WO2015131324A1

WO2015131324A1 - Software security detection method, apparatus and device

Info

Publication number: WO2015131324A1
Application number: PCT/CN2014/072826
Authority: WO
Inventors: 谭平
Original assignee: 华为技术有限公司
Priority date: 2014-03-04
Filing date: 2014-03-04
Publication date: 2015-09-11
Also published as: CN105190637A

Abstract

A software security detection method, apparatus and device. The method comprises: a network management device obtaining original summary information from a network element device, the original summary information being summary information generated by the network element device for software code loaded in a memory; the network management device receiving verification summary information sent by the network element device, the verification summary information being summary information generated by the network element device during the running of the software code; and the network management device comparing the verification summary information with the original summary information to determine whether they are consistent, if not, determining that the software code is not secure, and if yes, determining that the software code is secure. By using embodiments of the present invention, whether software suffers a malicious attack during the running of the software can be detected because a network element device can send, to a network management device, summary information during the running of the software, so that the security of software running on the network element device can be protected, thereby improving the dynamic security of the software.

Description

Software security testing method, device and device

Technical field

[01] The present invention relates to the field of information security technologies, and in particular, to a software security detection method, apparatus, and device. Background technique

[02] Malware can modify or replace software on some network element devices, invade the system of the network element device, destroy the system, or steal information on the network element device. In the prior art, the integrity of the software on the network element device can be verified by using a digital signature, that is, the network management device can generate a digital signature of the software when the software is released or upgraded, and package the digital signature in the software. Then, it is sent to the network element device, and the network element device verifies the security of the software according to the digital signature before loading the software, and loads the software after the verification is passed.

[03] The inventor found in the research process of the prior art that when the integrity and credibility of the software on the network element device is protected, the verification can usually only be performed before the software is loaded. A static verification method, when the software is maliciously attacked during the running process, the software is difficult to verify, thus reducing the dynamic security of the software running on the network element device. Summary of the invention

The embodiment of the invention provides a software security detection method, device and device, which solves the problem that the network element device in the prior art is difficult to protect the dynamic security during the running of the software.

[05] In order to solve the above technical problem, the embodiment of the present invention discloses the following technical solution: [06] In a first aspect, a software security detection method is provided, where the method includes: [07] a network management device obtains from a network element device The original summary information, where the original summary information is summary information generated by the network element device for software code loaded in the memory;

[08] The network management device receives the verification summary information sent by the network element device, where the verification summary information is summary information generated by the network element device during the running of the software code; [09] The network management device compares whether the verification summary information is consistent with the original summary information, and if not, determines that the software code is unsecure, and if yes, determines that the software code is secure.

[10] In combination with the first aspect, in a first possible implementation manner of the first aspect, the network management device obtains the original summary information from the network element device, including: [11] the network management device to the network element device Sending a request message of the original summary information, and receiving the original summary information returned by the network element device according to the request message of the original summary information; or

[12] The network management device receives the original summary information reported to the network management device when the network element device loads the software code in the memory.

[13] In combination with the first aspect, or the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the network management device receives the verification summary information sent by the network element device , including:

[14] The network management device receives the verification summary information reported by the network element device according to a set time period; or

[15] The network management device sends a report request message for verifying summary information to the network element device, and receives the verification summary information returned by the network element device according to the report request message of the verification summary information. [16] In a second aspect, a software security detection method is provided, where the method includes:

[17] The network element device sends the original summary information to the network management device, where the original summary information is summary information generated by the network element device for the software code loaded in the memory;

[18] The network element device sends the verification summary information of the software code to the network management device during the running of the software code, so that the network management device compares the verification summary information with the original summary information. Determine if the software code is secure.

[19] In combination with the second aspect, in a first possible implementation manner of the second aspect, the network element device sends the original summary information to the network management device, including:

[20] The network element device receives the request message of the original summary information sent by the network management device, and generates the original summary information for the software code loaded in the memory according to the request message of the original summary information, and the Sending the original summary information to the network management device; or [21] The network element device generates the original summary information for the software code when the software code is loaded in the memory, and reports the original summary information to the network management device.

[22] In combination with the second aspect, or the first possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, the network element device is in the process of running the software code The network management device sends the verification summary information of the software code, including:

[23] The network element device generates the verification summary information of the software code according to the set time period, and sends the verification summary information to the network management device during the running of the software code; or

[24] The network element device receives the report request message of the verification summary information sent by the network management device during the running of the software code, and generates the verification summary information of the software code according to the report request message of the verification summary information. And sending the verification summary information to the network management device.

[25] In a third aspect, a software security detecting apparatus is provided, where the apparatus includes:

[26] an obtaining unit, configured to obtain original summary information from the network element device, where the original summary information is summary information generated by the network element device for software code loaded in the memory;

[27] a receiving unit, configured to receive the verification summary information sent by the network element device, where the verification summary information is summary information generated by the network element device during the running of the software code;

[28] a detecting unit, configured to compare whether the verification summary information received by the receiving unit is consistent with the original summary information obtained by the obtaining unit, and if not, determining that the software code is unsafe, and if yes, Determine the software code security.

[29] In combination with the third aspect, in a first possible implementation manner of the third aspect, [30] the obtaining unit includes: a request message sending subunit and a first original digest receiving subunit;

[31] the request message sending subunit, configured to send a request message of the original digest information to the network element device;

[32] the first original digest receiving subunit, configured to receive the original digest information returned by the network element device according to the request message of the original digest information sent by the request message sending subunit;

[33] Alternatively, the obtaining unit includes: a second original digest receiving subunit; [34] The second original digest receiving subunit is configured to receive the original digest information reported by the network element device when the software code is loaded in the memory.

