CN111814157A - Data security processing system, method, storage medium, processor and hardware security card - Google Patents

Data security processing system, method, storage medium, processor and hardware security card Download PDF

Info

Publication number
CN111814157A
CN111814157A CN201910295533.XA CN201910295533A CN111814157A CN 111814157 A CN111814157 A CN 111814157A CN 201910295533 A CN201910295533 A CN 201910295533A CN 111814157 A CN111814157 A CN 111814157A
Authority
CN
China
Prior art keywords
data
unit
security
calculation
storage
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201910295533.XA
Other languages
Chinese (zh)
Other versions
CN111814157B (en
Inventor
付颖芳
肖鹏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Priority to CN201910295533.XA priority Critical patent/CN111814157B/en
Priority to PCT/CN2020/082312 priority patent/WO2020207292A1/en
Publication of CN111814157A publication Critical patent/CN111814157A/en
Application granted granted Critical
Publication of CN111814157B publication Critical patent/CN111814157B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/606—Protecting data by securing the transmission between two devices or processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

The invention discloses a data security processing system, a data security processing method, a storage medium, a processor and a hardware security card. Wherein, this system includes: the data transmission unit, the data memory cell, data computational element still includes: a data security guaranteeing unit for guaranteeing security of a system executing an execution environment executing data processing, security of the data calculating unit, security of the data transmitting unit, and security of the data storing unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, whether the operation of the data computing unit for performing data computing is safe or not, whether the operation of the data transmission unit for transmitting data is safe or not and whether the operation of the data storage unit for storing data is safe or not; and the data calculation control unit is used for monitoring the guarantee operation executed by the data security guarantee unit and/or the audit operation executed by the data security audit unit, and triggering the execution of the corresponding data processing limitation or prohibition when the monitoring finds that the data processing is abnormal.

Description

Data security processing system, method, storage medium, processor and hardware security card
Technical Field
The invention relates to the field of security computing, in particular to a data security processing system, a data security processing method, a storage medium, a processor and a hardware security card.
Background
In the related art, the protection of data security is performed on the data itself from a software level, for example, the data is protected by encryption, but when a cryptographic mode is adopted, the cryptographic capability is deficient, for example, a key for encrypting the data is not effectively managed, for example, the key appears in a memory in a plaintext mode sometimes, and the computational security of the data cannot be guaranteed. Moreover, in the related art, the protection of the security of the data is less concerned, for example, sometimes only whether the storage itself of the data is secure, sometimes only whether the transmission process of the data is secure, and the like. Therefore, the protection of data security is limited, and the security of data cannot be guaranteed from the whole.
Therefore, in the related art, there is a limitation to protection of data security, and the security of data cannot be guaranteed as a whole.
In view of the above problems, no effective solution has been proposed.
Disclosure of Invention
The embodiment of the invention provides a data security processing system, a data security processing method, a storage medium, a processor and a hardware security card, which at least solve the technical problems that in the related technology, the protection of data security is limited and the data security cannot be ensured from the whole.
According to an aspect of an embodiment of the present invention, there is provided a data security system including: a data transfer unit for transferring data, a data storage unit for storing data, a data calculation unit for performing data calculations, further comprising: a data security guaranteeing unit for guaranteeing security of a system executing an execution environment executing data processing, security of the data calculating unit, security of the data transmitting unit, and security of the data storing unit; the data security auditing unit is used for auditing whether the operation which is performed and ensured by the data security ensuring unit is safe or not, auditing whether the operation which is performed and ensured by the data computing unit is safe or not, auditing whether the operation which is transmitted by the data transmission unit is safe or not and auditing whether the operation which is stored by the data storage unit is safe or not; and the data calculation control unit is used for monitoring the guarantee operation executed by the data security guarantee unit and/or the audit operation executed by the data security audit unit, and triggering the limited execution or the forbidden execution of the corresponding data processing when the monitoring finds that the data processing is abnormal.
According to another aspect of the embodiments of the present invention, there is also provided a data security processing method, including: securing, by a data security securing unit, a system of an execution environment that executes data processing, a data calculation unit for executing data calculation, a data transmission unit for transmitting data, and a data storage unit for storing data; auditing whether the operation guaranteed by the data security guarantee unit is safe or not, auditing whether the operation calculated by the data calculation unit is safe or not, auditing whether the operation of the data transmission unit for transmitting data is safe or not and auditing whether the operation of the data storage unit for storing data is safe or not through a data security auditing unit; and monitoring the execution of the data security guarantee unit and/or the execution of the audit operation by the data security audit unit through a data calculation control unit, and triggering the limited execution or the forbidden execution of the corresponding data processing when the monitoring finds that the data processing is abnormal.
According to another aspect of the embodiments of the present invention, there is also provided a data security processing method, including: receiving a data calculation request; the data calculation is completed through a trusted computing pool to obtain a calculation result, and the calculation result is transmitted to a trusted storage pool and/or a trusted transmission unit, wherein the trusted computing pool is coordinated with a data calculation unit through a data security guarantee unit, a data security audit unit, a data calculation control unit and the data calculation unit to guarantee the security of data calculation operation; storing the calculation result through the credible storage pool and/or transmitting the calculation result through the credible transmission unit; the data security guarantee unit is used for guaranteeing the security of a data transmission unit in the trusted transmission unit, a data storage unit in the trusted storage pool, the data calculation unit, the data security audit unit and the data calculation control unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, auditing whether the operation of the data computing unit for performing data computing is safe or not, auditing whether the operation of the data transmission unit for transmitting data is safe or not and auditing whether the operation of the data storage unit for storing data is safe or not.
According to another aspect of the embodiments of the present invention, there is also provided a data security processing system, including: the system comprises a data security guarantee unit, a data security audit unit and a data calculation control unit, wherein the data security guarantee unit is used for guaranteeing the security of a system of an execution environment for executing data processing, the security of a data calculation unit for executing data calculation, the security of a data transmission unit for transmitting data and the security of a data storage unit for storing data; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, auditing whether the operation of the data computing unit for performing data computing is safe or not, auditing whether the operation of the data transmission unit for transmitting data is safe or not and auditing whether the operation of the data storage unit for storing data is safe or not; and the data calculation control unit is used for monitoring the execution of guarantee operation of the data security guarantee unit and/or the execution of audit operation of the data security audit unit, and triggering the limited execution or the forbidden execution of the corresponding data processing when the monitoring finds that the data processing is abnormal.
According to another aspect of the embodiments of the present invention, there is also provided a data security processing system, including: the receiving module is used for receiving a data calculation request; the first processing module is used for completing data calculation through a trusted computing pool to obtain a calculation result and transmitting the calculation result to a trusted storage pool and/or a trusted transmission unit, wherein the trusted computing pool is coordinated with the data computing unit through a data security guarantee unit, a data security audit unit, a data computing control unit and the data computing unit to guarantee the security of data computing operation; the second processing module is used for storing the calculation result through the credible storage pool and/or transmitting the calculation result through the credible transmission unit; the data security guarantee unit is used for guaranteeing the security of a data transmission unit in the trusted transmission unit, a data storage unit in the trusted storage pool, the data calculation unit, the data security audit unit and the data calculation control unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, auditing whether the operation of the data computing unit for performing data computing is safe or not, auditing whether the operation of the data transmission unit for transmitting data is safe or not and auditing whether the operation of the data storage unit for storing data is safe or not.
According to another aspect of the embodiments of the present invention, there is also provided a storage medium storing a program, wherein when the program is executed by a processor, the program causes the processor to execute any one of the above-mentioned data security processing methods.
According to another aspect of the embodiments of the present invention, there is also provided a processor, where the processor is configured to execute a program, where the program is executed to cause the processor to execute any one of the above-mentioned data security processing methods.
According to another aspect of the embodiments of the present invention, there is also provided a hardware security card, including: a memory and a processor, the memory storing a computer program; the processor is configured to execute a computer program stored in the memory, and when the computer program is executed by the processor, the processor is enabled to execute any one of the data security processing methods described above.
