Software supply chain traceability identification method and device for train-mounted equipment of motor train unit

Abstract

The invention provides a traceability identification method and device for a supply chain of on-board equipment software of a motor train unit, and relates to the technical field of on-board equipment software security, and the method comprises the steps: constructing a traceability fingerprint based on a binary file of target firmware or middleware; performing blocking processing on the binary file according to a preset block size to generate an overall check value; associating the traceability fingerprint and the overall verification value with a test report document corresponding to the binary file and identity information of a person in charge, and generating a unified verification value of a deliverable; and carrying out risk identification and responsibility positioning based on the unified verification value of the deliverable. According to the train set vehicle-mounted equipment software supply chain traceability identification method and device provided by the invention, accurate positioning of risk fragments and full-life-cycle software supply chain traceability which is cross-process, cross-version and accurate in responsibility are realized.

Description

Technical Field

[0001] This application relates to the field of onboard equipment software security technology, and in particular to a method and device for tracing and identifying the supply chain of onboard equipment software for high-speed trains. Background Technology

[0002] With the rapid development of high-speed railway construction, the number of high-speed train sets has continued to climb, reaching several thousand standard sets. Along with the evolution of equipment technology, advanced technologies such as intelligent diagnostics, health management, and high-capacity communication are being integrated and applied, and the onboard networks of high-speed trains are rapidly evolving towards wireless and intelligent operation. Against this backdrop, the complexity of onboard equipment software systems has significantly increased, and software security has become a crucial prerequisite for ensuring the stable operation of advanced high-speed train equipment.

[0003] However, during the flow of software in the high-speed train supply chain, firmware and middleware files often involve multiple parties and multiple processing stages, posing risks of introducing unknown open-source components, tampering, or the implantation of malicious files. Failure to identify risky files in the supply chain in a timely manner could lead to malfunctions in the onboard system or even threaten train safety. Existing supply chain traceability technologies mainly rely on manual inspection or single hash verification of the entire file. This approach lacks sufficient granularity and cannot pinpoint specific component fragments referenced within the file, making accurate identification of risky content difficult.

[0004] Furthermore, existing tracing mechanisms typically only operate at the file-level verification level, lacking the ability to link verification results with test reports, responsible personnel identities, and other information. This makes it difficult to trace the source of risk to specific responsible parties, hindering fault determination and closed-loop risk management. Moreover, since the software deliverables for high-speed trains are mostly compiled binary files, current reverse engineering techniques are insufficient, resulting in weak identification capabilities for risk files hidden in compiled or encrypted firmware, creating blind spots in the tracing chain.

[0005] In summary, the existing high-speed train software supply chain still suffers from problems such as coarse granularity, difficulty in assigning responsibility, and poor binary compatibility in terms of safety traceability.

[0006] This section is intended to provide background or context for the embodiments of the invention set forth in the claims. The description herein is not an admission that it is prior art simply because it is included in this section. Summary of the Invention

[0007] To address the problems in the prior art, this application provides a method and apparatus for tracing and identifying the software supply chain of high-speed train onboard equipment. This method and apparatus can solve the problems of difficulty in identifying open-source components and virus implantation, difficulty in locating risky segments, and inability to trace back to the testing stage and responsible parties during the circulation of firmware and middleware files in the high-speed train supply chain.

[0008] One aspect of the present invention provides a method for tracing and identifying the supply chain of onboard equipment software for high-speed trains, the method comprising:

[0009] Construct a source fingerprint based on the binary file of the target firmware or middleware;

[0010] The binary file is divided into blocks according to a preset block size to generate an overall check value;

[0011] The traceability fingerprint, the overall verification value, the test report document corresponding to the binary file, and the identity information of the responsible person are associated to generate a unified verification value for the deliverables;

[0012] Risk identification and liability determination are based on the unified verification value of the delivered items.

[0013] Furthermore, the construction of the source fingerprint based on the binary file of the target firmware or middleware includes:

[0014] The binary file is reverse engineered and parsed to extract source traceability information;

[0015] Based on the source tracing feature information, the source tracing fingerprint is constructed using a cryptographic algorithm.

[0016] Further, the step of dividing the binary file into blocks according to a preset block size to generate an overall checksum includes:

[0017] The binary file is divided into blocks according to a preset block size, and block check values ​​are generated.

[0018] The block check values ​​are summarized, and the SM3 cryptographic hash algorithm is used to generate the overall check value.

[0019] Further, the step of dividing the binary file into blocks according to a preset block size and generating block check values ​​includes:

[0020] The binary file is divided into blocks according to a preset block size to obtain file blocks;

[0021] Extract block feature information from each of the aforementioned file blocks;

[0022] The corresponding block verification value is generated based on the block feature information.

[0023] Furthermore, it also includes:

[0024] The system sends the binary file, the test report document, the responsible person's identity information, and the unified verification value of the deliverables to the lower-level process system so that the lower-level process system can verify the validity of the unified verification value of the deliverables.

[0025] Furthermore, the traceability feature information includes code module identifiers, data interaction interfaces, and file compilation features.