[35] In combination with the third aspect, or the first possible implementation manner of the third aspect, in a second possible implementation manner of the third aspect, [36] the receiving unit includes: a first verification digest receiver Unit

[37] the first verification digest receiving subunit, configured to receive the verification summary information reported by the network element device according to a set time period;

[38] Alternatively, the receiving unit includes: a report request sending subunit and a second verification digest receiving subunit;

[39] the report request sending subunit, configured to send a report request message of the verification summary information to the network element device;

[40] The second verification digest receiving subunit is configured to receive the verification digest information returned by the network element device according to the reporting request message of the verification digest information sent by the reporting request sending subunit.

[41] In a fourth aspect, a software security detecting apparatus is provided, where the apparatus includes:

[42] The first sending unit is configured to send the original summary information to the network management device, where the original summary information is summary information generated for the software code loaded in the memory;

[43] a second sending unit, configured to send, to the network management device, verification summary information of the software code during the running of the software code, so that the network management device compares the verification sent by the second sending unit The summary information and the original summary information sent by the first sending unit determine whether the software code is secure.

[44] In conjunction with the fourth aspect, in a first possible implementation manner of the fourth aspect, [45] the first sending unit includes: a request message receiving subunit, a first original digest generating subunit, and a first original Summary sending subunit;

[46] the request message receiving subunit, configured to receive a request message of the original summary information sent by the network management device;

[47] the first original digest generating subunit, configured to receive the original received by the subunit according to the request message The request message of the summary information generates the original summary information for the software code loaded in the memory;

[48] the first original digest sending subunit, configured to send the original digest information generated by the first original digest generating subunit to the network management device;

[49] Alternatively, the first sending unit includes: a second original digest generating subunit and a second original digest sending subunit;

[50] the second original digest generating subunit, configured to generate the original digest information for the software code when the software code is loaded in the memory;

[51] The second original digest sending subunit is configured to report, to the network management device, original digest information generated by the second original digest generating subunit.

[52] In combination with the fourth aspect, or the first possible implementation manner of the fourth aspect, in a second possible implementation manner of the fourth aspect,

[53] The second sending unit includes: a first verification digest generating unit and a first verification digest sending subunit;

[54] the first verification digest generating unit is configured to generate verification summary information of the software code according to a set time period during the running of the software code;

[55] the first verification digest sending subunit, configured to send the verification digest information generated by the first verification digest generating unit to the network management device;

[56] Alternatively, the second sending unit includes: a report request receiving subunit, a second verification digest generating subunit, and a second verification digest sending subunit;

[57] the report request receiving subunit, configured to receive a report request message of the verification summary information sent by the network management device during the running of the software code;

[58] the second verification digest generating subunit, configured to generate verification digest information of the software code according to the reporting request message of the verification digest information received by the reporting request receiving subunit;

[59] The second verification digest sending subunit is configured to send the verification digest information generated by the second verification digest generating subunit to the network management device. [60] The fifth aspect provides a network management device, where the network management device includes: a network interface and a processor, where

[61] the network interface, configured to obtain original summary information from a network element device, where the original summary information is summary information generated by the network element device for software code loaded in a memory, and receiving the network element device The verification summary information that is sent, the verification summary information is summary information generated by the network element device during the running of the software code;

[62] The processor is configured to compare whether the verification summary information is consistent with the original summary information, and if not, determine that the software code is unsafe, and if yes, determine that the software code is secure.

With reference to the fifth aspect, in a first possible implementation manner of the fifth aspect, the network interface is specifically configured to send a request message of the original digest information to the network element device, and receive the network element The original summary information returned by the device according to the request message of the original summary information; or the original summary information reported to the network management device when the network element device loads the software code in the memory.

With the fifth aspect, or the first possible implementation manner of the fifth aspect, in a second possible implementation manner of the fifth aspect, the network interface is specifically configured to receive the network element device according to And the verification summary information reported by the set time period; or sending the report request message of the verification summary information to the network element device, and receiving the report returned by the network element device according to the report request message of the verification summary information Verify summary information.

[65] In a sixth aspect, a network element device is provided, where the network element device includes: a network interface and a processor, where

[66] the processor is configured to send the original summary information to the network management device by using the network interface, where the original summary information is summary information generated by the network element device for software code loaded in the memory, and Sending, by the network interface, the verification summary information of the software code to the network management device, in the running of the software code, to enable the network management device to determine the verification by comparing the verification summary information with the original summary information. Is the software code secure?

With reference to the sixth aspect, in a first possible implementation manner of the sixth aspect, the processor is specifically configured to: after the network interface receives the request message of the original digest information sent by the network management device, Generating the original summary information for the software code loaded in the memory according to the request message of the original summary information, and sending the original summary information to the network management device through the network interface; or loading in the memory And generating, by the software code, the original summary information for the software code, and using the network interface to the network management The device reports the original summary information.

[68] In combination with the sixth aspect, or the first possible implementation manner of the sixth aspect, in a second possible implementation manner of the sixth aspect, the processor is specifically used in the running process of the software code Generating verification summary information of the software code according to the set time period, and sending the verification summary information to the network management device through the network interface; or, when the software code is running, when the network interface After receiving the report request message of the verification summary information sent by the network management device, generating the verification summary information of the software code according to the report request message of the verification summary information, and sending the verification summary information to the network interface through the network interface The network management device.