In an embodiment of the present invention, a data security processing system includes: the data transmission unit, the data memory cell, data computational element still includes: a data security guaranteeing unit for guaranteeing security of a system executing an execution environment executing data processing, security of the data calculating unit, security of the data transmitting unit, and security of the data storing unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, whether the operation of the data computing unit for performing data computing is safe or not, whether the operation of the data transmission unit for transmitting data is safe or not and whether the operation of the data storage unit for storing data is safe or not; the data calculation control unit is used for executing guarantee operation on the data security guarantee unit and/or monitoring the audit operation executed by the data security audit unit, when the monitoring finds that the execution is abnormal, the corresponding data processing is triggered to be executed in a limited mode or prohibited, and the purpose of guaranteeing the data security from the life cycle of the whole data of the system executing the data processing, data storage, data calculation and data transmission is achieved, so that the technical effect of guaranteeing the data security from the whole is achieved, and the technical problems that in the related technology, the protection on the data security is limited, and the data security cannot be guaranteed from the whole are solved.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the invention and together with the description serve to explain the invention without limiting the invention. In the drawings:
fig. 1 is a block diagram of a hardware configuration of a data security processing system according to embodiment 1 of the present invention;
FIG. 2 is a diagram of an abstract hardware security architecture of a data security processing system according to embodiment 1 of the present invention;
FIG. 3 is a schematic structural diagram of a hardware security card integrated with a data security assurance unit, a data security audit unit, a data calculation unit and a data transmission unit according to embodiment 1 of the present invention;
fig. 4 is a schematic structural diagram of a data security assurance unit, a data security audit unit, and a data calculation unit integrated with a data transmission unit to form a data security processing system according to embodiment 1 of the present invention;
FIG. 5 is a schematic structural diagram of an integration of a data security assurance unit and a data security audit unit, the integration of a data calculation unit and a data transmission unit forming a data security processing system according to embodiment 1 of the present invention;
fig. 6 is a flowchart of a data security processing method according to embodiment 1 of the present invention;
fig. 7 is a flowchart of a data security processing method according to embodiment 2 of the present invention;
fig. 8 is a hardware architecture diagram corresponding to the data security processing method according to embodiment 2 of the present invention;
fig. 9 is a block diagram of a data security processing system according to embodiment 3 of the present invention;
fig. 10 is a block diagram of a data security processing system according to embodiment 4 of the present invention;
fig. 11 is a block diagram of a hardware security card according to embodiment 5 of the present invention.
Detailed Description
In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
First, some terms or terms appearing in the description of the embodiments of the present application are applicable to the following explanations:
and (3) data calculation safety: the method is characterized in that in the program execution process, the execution environment of the program is guaranteed to be credible, sensitive data participating in calculation is not leaked and is not tampered, and a calculation instruction space-time sequence is not tampered.
And (3) data transmission safety: when information intercommunication is carried out between two communication entities, sensitive data can be guaranteed not to be tampered and leaked in the transmission process.
And (4) data storage security: the method refers to that sensitive data in an information system is not subjected to illegal operations such as unauthorized access, embezzlement, tampering, deletion and the like.
The safety of the system is as follows: the security of a platform and a System used for executing an execution environment of data processing means that software and hardware platforms and systems such as a Basic Input Output System (BIOS), hardware firmware, an operating System Loader (OS Loader) of a device are complete and legal.
And (3) trusted computing: trusted Computing (Trusted Computing) is a Trusted Computing platform widely used in Computing and communication systems and supported by hardware-based security modules, so as to improve the security of the whole system.
Trusted Platform Module (TPM)/Trusted Platform Control Module (TPCM) (TPM/TPCM): security chips that provide integrity and authenticity assurance for evidence are typically strongly bound to a computing platform by physical means.
And (3) credibility measurement: at some particular time, the target is measured to obtain some information about the target (e.g., a hash value for the file), and the value of this information is compared to a pre-recorded standard value to determine if the integrity of the target has been compromised.
Firmware: refers to a program stored in hardware that cannot be easily changed, and also refers to the underlying hardware on which some of the above programs are located.
Example 1
For the problem that protection of data security is limited and data cannot be guaranteed from the whole in the related art, data security is mainly guaranteed from four dimensions in terms of a data life cycle, that is, a platform and a system for data storage, data calculation, data transmission and data cycle support are secure (it should be noted that the platform and the system security herein can also be understood as execution environment security of data calculation).
In addition, data security is protected based on hardware components, and compared with the traditional software, the data security is protected, so that the performance and the security are greatly improved (for example, the encryption and decryption computing speed of hardware is higher than that of soft computing, and the encryption and decryption hardware implementation has a great security advantage in key generation and protection compared with the encryption and decryption software implementation).
Based on this, in the embodiment of the present invention, a data security processing system of hardware and a data security guaranteeing method implemented by the data security processing system based on the hardware are provided, so that a data security guaranteeing capability is effectively improved. In the hardware-based data security processing system, the data security is guaranteed by mainly integrating four dimensions of platform and system security, data calculation security, data transmission security and data storage security.
The embodiment of the hardware data security processing system provided in embodiment 1 of the present application may be implemented in a mobile terminal, a computer terminal, or a similar computing device. Fig. 1 is a block diagram of a hardware configuration of a data security processing system according to embodiment 1 of the present invention. As shown in fig. 1, the data security processing system includes: a data transfer unit for transferring data, a data storage unit for storing data, a data calculation unit for performing data calculations, further comprising: a data security guarantee unit, a data security audit unit and a data calculation control unit, wherein,
the data security guarantee unit is connected to the data transmission unit, the data storage unit, the data calculation unit, the data security audit unit and the data calculation control unit and is used for guaranteeing the security of a system of an execution environment for executing data processing, the security of the data calculation unit, the security of the data transmission unit and the security of the data storage unit; the data security auditing unit is connected with the data transmission unit, the data storage unit, the data computing unit, the data security guaranteeing unit and the data computing control unit and is used for auditing whether the operation which is guaranteed by the data security guaranteeing unit is safe or not, whether the operation which is performed by the data computing unit is safe or not, whether the operation which is performed by the data transmission unit is safe or not and whether the operation which is stored by the data storage unit is safe or not; and the data calculation control unit is connected to the data security guarantee unit and the data security audit unit and is used for executing guarantee operation on the data security guarantee unit and/or monitoring the audit operation executed by the data security audit unit, and triggering the corresponding data processing to be executed in a limited mode or prohibited to be executed when the monitoring finds that the data processing is abnormal.
As an alternative embodiment, the data security assurance unit secures a system of an execution environment executing data processing, where the system security is a broad understanding of an entire execution environment, and may be understood as security of a platform and a (specific) system, for example, the software and hardware platforms and systems such as BIOS, hardware and firmware, and OS Loader of a device are completely legal. To specifically describe the technical solution, the following embodiments take "platform and system" as an example to describe the system.
As an alternative embodiment, the data security assurance unit is used for ensuring the security of the platform and the system of the execution environment executing the data processing, the security of the data computing unit, the security of the data transmission unit, and the security of the data storage unit. According to the data safety guarantee unit, the safety of the data is guaranteed from four dimensions of the life cycle of the data. Specifically, when the four dimensions of the data lifecycle are respectively guaranteed, the data security processing system can be guaranteed from the beginning of receiving a data security calculation request, that is, from all the four dimensions of the data lifecycle, or can be guaranteed before the data security processing system respectively starts to execute specific operations for the four dimensions of the data lifecycle, and can be flexibly selected according to specific requirements.
As an alternative embodiment, the data security assurance unit is used for ensuring the security of the platform and the system of the execution environment executing the data processing, the security of the data computing unit, the security of the data transmission unit, and the security of the data storage unit. For guarantees of different dimensions, the contents of guarantees may be somewhat different, but the contents that basically require guarantees may all include: the main body for ensuring the execution is safe, the hardware environment for ensuring the execution is safe, the software program for ensuring the execution is safe, and the like.