[0026] In another aspect, the present invention provides a traceability and identification device for the software supply chain of high-speed train onboard equipment, the device comprising:

[0027] The source fingerprint construction unit is used to construct a source fingerprint based on the binary file of the target firmware or middleware;

[0028] The overall check value generation unit is used to divide the binary file into blocks according to a preset block size and generate an overall check value;

[0029] The verification value generation unit is used to associate the traceability fingerprint, the overall verification value, the test report document corresponding to the binary file, and the identity information of the responsible person to generate a unified verification value for the deliverables;

[0030] The risk and liability identification unit is used to identify risks and assign responsibilities based on the unified verification value of the delivered goods.

[0031] Furthermore, the source fingerprint construction unit includes:

[0032] The source traceability feature information extraction module is used to reverse engineer and parse the binary file to extract source traceability feature information;

[0033] The source fingerprint construction module is used to construct the source fingerprint based on the source feature information using a cryptographic algorithm.

[0034] Furthermore, the overall verification value generation unit includes:

[0035] The block check value generation module is used to divide the binary file into blocks according to a preset block size and generate block check values.

[0036] The overall verification value generation module is used to summarize the block verification values ​​and generate an overall verification value using the SM3 cryptographic hash algorithm.

[0037] Furthermore, the block checksum generation module includes:

[0038] The file segmentation submodule is used to segment the binary file into blocks according to a preset block size to obtain file blocks;

[0039] The block feature information extraction submodule is used to extract block feature information from each of the file blocks respectively;

[0040] The block check value generation submodule is used to generate corresponding block check values ​​based on the block feature information.

[0041] Furthermore, it also includes:

[0042] The information transmission unit sends the binary file, the test report document, the responsible person's identity information, and the unified verification value of the deliverables to the lower-level process system so that the lower-level process system can verify the validity of the unified verification value of the deliverables.

[0043] Furthermore, the traceability feature information includes code module identifiers, data interaction interfaces, and file compilation features.

[0044] To achieve the above objectives, according to another aspect of the present invention, a computer device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method for tracing and identifying the supply chain of onboard equipment software for high-speed trains.

[0045] To achieve the above objectives, according to another aspect of the present invention, a computer-readable storage medium is also provided, on which a computer program / instruction is stored, which, when executed by a processor, implements the steps of the above-described method for tracing and identifying the supply chain of onboard equipment software for high-speed trains.

[0046] To achieve the above objectives, according to another aspect of the present invention, a computer program product is also provided, including a computer program / instruction that, when executed by a processor, implements the steps of the above-described method for tracing and identifying the supply chain of onboard equipment software for high-speed trains.

[0047] The beneficial effects of this invention are as follows:

[0048] This invention combines binary reverse engineering with block verification technology to enable fine-grained tracing of firmware and middleware binary files, achieving precise location of open-source component references and malicious code injection points, thereby significantly improving the accuracy of software supply chain tracing. The tracing fingerprint generated based on the national cryptographic algorithm SM3 is unique and tamper-proof, effectively preventing forgery of tracing information and ensuring the authenticity and reliability of tracing results throughout the supply chain. It also facilitates integration into various technical tools across the entire lifecycle of onboard equipment. By associating the tracing fingerprint with test reports and responsible personnel identification information, a complete information chain linking file tracing, test records, and responsibility tracing is constructed, achieving unified risk identification and responsibility confirmation, providing a basis for risk management and process optimization. Furthermore, this invention is technically adapted to the characteristics of binary files in EMU firmware and middleware, ensuring stable execution in the onboard equipment's software operating environment and meeting the practical application needs of EMU software supply chain security management. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0050] Figure 1 This is a schematic diagram of the first process of the supply chain traceability and identification method for onboard equipment software of high-speed trains provided in this embodiment of the invention;

[0051] Figure 2 This is a schematic diagram of the second process of the method for tracing and identifying the supply chain of onboard equipment software for high-speed trains provided in this embodiment of the invention;

[0052] Figure 3 This is a schematic diagram of the third process of the method for tracing and identifying the supply chain of onboard equipment software for high-speed trains provided in this embodiment of the invention;

[0053] Figure 4 This is a schematic diagram of the fourth process of the method for tracing and identifying the supply chain of onboard equipment software for high-speed trains provided in this embodiment of the invention;

[0054] Figure 5 This is a schematic block diagram of the first structure of the onboard equipment software supply chain traceability and identification device for high-speed trains provided in this embodiment of the invention;

[0055] Figure 6 This is a schematic block diagram of the second structure of the onboard equipment software supply chain traceability and identification device for high-speed trains provided in this embodiment of the invention;

[0056] Figure 7 This is a schematic block diagram of the third structure of the onboard equipment software supply chain traceability and identification device for high-speed trains provided in this embodiment of the invention;

[0057] Figure 8 This is a schematic block diagram of the fourth structure of the onboard equipment software supply chain traceability and identification device for high-speed trains provided in this embodiment of the invention;

[0058] Figure 9 This is a fifth structural schematic block diagram of the onboard equipment software supply chain traceability and identification device for high-speed trains provided in this embodiment of the invention;

[0059] Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0060] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0061] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification, claims and accompanying drawings of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, products or devices.