In the embodiment of the present invention, the network management device obtains the original summary information from the network element device, where the original summary information is summary information generated by the network element device for the software code loaded in the memory, and the network element device runs during the software code. The verification summary information is generated, and the network management device receives the verification summary information sent by the network element device, and compares whether the verification summary information is consistent with the original summary information. If not, it determines that the software code is insecure, and if so, determines the software code security. According to the embodiment of the present invention, the network element device can send the summary information in the running process of the software to the network management device, so that it can detect whether the software is maliciously attacked during the running process, so that the software in the running process can be performed on the network element device. The security is protected and the dynamic security of the software is improved. DRAWINGS

[70] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the prior art description will be briefly described below, and obviously, in the following description The drawings are only some of the embodiments of the present invention, and other drawings may be obtained from those of ordinary skill in the art without departing from the scope of the invention.

1A is a flow chart of an embodiment of a software security detection method according to the present invention;

1B is a flow chart of another embodiment of a software security detection method according to the present invention;

2 is a flow chart of another embodiment of a software security detection method according to the present invention;

3 is a flow chart of another embodiment of a software security detection method according to the present invention; [75] FIG. 4 is a flowchart of another embodiment of a software security detection method according to the present invention;

FIG. 5 is a flowchart of another embodiment of a software security detection method according to the present invention; FIG. 6 is a block diagram of an embodiment of a software security detecting apparatus according to the present invention;

7 is a block diagram of another embodiment of a software security detecting apparatus of the present invention;

8 is a block diagram of an embodiment of a network management device of the present invention; [80] FIG. 9 is a block diagram of an embodiment of a network element device of the present invention. detailed description

The above described objects, features, and advantages of the embodiments of the present invention will become more apparent and understood. The technical solution is described in further detail.

FIG. 1A is a flowchart of an embodiment of a software security detection method according to the present invention. The embodiment describes a security detection process during software operation from a network management device side:

[83] Step 101: The network management device obtains the original summary information from the network element device, where the original summary information is summary information generated by the network element device for the software code loaded in the memory.

[84] Optionally, the network management device may send the request message of the original digest information to the network element device, and receive the original digest information returned by the network element device according to the request message of the original digest information; or the network management device may also receive the network element device. The original summary information reported to the network management device when the software code is loaded in memory.

[85] Step 102: The network management device receives the verification summary information sent by the network element device, where the verification summary information is summary information generated by the network element device during the running of the software code.

[86] Optionally, the network management device may receive the verification summary information reported by the network element device according to the set time period; or the network management device may send the report of the verification summary information to the network element device, and receive the network element device according to the Verification summary information returned by the report request message of the verification summary information.

[87] Step 103: The network management device compares the verification summary information with the original summary information. If not, it determines that the software code is not secure, and if so, determines the software code security.

[88] It can be seen from the foregoing embodiment that the network element device can send the summary information in the running process of the software to the network management device, so that it can detect whether the software is maliciously attacked during the running process, and thus can run on the network element device. The security of the software in the protection protects the dynamic security of the software. [0] FIG. 1B is a flowchart of another embodiment of a software security detection method according to the present invention. The embodiment describes a security detection process during software operation from a network element device side:

[90] Step 111: The network element device sends the original summary information to the network management device, where the original summary information is summary information generated by the network element device for the software code loaded in the memory. [91] Optionally, the network element device may receive the request message of the original summary information sent by the network management device, generate the original summary information for the software code loaded in the memory according to the request message of the original summary information, and send the original summary information to the The network management device; or the network element device may also generate the original summary information for the software code when the software code is loaded in the memory, and report the original summary information to the network management device.

[92] Step 112: The network element device sends the verification summary information of the software code to the network management device during the running of the software code, so that the network management device determines whether the software code is secure by comparing the verification summary information with the original summary information.

[93] Optionally, the network element device may generate the verification summary information of the software code according to the set time period during the running of the software code, and send the verification summary information to the network management device; or the network element device may also be in the software code. During the operation, the device sends a verification summary message of the verification summary information sent by the network management device, generates a verification summary information of the software code according to the report request message of the verification summary information, and sends the verification summary information to the network management device.

[94] It can be seen from the foregoing embodiment that the network element device can send the summary information in the running process of the software to the network management device, so that it can detect whether the software is maliciously attacked during the running process, so that the network element device can be run on the network element device. The security of the software in the protection protects the dynamic security of the software.

[95] Referring to FIG. 2, it is a flowchart of another embodiment of the software security detection method of the present invention: [96] Step 201: The network element device loads the software into the memory.

In the embodiment of the present invention, the network element device may be specifically a single board or the like. The network element device may be provided with a system on chip (SoC) security chip and a memory connected through a bus, wherein the SoC security chip It can further include a Central Processing Unit (CPU), a Field-Programmable Gate Array (FPGA), a Digital Signal Processor (DSP), and a Complex Programmable Logic ( Complex Programmable Logic). Device, CPU)), etc., the memory can include random access memory (RAM), flash memory, and the like. [98] When the network management device releases new software or software that upgrades the existing software, it generates a digital signature for the software, that is, the summary information of the network management device calculation software, and encrypts the summary information by the private key to generate a number. Signing, packaging the digital signature in the software, and sending the software package to the network element device. In the prior art, after receiving the software package, the network element device obtains the digital signature therein, and decrypts the digital signature with the public key to obtain the first a summary information, and the second summary information of the software is calculated in the same manner as the network management device side. If the first summary information is consistent with the second summary information, the software to be loaded is safe, if the first summary information and the second If the summary information is inconsistent, the software to be loaded is not secure, so as to ensure the static security of the software to be loaded.