As an optional embodiment, the data security ensuring unit is configured to ensure integrity and validity of hardware firmware of a platform and a system of an execution environment that performs data processing; that is, the data security assurance unit ensures that the platform and the system executing the data processing environment are secure, and it is mainly considered to ensure not only the integrity of the hardware firmware of the platform and the system executing the data processing environment but also the validity of the hardware firmware of the platform and the system executing the data processing environment.
As an optional embodiment, the data security guarantee unit guarantees the integrity and validity of the computing system software, the computing hardware firmware and the application program used for computing of the data computing unit; that is, the data security guarantee unit guarantees that the data calculation unit is secure, and not only needs to guarantee the integrity and the validity of the calculation system software of the data calculation unit, but also needs to guarantee the integrity and the validity of the hardware and the firmware of the data calculation unit, and also needs to guarantee the integrity and the validity of the calculation application program adopted by the data calculation unit during calculation. Namely, the data security guarantee unit guarantees the security of the data calculation unit from two layers of software and hardware.
As an optional embodiment, the data security ensuring unit is configured to ensure integrity and validity of transmission system software, transmission hardware firmware, and application programs used for transmission of the data transmission unit; namely, the data security guarantee unit guarantees that the data transmission unit is secure, and needs to guarantee not only the integrity and validity of the transmission system software of the data transmission unit, the integrity and validity of the transmission hardware and firmware of the data transmission unit, but also the integrity and validity of the application program (for example, when encryption and decryption transmission is needed, encryption and decryption programs are involved) used during the transmission of the data transmission unit. The safety of the software and hardware layers is guaranteed, and the safety of the data transmission unit is guaranteed.
As an optional embodiment, the data security ensuring unit is configured to ensure integrity and validity of storage system software, storage hardware firmware, and application programs used for storage of the data storage unit; that is, the data security ensuring unit ensures that the data storage unit is secure, and not only the integrity and the validity of the storage system software of the data storage unit, the integrity and the validity of the storage hardware and firmware of the data storage unit, but also the integrity and the validity of an application program (for example, when encryption and decryption are required for storage, an encryption and decryption program is involved) used when the data storage unit is stored need to be ensured. By adopting the guarantee method, the safety of the data storage unit is guaranteed on two levels of software and hardware.
In a preferred embodiment, the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, whether the operation of executing data calculation by the auditing data calculating unit is safe or not, whether the operation of transmitting data by the auditing data transmission unit is safe or not and whether the operation of storing data by the auditing data storage unit is safe or not, namely, the data security guaranteeing unit is used for judging whether the operation guaranteed by the data security guaranteeing unit is safe or not, whether the operation of executing data calculation by the data calculating unit is safe or not, whether the operation of transmitting data by the data transmission unit is safe or not and whether the operation of storing data by the data storage unit is safe or not by means of. On one hand, the data security auditing unit also performs auditing respectively from four dimensions of the data security life cycle, and determines that the operation of executing respective operation in each dimension is safe. On the other hand, the data security guarantee unit carries out security guarantee on the data security audit unit, and the data security audit unit carries out audit on the guarantee operation of the data security guarantee unit, so that the purpose of mutual restriction security is realized, and the effect of double security guarantee is achieved.
When the data security auditing unit audits the four dimensions of the data security period, the auditing method can be multiple, and the simplest matching method can also be adopted, wherein the matching method is to compare the result executed on each dimension with the expected execution result, and if the two results are consistent, the corresponding operation executed on the dimension is determined to be safe.
As an optional embodiment, the data security auditing unit is configured to audit whether a guarantee result obtained by performing a guarantee by the data security guaranteeing unit is consistent with an expected guarantee result, determine that an operation performed by the data security guaranteeing unit is secure if the guarantee result is consistent with the expected guarantee result, and determine that the operation performed by the data security guaranteeing unit is not secure if the guarantee result is inconsistent with the expected guarantee result; i.e. by means of a comparison with the expected safeguarding result, it is determined whether the operation of the data security safeguard unit to perform the safeguarding is safe. In addition, when the data security audit unit is configured to audit whether the operation of the data security guarantee unit for performing the guarantee is secure, not only the above-mentioned manner of comparing with the expected guarantee result may be adopted, but also the data security audit unit may be further configured to audit whether the guarantee process performed by the data security guarantee unit is consistent with the expected guarantee process in order to timely find out the abnormal guarantee and timely interrupt the insecure guarantee process (for example, the step of performing the guarantee is inconsistent with the expected step, the process of the process result obtained by the guarantee process is inconsistent with the process result of the expected process, and the like). When the method is compared with the expected guarantee process, if the guarantee process is inconsistent, the operation of the data security guarantee unit for executing the guarantee can be directly determined to be unsafe under the condition of not comparing the guarantee results, so that the stopping operation under the abnormal condition can be realized more quickly, and the auditing efficiency is improved.
As an alternative embodiment, the data security auditing unit is configured to audit whether a calculation result obtained by the data calculation unit performing the data calculation is consistent with an expected calculation result, and in a case where the calculation result is consistent with the expected calculation result, determine that an operation performed by the data calculation unit is secure, and in a case where the calculation result is not consistent with the expected calculation result, determine that the operation performed by the data calculation unit is not secure; i.e., by comparison with expected calculation results, it is determined whether the operation of the data calculation unit to perform the data calculation is safe. In addition, when the data security auditing unit is configured to audit whether the operation of the data computing unit for performing the computation is secure, the data security auditing unit may not only adopt the above-mentioned manner of comparing with the expected computation result, but also may be configured to audit whether the computation process of the data computing unit for performing the computation is consistent with the expected computation process, and determine that the operation of the data computing unit for performing the computation is not secure in order to timely find out the abnormal data computation and timely interrupt the unsecure data computation process (for example, the step of performing the computation on the data is not an expected step, the process of the process result obtained in the process of performing the computation on the data is inconsistent with the expected process, and the like). When the method is compared with the expected calculation process, if the calculation process is inconsistent, the calculation operation executed by the data calculation unit can be directly determined to be unsafe under the condition of not comparing the calculation result, so that the stopping operation under the abnormal condition can be realized more quickly, and the auditing efficiency is improved.
As an optional embodiment, the data security auditing unit is configured to audit whether a transmission result obtained by data transmission by the data transmission unit is consistent with an expected transmission result, determine that an operation of the data transmission unit for transmitting data is secure if the transmission result is consistent with the expected transmission result, and determine that the operation of the data transmission unit for transmitting data is not secure if the transmission result is not consistent with the expected transmission result; i.e. by means of a comparison with an expected transmission result, it is determined whether the operation of the data transmission unit to transmit data is safe. In addition, when the data security auditing unit is configured to audit whether the operation of the data transmission unit for transmitting data is secure, the data security auditing unit may not only adopt the above-mentioned manner of comparing with the expected transmission result, but also may be configured to audit whether the transmission process of the data transmission unit for transmitting data is consistent with the expected transmission process, and determine that the operation of the data calculation unit for transmitting data is not secure in order to timely find out abnormal transmission and timely interrupt the processing of the data transmission that is not secure (for example, whether a transmission manner adopted by the data transmission is inconsistent with the expected transmission manner (for example, whether encryption/decryption transmission is performed, and the like), whether a transfer is inconsistent with the expected transmission process in the data transmission process, and the like). When the mode of comparing with the expected transmission process is adopted, if the transmission process is inconsistent, the operation that the data computing unit transmits the data can be directly determined to be unsafe under the condition of not comparing the transmission results, so that the stopping operation under the abnormal condition can be realized more quickly, and the auditing efficiency is improved.
As an alternative embodiment, the data security auditing unit is configured to audit whether a storage result obtained by storing the data by the data storage unit is consistent with an expected storage result, and in the case of consistency, determine that the operation of storing the data by the data storage unit is secure, and in the case of inconsistency, determine that the operation of storing the data by the data storage unit is not secure. I.e., by comparison with expected storage results, to determine whether the operation of the data storage unit to store data is safe. In addition, when the data security auditing unit is configured to audit whether the operation of storing data in the data storage unit is secure, not only the above-mentioned manner of comparing with the expected storage result may be adopted, but also the data security auditing unit may be configured to audit whether the storage process of storing data in the data storage unit is consistent with the expected storage process or not, and determine that the operation of storing data in the data computing unit is not secure in case that the storage process of storing data in the data storage unit is not consistent with the expected storage process, in order to timely find abnormal storage and timely interrupt the processing of storing data that is not secure (for example, the storage property (for example, temporary storage or permanent storage) adopted in the data storage process is not consistent with the expected storage property, the storage speed of storing data is not consistent with the expected storage speed, and the. When the mode of comparing with the expected storage process is adopted, if the storage process is inconsistent, the operation of storing the data by the data computing unit can be directly determined to be unsafe under the condition of not comparing the storage results, so that the stopping operation under the abnormal condition can be realized more quickly, and the auditing efficiency is improved.
