WO2018196383A1 - 一种电动汽车互联互通信息安全防护系统 - Google Patents

一种电动汽车互联互通信息安全防护系统 Download PDF

Info

Publication number
WO2018196383A1
WO2018196383A1 PCT/CN2017/114362 CN2017114362W WO2018196383A1 WO 2018196383 A1 WO2018196383 A1 WO 2018196383A1 CN 2017114362 W CN2017114362 W CN 2017114362W WO 2018196383 A1 WO2018196383 A1 WO 2018196383A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
module
network
virtual disk
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/114362
Other languages
English (en)
French (fr)
Inventor
王伟
徐石明
周静
张�浩
李捷
郑庆荣
赵建立
陈良亮
张卫国
唐雾婺
杨凤坤
刘爱华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
State Grid Zhejiang Electric Power Co Ltd
NARI Technology Co Ltd
State Grid Shanghai Electric Power Co Ltd
State Grid Corp of China SGCC
Original Assignee
State Grid Zhejiang Electric Power Co Ltd
NARI Technology Co Ltd
State Grid Shanghai Electric Power Co Ltd
State Grid Corp of China SGCC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by State Grid Zhejiang Electric Power Co Ltd, NARI Technology Co Ltd, State Grid Shanghai Electric Power Co Ltd, State Grid Corp of China SGCC filed Critical State Grid Zhejiang Electric Power Co Ltd
Publication of WO2018196383A1 publication Critical patent/WO2018196383A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G06F21/6263—Protecting personal data, e.g. for financial or medical purposes during internet communication, e.g. revealing personal data from cookies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2107—File encryption