[0063] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0064] This invention aims to address the problems of coarse traceability granularity, insufficient information association, and poor adaptability to reverse analysis in existing high-speed train software supply chain traceability technologies. It provides a traceability identification method for the software supply chain of high-speed train onboard equipment, which combines cryptography and reverse engineering to achieve accurate traceability analysis of firmware and middleware files. This falls under the scope of software supply chain security protection, effectively identifying open-source component references and virus files, while also associating test reports with responsible personnel information, thereby improving the completeness and traceability of traceability.

[0065] The following describes the specific implementation process of the software supply chain traceability and identification method for high-speed train onboard equipment provided in this application embodiment, taking the server as the execution subject as an example.

[0066] Figure 1 This is a schematic diagram of the first process of the supply chain traceability and identification method for onboard equipment software of high-speed trains provided in this embodiment of the invention, as shown below. Figure 1As shown, in one embodiment of the present invention, the method for tracing and identifying the supply chain of onboard equipment software for high-speed trains includes:

[0067] S101: Construct a traceability fingerprint based on the binary file of the target firmware or middleware;

[0068] S102: Divide the binary file into blocks according to the preset block size to generate an overall check value;

[0069] S103: Associate the traceability fingerprint, the overall verification value, the test report document corresponding to the binary file, and the identity information of the responsible person to generate a unified verification value for the deliverables;

[0070] S104: Risk identification and liability determination are performed based on the unified verification value of the delivered goods.

[0071] from Figure 1 As shown in the flowchart, the method for tracing and identifying the software supply chain of high-speed train onboard equipment provided by this invention constructs a traceability fingerprint based on the binary file of the target firmware or middleware; divides the binary file into blocks according to a preset block size to generate an overall verification value; associates the traceability fingerprint, the overall verification value, and the test report document and responsible person identity information corresponding to the binary file to generate a unified verification value for the deliverable; and performs risk identification and responsibility positioning based on the unified verification value for the deliverable, thereby achieving accurate positioning of risk segments and cross-process, cross-version, and verifiable full lifecycle software supply chain traceability.

[0072] Each step is explained in detail below.

[0073] S101: Construct a traceability fingerprint based on the binary file of the target firmware or middleware;

[0074] Specifically, during the software flow process in the supply chain, the binary file of the target vehicle firmware and / or middleware is obtained, and the binary file is used as the traceability object for fingerprint construction.

[0075] During the fingerprint construction process, the server extracts characteristic content from the binary file and uses cryptographic algorithms to form a unique traceability identifier. This traceability fingerprint reflects the file's origin and identity characteristics within the supply chain system. Because firmware and middleware in the supply chain may undergo multiple packaging, compilation, and deployments, the method of generating traceability fingerprints is stable and tamper-resistant, ensuring that files from the same source can still yield consistent fingerprint results when acquired at different stages.

[0076] This step provides an identification basis for subsequent verification and risk identification, enabling different stages to use a unified fingerprint to identify the same deliverable.

[0077] Figure 2 This is a schematic diagram of the second process of the supply chain traceability and identification method for onboard equipment software of high-speed trains provided in this embodiment of the invention, as shown below. Figure 2 As shown, in one embodiment of the present invention, S101 includes:

[0078] S201: Perform reverse engineering analysis on the binary file to extract source traceability feature information;

[0079] Specifically, after obtaining the binary file of the target firmware or middleware, the server first performs reverse engineering analysis on the file, analyzing the file structure, code snippets, and data links to extract traceability feature information that can characterize the file's origin and composition.

[0080] Reverse engineering does not focus on the functional execution semantics of the software. Instead, it analyzes and abstracts the file's structural layout, code segment distribution, and data interaction relationships to identify stable and unique technical features within the file. For example, by parsing areas such as program segments, resource segments, symbol segments, interface call tables, and data structure declaration locations, information reflecting module divisions and functional boundaries can be extracted, thereby constructing the file's structural characteristics within the supply chain system.

[0081] Since the software of the onboard equipment of the high-speed train may be subject to compilation optimization, packaging obfuscation or even security packing in the actual supply chain operation, the reverse analysis method can isolate the impact caused by compilation differences and ensure that the same source files generated by different versions and different build methods still exhibit stable and consistent characteristics, thereby ensuring the availability and long-term effectiveness of the feature extraction process.

[0082] The extracted source traceability feature information will serve as the basic data for constructing the source traceability fingerprint, providing verifiable evidence of the document's identity for subsequent verification steps.

[0083] S202: Based on the source traceability feature information, construct the source traceability fingerprint using a cryptographic algorithm.

[0084] Specifically, after feature extraction is completed, the server processes the aforementioned feature information to generate a traceability fingerprint used to identify the file's identity.

[0085] The fingerprint construction process utilizes cryptographic algorithms for irreversible hashing, ensuring that traceability features are converted into a unique and tamper-proof identifier. This algorithm guarantees a complete mapping of feature information, meaning that even minor changes within a file, such as module replacement, interface adjustments, or compilation configuration changes, will result in a change in the fingerprint, thus enabling fine-grained monitoring of file drift.