As an optional embodiment, the data security audit unit is further configured to obtain security audit data of the non-user data, and is configured to determine, according to the obtained security audit data of the non-user data, whether an operation performed by the audit data security guarantee unit is secure, whether an operation performed by the audit data calculation unit is secure, whether an operation performed by the audit data transmission unit is secure, and whether an operation performed by the audit data storage unit for storing the data is secure. Wherein the security audit data of the non-user data may include: compute any instructions executed, execution time, memory address, and electromagnetic signals to perform the computation, and the like. The above listed elements other than user data are only examples and are not limited thereto. The execution operation on each dimension is audited by obtaining the security audit data of the non-user data, and compared with the prior art that the audit is carried out by reading the memory data, the security protection of the user data is effectively realized on the premise that the privacy of the user is exposed.
In addition, it should be noted that the functions of the data transmission unit, the data storage unit, the data calculation unit, the data security guarantee unit, the data security audit unit, and the data calculation control unit may be implemented in any form, for example, at least two of the data transmission unit, the data storage unit, the data calculation unit, the data security guarantee unit, the data security audit unit, and the data calculation control unit are integrated in a hardware security card. For example, the data computing unit may be implemented by integrating the memory and the data transmission unit in a security chip; the calculation control unit and the data calculation unit, or the data calculation security guarantee unit, or the data calculation security audit unit can be integrated in a chip; the data calculation safety guarantee unit is integrated with the data calculation safety audit unit, the data calculation control unit and the like.
In the preferred embodiment of the invention, the invention also provides a data security processing system. In the data security processing system provided in the preferred embodiment, in order to ensure the security of the whole life cycle of data, the platform and system security of the execution environment for executing data processing, the data computation security, the data transmission security, and the data storage security are four-dimensional, and the security protection is performed based on hardware, fig. 2 is an abstract hardware security architecture diagram of the data security processing system according to embodiment 1 of the present invention, as shown in fig. 2, the system mainly includes: the system comprises a data calculation unit, a data security guarantee unit, a data security audit unit, a calculation control unit, a memory, a data transmission unit, a data storage unit and the like. Wherein:
the data calculation unit is mainly used for completing calculation function;
the data security guarantee unit is used for guaranteeing the security of the platform system environment, such as the integrity of a BIOS (basic input output System), an OS Loader, an OS kernel platform and a system, the integrity of a computing application program, the security of a data security audit unit and a data transmission unit, and the integrity and the legality of other hardware firmware such as a data storage unit;
the data security auditing unit is used for auditing whether the data computing unit, the data security guarantee unit, the data transmission unit and the data storage unit meet expectations or not in the processes of data computing, guarantee computing, data transmission and data storage, and is provided with computing related data for acquiring non-user data, such as: calculating any instruction executed, execution time, memory address and the like;
the calculation control unit is used for controlling calculation control, and the function is that when the data security guarantee unit or the data security audit unit finds abnormality, the calculation control unit is triggered to control the limited execution or the forbidden execution of the calculation;
the data transmission unit is used for completing the remote transmission function of data;
the data storage unit is used for completing the storage function of data;
the memory is used for storing some data and addresses related to the computing unit.
Note: the above-mentioned parts are not limited to the implementation form, for example, the data calculation Unit may be implemented in a calculation Unit such as a general Central Processing Unit (CPU), a Graphics Processing Unit (GPU), a Field-programmable Gate array (FPGA), or a memory, a data transmission Unit (for example, an intelligent network Interface Controller (smart Network Interface Controller) (NIC), a calculation control Unit may be integrated with the data calculation Unit, the data calculation security assurance Unit, or the data calculation security audit Unit, and the data calculation control Unit is integrated together.
For example, several ways of integrating the data calculation unit, the data security guarantee unit, the data security audit unit, the calculation control unit, the memory, the data transmission unit, and the data storage unit are listed below. The following combinations are merely examples, and do not limit embodiments of other combinations. It should be noted that, in the following examples, TPM/TPCM is used as two product forms for implementing data security guarantee, that is, for implementing the function of the data security guarantee unit; the jinbai X is used as a product form for realizing data security audit, namely the function of the data security audit unit is realized; a Trusted high-speed Data Encryption Card (or THSDC for short) is a product form for realizing high-speed Encryption and decryption calculation, namely, is used for realizing the functions of the Data calculation unit; the Smart NIC is a product form of data transmission, namely, is used for implementing the functions of the data transmission unit.
Fig. 3 is a schematic structural diagram of a hardware security card integrated with a data security assurance unit, a data security auditing unit, a data calculating unit and a data transmission unit according to embodiment 1 of the present invention, and as shown in fig. 3, a TPM/TPCM, jindaiX, THSDEC and a Smart NIC are integrated in a hardware security card entity.
Fig. 4 is a schematic structural diagram of a data security processing system formed by a data security ensuring unit, a data security auditing unit, and a data computing unit after being integrated with a data transmission unit according to embodiment 1 of the present invention, as shown in fig. 4, TPM/TPCM, jindai X, and THSDEC are integrated in a hardware security card entity, and then the hardware security card entity performs data transmission with a data transmission unit Smart NIC.
Fig. 5 is a schematic structural diagram of a data security processing system formed by integrating a data security ensuring unit and a data security auditing unit according to embodiment 1 of the present invention, where, as shown in fig. 5, TPM/TPCM and jindai X are integrated in one hardware security card entity, THSDEC and Smart NIC are integrated in one hardware security card entity, and then the two hardware security card entities coordinate together to complete the functions of the data security processing system.
It should be noted that, in fig. 3, fig. 4 and fig. 5, the TPM/TPCM and jindai X are integrated together for example, in a specific implementation, as described above, the TPM/TPCM is a product form for implementing data security assurance, the jindaiX is a product form for implementing data security audit, and implementing data security assurance and implementing data security audit are separable, so that the TPM/TPCM and the jindai X are separable in the specific implementation. The integration of fig. 3, fig. 4 and fig. 5 is only an example, and is not limited to the implementation of the integration.
Based on the data security processing system provided in the foregoing embodiment or preferred implementation, in an embodiment of the present invention, a data security processing method is further provided, and fig. 6 is a flowchart of the data security processing method according to embodiment 1 of the present invention, as shown in fig. 6, where the flowchart includes the following steps:
step S602, the security of the platform and the system of the execution environment for executing data processing, the security of the data calculation unit for executing data calculation, the security of the data transmission unit for transmitting data, and the security of the data storage unit for storing data are guaranteed by the data security guarantee unit;
step S604, through the data security auditing unit, auditing whether the operation of the data security guarantee unit for executing guarantee is safe, whether the operation of the data computing unit for executing data computation is safe, whether the operation of the data transmission unit for auditing is safe, and whether the operation of the data storage unit for auditing is safe;
and step S606, the data calculation control unit executes guarantee operation on the data security guarantee unit and/or monitors the audit operation executed by the data security audit unit, and when the monitoring finds that the data processing is abnormal, the corresponding data processing is executed in a limited mode or is prohibited from being executed.
In an optional embodiment, the data security assurance unit is configured to ensure the security of a platform and a system of an execution environment that executes data processing, the security of a data calculation unit that executes data calculation, the security of a data transmission unit that transmits data, and the security of a data storage unit that stores data, and the functions of the data security assurance unit may be combined to execute operations corresponding to security assurance of each dimension in a data security cycle, which is not described herein again.