[99] When the network element device determines the security of the software to be loaded by verifying the digital signature, the software is loaded into the memory, and the loading process may include decompressing and initializing the software. After the loading is completed, the software is usually in the form of software code. Running in memory, ie the software to be loaded is different from the software code loaded into memory.

[100] Step 202: The network management device sends a request message of the original summary information to the network element device.

In this embodiment, the network management device can be specifically an operation and maintenance center (OMC) device, and each network management device can implement communication with multiple network element devices. [102] In this embodiment, the network management device may send the request message of the original summary information to the network element device, and the network management device may send the request message after the preset time after the software package is sent to the network element device. Time to ensure that the network element device can complete the loading of the software code in the memory.

[103] Step 203: The network element device generates the original summary information after the software message loaded in the memory according to the request message of the original summary information. [104] In this embodiment, after receiving the request message of the original digest information, the network element device calculates the digest information of the software code that has been loaded in the memory, and uses the digest information as the original digest information. The summary information may also be referred to as a Message Digest, or a Digital Digest, which is a unique fixed-length value corresponding to the software code, which may be a one-way hash (Hash) encryption function to the software. The code is generated. If the software code itself changes, the calculated summary information will also change, so the summary information can verify the security and integrity of the software code.

[105] Step 204: The network element device sends the original summary information to the network management device.

[106] Step 205: The network management device saves the original summary information. [107] Step 206: The network element device generates the verification summary information of the software code according to the set time period during the running of the software code.

[108] In this embodiment, in order to verify the security during the running of the software code, the network element device may calculate the summary information of the software code according to the set time period during the running of the software code, and use the summary information as the verification summary information. For example, the network element device can set a timer. When the timer period of the timer arrives, the network element device is triggered to calculate the verification summary information of the timing period. In this step, the calculation method and process of the verification summary information are consistent with the original summary information, and are not described here.

[109] Step 207: The network element device reports the verification summary information to the network management device.

[110] Step 208: The network management device compares the verification summary information with the original summary information. When the verification summary information is inconsistent with the original summary information, the software code is determined to be insecure. When the verification summary information is consistent with the original summary information, the software code is determined. Safety.

[111] After receiving the verification summary information, the network management device can obtain the saved original summary information, and then compare whether the verification summary information is consistent with the original summary information. If they are consistent, it can be determined that the software code has not been tampered with during operation, and the software code is secure. If it is inconsistent, it can be determined that the software code has been tampered with during operation, so the software code is not secure. At this time, the network management device can trigger an alarm, or the administrator can perform manual intervention.

[112] It can be seen from the foregoing embodiment that the network element device can send the summary information in the running process of the software to the network management device, so that it can detect whether the software is maliciously attacked during the running process, so that the network element device can be run on the network element device. The security of the software in the protection protects the dynamic security of the software.

Referring to FIG. 3, it is a flowchart of another embodiment of the software security detection method of the present invention: [114] Step 301: The network element device loads software into the memory.

In the embodiment of the present invention, the network element device may be specifically a single board or the like, and the network element device may be provided with a SoC security chip and a memory, wherein the SoC security chip may further include a CPU, an FPGA, a DSP, a CPLD, and the like. , the memory can contain RAM, Flash, and so on.

[116] When the network management device releases new software or software that upgrades existing software, it will generate a digital signature for the software, package the digital signature in the software, and send the software package to the network element device. In the prior art, after receiving the software package, the network element device obtains the digital signature therein, and determines the software by verifying the digital signature. Whether it is safe, so as to ensure the static security of the software to be loaded. The specific process of verifying the received software by the network element device is consistent with the description in the foregoing step 201, and details are not described herein again.

[117] When the network element device determines the security of the software to be loaded by verifying the digital signature, the software is loaded into the memory, and the loading process may include decompressing and initializing the software. After the loading is completed, the software is usually in the form of software code. Running in memory, ie the software to be loaded is different from the software code loaded into memory.

[118] Step 302: The network management device sends a request message of the original summary information to the network element device.

In this embodiment, the network management device can be specifically an OMC device, and each network management device can implement communication with multiple network element devices. [120] In this embodiment, the network management device may send the request message of the original summary information to the network element device, and the network management device may send the request message after the preset time after the software package is sent to the network element device. Time to ensure that the network element device can complete the loading of the software code in the memory.

[121] Step 303: The network element device generates the original summary information after the software message loaded in the memory according to the request message of the original summary information. [122] In this embodiment, after receiving the request message of the original digest information, the network element device calculates the digest information of the software code that has been loaded in the memory, and uses the digest information as the original digest information. The summary information may be generated by a one-way Hash encryption function acting on the software code. If the software code itself changes, the calculated summary information may also change, so the summary information can verify the security of the software code and Integrity. [123] Step 304: The network element device sends the original summary information to the network management device. [124] Step 305: The network management device saves the original summary information.

[125] Step 306: The network element device receives the report request message of the verification summary information sent by the network management device during the running of the software code.

[126] The difference from the embodiment shown in FIG. 2 is that, in the running process of the software code on the network element device, the network management device can send the report request message of the verification summary information in real time according to the administrator's requirement. [127] Step 307: The network element device generates verification summary information of the software code according to the report request message of the verification summary information.

