used to introduce a real-time constraint detection mechanism during the obfuscation program generation process. It performs simulation evaluation on the generated paths. If the execution time or instruction statistics of each path exceed the threshold, the obfuscation strategy is automatically adjusted to ensure that the obfuscated control logic meets the requirements of periodicity and real-time operation. It also performs functional equivalence verification on the generated obfuscated program. If the verification fails, the obfuscation strategy is automatically adjusted to ensure that the output of the obfuscated program is consistent with the original program.

[0017] Compared with the prior art, the present invention has the following beneficial effects: This invention, through collaborative obfuscation at the semantic and binary layers, combined with dynamic polymorphic execution and real-time constraint control, not only significantly increases the difficulty of reversing and tampering with the control logic, but also ensures the equivalence of logical functions and the real-time performance of operation. Without altering the PLC hardware architecture, this invention offers advantages such as low cost, easy deployment, and high security. Attached Figure Description

[0018] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the obfuscation strategy used in the method of the present invention; Figure 3 A diagram illustrating the additional overhead introduced to the control program by selecting different confusion parameters. Detailed Implementation

[0019] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0020] Industrial control systems, as a crucial component of critical infrastructure, directly impact the stable operation of industries such as energy, power, and manufacturing. However, under existing systems, once the control logic is compromised by attackers, the logical structure can often be recovered through reverse engineering, allowing for the tampering of critical components. These attacks are often highly covert, and may even maintain partial functionality after logical alteration, making them difficult for maintenance personnel to detect in a timely manner. Therefore, a protection method is needed that increases the difficulty of logical analysis and tampering while simultaneously ensuring real-time performance and functional correctness.

[0021] In this invention, industrial control logic is abstracted into a set of input terminals. With output terminal set Mapping relationship between them: ,in, This is a function mapping for the control logic, where n is the number of inputs and m is the number of outputs. Because PLC programs have the characteristic of periodic scanning execution, In each control cycle The calculation must be completed internally; otherwise, it will lead to control delays. The core idea of ​​this invention is based on binary program obfuscation technology, which... Transform into a set of equivalent function families Let k be the number of equivalent functions, where each function satisfies: However, there are differences in the implementation path, intermediate variable dependencies, and the way the implementation structure and path are combined. This design can significantly increase the difficulty for attackers to recover the logic, making it difficult for them to confirm its global semantics even if they successfully reverse engineer part of the logic.

[0022] Specifically, this embodiment provides a method for preventing tampering with industrial control logic based on binary program obfuscation, applicable to industrial logic control systems such as programmable logic controllers (PLCs). This method achieves proactive protection of the control logic by introducing multi-path obfuscation and logic fusion mechanisms at the binary level. For example... Figure 1 As shown, the method includes the following steps: S1: Obtain the control logic binary program of the industrial logic controller and parse it to construct a control flow graph (CFG) and a data dependency graph (DDG).

[0023] This invention first parses the binary file of the PLC control logic to construct a control flow graph. With data dependency graph This analysis reveals the control relationships between the basic blocks in the logic and the dependencies between variables.

[0024] Specifically, the binary program file is extracted from the PLC device, and a disassembler (such as IDA Pro or Ghidra) is used to convert the binary code into a sequence of assembly instructions. Then, static analysis is used to identify the logical segments of the program and their calling relationships, forming an execution path branch structure to describe the program's logical dependencies and execution order. Simultaneously, data flow analysis is performed to trace read-write dependencies between variables, constructing a Data Flow Dependency Group (DDG), where nodes represent variables or registers, and edges represent data dependencies (e.g., the value of one variable depends on the calculation result of another variable). For example, for a simple control logic output... ,in and For input terminals, For output terminals, DDG will display. Depends on and The direct edges. This step ensures that subsequent obfuscation operations are based on accurate program semantics, avoiding disruption of the original logic.

[0025] S2, based on the logic flow graph and data dependency graph, performs semantic layer transformation on the control logic, generates multiple semantically equivalent but different execution flow logic paths, and performs dependency cross-reorganization on the control variables.

[0026] This step performs path expansion at the semantic level, that is, performs semantic layer transformation on the original output function. Generate a set of equivalent transformations: , Among the different There are differences in constant combinations, order of operations, and use of intermediate variables.