In an optional embodiment, through the data security auditing unit, whether the operation guaranteed by the data security guaranteeing unit is safe or not is audited, whether the operation of performing data computation by the auditing data computing unit is safe or not, whether the operation of transmitting data by the auditing data transmission unit is safe or not, and whether the operation of storing data by the auditing data storage unit is safe or not is audited, and the operation corresponding to security auditing of each dimension in a data security cycle can be executed by combining the functions of the data security auditing unit, which is not described herein again.
In an optional embodiment, the data calculation control unit is used for executing guarantee operation on the data security guarantee unit and/or monitoring the audit operation executed by the data security audit unit, and when the monitoring finds that the data processing is abnormal, the corresponding data processing is triggered to be executed in a limited mode or is prohibited from being executed. That is, in the operation of the data security assurance unit for securing a platform and a system of an execution environment for executing data processing, in the operation of securing a data calculation unit for executing data calculation, in the operation of securing a data transmission unit for transmitting data, and in the operation of securing a data storage unit for storing data, as long as an abnormality is found, the data calculation control unit may be triggered to control the data calculation unit, the data transmission unit, and the data storage unit to execute a restricted operation, or to prohibit execution of an operation. In addition, in the operation of the data security auditing unit for auditing the data security guaranteeing unit, the data computing unit, the data transmission unit and the data storage unit, if an abnormality is found, the data computing control unit can be directly triggered to control the data security guaranteeing unit, the data computing unit, the data transmission unit and the data storage unit to execute limited operation or forbid the execution of the operation.
In the embodiment of the invention, the safety guarantee of each dimension of the data safety cycle is completed through the data safety guarantee unit, the safety audit of each dimension of the data safety cycle is completed through the data safety audit unit, the data calculation control unit monitors the data safety guarantee unit and the data safety audit unit, and the limited execution or the forbidden execution of the data processing is triggered under the condition of abnormity. The purpose of ensuring the data security from the life cycle of the data storage, the data calculation and the data transmission of the whole data of the platform and the system of the execution environment executing the data processing is achieved, so that the technical effect of ensuring the data security from the whole is achieved, and the technical problems that the protection of the data security is limited and the data security cannot be ensured from the whole in the related technology are solved.
Example 2
There is also provided, in accordance with an embodiment of the present invention, a method embodiment of a data security processing method, it should be noted that the steps illustrated in the flowchart of the accompanying drawings may be performed in a computer system such as a set of computer executable instructions, and that, although a logical order is illustrated in the flowchart, in some cases the steps illustrated or described may be performed in an order different than here.
The method provided by embodiment 2 of the present application may be executed in a mobile terminal, a computer terminal, or a similar computing device. Fig. 7 is a flowchart of a data security processing method according to embodiment 2 of the present invention, and as shown in fig. 7, the flowchart includes the following steps:
step S702, receiving a data calculation request;
as an alternative embodiment, the executing subject of the above steps may be a computer terminal, for example, a user terminal such as a smart phone, a mobile phone, a tablet computer, a notebook computer, a smart watch, and the like. The execution subject of the above steps may also be a separate chip including a function for executing data secure computation, for example, a trusted chip for trusted computation, or other computing chips for ensuring data secure computation. The execution subject of the above steps may also be a network device such as a server for executing a secure computing function.
As an alternative embodiment, a data computation request is received, i.e. a request for performing a secure computation on data is received. It should be noted that the data calculation request may include one data calculation request or may include a plurality of data calculation requests, and when a plurality of data calculation requests are included, the plurality of data calculation requests may be distinguished by a certain distinguishing identifier, so that data calculation security of the plurality of data calculation requests can be guaranteed orderly within a certain period of time.
Step S704, data calculation is completed through a trusted computing pool to obtain a calculation result, and the calculation result is transmitted to a trusted storage pool and/or a trusted transmission unit, wherein the trusted computing pool is coordinated with a data calculation unit through a data security guarantee unit, a data security audit unit, a data calculation control unit and the data calculation unit to guarantee the security of data calculation operation;
as an optional embodiment, for a received data calculation request, before performing data security calculation, the identity of a user sending the request may be verified, and in a case that the verification is legal, a corresponding data calculation unit is allocated to the data calculation request to perform the data security calculation, so that the validity of the calculation is ensured, and the calculation of an illegal user request is prevented from being performed.
As an optional embodiment, when data security computation is to be performed, an appropriate data computation unit may be allocated to the received data computation request according to the computation requirement carried in the data computation request and the load or performance of each data computation unit, so that on one hand, the user requirement may be satisfied to a certain extent, and computation resources may be saved to a limited extent, and in addition, the computation efficiency may be improved to a certain extent.
As an optional embodiment, after a received data calculation request, since some data calculation requests may include a storage request for data or a transmission request for data, when the trusted computing pool receives a storage request for data or a transmission request for data, and stores or transmits data when storing or transmitting data, the trusted computing pool may first perform authentication on a user who sent the storage request or the transmission request, and store or transmit data when the authentication passes, thereby ensuring validity of storage or transmission and avoiding data storage or data transmission requested by an illegal user. It should be noted that the request for secure computation of data, the request for secure storage of data, and the request for secure transmission of data may be separate from each other, or may be any combination of them.
As an optional embodiment, since the data computing pool is completed through the trusted computing pool, and the trusted computing pool is further coordinated with the data computing unit through the data security assurance unit, the data security audit unit, and the data computing control unit, to ensure the security of the data computing operation, the data computing completed through the trusted computing pool can be regarded as secure and trusted.
As an alternative embodiment, the calculation result is obtained after the calculation is performed on the data, and different calculation results may be applied to different functions and roles, for example, some calculation results need to be stored, and therefore, the calculation result needs to be transferred to the trusted storage pool after the calculation is completed, so as to complete the trusted storage of the data. For another example, some calculation results need to be transmitted continuously, so that the calculation results need to be transmitted to the trusted transmission unit after the calculation is completed, and the trusted transmission unit completes the subsequent transmission.
Step S706, storing the calculation result through the trusted storage pool, and/or transmitting the calculation result through the trusted transmission unit;
the data security guarantee unit is used for guaranteeing the security of a data transmission unit in the trusted transmission unit, a data storage unit in the trusted storage pool, a data calculation unit, a data security audit unit and a data calculation control unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, whether the operation of the data calculation performed by the auditing data calculating unit is safe or not, whether the operation of the data transmission unit for auditing the data is safe or not and whether the operation of the data storage unit for auditing the data is safe or not.
As an optional embodiment, in a case that the data calculation request carries a calculation policy, completing data calculation through the trusted computing pool may include: according to the calculation strategy, data calculation is completed through the trusted computing pool; the calculation policy may include requirements involved in executing various aspects of the calculation, and may include, for example, an execution subject executing the calculation, an execution environment executing the calculation, a verification condition for performing verification on a calculation result, and the like.
As an optional embodiment, in a case that the data computation request carries a transmission policy and/or a storage policy, storing the computation result by using the trusted storage pool, and/or transmitting the computation result by using the trusted transmission unit includes: storing the calculation result through the credible storage pool according to the storage strategy; and/or transmitting the calculation result through the trusted transmission unit according to the transmission strategy. The transmission policy mentioned above includes some condition requirements related to the transmission, such as the speed of transmission, the security level of transmission, etc. The storage policy referred to above includes some conditions involved in the storage, such as the speed of storage, the security level of storage, etc.
As an alternative embodiment, correspondingly, the data calculation unit may include: divided according to different computing power: the general calculation unit is a high-speed encryption and decryption calculation unit; the data storage unit may include: the memory units with different storage speeds are divided according to different storage capacities, and the plaintext memory unit and the ciphertext memory unit are divided according to different security levels; the data transmission unit may include: the transmission unit with different transmission speeds is divided according to different transmission capacities, and the plaintext transmission unit and the ciphertext transmission unit are divided according to different security levels. The different storage speeds indicated above may be divided according to requirements, for example, into a rough high-speed storage and a low-speed storage, or into a finer high-speed storage, a medium-speed storage, and a low-speed storage. Ciphertext storage is more secure than plaintext storage. The different transmission speeds can be divided according to the requirement, for example, the transmission speeds can be divided into rough high-speed transmission and low-speed transmission, or can be divided into fine high-speed transmission, medium-speed transmission and low-speed transmission. Also, the security level of ciphertext transmission is relatively high compared to plaintext transmission.