Definitions

  • the invention relates to an electric vehicle interconnection and information security protection system, and belongs to the technical field of electric vehicles.
  • Electric vehicles are strategic emerging industries in China and play an important role in improving China's energy security, tackling climate change and improving environmental protection. China attaches great importance to the development of the electric vehicle industry.
  • General Secretary Xi Jinping pointed out that "developing new energy vehicles is the only way to become a car power.” China has formulated many important industrial policies and provided important guarantees for promoting the development of electric vehicles.
  • the electric vehicle charging facility is an important part of the smart grid and the basic guarantee for the development of the electric vehicle industry. It has been rapidly developed in recent years.
  • the electric vehicle charging network includes electric vehicle charging facilities, related distribution facilities, security facilities, electric vehicles, The storage and analysis of the operating parameters and data of the battery, etc., help to provide technical support for the development of electric vehicles and ensure their safe and reliable operation.
  • the electric vehicle interconnection platform is a new platform that contributes to the development of electric vehicle service networks.
  • foreign work on interconnection and interoperability mainly solves the problem of charging operation. It provides services for electric vehicle charging needs in their respective networks.
  • the systems are independent of each other, and the research work on interconnection security for charging security has not yet been carried out. Therefore, it is especially important to design an information security system with comprehensive protection capabilities.
  • the present invention provides an electric vehicle interconnection information security protection system.
  • An electric vehicle interconnection information security protection system comprising a network protection module and a file system protection module;
  • the network protection module is configured to filter network packets, implement control of network connection operations, and record detailed information of network actions;
  • the file system protection module includes a file monitoring module, a storage device control module, and a virtual disk control module;
  • the file monitoring module is configured to monitor file operations, record operation information of the file, and control file read and write according to access rights to the file;
  • the storage device control module is configured to perform read and write control on the storage device, and the storage device writes and has stored the file without using a confidential file;
  • the virtual disk control module is configured to create a virtual disk, load/unload a virtual disk, perform read/write control on the virtual disk, and write and store the virtual disk as a confidential file.
  • the confidential file is written to the virtual disk, the virtual disk is controlled.
  • the module encrypts it and decrypts the secret file in the virtual disk when it is read by the virtual disk control module.
  • the specific process of the file monitoring module is:
  • the operation information of the file is intercepted, and then the file operation is filtered according to the access right to the file. If the operation is allowed, the operation is released, and the related information of the operation is recorded through the log. If it is not allowed, the operation is rejected, and the related information of the illegal operation is recorded through the log.
  • Operational information includes creation, opening, reading, writing, setting, and closing of confidential files, as well as creation, opening, reading, writing, setting, and closing of files that do not require confidentiality.
  • the virtual disk control module authenticates the user's password when the virtual disk is mounted.
  • the working mode and the control rule are preset, and then the network packet is filtered according to the working mode and the control rule to realize the control of the network connection operation, and the detailed information of the network action is recorded through the log.
  • the network protection module uses Win Sock2 SPI technology for network packet filtering at the application layer and TDI at the transport layer.
  • HOOK technology controls network operations and uses NDIS at the network layer.
  • HOOK technology performs network packet filtering.
  • the invention achieves the beneficial effects: 1.
  • the invention realizes an information security protection system to effectively monitor and protect the electric vehicle information platform; 2.
  • the file system protection module of the invention adopts the RBAC model and the virtual disk. And operation filtering technology to achieve access control of files and storage devices and transparent encryption and decryption of files; network protection module Win Sock2 SPI technology, TDI HOOK and NDIS HOOK technology greatly improves the security performance of the system; both modules implement log function, record file operation and network behavior, and locate and analyze system intrusion behavior; 3.
  • the system can better maintain computer data. Confidentiality and integrity provide more reliable protection for personal information.
  • Figure 1 is a block diagram showing the structure of the present invention
  • FIG. 2 is a power supply diagram of the present invention
  • Figure 3 shows the flow of file read and write access control
  • FIG. 4 is a structural diagram of a virtual disk management module
  • Figure 5 is a block diagram of the network protection module.
  • an electric vehicle interconnection information security protection system includes a network protection module and a file system protection module.
  • the file system protection module includes a file monitoring module, a storage device control module, and a virtual disk control module.
  • the file monitoring module is used to monitor file operations, record operation information of files, and control file reading and writing according to access rights to files.
  • the module adopts the RBAC model to implement access control of the file system by the process.
  • the specific process is as follows: firstly, the operation information of the file is intercepted, and the operation information includes creation, opening, reading, writing, setting and closing of the confidential file, and no need to keep the confidential file. Create, open, read, write, set, and close, and then filter the file operations according to the access rights to the file. If the operation is allowed, release the information, and log the operation related information. If not, the operation is rejected. Information about illegal operations.