[0086] The traceability fingerprint is generated in a unified format and is used to cover the design, testing, integration, release and maintenance phases of the in-vehicle equipment software lifecycle. This allows all participants in the supply chain to verify the software's origin and version identity through fingerprints without exposing the file content, thereby avoiding identity verification failures caused by file transfer, manual review or multi-level collaboration in the supply chain.

[0087] The resulting traceability fingerprint can be used as a unique identity credential for software deliverables within the supply chain system, providing a foundation of trust for subsequent integrity verification, risk identification, and accountability.

[0088] In one embodiment, the software firmware of a high-speed train's onboard controller is used as the target file, and a source fingerprint generation process is performed on it. First, the server performs reverse engineering analysis on the target firmware to extract source fingerprint information that can be used to characterize the file's origin and composition, including but not limited to module partitioning structure, interface call relationships, and compilation generation characteristics. This feature information, as a set of structural features of the file, can accurately reflect the file's component composition, code organization method, and technological origin.

[0089] Subsequently, based on the extracted traceability feature information, the server invokes a cryptographic algorithm to execute the fingerprint construction process. In this embodiment, the SM3 cryptographic hash algorithm (a national standard) is used to process the reverse-extracted feature information, generating a unique and tamper-proof traceability fingerprint to identify the source and composition of the target firmware. The generated fingerprint has mapping capabilities, forming a one-to-one correspondence with the original source, version evolution, and module component composition of the target file.

[0090] After fingerprint generation, it can be used to quickly compare firmware from different supply chains or different versions. When a file references an unknown open-source component, replaces an internal module, or is infected with a virus, its reverse feature information will shift, and the corresponding fingerprint identifier will change accordingly, thereby achieving rapid and accurate identification of abnormal files. This embodiment demonstrates that the fingerprint generation method of the present invention can stably support the identity tracking of firmware and middleware files throughout the entire supply chain lifecycle, helping to improve the security and traceability of the in-vehicle equipment software delivery process.

[0091] In one embodiment, the cryptographic algorithm may also be SHA-256, RSA asymmetric encryption algorithm, etc.

[0092] S102: Divide the binary file into blocks according to the preset block size to generate an overall check value;

[0093] Specifically, after constructing the source fingerprint, the server continues to perform integrity verification on the binary file.

[0094] To avoid biases caused by relying solely on whole-file hash verification, the server employs a block-based strategy to perform a traversal analysis of the target binary file. The file is divided into several blocks of a preset size, and these blocks are used as input data to generate a verification value for overall judgment. This verification value remains consistent across different file versions and different supply stages, reflecting whether the file has been modified or replaced during its circulation.

[0095] The overall verification value works in conjunction with the traceability fingerprint to form a dual verification system of "identity identifier + integrity identifier", which improves the credibility of supply chain delivery.

[0096] Figure 3 This is a schematic diagram of the third process of the supply chain traceability and identification method for onboard equipment software of high-speed trains provided in this embodiment of the invention, as shown below. Figure 3 As shown, in one embodiment of the present invention, S102 includes:

[0097] S301: Divide the binary file into blocks according to a preset block size and generate block check values;

[0098] Specifically, to improve the accuracy and robustness of binary file integrity verification, the server does not directly perform overall hashing of the entire file when verifying the target firmware or middleware. Instead, it first divides the file into blocks according to a preset block size.

[0099] This segmentation process can be executed automatically according to the server's configured strategy, such as dividing the file into segments based on fixed lengths or logical boundaries formed by the software packaging method, thereby ensuring the repeatability of each file segment. For each segmented file segment, the server extracts its data content characteristics and generates a segmentation check value that reflects the integrity status of the file segment.

[0100] This segmented processing method avoids the problem of entire file verification failing due to changes in partial content. Even if only some sections of the file are replaced, tampered with, or have abnormal content inserted, this step can accurately locate the specific file block area where the anomaly occurred. This segmented verification mechanism further supports risk identification and refined problem tracking, improving the interpretability of verification results and the efficiency of supply chain fault location.

[0101] Figure 4 This is a schematic diagram of the fourth process of the supply chain traceability and identification method for onboard equipment software of high-speed trains provided in this embodiment of the invention, as shown below. Figure 4 As shown, in one embodiment of the present invention, S301 includes:

[0102] S401: Divide the binary file into blocks according to a preset block size to obtain file blocks;

[0103] Specifically, to improve the accuracy of content parsing and integrity verification of binary software files, the server first divides the target firmware or middleware into blocks based on a preset block size. This block size can be preset according to the actual software scale, compilation method, and vehicle equipment adaptation requirements in the supply chain, and remains consistent when performing verification tasks, thereby ensuring that the block boundaries are reproducible at different stages and at different times.

[0104] After the block processing is completed, the software file is divided into multiple sequentially independent file blocks. The server can perform subsequent feature analysis and check value generation operations on different file blocks separately, without having to process the entire file at once. This avoids the problem of excessive computational overhead or difficulty in locating large firmware files.