[0027] In this embodiment, semantic layer transformation includes generating multiple equivalent transformation paths for the output variables and using path crossing technology to integrate the computational logic of different output variables into several execution paths.

[0028] These equivalent paths are mixed through dependency crossing and recombination, making the data dependency graph... The number of edges and complexity increase significantly. The complexity can be defined as: , After this step, the complexity increases to: .

[0029] In practice, firstly, for each output variable (such as...) This generates multiple equivalent transformation paths, such as the original logic. It can be transformed into ,in As random constants, ensuring semantic equivalence but different intermediate operations. Then, using path crossing techniques, the logic of multiple output variables is logically merged, for example, by... Merging into a single path, which introduces intermediate variables , , This increases coupling between paths. The variable dependency crossover and recombination are achieved through constructing intermediate variables, algebraic equivalent substitutions, and assignment sequence rearrangements, thereby increasing the complexity of the data flow dependency graph. For example, redundant intermediate variables are introduced. , ,make sure Equivalent to However, this increases the dependency chain length. This step verifies path equivalence by simulating the execution, ensuring that all paths produce the same output under the same input.

[0030] S3 performs obfuscation on logical paths at the binary instruction level.

[0031] like Figure 2 As shown, at the binary level, this invention employs multiple obfuscation strategies. If the original instruction sequence is: , The confused sequence is: , in It may consist of equivalent substitution instructions, invalid instruction insertion, self-modifying code segment insertion, and path order adjustment.

[0032] Specifically, for equivalent instruction substitution, the original instructions, such as ADD R1, R2, are replaced with functionally equivalent forms like SUB R1, -R2 or LEAR1, [R1 + R2], to change the instruction fingerprint. For invalid instruction insertion, this includes inserting redundant computations that do not change the logical result (such as ADD R0, 0), no-operation instructions (NOP), or pseudo-conditional jumps (Opaque Predicates, such as JNZ based on tautology conditions) to interfere with static analysis and reverse engineering. For example, pseudo-conditional jumps are inserted between basic blocks, such as IF (1 == 1) THEN JMP Label1 ELSE JMP Label2, where Label2 is an invalid path. Self-modifying code segments dynamically decrypt or rewrite some instructions before or during program execution, for example, encrypting critical instructions using an XOR key and decrypting them at runtime using a self-modifying function to prevent long-term static analysis of the code. Path order adjustment is achieved by modifying the branch order in the CFG, such as splitting a linear path into a multi-level jump chain (JMP A -> JMP B -> JMPC), increasing control flow complexity. After this step, simulation execution and logic consistency analysis are used to verify the obfuscation effect, ensuring that the program is difficult to directly reverse engineer.

[0033] S4, during the runtime phase, uses a pseudo-random path scheduler to dynamically select one of multiple obfuscated logical paths for execution, achieving polymorphic execution and generating an obfuscated program.

[0034] In practice, a pseudo-random path scheduler is embedded in the PLC's operating environment. This scheduler uses a pseudo-random function (such as the Mersenne Twister algorithm) based on timestamps or hardware random sources (e.g., temperature sensors) to generate path indices, such as path sets. Within each control cycle, a scrambled logical path is selected for execution. In this embodiment, a scrambled logical path is selected. implement.

[0035] During the operational phase, this invention further introduces a polymorphic execution mechanism. This polymorphic execution ensures that even if an attacker tampers with one path, they cannot predict the next execution path, thereby raising the threshold for tampering. Simultaneously, the scheduler is compatible with the PLC's periodic scanning model, ensuring that scheduling overhead does not exceed 5% of the cycle.

[0036] Let the set of obfuscated paths be Then in the first Within each control cycle, the runtime scheduler randomly selects a function. implement: , in It is a pseudo-random function.

[0037] S5 introduces a real-time constraint detection mechanism during the obfuscation program generation process. It performs simulation evaluation on the generated path. If the execution time or instruction statistics of each path exceed the threshold, the obfuscation processing strategy is automatically adjusted to ensure that the obfuscated control logic meets the requirements of periodicity and real-time operation.

[0038] The real-time constraint detection mechanism obtains the execution time or instruction statistics for each path through simulation or measurement. If the simulated execution time or instruction statistics for a certain path exceeds a preset threshold, the obfuscation items in that path are reduced or simplified, or replaced with a lighter equivalent implementation, until the threshold requirement is met. In this embodiment, instruction statistics include the number of instructions, the number of jumps, and register usage.