  • the file monitoring module includes a corresponding application module and a driving module, wherein the driving module is a core thereof, and the implementation mainly includes:
  • volume parameter block (VPB) pointer from the IRP; then, set the completion function and wait for the IRP to complete, get the file system volume device in the completion function and implement the binding process.
  • VB volume parameter block
  • Step1 intercept the read and write IRP sent by the upper layer
  • Step2 Determine whether the volume device is for the volume device, if yes, obtain the full path name of the file; if not, then go to Step6;
  • Step3 Find the corresponding rule in the rules table, if found, proceed to the next step; if not, go to Step6;
  • Step4 Determine whether you have access, if you can access, proceed to the next step; if not, go back and go to Step7;
  • Step 5 Temporarily store the record access log to the log access queue
  • Step6 Pass the IRP to the lower layer
  • Step7 End of reading and writing.
  • the implementation process includes obtaining logs, clearing log queues, setting a list of monitoring files, and setting a list of legal processes. Among them, when obtaining the log, first determine whether there is a log, if not, directly return no log, if there is, take a log from the log temporary storage queue, and convert the log format to a log of LOG format, and then put the output into the output Buffer.
  • the storage device control module is used for reading and writing control of the storage device, and the storage device writes and has stored the file without using a confidential file.
  • the storage device control module also includes a corresponding application module and a driver module, wherein the driver module is its core, and the implementation mainly includes:
  • the bus driver detects the device, and the PnP Manager creates a PDO and loads the filter driver and function driver corresponding to the PDO.
  • the storage device is loaded as an FDO onto the PDO, and the storage device will In addition, create a physical device, mount the disk driver Disk.sys, and then mount the partition driver Part Mgr.sys.
  • the disk sector read and write technology is used to add and delete the device security identifier.
  • the application module can call the Win32 API Read File and Write File function to read and write sectors, Windows I/O Manager will read and write requests IRP_MJ_READ or IRP_MJ_WRITE is sent to the partition driver Part Mgr.sys, the disk drive DISK converts the read and write request into a SCSI request packet and sends it to the SCSI port driver SCSIPORT.sys, constructs the IRP in the storage device filter driver and fills in the corresponding SRB, and then sends it to the lower layer driver. Process read and write requests.
  • the control of the storage device mainly implements these functions: dynamically capturing the loading of the storage device, disabling the device, reading the device, and preventing the program from running from the storage device.
  • the virtual disk control module is used to create a virtual disk, load/unload a virtual disk, read and write the virtual disk, and write and store the virtual disk as a confidential file.
  • the virtual disk control module pairs It encrypts and decrypts the secret file in the virtual disk when it is read by the virtual disk control module.
  • the virtual disk control module authenticates the user's password when the virtual disk is mounted.
  • the specific process is as follows:
  • Step1 Read 512 bytes of data from the head of the volume file into the memory; wherein the first 64 bytes of data are unencrypted salts, and the remaining data is stored encrypted, and the salt is used to transform the user password to generate The key that decrypts the head of the volume file.
  • Step2 Try to decrypt the volume file header data of the previous step, decrypt the volume file header data in the memory, and then try to use different Ha
  • the algorithm generates a key to decrypt the volume file header encrypted data until it is confirmed that the decryption is correct.
  • Step3 If the first 4 bytes of the plaintext after decryption are the string "TRUE" and the CRC-32 check value of 256 bytes after the plaintext is equal to the data at the 8th byte of the head of the volume file, the authentication passes, virtual The disk is successfully loaded. Otherwise, you need to re-enter the user password and repeat the above process.
  • Step4 After the header of the decrypted volume file is completed, the correct user password, encryption algorithm, encryption algorithm mode, volume file header key generation algorithm and key are determined; at this time, the system can be saved in the header of the volume file. The master key and the secondary key decrypt the rest of the volume data, and the virtual disk is successfully loaded.
  • the virtual disk control module also includes a corresponding application module and a driver module, wherein the driver module is its core, which is responsible for processing all I/O requests of the system to the virtual disk, in the process of processing the I/O request.
  • the encryption and decryption module is called to perform real-time encryption and decryption processing on the data stream.
  • the network protection module is used to filter the network packet, realize the control of the network connection action, and record the detailed information of the network action.
  • the specific process shown in FIG. 5 is: firstly, the working mode and the control rule are preset, and then the network packet is filtered according to the working mode and the control rule to implement the control of the network connection operation, and the detailed information of the network action is recorded through the log.
  • the network protection module uses Win Sock2 SPI technology for network packet filtering at the application layer; TDI is adopted at the transport layer. HOOK technology controls network operations; NDIS is used at the network layer HOOK technology performs network packet filtering.
  • the invention realizes an information security protection system for effectively monitoring and protecting the electric vehicle information platform; changing the file system protection module of the system, adopting the RBAC model, the virtual disk and the operation filtering technology to realize the access of the file and the storage device Control and file transparent encryption and decryption; network protection module Win Sock2 SPI technology, TDI HOOK and NDIS HOOK technology, greatly improve the security performance of the system; both modules implement the log function, record file operations and network behavior, It is used to locate and analyze system intrusion behavior; the system can better maintain the confidentiality and integrity of computer data, and provide more reliable protection services for personal information.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Medical Informatics (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