[0105] S402: Extract block feature information for each of the file blocks;

[0106] Specifically, after generating each file block, the server performs content analysis and data extraction on a block-by-block basis to obtain block feature information that can be used to reflect the structure and composition attributes of the file blocks. This feature information is used to characterize the uniqueness and content status of the file block in the supply chain. The extraction focus is not on the file's functional logic, but on the distinctive and stable feature attributes in the binary structure.

[0107] Because this process operates on a file block basis, even partial changes to the content of the entire file will not affect unmodified file blocks, thus maintaining overall verification sensitivity while enabling local content tracking. This feature information is ultimately used to generate block verification values, providing a basis for subsequent risk identification and integrity verification.

[0108] S403: Generate the corresponding block verification value based on the block feature information.

[0109] Specifically, after extracting the feature information of file blocks, the server further generates a corresponding block check value based on the feature content of each file block. This check value is irreversibly calculated using a cryptographic hash algorithm, ensuring that any minute changes to the content will be reflected in the check result, thus highlighting the uniqueness and tamper-proof nature of the check value.

[0110] Each block checksum is only associated with its corresponding file block. Therefore, if changes to the overall file checksum are found in subsequent supply chain processes, these block checksums can be compared one by one to determine which part of the content has been changed, thereby quickly locating the risky file segment and guiding subsequent investigations.

[0111] By generating segmented verification values, this invention establishes a verification mechanism that breaks down the integrity monitoring of the entire file into local areas. This addresses the problem of coarse granularity in traditional whole-file verification, prevents minor content changes from being overlooked, and provides basic data for subsequent overall verification value calculation and risk identification.

[0112] S302: Summarize the block check values ​​and generate an overall check value using the SM3 cryptographic hash algorithm.

[0113] Specifically, after generating all the block check values, the server summarizes the block check results to form an overall check value that can cover the entire binary file.

[0114] The overall checksum is not directly derived from the file content, but is calculated based on the aggregated results of the checksums of each block. The server uses the SM3 cryptographic hash algorithm as the overall checksum generation method. By performing irreversible hashing on the checksums of each block, a checksum that can uniquely represent the integrity of the entire file is constructed.

[0115] This overall checksum remains sensitive to differences in the file's global structure and content, and can be used to determine whether the file has been replaced or tampered with during circulation and delivery. When the file content changes at any location, the relevant block checksums will change accordingly, further causing a change in the overall checksum, thus ensuring high reliability of the verification process.

[0116] By adopting a two-layer mechanism of "block verification and positioning + overall verification and judgment", the server significantly enhances the accuracy and reliability of software delivery verification without increasing the workload of the supply chain, and effectively adapts to the actual application scenarios of large firmware and middleware files in the EMU software supply chain.

[0117] In one embodiment, the software middleware file deployed in the network control unit of a high-speed train is used as the target object, and integrity verification and traceability identification are generated based on a block-based mechanism. Given that onboard equipment software is typically large in size, using only a single file-level verification method can easily lead to the failure of the overall verification result due to changes in local content or replacement of some modules, which is detrimental to supply chain risk identification. Therefore, this embodiment uses a block-based verification technology constructed using the national cryptographic SM3 algorithm for content processing.

[0118] First, the target middleware file is divided into blocks according to a uniformly set block size (e.g., 4KB / block), resulting in multiple sequential and independent file blocks. Then, the server extracts features from each file block to obtain feature data characterizing the content state of that block, and generates a block verification value corresponding to each file block based on this feature data. If a local area of ​​the file is modified, such as by replacing a module, inserting malicious content, or changing the encryption shell, the corresponding block verification value will change accordingly, thus achieving precise location of the risky location within the file.

[0119] After obtaining all the block checksums, the server further aggregates the checksums of each block and uses the national cryptographic algorithm SM3 to generate an overall checksum covering the entire file. The overall checksum can be used to determine whether the file as a whole maintains content consistency, thus serving as a globally trusted identifier in the file delivery and verification process.

[0120] By combining segmented checksums with overall checksums, not only can specific problematic segments be quickly identified when risks or anomalies occur, but the entire file can also be ensured to remain unaltered or unreplaced throughout the supply chain, achieving a dual traceability effect of "local location capability + overall integrity assurance." This embodiment demonstrates that this solution can effectively adapt to real-world application scenarios where onboard software files for high-speed trains are large in scale, complex in structure, and frequently delivered across supply chain stages, significantly improving the security level and traceability of trusted software delivery.

[0121] S103: Associate the traceability fingerprint, the overall verification value, the test report document corresponding to the binary file, and the identity information of the responsible person to generate a unified verification value for the deliverables;

[0122] Specifically, to address the issue that verification results cannot be traced back to specific responsible parties in existing technologies, the server binds the file's own identification information with external business information.

[0123] The server combines the aforementioned traceability fingerprint and overall verification value with the test report document corresponding to the software delivery and the identity information of the responsible persons (such as the identity information of test participants, reviewers and delivery managers) to generate a unified verification value for the deliverables that can cover multiple dimensions of information such as document source, test status and responsible parties.