As an optional embodiment, in order to make the allocated data computing units for performing computing accurate and efficient, when data computing is completed through the trusted computing pool, the corresponding data computing units may be selected for the data computing requests by the computing request offload engine in the trusted computing pool to perform data computing; the computation request distribution engine may specifically select a data computation unit for performing data computation according to computation requirements carried in the data computation request and the performance of each data computation unit to be selected.
As an optional embodiment, to improve the storage efficiency of data and/or the transmission efficiency of data, when the calculation result is stored in the trusted storage pool and/or transmitted by the trusted transmission unit, the method may include: selecting a corresponding data storage unit to store the calculation result through a storage separation engine in the credible storage pool; and/or selecting a corresponding data transmission unit in the credible transmission units by the transmission separation engine to transmit the calculation result. Similarly, the storage separation engine may select the data storage unit for performing data storage according to the storage requirement carried in the data calculation request and the performance of each data storage unit to be selected. The transmission separation engine may select the data transmission unit for performing data transmission according to the transmission requirement carried in the data calculation request and the performance of each data transmission unit to be selected.
It should be noted that, the data transmission unit, the data storage unit, the data calculation unit, the data security guarantee unit, the data security audit unit, and the data calculation control unit may be implemented in any form, for example, at least two of the data transmission unit, the data storage unit, the data calculation unit, the data security guarantee unit, the data security audit unit, and the data calculation control unit are integrated in one hardware security card. For example, the data computing unit may be implemented by integrating the memory and the data transmission unit in a security chip; the calculation control unit and the data calculation unit, or the data calculation security guarantee unit, or the data calculation security audit unit can be integrated in a chip; the data calculation safety guarantee unit is integrated with the data calculation safety audit unit, the data calculation control unit and the like.
In the data security processing method, security guarantee on each dimension of a data security period is completed through a data security guarantee unit, security audit on each dimension of the data security period is completed through a data security audit unit, a data calculation control unit monitors the data security guarantee unit and the data security audit unit, and under the condition of abnormity, limited execution or forbidden execution of data processing is triggered. The purpose of ensuring the data security from the life cycle of the data storage, the data calculation and the data transmission of the whole data of the platform and the system of the execution environment executing the data processing is achieved, so that the technical effect of ensuring the data security from the whole is achieved, and the technical problems that the protection of the data security is limited and the data security cannot be ensured from the whole in the related technology are solved.
In a preferred embodiment, a data security processing method is provided, in which, according to the whole life cycle of data, a hardware architecture corresponding to the whole method may include: trusted computing pools, trusted storage pools, trusted transports, and the like. Fig. 8 is a hardware architecture diagram corresponding to the data security processing method according to embodiment 2 of the present invention, as shown in fig. 8:
the trusted computing pool comprises data computing units with different computing capabilities, wherein the general computing unit and the sensitive high-speed encryption and decryption computing unit are one type of data computing units with different computing capabilities. It should be noted that no matter which data computing unit is adopted for data computing, the data security guarantee unit, the data security audit unit and the data computing control unit can coordinate with the data computing unit to ensure that the computing of the data computing unit is safe and credible; in addition, the trusted computing pool may perform local computation on the data according to the input computing request, for example, perform computation by using computing resources local to the trusted computing pool; remote computing may also be performed on the data, for example, where the trusted computing pool detects that the local computing resources are limited, which may affect computing efficiency, the data may be transmitted by trusted transmission to a remote server with sufficient computing resources, and the remote computing performed by the remote server. Specifically, which computing method is adopted can be flexibly selected according to the requirements of computing requests and computing resources of the trusted computing pool.
The trusted storage pool includes storage units with different capabilities, wherein, as shown in fig. 8, the trusted storage pool may be divided into: plaintext storage (with high, medium and low speed), ciphertext storage (with high, medium and low speed), and the like; it should be noted that, when the trusted storage pool stores data, local storage may also be performed on the data, for example, storage resources local to the trusted storage pool are used for storage; remote storage of data may also be performed, for example, when the trusted memory pool detects that local storage resources are limited and storage performance may be affected, data may be stored to a remote storage with rich storage resources through trusted transmission, and the data may be stored remotely by the remote storage. The specific storage mode can be flexibly selected according to the requirements of the specific request and the storage resources of the trusted storage pool.
The data transmission unit in the trusted transmission can be communicated with the data storage unit and the data calculation unit, and the communication needs to ensure the trusted transmission and conforms to the trusted transmission of the trusted network connection standard in the world. Plaintext transmission, low-security-level or high-security-level ciphertext transmission, and the like can be supported according to the transmission capability.
It should be noted that, the data security guarantee is divided into two stages, the first stage, the platform and the system supporting the data life cycle security in the equipment starting stage are complete, not tampered and legal; in the second stage, after the device is started, the security of the data in the processes of calculation (use), storage, and transmission is as shown in fig. 8, and in fig. 8, a general purpose computing unit CPU and a trusted computing unit are taken as examples to illustrate a data security procedure:
(1) a user sends a data calculation request carrying a calculation strategy, a transmission strategy or a storage strategy;
(2) the calculation request distribution engine receives a user calculation request, identifies the user identity and the legality of a user platform, selects a corresponding data calculation unit according to parameters in the user calculation request to perform data calculation, transmits a calculation result, a transmission strategy and a storage strategy to a calculation result output separation engine after the calculation is finished, and transmits the calculation result to a trusted storage pool or a data transmission unit in trusted transmission according to the transmission strategy or the storage strategy;
(3) after receiving the data, the transmission separation engine transmits the data by a corresponding mechanism according to a transmission strategy;
(4) and when the storage separation engine receives the data, the data is correspondingly stored according to the storage strategy.
(5) The trusted storage pool and the data transmission unit can also rely on a trusted network transmission protocol worldwide for data intercommunication.
By the preferred embodiment, data storage safety, data calculation safety, data transmission safety and data use execution environment safety can be communicated on one hardware safety card to form a systematic guarantee data safety; in addition, the hardware security card can provide flexible elastic security service for the service through a trusted computing pool, a trusted storage pool, data transmission units with different data transmission capabilities and a secure data use execution environment according to a service demand strategy.
It should be noted that, for simplicity of description, the above-mentioned method embodiments are described as a series of acts or combination of acts, but those skilled in the art will recognize that the present invention is not limited by the order of acts, as some steps may occur in other orders or concurrently in accordance with the invention. Further, those skilled in the art should also appreciate that the embodiments described in the specification are preferred embodiments and that the acts and modules referred to are not necessarily required by the invention.
Through the above description of the embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but the former is a better implementation mode in many cases. Based on such understanding, the technical solutions of the present invention may be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) and includes instructions for enabling a terminal device (such as a mobile phone, a computer, a server, or a network device) to execute the method according to the embodiments of the present invention.
Example 3
According to an embodiment of the present invention, there is further provided a data security processing system for implementing the data security processing method of embodiment 1, and fig. 9 is a block diagram of a data security processing system according to embodiment 3 of the present invention, and as shown in fig. 9, the data security processing system includes: the data security processing system comprises a data security guarantee unit, a data security audit unit and a data calculation control unit, and is explained below.
A data security guaranteeing unit for guaranteeing security of a platform and a system of an execution environment that executes data processing, security of a data calculation unit that executes data calculation, security of a data transmission unit that transmits data, and security of a data storage unit that stores data; the data security auditing unit is connected with the data security guaranteeing unit and the data calculation control unit and is used for auditing whether the operation of the data security guaranteeing unit for executing guarantee is safe or not, whether the operation of the data calculation is executed by the auditing data calculation unit is safe or not, whether the operation of the data transmission unit for transmitting data is safe or not and whether the operation of the data storage unit for storing data is safe or not; and the data calculation control unit is connected to the data security guarantee unit and the data security audit unit and is used for executing guarantee operation on the data security guarantee unit and/or monitoring the audit operation executed by the data security audit unit, and triggering the corresponding data processing to be executed in a limited mode or prohibited to be executed when the monitoring finds that the data processing is abnormal.