[128] After receiving the report request message of the verification summary information, the network element device calculates the summary information of the software code running in the current memory, and uses the summary information as the verification summary information, and the calculation manner and process of the verification summary information are consistent with the original summary information. , will not repeat them here.

[129] Step 308: The network element device sends the verification summary information to the network management device.

[130] Step 309: The network management device compares the verification summary information with the original summary information. When the verification summary information is inconsistent with the original summary information, determining that the software code is insecure, and determining the software code when the verification summary information is consistent with the original summary information. Safety. [131] After receiving the verification summary information, the network management device can obtain the saved original summary information, and then compare whether the verification summary information is consistent with the original summary information. If they are consistent, it can be determined that the software code has not been tampered with during the running process, and the software code is secure. If it is inconsistent, it can be determined that the software code has been tampered with during operation, so the software code is not secure. At this time, the network management device can trigger an alarm, or the administrator can perform manual intervention.

[132] It can be seen from the above embodiment that the network element device can send the summary information in the running process of the software to the network management device, so that it can detect whether the software is maliciously attacked during the running process, and thus can run on the network element device. The security of the software in the protection protects the dynamic security of the software.

[133] Referring to FIG. 4, it is a flowchart of another embodiment of the software security detection method of the present invention:

[134] Step 401: The network element device loads the software into the memory.

[136] When the network management device releases new software or software that upgrades existing software, it will generate a digital signature for the software, package the digital signature in the software, and send the software package to the network element device. In the prior art, after receiving the software package, the network element device obtains the digital signature therein, and determines whether the software is secure by verifying the digital signature, thereby ensuring the static security of the software to be loaded. The specific process of verifying the received software by the network element device is consistent with the description in the foregoing step 201, and details are not described herein again. [137] Step 402: The network element device generates original summary information for the software code when the software code is loaded in the memory.

[138] Unlike the foregoing embodiment shown in FIG. 2 and FIG. 3, the network element device in this embodiment may generate summary information of the software code in real time after loading the software code, and use the summary information as the original summary information. The summary information may be generated by a one-way Hash encryption function acting on the software code. If the software code itself changes, the calculated summary information may also change, so the summary information can verify the security of the software code and Integrity.

[139] Step 403: The network element device reports the original summary information to the network management device. [140] Step 404: The network management device saves the original summary information.

[141] Step 405: The network element device generates the verification summary information of the software code according to the set time period during the running of the software code.

[142] In this embodiment, in order to verify the security during the running of the software code, the network element device may calculate the summary information of the software code according to the set time period during the running of the software code, and use the summary information as the verification summary information. For example, the network element device can set a timer. When the timer period of the timer arrives, the network element device is triggered to calculate the verification summary information of the timing period. In this step, the calculation method and process of the verification summary information are consistent with the original summary information, and are not described here.

[143] Step 406: The network element device reports the verification summary information to the network management device.

[144] Step 407: The network management device compares the verification summary information with the original summary information. When the verification summary information is inconsistent with the original summary information, the software code is determined to be insecure. When the verification summary information is consistent with the original summary information, the software code is determined. Safety. [145] After receiving the verification summary information, the network management device can obtain the saved original summary information, and then compare whether the verification summary information is consistent with the original summary information. If they are consistent, it can be determined that the software code has not been tampered with during the operation, and the software code is secure. If it is inconsistent, it can be determined that the software code has been tampered with during operation, so the software code is not secure. At this time, the network management device can trigger an alarm, or the administrator can perform manual intervention.

[146] It can be seen from the above embodiment that the network element device can send the summary information in the running process of the software to the network management device, so that it can detect whether the software is maliciously attacked during the running process, so that the network element device can be run on the network element device. The security of the software in the protection protects the dynamic security of the software. Referring to FIG. 5, it is a flowchart of another embodiment of the software security detection method of the present invention: [148] Step 501: The network element device loads the software into the memory.

[150] When the network management device releases new software or software that upgrades existing software, it will generate a digital signature for the software, package the digital signature in the software, and send the software package to the network element device. In the prior art, after receiving the software package, the network element device obtains the digital signature therein, and determines whether the software is secure by verifying the digital signature, thereby ensuring the static security of the software to be loaded. The specific process of verifying the received software by the network element device is consistent with the description in the foregoing step 201, and details are not described herein again.

[151] Step 502: The network element device generates original summary information for the software code when the software code is loaded in the memory. Step 503: The network element device reports the original summary information to the network management device.

[152] Step 504: The network management device saves the original summary information.

[153] Unlike the foregoing embodiment shown in FIG. 2 and FIG. 3, the network element device in this embodiment may generate summary information of the software code in real time after the software code is loaded, and use the summary information as the original summary information. The summary information may be generated by a one-way Hash encryption function acting on the software code. If the software code itself changes, the calculated summary information may also change, so the summary information can verify the security of the software code and Integrity.

[154] Step 505: The network element device receives the report request message of the verification summary information sent by the network management device during the running of the software code.

The difference between the embodiment shown in FIG. 2 and FIG. 4 is that, in the running process of the software code on the network element device, the network management device can send the report request message of the verification summary information in real time according to the administrator's requirement.

[156] Step 506: The network element device generates verification summary information of the software code according to the report request message of the verification summary information. [157] After receiving the report request message of the verification summary information, the network element device calculates the summary information of the software code running in the current memory, and uses the summary information as the verification summary information to verify the calculation manner and process of the summary information. The original summary information is consistent and will not be described here.