[0124] The unified verification value of this deliverable serves as authentication information for the phased delivery of the supply chain. It can provide a single, reliable entry point for upstream or downstream links to verify the source of the software and the chain of responsibility, thereby constructing a complete closed loop of reliable information in the software supply chain.

[0125] In one embodiment, the test report document includes the signature of the person in charge, test items, test results, and defect records; the identity information of the person in charge includes the person's ID card number.

[0126] S104: Risk identification and liability determination are performed based on the unified verification value of the delivered goods.

[0127] Specifically, when risk assessment of deliverables is required in the software supply chain, it can be quickly identified through a unified verification value for the deliverables.

[0128] On the one hand, the unified verification value includes traceability fingerprints and overall verification values, which can be used to determine whether the target file has been replaced, tampered with, or had abnormal components inserted. On the other hand, since this value is related to the test report and the information of the responsible person, when a risk is detected in the deliverable, its circulation path and the corresponding responsible entity can be further located, realizing a closed loop of traceability to the person responsible.

[0129] This mechanism not only shortens the time required for risk identification but also forms a chain of evidence that can be used for compliance audits and fault tracing, significantly improving the safe operation capability of the EMU onboard equipment software supply chain.

[0130] In one embodiment of the present invention, the method for tracing and identifying the supply chain of onboard equipment software for high-speed trains further includes:

[0131] The system sends the binary file, the test report document, the responsible person's identity information, and the unified verification value of the deliverables to the lower-level process system so that the lower-level process system can verify the validity of the unified verification value of the deliverables.

[0132] Specifically, after completing the generation of traceability fingerprints, the calculation of overall verification values, and the formation of unified verification values ​​for deliverables, the server does not simply stop at the current process stage with the verification results, but continues to execute delivery information transmission operations to achieve multi-level collaborative verification management of the supply chain.

[0133] The server sends the binary file body (deliverable files, such as code and software packages), test report documents, responsible person's identity information, and the generated unified verification value of deliverables to the lower-level process system, enabling the lower-level process system to directly perform further document acceptance and verification based on the above information.

[0134] During transmission, all types of information do not require semantic parsing. Instead, they are packaged and output as trusted deliverables. This allows lower-level processes to reconfirm the identity and integrity of files based on a unified verification value for the deliverables, thus avoiding verification biases caused by manual review or inference based solely on file naming. After receiving the above information, lower-level process systems can use the verification mechanism of this invention to verify the validity of the deliverables received at the current stage. This includes determining whether the delivered binary file is consistent with the test results, responsible person information, and their unified verification value, ensuring transparent and trustworthy handover between supply chain nodes.

[0135] By implementing this sending and verification mechanism, this invention achieves continuous and reliable transmission between supply chain links, enabling the software delivery process to no longer rely solely on the file content itself, but rather on authentication information with identity and responsibility chain characteristics. When risks or anomalies are discovered in subsequent stages of the supply chain, historical delivery records can be used to trace back to specific process nodes, achieving traceable management of problem points and points of responsibility, thereby significantly improving the security and traceability of the high-speed train onboard equipment software supply chain throughout its entire lifecycle.

[0136] In one embodiment, the software supply chain flow of a high-speed train's onboard system is used as the application scenario. A layered verification structure is introduced to achieve reliable verification and accountability throughout the entire software delivery process. The software lifecycle of high-speed train onboard equipment is relatively long, and its delivery process typically involves multiple stages, including system image creation, application software development, software integration and release, software distribution, and on-site deployment. These stages involve multiple deliveries and multi-role collaborations. Since malicious code, virus files, or unauthorized module changes can occur at any stage, relying solely on verification at a single stage cannot guarantee supply chain security. Therefore, it is necessary to establish a continuous and reliable verification system across the multiple levels of the supply chain.

[0137] Therefore, this embodiment generates and verifies delivery identification information at each process stage. After completing software construction and verification, this level of process transmits the deliverables to the next level process in a unified and trusted delivery format. The transmitted content includes: deliverable files (such as code files or software packages), corresponding test report documents, responsible person identification information, and the unified verification value of the deliverables generated in this embodiment. After receiving the above content, the lower-level process can confirm whether the source, composition, and completeness of the files meet expectations by verifying the validity of the unified verification value of the deliverables without relying on manual judgment or retesting, thereby ensuring the credibility and consistency of process connection.

[0138] As verification and transmission continue through each link of the supply chain, a software release record and its verification information that are completely consistent with the actual deployment status of the EMU software are ultimately formed. Since each layer of delivery has a verifiable chain of responsibility, when a cybersecurity incident or software anomaly occurs on-site, the delivery history can be traced back layer by layer along the supply chain to accurately pinpoint the link of risk impact and the corresponding responsible party, achieving rapid source tracing and accountability. This embodiment illustrates that a layered verification structure can significantly improve the security resilience and traceability of the EMU onboard equipment software supply chain, and is suitable for onboard software delivery systems with complex lifecycles and multi-stage collaboration.

[0139] In one embodiment of the present invention, the traceability feature information includes code module identifier, data interaction interface and file compilation features.