It should be noted here that the data security assurance unit, the data security audit unit and the data calculation control unit correspond to steps S602 to S606 in embodiment 1, and the two modules are the same as the corresponding steps in the implementation example and application scenario, but are not limited to the disclosure in embodiment 1. It should be noted that the modules described above may be implemented in a computer terminal as part of an apparatus.
Example 4
According to an embodiment of the present invention, there is further provided a data security processing system for implementing the data security processing method of embodiment 2, and fig. 10 is a block diagram of a data security processing system according to embodiment 4 of the present invention, and as shown in fig. 10, the data security processing system 10 includes: the receiving module 102, the first processing module 104 and the second processing module 106 are described below.
A receiving module 102, configured to receive a data calculation request; the first processing module 104 is connected to the receiving module 102, and configured to complete data calculation through a trusted computing pool to obtain a calculation result, and transmit the calculation result to a trusted storage pool and/or a trusted transmission unit, where the trusted computing pool coordinates with the data computing unit through a data security assurance unit, a data security audit unit, and a data calculation control unit to ensure security of data calculation operations; a second processing module 106, connected to the first processing module 104, for storing the calculation result through the trusted storage pool and/or transmitting the calculation result through the trusted transmission unit; the data security guarantee unit is used for guaranteeing the security of a data transmission unit in the trusted transmission unit, a data storage unit in the trusted storage pool, a data calculation unit, a data security audit unit and a data calculation control unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, whether the operation of the data calculation performed by the auditing data calculating unit is safe or not, whether the operation of the data transmission unit for auditing the data is safe or not and whether the operation of the data storage unit for auditing the data is safe or not.
It should be noted here that the receiving module 102, the first processing module 104 and the second processing module 106 correspond to steps S702 to S706 in embodiment 2, and the two modules are the same as the corresponding steps in the implementation example and application scenario, but are not limited to the disclosure in embodiment 2. It should be noted that the modules described above may be implemented in a computer terminal as part of an apparatus.
Example 5
Embodiments of the present invention may provide a hardware security card, which is used for performing data security calculation, and may be a hardware card in a computer terminal device or a hardware card in a network device.
Fig. 11 is a block diagram of a hardware security card according to embodiment 5 of the present invention, and as shown in fig. 5, the hardware security card 110 includes: a memory 112 and a processor 114, the memory storing computer programs; a processor for executing a computer program stored in the memory, the computer program when running performing the method of data security processing of any one of claims 6 to 11.
The memory may be used to store software programs and modules, such as program instructions/modules corresponding to the security vulnerability detection method and apparatus in the embodiments of the present invention, and the processor executes various functional applications and data processing by operating the software programs and modules stored in the memory, that is, implements the data security processing method. The memory may include high speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory located remotely from the processor, which may be connected to a computer terminal or a network device via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
In an alternative embodiment, the processor may invoke the information stored in the memory and the application program via the transmission device to execute the program code of the following steps: the security of a platform and a system of an execution environment for executing data processing, the security of a data calculation unit for executing data calculation, the security of a data transmission unit for transmitting data, and the security of a data storage unit for storing data are guaranteed by a data security guarantee unit; through the data security audit unit, whether the operation of the data security guarantee unit for executing the guarantee is safe or not, whether the operation of the data calculation is safe or not is executed by the audit data calculation unit, whether the operation of the data transmission by the audit data transmission unit is safe or not, and whether the operation of the data storage unit for storing the data is safe or not is audited; and the data calculation control unit is used for monitoring the execution of the guarantee operation of the data security guarantee unit and/or the execution of the audit operation of the data security audit unit, and triggering the limited execution or the forbidden execution of the corresponding data processing when the monitoring finds that the abnormal operation is abnormal.
In another alternative embodiment, the processor may invoke the information stored in the memory and the application program via the transmission device to execute the program code of the following steps: receiving a data calculation request; the data calculation is completed through the trusted computing pool to obtain a calculation result, and the calculation result is transmitted to the trusted storage pool and/or the trusted transmission unit, wherein the trusted computing pool coordinates with the data computing unit through the data security guarantee unit, the data security audit unit, the data computing control unit and the data computing unit to guarantee the security of the data computing operation; storing the calculation result through the credible storage pool and/or transmitting the calculation result through the credible transmission unit; the data security guarantee unit is used for guaranteeing the security of a data transmission unit in the trusted transmission unit, a data storage unit in the trusted storage pool, a data calculation unit, a data security audit unit and a data calculation control unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, whether the operation of the data calculation performed by the auditing data calculating unit is safe or not, whether the operation of the data transmission unit for auditing the data is safe or not and whether the operation of the data storage unit for auditing the data is safe or not.
Optionally, the processor may further execute the program code of the following steps: under the condition that the data calculation request carries a calculation strategy, a transmission strategy and/or a storage strategy, the data calculation completed through the trusted computing pool comprises the following steps: according to the calculation strategy, data calculation is completed through the trusted computing pool; the step of storing the calculation result through the trusted storage pool and/or the step of transmitting the calculation result through the trusted transmission unit comprises the following steps: storing the calculation result through the credible storage pool according to the storage strategy; and/or transmitting the calculation result through the trusted transmission unit according to the transmission strategy.
Optionally, the processor may further execute the program code of the following steps: including at least one of: the data calculation unit includes: divided according to different computing power: the general calculation unit is a high-speed encryption and decryption calculation unit; the data storage unit includes: the memory units with different storage speeds are divided according to different storage capacities, and the plaintext memory unit and the ciphertext memory unit are divided according to different security levels; the data transmission unit includes: the transmission unit with different transmission speeds is divided according to different transmission capacities, and the plaintext transmission unit and the ciphertext transmission unit are divided according to different security levels.
Optionally, the processor may further execute the program code of the following steps: the data calculation completed through the trusted computing pool comprises the following steps: selecting a corresponding data computing unit for the data computing request to perform data computing through a computing request shunting engine in the trusted computing pool; the step of storing the calculation result through the trusted storage pool and/or the step of transmitting the calculation result through the trusted transmission unit comprises the following steps: selecting a corresponding data storage unit to store the calculation result through a storage separation engine in the credible storage pool; and/or selecting a corresponding data transmission unit in the credible transmission units by the transmission separation engine to transmit the calculation result.
Optionally, the processor may further execute the program code of the following steps: at least two of the data transmission unit, the data storage unit, the data calculation unit, the data security guarantee unit, the data security audit unit and the data calculation control unit are integrated in a hardware security card.
By adopting the hardware security card, the purpose of ensuring the data security from the life cycle of the data storage, the data calculation and the data transmission of the platform and the system of the execution environment for executing the data processing is achieved, so that the technical effect of ensuring the data security from the whole is realized, and the technical problems that the protection of the data security is limited and the data security cannot be ensured from the whole in the related technology are solved.
Example 6
The embodiment of the invention also provides a storage medium. Optionally, in this embodiment, the storage medium may be configured to store a program code executed by the data security processing method provided in embodiment 1.
Optionally, in this embodiment, the storage medium may be located in any one of computer terminals in a computer terminal group in a computer network, or in any one of mobile terminals in a mobile terminal group.
Optionally, in an implementation manner of this embodiment, the storage medium is configured to store program codes for performing the following steps: the security of a platform and a system of an execution environment for executing data processing, the security of a data calculation unit for executing data calculation, the security of a data transmission unit for transmitting data, and the security of a data storage unit for storing data are guaranteed by a data security guarantee unit; through the data security audit unit, whether the operation of the data security guarantee unit for executing the guarantee is safe or not, whether the operation of the data calculation is safe or not is executed by the audit data calculation unit, whether the operation of the data transmission by the audit data transmission unit is safe or not, and whether the operation of the data storage unit for storing the data is safe or not is audited; and the data calculation control unit is used for monitoring the execution of the guarantee operation of the data security guarantee unit and/or the execution of the audit operation of the data security audit unit, and triggering the limited execution or the forbidden execution of the corresponding data processing when the monitoring finds that the abnormal operation is abnormal.