[0039] Specifically, the execution time of each path is evaluated using a simulator (such as QEMU or a custom PLC simulation environment). ,like ,in The PLC control cycle (usually 10-100ms). To provide a safety margin (e.g., 0.1), invalid instruction insertion is reduced or path merging is simplified. Alternatively, if the number of jumps in a path exceeds a threshold of 20, some pseudo-conditional jumps are automatically removed. This mechanism, through iterative optimization, ensures that the average execution time of the obfuscated program does not exceed 1.2 times that of the original program.

[0040] Suppose the execution time of a certain path is... The system period is Then the following must be satisfied: in To provide a safety margin, this embodiment achieves this constraint through this step.

[0041] S6 performs functional equivalence verification on the generated obfuscated program. If the verification fails, the obfuscation strategy is automatically adjusted to ensure that the output of the obfuscated program is consistent with the original program.

[0042] Functional equivalence verification employs simulation comparison with a preset input set (such as an exhaustive set or a random sampling set covering all input combinations) or local path equivalence checks based on symbolic execution to ensure that the obfuscated program outputs consistent with the original program output under all expected inputs.

[0043] Specifically, it can be achieved through a preset input set. Compare the outputs of the original logic and the confused logic, and require: For example, for input terminals , Verify output Check for consistency. If inconsistent, roll back the obfuscation steps and adjust the parameters. This verification can be integrated with automated tools, such as the symbolic execution-based KLEE framework, to ensure 100% coverage.

[0044] In practical deployments, this method can generate obfuscated programs using offline tools and then upload them to the PLC device for execution. For example, in a PLC system of a chemical production line, after applying this method, the difficulty of reverse engineering (measured by code similarity) increased to more than three times the original, the success rate of tampering decreased to 15% of the original, and the real-time overhead was controlled within 3%. Figure 3 As shown, experimental results demonstrate that in simulated industrial control scenarios, the time required for reverse engineering and tampering increases significantly with the increase in the number of paths and obfuscation depth, verifying the effectiveness of this invention in improving logic security. With the increase in the number of paths, this method significantly enhances the difficulty of reverse engineering and tampering, especially the hybrid rearrangement mechanism, which eliminates common instructions between branches to the greatest extent possible.

[0045] The above is an introduction to the method embodiments. The following describes the solution of the present invention further through device embodiments.

[0046] An anti-tampering device for industrial control logic based on binary program obfuscation, comprising: The parsing module is used to obtain the control logic binary program of the industrial logic controller and parse it to construct a logic flow graph and a data dependency graph. The transformation module is used to perform semantic layer transformation on the control logic based on the logic flow graph and data dependency graph, generate multiple semantically equivalent but execution flow different logic paths, and perform dependency cross-reorganization on the control variables; The obfuscation module performs obfuscation processing on the logical path at the binary instruction layer. The obfuscation processing includes equivalent instruction replacement, invalid instruction insertion, self-modifying code segment insertion, and path order adjustment. The scheduling module uses a pseudo-random path scheduler to dynamically select one of multiple obfuscated logical paths for execution during the runtime phase, achieving polymorphic execution and generating obfuscated programs. The verification module is used to introduce a real-time constraint detection mechanism during the obfuscation program generation process. It performs simulation evaluation on the generated paths. If the execution time or instruction statistics of each path exceed the threshold, the obfuscation strategy is automatically adjusted to ensure that the obfuscated control logic meets the requirements of periodicity and real-time operation. It also performs functional equivalence verification on the generated obfuscated program. If the verification fails, the obfuscation strategy is automatically adjusted to ensure that the output of the obfuscated program is consistent with the original program.