一种电动汽车互联互通信息安全防护系统，包括网络防护模块和文件系统防护模块；网络防护模块用以对网络封包进行过滤，实现连网动作的管控，记录网络动作的详细信息；文件系统防护模块包括文件监控模块、存储设备控制模块和虚拟磁盘控制模块；文件监控模块用以监视文件操作，记录文件的操作信息，根据对文件的访问权限控制文件读写；存储设备控制模块用以对存储设备进行读写控制；虚拟磁盘控制模块用以创建虚拟磁盘，加载/卸载虚拟磁盘，对虚拟磁盘进行读写控制。实现了一种信息安全防护系统，来对电动汽车信息平台进行有效的监控和防护，可以更好地维护计算机数据的保密性和完整性，为个人信息提供更加可靠的防护服务。

Description

一种电动汽车互联互通信息安全防护系统 技术领域
本发明涉及一种电动汽车互联互通信息安全防护系统，属于电动汽车技术领域。
 背景技术
电动汽车是我国战略性新兴产业，对提高我国能源安全、应对气候变化、改善环境保护起着重要作用。我国高度重视电动汽车产业发展，习近平总书记指出“发展新能源汽车是迈向汽车强国的必由之路”。我国制订了许多重要产业政策，为促进推广电动汽车的发展提供了重要的保障。电动汽车充电设施是智能电网的重要组成部分，也是电动汽车行业发展的基础保障，在近年得到快速的发展，电动汽车充电网络包括电动汽车充电设施、相关的配电设施、安防设施、电动汽车、蓄电池等，对其运行参数和数据进行采集、分析，有助于为电动汽车的发展提供技术支持，保障其安全可靠运行。
随着计算机应用的普及，计算机数据安全成为日益突出的问题，特别是在网络环境下，敏感数据受到网络泄漏的威胁。与此同时，数据安全技术也在快速发展，各种数据加密软件和网络防火墙等信息安全产品层出不穷，然而或多或少都存在各种问题。如何更好、更有效地保护个人信息数据安全成为当前研究的热点。电动汽车互联互通平台是一个新型平台，有助于电动汽车服务网络的发展。目前国外针对互联互通的工作主要解决充电运营层面问题，都是为各自网络内电动汽车充电需求提供服务，各系统之间相互独立，面向充电安全性的互联互通研究工作尚未开展。因此设计一个具有综合防护能力的信息安全系统显得尤为重要。
 技术问题
为了解决上述技术问题，本发明提供了一种电动汽车互联互通信息安全防护系统。
 技术解决方案
为了达到上述目的，本发明所采用的技术方案是：
一种电动汽车互联互通信息安全防护系统，包括网络防护模块和文件系统防护模块；
所述网络防护模块用以对网络封包进行过滤，实现连网动作的管控，记录网络动作的详细信息；
所述文件系统防护模块包括文件监控模块、存储设备控制模块和虚拟磁盘控制模块；
所述文件监控模块用以监视文件操作，记录文件的操作信息，根据对文件的访问权限控制文件读写；
所述存储设备控制模块用以对存储设备进行读写控制，存储设备写入和已经存储的均是无需保密文件；
所述虚拟磁盘控制模块用以创建虚拟磁盘，加载/卸载虚拟磁盘，对虚拟磁盘进行读写控制，虚拟磁盘写入和已经存储的均是保密文件，保密文件写入虚拟磁盘时，虚拟磁盘控制模块对其进行加密，对虚拟磁盘中的保密文件读取时，虚拟磁盘控制模块对其进行解密。
文件监控模块工作的具体过程为，
首先截获文件的操作信息，然后根据对文件的访问权限对文件操作进行过滤，若允许操作则放行，通过日志记录操作的相关信息，若不允许则拒绝操作，通过日志记录非法操作的相关信息。
操作信息包括对保密文件的创建、打开、读、写、设置和关闭，以及对无需保密文件的创建、打开、读、写、设置和关闭。
在加载虚拟磁盘之时，虚拟磁盘控制模块对用户口令进行认证。
网络防护模块工作的具体过程为，
首先预设工作模式和控管规则，然后根据工作模式和控管规则对网络封包进行过滤，实现连网动作的管控，同时通过日志记录网络动作的详细信息。
网络防护模块在应用层采用Win Sock2 SPI技术进行网络封包过滤，在传输层采用 TDI HOOK 技术进行连网动作的管控，在网络层采用 NDIS HOOK 技术进行网络封包过滤。