[158] Step 507: The network element device sends the verification summary information to the network management device.

[159] Step 508: The network management device compares the verification summary information with the original summary information. When the verification summary information is inconsistent with the original summary information, determining that the software code is insecure, and determining the software code when the verification summary information is consistent with the original summary information. Safety.

[160] After receiving the verification summary information, the network management device can obtain the saved original summary information, and then compare whether the verification summary information is consistent with the original summary information. If they are consistent, it can be determined that the software code has not been tampered with during the operation, and the software code is secure. If it is inconsistent, it can be determined that the software code has been tampered with during operation, so the software code is not secure. At this time, the network management device can trigger an alarm, or the administrator can perform manual intervention. [161] It can be seen from the above embodiment that the network element device can send the summary information in the running process of the software to the network management device, so that it can detect whether the software is maliciously attacked during the running process, and thus can run on the network element device. The security of the software in the protection protects the dynamic security of the software.

Corresponding to the embodiment of the method for detecting software security of the method of the present invention, the present invention also provides an embodiment of a software security detecting device, a network management device, and a network element device. [163] Referring to FIG. 6, a block diagram of an embodiment of a software security detecting apparatus according to the present invention may be disposed on a network management device side:

The apparatus includes: an obtaining unit 610, a receiving unit 620, and a detecting unit 630.

[165] The obtaining unit 610 is configured to obtain original summary information from the network element device, where the original summary information is summary information generated by the network element device for software code loaded in the memory; [166] receiving unit 620 And for receiving the verification summary information sent by the network element device, where the verification summary information is summary information generated by the network element device during the running of the software code;

The detecting unit 630 is configured to compare whether the verification summary information received by the receiving unit 610 is consistent with the original summary information obtained by the obtaining unit 620, and if not, determining that the software code is unsafe. If so, the software code is determined to be secure. [168] Optionally, the obtaining unit 610 may include (not shown in FIG. 6): [169] a request message sending subunit, configured to send a request message of the original digest information to the network element device;

And a first original digest receiving subunit, configured to receive the original digest information returned by the network element device according to the request message that sends the original digest information sent by the subunit according to the request message.

[171] Optionally, the obtaining unit 610 may also include (not shown in FIG. 6): [172] a second original digest receiving subunit, configured to receive, after the network element device is loaded in the memory, The original summary information reported when the software code is reported.

[173] Optionally, the receiving unit 620 may include (not shown in FIG. 6):

[174] The first verification digest receiving subunit is configured to receive the verification digest information reported by the network element device according to the set time period; [175] Optionally, the receiving unit 620 may also include (FIG. 6 Not shown):

[176] a report request sending subunit, configured to send a report request message of the verification summary information to the network element device;

And a second verification digest receiving subunit, configured to receive the verification digest information returned by the network element device according to the reporting request message of the verification digest information sent by the sub-unit.

FIG. 7 is a block diagram of another embodiment of a software security detecting apparatus according to the present invention. The apparatus may be disposed on a network element device side:

The apparatus includes: a first transmitting unit 710 and a second transmitting unit 720.

[180] The first sending unit 710 is configured to send the original summary information to the network management device, where the original summary information is summary information generated for the software code loaded in the memory;

[181] The second sending unit 720 is configured to send the verification summary information of the software code to the network management device during the running of the software code, so that the network management device sends the comparison by the second sending unit. The verification summary information and the original summary information sent by the first sending unit determine whether the software code is secure.

[182] Optionally, the first sending unit 710 may include (not shown in FIG. 7):

[183] a request message receiving subunit, configured to receive a request message of the original digest information sent by the network management device; a first original digest generating subunit, configured to generate the original digest information for the software code loaded in the memory according to the request message that the request message receives the original digest information received by the subunit;

[185] The first original digest sending subunit is configured to send the original digest information generated by the first original digest generating subunit to the network management device.

[186] Optionally, the first sending unit 710 may also include (not shown in FIG. 7):

[187] a second original digest generating subunit, configured to generate the original digest information for the software code when the software code is loaded in the memory;

And a second original digest sending subunit, configured to report, to the network management device, original digest information generated by the second original digest generating subunit.

[189] Optionally, the second sending unit 720 may include (not shown in FIG. 7):

a first verification digest generating unit, configured to generate verification summary information of the software code according to a set time period during the running of the software code;

[191] The first verification digest sending subunit is configured to send the verification digest information generated by the first verification digest generating unit to the network management device.

[192] Optionally, the second sending unit 720 may also include (not shown in FIG. 7):

[193] a report request receiving subunit, configured to receive a report request message of the verification summary information sent by the network management device during the running of the software code;

[194] a second verification digest generating subunit, configured to generate verification digest information of the software code according to the reporting request message of the verification digest information received by the reporting request receiving subunit;

[195] The second verification digest sending subunit is configured to send the verification digest information generated by the second verification digest generating subunit to the network management device.

[196] See FIG. 8, which is a block diagram of an embodiment of the network management device of the present invention:

The network management device includes: a network interface 810 and a processor 820. [198] The network interface 810 is configured to obtain original summary information from a network element device, where the original summary information is summary information generated by the network element device for software code loaded in a memory, and receive the The verification summary information sent by the network element device, where the verification summary information is summary information generated by the network element device during the running of the software code; [199] the processor 820 is configured to compare the verification summary information Whether it is consistent with the original summary information, if not, determining that the software code is unsafe, and if so, determining that the software code is secure.