[0047] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the described module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0048] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method for preventing tampering of industrial control logic based on binary program obfuscation, characterized in that, Includes the following steps: The process involves acquiring the control logic binary program of an industrial logic controller and parsing it to construct a control flow graph and a data dependency graph. This process reveals the control relationships between basic blocks in the logic and the dependencies between variables. Specifically, the binary program file is extracted from the PLC device, and a disassembler is used to convert the binary code into a sequence of assembly instructions. Then, static analysis is used to identify the logical segments of the program and their calling relationships, forming an execution path branch structure to describe the logical dependencies and execution order of the program. Simultaneously, data flow analysis is performed to trace the read-write dependencies between variables and construct a data dependency graph, where nodes represent variables or registers and edges represent data dependencies. Based on the control flow graph and data dependency graph, the control logic is transformed at the semantic level to generate multiple semantically equivalent but different execution paths, and the control variables are subjected to dependency cross-combination and reorganization. Obfuscation is performed on the logical path at the binary instruction level. The obfuscation includes equivalent instruction replacement, invalid instruction insertion, self-modifying code segment insertion, and path order adjustment. The self-modifying code segment is a logical unit that dynamically decrypts or rewrites some instructions before or during execution. During the runtime phase, a pseudo-random path scheduler is used to dynamically select one of multiple obfuscated logical paths for execution, achieving polymorphic execution and generating an obfuscated program. A real-time constraint detection mechanism is introduced during the obfuscation program generation process to simulate and evaluate the generated paths. If the execution time or instruction statistics of each path exceed a threshold, the obfuscation strategy is automatically adjusted to ensure that the obfuscated control logic meets the requirements of periodicity and real-time operation. The real-time constraint detection mechanism obtains the execution time or instruction statistics of each path through simulation or measurement. If the simulated execution time or instruction statistics of a certain path exceed a preset threshold, the obfuscation items in that path are reduced or simplified or replaced with a lighter equivalent implementation until the threshold requirement is met. The generated obfuscated program is subjected to functional equivalence verification. If the verification fails, the obfuscation strategy is automatically adjusted to ensure that the output of the obfuscated program is consistent with that of the original program. The functional equivalence verification adopts simulation comparison of preset input sets or local path equivalence check based on symbolic execution to ensure that the output of the obfuscated program is consistent with that of the original program under all expected inputs.

2. The method for preventing tampering of industrial control logic based on binary program obfuscation according to claim 1, characterized in that, The semantic layer transformation includes generating multiple equivalent transformation paths for the output variables and using path crossing technology to integrate the computational logic of different output variables into several execution paths.

3. The method for preventing tampering of industrial control logic based on binary program obfuscation according to claim 1, characterized in that, The dependency crossover and recombination of control variables are achieved by constructing intermediate variables, algebraic equivalent substitution, and reordering of assignment sequences, in order to increase the length and coupling of the data flow dependency chain.

4. The method for preventing tampering of industrial control logic based on binary program obfuscation according to claim 1, characterized in that, The insertion of invalid instructions includes inserting redundant calculations, no-operation instructions, or pseudo-conditional jumps that do not change the logical result, in order to interfere with static analysis and reverse engineering.

5. The method for preventing tampering of industrial control logic based on binary program obfuscation according to claim 1, characterized in that, The pseudo-random path scheduler uses a pseudo-random function based on timestamps or hardware random sources to generate path indexes, and selects a confused logical path to execute in each control cycle.

6. The method for preventing tampering of industrial control logic based on binary program obfuscation according to claim 1, characterized in that, The instruction statistics include the number of instructions, the number of jumps, and register usage.

7. A device for preventing tampering of industrial control logic based on binary program obfuscation, applied to the method for preventing tampering of industrial control logic based on binary program obfuscation as described in any one of claims 1 to 6, characterized in that, include: The parsing module is used to obtain the control logic binary program of the industrial logic controller and parse it to construct the control flow graph and data dependency graph; The transformation module is used to perform semantic layer transformation on the control logic based on the control flow graph and data dependency graph, generate multiple semantically equivalent but execution flow different logical paths, and perform dependency cross-combination and reorganization on the control variables; The obfuscation module performs obfuscation processing on the logical path at the binary instruction layer. The obfuscation processing includes equivalent instruction replacement, invalid instruction insertion, self-modifying code segment insertion, and path order adjustment. The scheduling module uses a pseudo-random path scheduler to dynamically select one of multiple obfuscated logical paths for execution during the runtime phase, achieving polymorphic execution and generating obfuscated programs. The verification module is used to introduce a real-time constraint detection mechanism during the obfuscation program generation process. It performs simulation evaluation on the generated paths. If the execution time or instruction statistics of each path exceed the threshold, the obfuscation strategy is automatically adjusted to ensure that the obfuscated control logic meets the requirements of periodicity and real-time operation. It also performs functional equivalence verification on the generated obfuscated program. If the verification fails, the obfuscation strategy is automatically adjusted to ensure that the output of the obfuscated program is consistent with the original program.

Images