 有益效果
本发明所达到的有益效果：1、本发明实现了一种信息安全防护系统，来对电动汽车信息平台进行有效的监控和防护；2、本发明的文件系统防护模块，采用RBAC 模型、虚拟磁盘和操作过滤技术，实现文件及存储设备的访问控制和文件的透明加解密；网络防护模块Win Sock2 SPI技术、TDI HOOK 和NDIS HOOK 技术，极大地提高了系统的安全性能；这两个模块均实现日志功能，对文件操作和网络行为进行记录，用于定位和分析系统入侵行为；3、本系统可以更好地维护计算机数据的保密性和完整性，为个人信息提供更加可靠的防护服务。
 附图说明
图1为本发明的结构框图；
图2为本发明的供能图；
图3为文件读写访问控制的流程；
图4为虚拟磁盘管理模块结构图；
图5为网络防护模块结构图。
 本发明的最佳实施方式
下面结合附图对本发明作进一步描述。以下实施例仅用于更加清楚地说明本发明的技术方案，而不能以此来限制本发明的保护范围。
如图1和2所示，一种电动汽车互联互通信息安全防护系统，包括网络防护模块和文件系统防护模块。
文件系统防护模块包括文件监控模块、存储设备控制模块和虚拟磁盘控制模块。
文件监控模块用以监视文件操作，记录文件的操作信息，根据对文件的访问权限控制文件读写。该模块采用RBAC模型来实现进程对文件系统的访问控制，具体过程为：首先截获文件的操作信息，操作信息包括对保密文件的创建、打开、读、写、设置和关闭，以及对无需保密文件的创建、打开、读、写、设置和关闭，然后根据对文件的访问权限对文件操作进行过滤，若允许操作则放行，通过日志记录操作的相关信息，若不允许则拒绝操作，通过日志记录非法操作的相关信息。
文件监控模块包括相应的应用模块和驱动模块，其中驱动模块是其核心，实现主要包括：
（1）驱动入口函数的实现。
首先，创建驱动程序控制设备对象；其次，创建控制设备对象符号连接；接着，设置驱动程序的普通分发例程和快速I/O分发例程；最后，注册文件系统变动回调函数。
（2）文件系统控制设备和卷设备的绑定。
21）文件系统控制设备的绑定；
首先，生成文件系统控制设备的过滤设备；然后，使用绑定函数完成对文件系统控制设备的绑定；接着，通过发送给文件系统控制设备的文件系统控制请求，获得卷设备的相关信息并对它进行绑定，从而捕获针对文件的各种请求；
22）文件系统卷设备的绑定；
首先，从 IRP 中获得卷参数块（VPB）指针；然后，设置完成函数并等待IRP完成，在完成函数中得到文件系统卷设备并实施绑定过程。
（3）文件读写访问控制的实现。
具体流程如图3所示：
Step1：拦截上层发送的读写IRP；
Step2：判断是否针对卷设备，若是，则获取文件全路径名；若不是，则转向Step6；
Step3：在规则表中查找相应规则，若找到，则进行下一步；若不能找到，则转向Step6；
Step4：判断是否有权访问，若能访问，则进行下一步；若不能，则向上返回，转向Step7；
Step5：将记录访问日志暂存到日志访问队列；
Step6：向下层传递IRP；
Step7：读写结束。
（4）设备控制例程的实现。
实现流程包括获取日志、清空日志队列、设置监控文件列表和设置合法进程列表。其中，在获取日志时，首先判断有无日志，如果没有，直接返回无日志，如果有，就从日志暂存队列中取出一条日志，并把日志格式转换为LOG 格式的日志，然后放入输出缓冲区。
存储设备控制模块用以对存储设备进行读写控制，存储设备写入和已经存储的均是无需保密文件。
存储设备控制模块也包括相应的应用模块和驱动模块，其中驱动模块是其核心，实现主要包括：
（1）存储设备加载机制。