[0140] Specifically, in the process of reverse parsing a binary file to construct a source fingerprint, the source traceability feature information extracted by the server not only comes from the overall file structure, but also includes key technical attributes that can reliably reflect the composition and interaction relationships of software modules. Source traceability feature information may include, but is not limited to, code module identifiers, data interaction interfaces, and file compilation characteristics.

[0141] This invention provides a method for tracing and identifying the software supply chain of high-speed train onboard equipment. It constructs a traceability fingerprint based on the binary file of the target firmware or middleware; divides the binary file into blocks according to a preset block size to generate an overall verification value; associates the traceability fingerprint, the overall verification value, and the test report document and responsible person's identity information corresponding to the binary file to generate a unified verification value for deliverables; and performs risk identification and responsibility positioning based on the unified verification value for deliverables, achieving precise positioning of risk segments and cross-process, cross-version, and verifiable full lifecycle software supply chain traceability.

[0142] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0143] Based on the same inventive concept, embodiments of the present invention also provide a traceability and identification device for the software supply chain of high-speed train onboard equipment, which can be used to implement the traceability and identification method for the software supply chain of high-speed train onboard equipment described in the above embodiments, as described in the following embodiments. Since the principle of the software supply chain traceability and identification device for high-speed train onboard equipment is similar to that of the software supply chain traceability and identification method for high-speed train onboard equipment, embodiments of the software supply chain traceability and identification device for high-speed train onboard equipment can refer to embodiments of the software supply chain traceability and identification method for high-speed train onboard equipment, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0144] Figure 5 This is a schematic block diagram of the first structure of the onboard equipment software supply chain traceability and identification device for high-speed trains provided in this embodiment of the invention, as shown below. Figure 5 As shown, in one embodiment of the present invention, the on-board equipment software supply chain traceability and identification device of the present invention includes:

[0145] The traceability fingerprint construction unit 501 is used to construct a traceability fingerprint based on the binary file of the target firmware or middleware;

[0146] The overall check value generation unit 502 is used to divide the binary file into blocks according to a preset block size and generate an overall check value;

[0147] The verification value generation unit 503 is used to associate the traceability fingerprint, the overall verification value, the test report document corresponding to the binary file, and the identity information of the responsible person to generate a unified verification value for the deliverables;

[0148] Risk and liability positioning unit 504 is used to identify risks and position liabilities based on the unified verification value of the delivered goods.

[0149] Figure 6 This is a schematic block diagram of the second structure of the onboard equipment software supply chain traceability and identification device for high-speed trains provided in this embodiment of the invention. Figure 5 Based on the embodiments, further, such as Figure 6 As shown, in one embodiment of the present invention, the traceability fingerprint construction unit 501 includes:

[0150] The source traceability feature information extraction module 601 is used to reverse engineer and parse the binary file to extract source traceability feature information;

[0151] The traceability fingerprint construction module 602 is used to construct the traceability fingerprint based on the traceability feature information using a cryptographic algorithm.

[0152] Figure 7 This is a schematic block diagram of the third structure of the onboard equipment software supply chain traceability and identification device for high-speed trains provided in this embodiment of the invention. Figure 5 Based on the embodiments, further, such as Figure 7 As shown, in one embodiment of the present invention, the overall verification value generation unit 502 includes:

[0153] The block check value generation module 701 is used to divide the binary file into blocks according to a preset block size and generate block check values.

[0154] The overall verification value generation module 702 is used to summarize the block verification values ​​and generate an overall verification value using the SM3 cryptographic hash algorithm.

[0155] Figure 8 This is a schematic block diagram of the fourth structure of the onboard equipment software supply chain traceability and identification device for high-speed trains provided in this embodiment of the invention. Figure 7 Based on the embodiments, further, such as Figure 8 As shown, in one embodiment of the present invention, the block verification value generation module 701 includes:

[0156] The file segmentation submodule 801 is used to segment the binary file into blocks according to a preset block size to obtain file blocks;

[0157] The block feature information extraction submodule 802 is used to extract block feature information for each of the file blocks respectively;

[0158] The block check value generation submodule 803 is used to generate corresponding block check values ​​based on the block feature information.

[0159] Figure 9 This is a schematic block diagram of the fifth structure of the onboard equipment software supply chain traceability and identification device for high-speed trains provided in this embodiment of the invention. Figure 5 Based on the embodiments, further, such as Figure 9 As shown, in one embodiment of the present invention, the on-board equipment software supply chain traceability and identification device for high-speed trains further includes:

[0160] The information transmission unit 901 sends the binary file, the test report document, the responsible person's identity information, and the unified verification value of the deliverables to the lower-level process system so that the lower-level process system can verify the validity of the unified verification value of the deliverables.

[0161] In one embodiment of the present invention, the traceability feature information includes code module identifier, data interaction interface and file compilation features.