[200] Optionally, the network interface 810 may be specifically configured to send a request message of the original digest information to the network element device, and receive a request message returned by the network element device according to the request message of the original digest information. Or the original summary information reported to the network management device when the network element device loads the software code in the memory.

[201] Optionally, the network interface 810 may be specifically configured to receive the verification summary information that is reported by the network element device according to a set time period; or send a report of the verification summary information to the network element device. And requesting the message, and receiving the verification summary information returned by the network element device according to the report request message of the verification summary information. [202] Referring to FIG. 9, a block diagram of an embodiment of a network element device of the present invention is shown:

[00] The network element device includes: a network interface 910 and a processor 920.

The processor 920 is configured to send the original summary information to the network management device by using the network interface 910, where the original summary information is a summary generated by the network element device for the software code loaded in the memory. And the verification summary information of the software code is sent to the network management device by using the network interface 910 during the running of the software code, so that the network management device compares the verification summary information with the original The summary information determines if the software code is secure.

[205] Optionally, the processor 920 may be specifically configured to: when the network interface receives the request message of the original digest information sent by the network management device, the request message according to the original digest information is loaded in the memory. The software code in the middle generates the original summary information, and sends the original summary information to the network management device through the network interface; or, when the software code is loaded in the memory, generates the software code The original summary information is reported, and the original summary information is reported to the network management device by using the network interface.

[206] Optionally, the processor 920 may be specifically configured to follow the setting during the running of the software code. And generating the verification summary information of the software code, and sending the verification summary information to the network management device through the network interface; or, when the software code is running, when the network interface receives the network management After the report request message of the verification summary information sent by the device, the verification summary information of the software code is generated according to the report request message of the verification summary information, and the verification summary information is sent to the network management device by using the network interface. .

[207] It can be seen from the foregoing embodiment that the network management device obtains the original summary information from the network element device, where the original summary information is summary information generated by the network element device for the software code loaded in the memory, and the network element device is in the process of running the software code. The verification summary information is generated, and the network management device receives the verification summary information sent by the network element device, and compares whether the verification summary information is consistent with the original summary information. If not, it determines that the software code is insecure, and if so, determines the software code security. According to the embodiment of the present invention, the network element device can send the summary information in the running process of the software to the network management device, so that it can detect whether the software is maliciously attacked during the running process, so that the software in the running process can be performed on the network element device. The security is protected and the dynamic security of the software is improved.

It will be apparent to those skilled in the art that the techniques in the embodiments of the present invention can be implemented by means of software plus the necessary general hardware platform. Based on such understanding, the technical solution in the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product, which may be stored in a storage medium such as a ROM/RAM. , a diskette, an optical disk, etc., includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention or in some portions of the embodiments.

The various embodiments in the present specification are described in a progressive manner, and the same or similar parts between the various embodiments may be referred to each other, and each embodiment focuses on differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

The embodiments of the invention described above are not intended to limit the scope of the invention. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Rights request

1. A software security detection method, characterized in that the method includes:

The network management device obtains original summary information from the network element device, where the original summary information is the summary information generated by the network element device for the software code loaded in the memory;

The network management device receives verification summary information sent by the network element device, where the verification summary information is summary information generated by the network element device during the running of the software code;

The network management device compares whether the verification summary information is consistent with the original summary information. If not, it is determined that the software code is unsafe. If yes, it is determined that the software code is safe.

2. The method according to claim 1, characterized in that the network management device obtains original summary information from the network element device, including:

The network management device sends a request message for original summary information to the network element device, and receives the original summary information returned by the network element device according to the request message for the original summary information; or, the network management device receives the original summary information. The original summary information reported to the network management device when the network element device finishes loading the software code in the memory.

3. The method according to claim 1 or 2, characterized in that the network management device receives the verification summary information sent by the network element device, including:

The network management device receives the verification summary information reported by the network element device according to a set time period; or,

The network management device sends a verification summary information reporting request message to the network element device, and receives the verification summary information returned by the network element device according to the verification summary information reporting request message.

4. A software security detection method, characterized in that the method includes:

The network element device sends the original summary information to the network management device, where the original summary information is the summary information generated by the network element device for the software code loaded in the memory;

The network element device sends the verification summary information of the software code to the network management device during the running process of the software code, so that the network management device determines the verification summary information by comparing the verification summary information with the original summary information. Is the software code safe?

5. The method according to claim 4, characterized in that the network element device converts the original abstract The required information is sent to the network management device, including:

The network element device receives a request message for original summary information sent by the network management device, generates the original summary information for the software code loaded in the memory according to the request message for the original summary information, and converts the original summary information Send to the network management device; or,

When the network element device finishes loading the software code in the memory, it generates the original summary information for the software code, and reports the original summary information to the network management device.

6. The method according to claim 4 or 5, characterized in that the network element device sends the verification summary information of the software code to the network management device during the running of the software code, including: the network During the running process of the software code, the network element device generates the verification summary information of the software code according to the set time period, and sends the verification summary information to the network management device; or, the network element device generates the verification summary information when the software code is running. During the running of the code, receive a reporting request message for verification summary information sent by the network management device, generate verification summary information for the software code based on the reporting request message for verification summary information, and send the verification summary information to the Network management equipment.

7. A software security detection device, characterized in that the device includes:

An obtaining unit, configured to obtain original summary information from the network element device, where the original summary information is the summary information generated by the network element device for the software code loaded in the memory;

A receiving unit, configured to receive verification summary information sent by the network element device, where the verification summary information is summary information generated by the network element device during the running of the software code;

A detection unit, configured to compare whether the verification summary information received by the receiving unit is consistent with the original summary information obtained by the obtaining unit. If not, determine that the software code is unsafe. If yes, determine that the software code is unsafe. Software code is secure.