当存储设备插入时，总线驱动程序检测到了该设备，PnP管理器就会创建一个 PDO 并加载与这个 PDO 相应的过滤驱动和功能驱动程序，存储设备作为 FDO 加载到了PDO 之上，同时存储设备会另外创建一个物理设备，上面挂载磁盘驱动程序Disk.sys，在此之上再挂载分区驱动Part Mgr.sys。
（2）磁盘扇区的直接读写。
采用磁盘扇区的读写技术实现设备安全标识的添加和删除，应用模块可以调用 Win32 API 的 Read File 和 Write File 函数来读写扇区，Windows I/O 管理器将其读写请求 IRP_MJ_READ 或 IRP_MJ_WRITE 发送给分区驱动 Part Mgr.sys，磁盘驱动 DISK 将读写请求转换成 SCSI 请求包发送给 SCSI 端口驱动 SCSIPORT.sys，在存储设备过滤驱动中构造 IRP 并填写相应的 SRB，然后发送给下层驱动处理读写请求。
（3）存储设备的控制。
存储设备的控制主要实现这些功能：动态捕获存储设备的加载、设备禁用、设备只读以及阻止从存储设备运行程序。
虚拟磁盘控制模块用以创建虚拟磁盘，加载/卸载虚拟磁盘，对虚拟磁盘进行读写控制，虚拟磁盘写入和已经存储的均是保密文件，保密文件写入虚拟磁盘时，虚拟磁盘控制模块对其进行加密，对虚拟磁盘中的保密文件读取时，虚拟磁盘控制模块对其进行解密。
在加载虚拟磁盘之时，虚拟磁盘控制模块对用户口令进行认证。具体过程如下：
Step1：读取卷文件头部的 512 字节数据到内存中；其中，前 64 字节数据为未经加密的盐，其余数据加密存储，该盐用于对用户口令进行变换从而生成用于加解密卷文件头部的密钥。
Step2：尝试解密上一步的卷文件头部数据，根据用户口令和盐，通过卷文件头部密钥生成算法生成密钥后，解密内存中的卷文件头部数据，并依次尝试使用不同的哈希算法生成密钥来解密卷文件头部加密数据，直到确认解密正确为止。
Step3：如果解密后明文的前 4 个字节为字符串“TRUE”并且明文后 256字节的 CRC-32 校验值等于卷文件头部第 8 个字节处的数据，则认证通过，虚拟磁盘成功加载，否则要求重新输入用户口令并重复上述流程。
Step4：解密卷文件头部完成后，就确定了正确的用户口令、加密算法、加密算法模式、卷文件头部密钥生成算法和密钥；这时，系统可以使用保存在卷文件头部中的主密钥和次密钥来解密卷的其余部分数据，至此，虚拟磁盘成功加载。
如图4所示，虚拟磁盘控制模块也包括相应的应用模块和驱动模块，其中驱动模块是其核心，它负责处理系统对虚拟磁盘的所有I/O请求，在处理 I/O 请求的过程中，调用加解密模块对数据流进行实时加解密处理。
网络防护模块用以对网络封包进行过滤，实现连网动作的管控，记录网络动作的详细信息。如图5所示具体过程为：首先预设工作模式和控管规则，然后根据工作模式和控管规则对网络封包进行过滤，实现连网动作的管控，同时通过日志记录网络动作的详细信息。
网络防护模块在应用层采用Win Sock2 SPI技术进行网络封包过滤；在传输层采用 TDI HOOK 技术进行连网动作的管控；在网络层采用 NDIS HOOK 技术进行网络封包过滤。
本发明实现了一种信息安全防护系统，来对电动汽车信息平台进行有效的监控和防护；改系统的文件系统防护模块，采用RBAC 模型、虚拟磁盘和操作过滤技术，实现文件及存储设备的访问控制和文件的透明加解密；网络防护模块Win Sock2 SPI技术、TDI HOOK 和NDIS HOOK 技术，极大地提高了系统的安全性能；这两个模块均实现日志功能，对文件操作和网络行为进行记录，用于定位和分析系统入侵行为；改系统可以更好地维护计算机数据的保密性和完整性，为个人信息提供更加可靠的防护服务。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明技术原理的前提下，还可以做出若干改进和变形，这些改进和变形也应视为本发明的保护范围。