[0162] This invention provides a method and apparatus for tracing and identifying the software supply chain of high-speed train onboard equipment. It constructs a traceability fingerprint based on the binary file of the target firmware or middleware; divides the binary file into blocks according to a preset block size to generate an overall verification value; associates the traceability fingerprint, the overall verification value, and the test report document and responsible person's identity information corresponding to the binary file to generate a unified verification value for deliverables; and performs risk identification and responsibility positioning based on the unified verification value for deliverables, achieving precise positioning of risk segments and cross-process, cross-version, and verifiable full lifecycle software supply chain traceability.

[0163] Figure 10 This is a schematic diagram of the structure of the computer device provided in an embodiment of the present invention, such as... Figure 10As shown, the electronic device may include: a processor 1001, a communication interface 1002, a memory 1003, and a communication bus 1004, wherein the processor 1001, the communication interface 1002, and the memory 1003 communicate with each other through the communication bus 1004. The processor 1001 can call logical instructions in the memory 1003 to execute the following methods: constructing a traceability fingerprint based on the binary file of the target firmware or middleware; dividing the binary file into blocks according to a preset block size to generate an overall verification value; associating the traceability fingerprint, the overall verification value, and the test report document and responsible person identity information corresponding to the binary file to generate a unified verification value for the deliverable; and performing risk identification and responsibility positioning based on the unified verification value for the deliverable.

[0164] Furthermore, the logical instructions in the aforementioned memory 1003 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a top-drive control center server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0165] This embodiment discloses a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can execute the methods provided in the above-described method embodiments, such as: constructing a traceability fingerprint based on a binary file of a target firmware or middleware; dividing the binary file into blocks according to a preset block size to generate an overall verification value; associating the traceability fingerprint, the overall verification value, and the test report document and responsible person identity information corresponding to the binary file to generate a unified verification value for deliverables; and performing risk identification and responsibility positioning based on the unified verification value for deliverables.

[0166] This embodiment provides a computer-readable storage medium storing a computer program that causes the computer to execute the methods provided in the above-described method embodiments. These methods include, for example: constructing a traceability fingerprint based on a binary file of a target firmware or middleware; dividing the binary file into blocks according to a preset block size to generate an overall verification value; associating the traceability fingerprint, the overall verification value, and the test report document and responsible person identity information corresponding to the binary file to generate a unified verification value for the deliverables; and performing risk identification and responsibility determination based on the unified verification value for the deliverables.

[0167] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0168] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0169] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0170] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0171] In the description of this specification, the references to terms such as "an embodiment," "a specific embodiment," "some embodiments," "for example," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0172] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this application. It should be understood that the above descriptions are merely specific embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for tracing and identifying the supply chain of onboard equipment software for high-speed trains, characterized in that, include: Construct a source fingerprint based on the binary file of the target firmware or middleware; The binary file is divided into blocks according to a preset block size to generate an overall check value; The traceability fingerprint, the overall verification value, the test report document corresponding to the binary file, and the identity information of the responsible person are associated to generate a unified verification value for the deliverables; Risk identification and liability determination are based on the unified verification value of the delivered items.

2. The method for tracing and identifying the supply chain of onboard equipment software for high-speed trains according to claim 1, characterized in that, The construction of the source fingerprint based on the binary file of the target firmware or middleware includes: The binary file is reverse engineered and parsed to extract source traceability information; Based on the source tracing feature information, the source tracing fingerprint is constructed using a cryptographic algorithm.

3. The method for tracing and identifying the supply chain of onboard equipment software for high-speed trains according to claim 1, characterized in that, The step of dividing the binary file into blocks according to a preset block size to generate an overall checksum includes: The binary file is divided into blocks according to a preset block size, and block check values ​​are generated. The block check values ​​are summarized, and the SM3 cryptographic hash algorithm is used to generate the overall check value.

4. The method for tracing and identifying the supply chain of onboard equipment software for high-speed trains according to claim 3, characterized in that, The step of dividing the binary file into blocks according to a preset block size and generating block check values ​​includes: The binary file is divided into blocks according to a preset block size to obtain file blocks; Extract block feature information from each of the aforementioned file blocks; The corresponding block verification value is generated based on the block feature information.

5. The method for tracing and identifying the supply chain of onboard equipment software for high-speed trains according to claim 1, characterized in that, Also includes: The system sends the binary file, the test report document, the responsible person's identity information, and the unified verification value of the deliverables to the lower-level process system so that the lower-level process system can verify the validity of the unified verification value of the deliverables.

6. The method for tracing and identifying the supply chain of onboard equipment software for high-speed trains according to claim 2, characterized in that, The traceability feature information includes code module identifiers, data interaction interfaces, and file compilation features.

7. A software supply chain traceability and identification device for high-speed trains, characterized in that, include: The source fingerprint construction unit is used to construct a source fingerprint based on the binary file of the target firmware or middleware; The overall check value generation unit is used to divide the binary file into blocks according to a preset block size and generate an overall check value; The verification value generation unit is used to associate the traceability fingerprint, the overall verification value, the test report document corresponding to the binary file, and the identity information of the responsible person to generate a unified verification value for the deliverables. The risk and liability identification unit is used to identify risks and assign responsibilities based on the unified verification value of the delivered goods.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6.

Images