8. The device according to claim 7, characterized in that,

The obtaining unit includes: a request message sending subunit and a first original summary receiving subunit; the request message sending subunit is used to send a request message for original summary information to the network element device;

The first original summary receiving subunit is configured to receive the original summary information returned by the network element device according to the request message of the original summary information sent by the request message sending subunit;

Alternatively, the obtaining unit includes: a second original summary receiving subunit;

The second original summary receiving subunit is used to receive the network element device after loading the The original summary information reported when the software code is used.

9. The device according to claim 7 or 8, characterized in that,

The receiving unit includes: a first verification digest receiving subunit;

The first verification summary receiving subunit is used to receive the verification summary information reported by the network element device according to a set time period;

Alternatively, the receiving unit includes: a reporting request sending subunit and a second verification summary receiving subunit; the reporting request sending subunit is used to send a reporting request message of verification summary information to the network element device;

The second verification summary receiving subunit is configured to receive the verification summary information returned by the network element device according to the verification summary information reporting request message sent by the reporting request sending subunit.

10. A software security detection device, characterized in that the device includes:

The first sending unit is used to send original summary information to the network management device, where the original summary information is summary information generated for the software code loaded in the memory;

The second sending unit is configured to send the verification summary information of the software code to the network management device during the running process of the software code, so that the network management device compares the verification summary information sent by the second sending unit with The original summary information sent by the first sending unit determines whether the software code is safe.

11. The device according to claim 10, characterized in that,

The first sending unit includes: a request message receiving subunit, a first original summary generating subunit and a first original summary sending subunit;

The request message receiving subunit is used to receive the request message of the original summary information sent by the network management device;

The first original summary generating subunit is configured to generate the original summary information for the software code loaded in the memory according to the request message of the original summary information received by the request message receiving subunit; the first original summary is sent Subunit, configured to send the original summary information generated by the first original summary generation subunit to the network management device;

Alternatively, the first sending unit includes: a second original summary generating subunit and a second original summary sending subunit;

The second original summary generation subunit is used to generate the The software code generates the original summary information;

The second original summary sending subunit is configured to report the original summary information generated by the second original summary generating subunit to the network management device.

12. The device according to claim 10 or 11, characterized in that,

The second sending unit includes: a first verification digest generating unit and a first verification digest sending subunit;

The first verification summary generation unit is configured to generate verification summary information of the software code according to a set time period during the running process of the software code;

The first verification summary sending subunit is used to send the verification summary information generated by the first verification summary generation unit to the network management device;

Alternatively, the second sending unit includes: a reporting request receiving subunit, a second verification summary generating subunit, and a second verification summary sending subunit;

The reporting request receiving subunit is used to receive the reporting request message of the verification summary information sent by the network management device during the running process of the software code;

The second verification summary generating subunit is configured to generate verification summary information of the software code according to the reporting request message of the verification summary information received by the reporting request receiving subunit;

The second verification summary sending subunit is used to send the verification summary information generated by the second verification summary generating subunit to the network management device.

13. A network management device, characterized in that, the network management device includes: a network interface and a processor, wherein,

The network interface is used to obtain original summary information from the network element device. The original summary information is the summary information generated by the network element device for the software code loaded in the memory, and to receive verification sent by the network element device. Summary information, the verification summary information is summary information generated by the network element device during the running of the software code;

The processor is configured to compare whether the verification summary information is consistent with the original summary information. If not, determine that the software code is unsafe. If yes, determine that the software code is safe.

14. The network management equipment according to claim 13, characterized in that,

The network interface is specifically configured to send a request message for original summary information to the network element device, and receive the original summary information returned by the network element device according to the request message for the original summary information; Or, receive the original summary information reported to the network management device when the network element device has loaded the software code in the memory.

15. The network management device according to claim 13 or 14, characterized in that,

The network interface is specifically configured to receive the verification summary information reported by the network element device according to a set time period; or, send a reporting request message for verification summary information to the network element device, and receive the verification summary information from the network element device. The device returns the verification summary information according to the verification summary information reporting request message.

16. A network element device, characterized in that, the network element device includes: a network interface and a processor, wherein,

The processor is configured to send original summary information to the network management device through the network interface, where the original summary information is summary information generated by the network element device for the software code loaded in the memory, and, in the During the running of the software code, the verification summary information of the software code is sent to the network management device through the network interface, so that the network management device determines whether the software code is by comparing the verification summary information with the original summary information. Safety.

17. The network element device according to claim 16, characterized in that,

The processor is specifically configured to generate the original summary for the software code loaded in the memory according to the request message of the original summary information after the network interface receives the request message of the original summary information sent by the network management device. information, and send the original summary information to the network management device through the network interface; or, when the software code is loaded in the memory, generate the original summary information for the software code, and use the The network interface reports the original summary information to the network management device.

18. The network element device according to claim 16 or 17, characterized in that,

The processor is specifically configured to generate verification summary information of the software code according to a set time period during the running process of the software code, and send the verification summary information to the network management device through the network interface; Or, when the network interface receives the reporting request message of the verification summary information sent by the network management device during the running of the software code, generate the verification summary information of the software code according to the reporting request message of the verification summary information. , and sends the verification summary information to the network management device through the network interface.