Claims (6)

  1. 一种电动汽车互联互通信息安全防护系统，其特征在于：包括网络防护模块和文件系统防护模块；
    所述网络防护模块用以对网络封包进行过滤，实现连网动作的管控，记录网络动作的详细信息；
    所述文件系统防护模块包括文件监控模块、存储设备控制模块和虚拟磁盘控制模块；
    所述文件监控模块用以监视文件操作，记录文件的操作信息，根据对文件的访问权限控制文件读写；
    所述存储设备控制模块用以对存储设备进行读写控制，存储设备写入和已经存储的均是无需保密文件；
    所述虚拟磁盘控制模块用以创建虚拟磁盘，加载/卸载虚拟磁盘，对虚拟磁盘进行读写控制，虚拟磁盘写入和已经存储的均是保密文件，保密文件写入虚拟磁盘时，虚拟磁盘控制模块对其进行加密，对虚拟磁盘中的保密文件读取时，虚拟磁盘控制模块对其进行解密。
  2. 根据权利要求1所述的一种电动汽车互联互通信息安全防护系统，其特征在于：文件监控模块工作的具体过程为，
    首先截获文件的操作信息，然后根据对文件的访问权限对文件操作进行过滤，若允许操作则放行，通过日志记录操作的相关信息，若不允许则拒绝操作，通过日志记录非法操作的相关信息。
  3. 根据权利要求2所述的一种电动汽车互联互通信息安全防护系统，其特征在于：操作信息包括对保密文件的创建、打开、读、写、设置和关闭，以及对无需保密文件的创建、打开、读、写、设置和关闭。
  4. 根据权利要求1所述的一种电动汽车互联互通信息安全防护系统，其特征在于：在加载虚拟磁盘之时，虚拟磁盘控制模块对用户口令进行认证。
  5. 根据权利要求1所述的一种电动汽车互联互通信息安全防护系统，其特征在于：网络防护模块工作的具体过程为，
    首先预设工作模式和控管规则，然后根据工作模式和控管规则对网络封包进行过滤，实现连网动作的管控，同时通过日志记录网络动作的详细信息。
  6. 根据权利要求1所述的一种电动汽车互联互通信息安全防护系统，其特征在于：网络防护模块在应用层采用Win Sock2 SPI技术进行网络封包过滤，在传输层采用 TDI HOOK 技术进行连网动作的管控，在网络层采用 NDIS HOOK 技术进行网络封包过滤。
PCT/CN2017/114362 2017-04-28 2017-12-04 一种电动汽车互联互通信息安全防护系统 Ceased WO2018196383A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710291922.6 2017-04-28
CN201710291922.6A CN107247907A (zh) 2017-04-28 2017-04-28 一种电动汽车互联互通信息安全防护系统

Publications (1)

Publication Number Publication Date
WO2018196383A1 true WO2018196383A1 (zh) 2018-11-01

Family

ID=60016844

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/114362 Ceased WO2018196383A1 (zh) 2017-04-28 2017-12-04 一种电动汽车互联互通信息安全防护系统

Country Status (2)

Country Link
CN (1) CN107247907A (zh)
WO (1) WO2018196383A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107247907A (zh) * 2017-04-28 2017-10-13 国电南瑞科技股份有限公司 一种电动汽车互联互通信息安全防护系统
CN113468607B (zh) * 2020-03-31 2024-08-20 国电南瑞科技股份有限公司 一种加密防篡改文件的生成和使用方法
CN114138362B (zh) * 2021-11-18 2024-03-01 武汉深之度科技有限公司 一种内核模块防卸载方法、防卸载装置及计算设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040078568A1 (en) * 2002-10-16 2004-04-22 Duc Pham Secure file system server architecture and methods
CN1928881A (zh) * 2006-09-26 2007-03-14 南京擎天科技有限公司 一种计算机数据安全防护方法
CN102436697A (zh) * 2011-11-08 2012-05-02 中国电力科学研究院 一种具有安全防护功能的电动汽车充电桩控制装置
CN103605930A (zh) * 2013-11-27 2014-02-26 湖北民族学院 一种基于hook和过滤驱动的双重文件防泄密方法及系统
CN104182691A (zh) * 2014-08-22 2014-12-03 国家电网公司 数据保密方法及装置
CN107247907A (zh) * 2017-04-28 2017-10-13 国电南瑞科技股份有限公司 一种电动汽车互联互通信息安全防护系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102567659B (zh) * 2010-12-28 2014-12-24 河南省躬行信息科技有限公司 基于双驱动联动的文件安全主动防护方法
CN103632107B (zh) * 2012-08-23 2017-10-13 慧盾信息安全科技（苏州）股份有限公司 一种移动终端信息安全防护系统和方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040078568A1 (en) * 2002-10-16 2004-04-22 Duc Pham Secure file system server architecture and methods
CN1928881A (zh) * 2006-09-26 2007-03-14 南京擎天科技有限公司 一种计算机数据安全防护方法
CN102436697A (zh) * 2011-11-08 2012-05-02 中国电力科学研究院 一种具有安全防护功能的电动汽车充电桩控制装置
CN103605930A (zh) * 2013-11-27 2014-02-26 湖北民族学院 一种基于hook和过滤驱动的双重文件防泄密方法及系统
CN104182691A (zh) * 2014-08-22 2014-12-03 国家电网公司 数据保密方法及装置
CN107247907A (zh) * 2017-04-28 2017-10-13 国电南瑞科技股份有限公司 一种电动汽车互联互通信息安全防护系统

Also Published As

Publication number Publication date
CN107247907A (zh) 2017-10-13

Similar Documents

Publication Publication Date Title
CN100487715C (zh) 一种数据安全存储系统和装置及方法
CN101729550B (zh) 基于透明加解密的数字内容安全防护系统及加解密方法
US8464073B2 (en) Method and system for secure data storage
CN103065102B (zh) 基于虚拟磁盘的数据加密移动存储管理方法
CN100480946C (zh) 用于在计算机系统内为sim设备提供受信通道的方法和装置
CN100592313C (zh) 一种电子文档防泄密系统及实现方法
TWI620093B (zh) 用於保全電腦大容量儲存資料的方法和裝置
CN115357528B (zh) 固态硬盘的密钥加密方法、密钥解密方法和安全防护系统
CN100446024C (zh) 一种电子文件保护方法及系统
CN112269547B (zh) 无需操作系统的、主动、可控硬盘数据删除方法及装置
CN102609667A (zh) 基于过滤驱动程序的文件自动加解密系统和方法
CN101308475A (zh) 安全移动存储系统及其使用方法
CN103530570A (zh) 一种电子文档安全管理系统及方法
CN102799539B (zh) 一种安全优盘及其数据主动防护方法
WO2022078222A1 (zh) 一种文件安全管理终端及系统
CN120316839B (zh) 一种硬盘数据保护与安全传输系统
WO2018196383A1 (zh) 一种电动汽车互联互通信息安全防护系统
CN107609408A (zh) 一种基于过滤驱动控制文件操作行为的方法
CN110300289A (zh) 视频安全管理系统及方法
JPH04181282A (ja) ファイルの暗号方式
CN104200173B (zh) 一种电子文档信任与安全控制方法和系统
TWI514834B (zh) 機敏資料加密演算儲存裝置
CN113626149B (zh) 一种基于终端虚拟化的商业秘密保护方法及系统
CN114340051A (zh) 一种基于高速传输接口的便携式网关
CN113553632A (zh) 一种数据安全传输接口设备、系统及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17907353

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17907353

Country of ref document: EP

Kind code of ref document: A1