Optionally, in another implementation of this embodiment, the storage medium is configured to store program code for performing the following steps: receiving a data calculation request; the data calculation is completed through the trusted computing pool to obtain a calculation result, and the calculation result is transmitted to the trusted storage pool and/or the trusted transmission unit, wherein the trusted computing pool coordinates with the data computing unit through the data security guarantee unit, the data security audit unit, the data computing control unit and the data computing unit to guarantee the security of the data computing operation; storing the calculation result through the credible storage pool and/or transmitting the calculation result through the credible transmission unit; the data security guarantee unit is used for guaranteeing the security of a data transmission unit in the trusted transmission unit, a data storage unit in the trusted storage pool, a data calculation unit, a data security audit unit and a data calculation control unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, whether the operation of the data calculation performed by the auditing data calculating unit is safe or not, whether the operation of the data transmission unit for auditing the data is safe or not and whether the operation of the data storage unit for auditing the data is safe or not.
Optionally, the storage medium is configured to store program code for performing the steps of: under the condition that the data calculation request carries a calculation strategy, a transmission strategy and/or a storage strategy, the data calculation completed through the trusted computing pool comprises the following steps: according to the calculation strategy, data calculation is completed through the trusted computing pool; the step of storing the calculation result through the trusted storage pool and/or the step of transmitting the calculation result through the trusted transmission unit comprises the following steps: storing the calculation result through the credible storage pool according to the storage strategy; and/or transmitting the calculation result through the trusted transmission unit according to the transmission strategy.
Optionally, the storage medium is configured to store program code for performing the steps of: including at least one of: the data calculation unit includes: divided according to different computing power: the general calculation unit is a high-speed encryption and decryption calculation unit; the data storage unit includes: the memory units with different storage speeds are divided according to different storage capacities, and the plaintext memory unit and the ciphertext memory unit are divided according to different security levels; the data transmission unit includes: the transmission unit with different transmission speeds is divided according to different transmission capacities, and the plaintext transmission unit and the ciphertext transmission unit are divided according to different security levels.
Optionally, the storage medium is configured to store program code for performing the steps of: the data calculation completed through the trusted computing pool comprises the following steps: selecting a corresponding data computing unit for the data computing request to perform data computing through a computing request shunting engine in the trusted computing pool; the step of storing the calculation result through the trusted storage pool and/or the step of transmitting the calculation result through the trusted transmission unit comprises the following steps: selecting a corresponding data storage unit to store the calculation result through a storage separation engine in the credible storage pool; and/or selecting a corresponding data transmission unit in the credible transmission units by the transmission separation engine to transmit the calculation result.
Optionally, the storage medium is configured to store program code for performing the steps of: at least two of the data transmission unit, the data storage unit, the data calculation unit, the data security guarantee unit, the data security audit unit and the data calculation control unit are integrated in a hardware security card.
Example 7
The embodiment of the invention also provides a processor. The processor can be an independent device or a functional module integrated on a predetermined network device, and can be flexibly selected according to the requirements.
In a preferred implementation manner of this embodiment, the processor may execute the program code of the following steps: the security of a platform and a system of an execution environment for executing data processing, the security of a data calculation unit for executing data calculation, the security of a data transmission unit for transmitting data, and the security of a data storage unit for storing data are guaranteed by a data security guarantee unit; through the data security audit unit, whether the operation of the data security guarantee unit for executing the guarantee is safe or not, whether the operation of the data calculation is safe or not is executed by the audit data calculation unit, whether the operation of the data transmission by the audit data transmission unit is safe or not, and whether the operation of the data storage unit for storing the data is safe or not is audited; and the data calculation control unit is used for monitoring the execution of the guarantee operation of the data security guarantee unit and/or the execution of the audit operation of the data security audit unit, and triggering the limited execution or the forbidden execution of the corresponding data processing when the monitoring finds that the abnormal operation is abnormal.
In a preferred implementation manner of this embodiment, the processor may execute the program code of the following steps: receiving a data calculation request; the data calculation is completed through the trusted computing pool to obtain a calculation result, and the calculation result is transmitted to the trusted storage pool and/or the trusted transmission unit, wherein the trusted computing pool coordinates with the data computing unit through the data security guarantee unit, the data security audit unit, the data computing control unit and the data computing unit to guarantee the security of the data computing operation; storing the calculation result through the credible storage pool and/or transmitting the calculation result through the credible transmission unit; the data security guarantee unit is used for guaranteeing the security of a data transmission unit in the trusted transmission unit, a data storage unit in the trusted storage pool, a data calculation unit, a data security audit unit and a data calculation control unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, whether the operation of the data calculation performed by the auditing data calculating unit is safe or not, whether the operation of the data transmission unit for auditing the data is safe or not and whether the operation of the data storage unit for auditing the data is safe or not.
Optionally, the processor may further execute the program code of the following steps: under the condition that the data calculation request carries a calculation strategy, a transmission strategy and/or a storage strategy, the data calculation completed through the trusted computing pool comprises the following steps: according to the calculation strategy, data calculation is completed through the trusted computing pool; the step of storing the calculation result through the trusted storage pool and/or the step of transmitting the calculation result through the trusted transmission unit comprises the following steps: storing the calculation result through the credible storage pool according to the storage strategy; and/or transmitting the calculation result through the trusted transmission unit according to the transmission strategy.
Optionally, the processor may further execute the program code of the following steps: including at least one of: the data calculation unit includes: divided according to different computing power: the general calculation unit is a high-speed encryption and decryption calculation unit; the data storage unit includes: the memory units with different storage speeds are divided according to different storage capacities, and the plaintext memory unit and the ciphertext memory unit are divided according to different security levels; the data transmission unit includes: the transmission unit with different transmission speeds is divided according to different transmission capacities, and the plaintext transmission unit and the ciphertext transmission unit are divided according to different security levels.
Optionally, the processor may further execute the program code of the following steps: the data calculation completed through the trusted computing pool comprises the following steps: selecting a corresponding data computing unit for the data computing request to perform data computing through a computing request shunting engine in the trusted computing pool; the step of storing the calculation result through the trusted storage pool and/or the step of transmitting the calculation result through the trusted transmission unit comprises the following steps: selecting a corresponding data storage unit to store the calculation result through a storage separation engine in the credible storage pool; and/or selecting a corresponding data transmission unit in the credible transmission units by the transmission separation engine to transmit the calculation result.
Optionally, the processor may further execute the program code of the following steps: at least two of the data transmission unit, the data storage unit, the data calculation unit, the data security guarantee unit, the data security audit unit and the data calculation control unit are integrated in a hardware security card.
The above-mentioned serial numbers of the embodiments of the present invention are merely for description and do not represent the merits of the embodiments.
In the above embodiments of the present invention, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.
In the embodiments provided in the present application, it should be understood that the disclosed technology can be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, a division of a unit is merely a division of a logic function, and an actual implementation may have another division, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, and other various media capable of storing program codes.
The foregoing is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, various modifications and decorations can be made without departing from the principle of the present invention, and these modifications and decorations should also be regarded as the protection scope of the present invention.

Claims (16)

1. A data security processing system, comprising: a data transfer unit for transferring data, a data storage unit for storing data, a data calculation unit for performing data calculations, further comprising:
a data security guaranteeing unit for guaranteeing security of a system executing an execution environment executing data processing, security of the data calculating unit, security of the data transmitting unit, and security of the data storing unit;
the data security auditing unit is used for auditing whether the operation which is performed and ensured by the data security ensuring unit is safe or not, auditing whether the operation which is performed and ensured by the data computing unit is safe or not, auditing whether the operation which is transmitted by the data transmission unit is safe or not and auditing whether the operation which is stored by the data storage unit is safe or not;
and the data calculation control unit is used for monitoring the guarantee operation executed by the data security guarantee unit and/or the audit operation executed by the data security audit unit, and triggering the limited execution or the forbidden execution of the corresponding data processing when the monitoring finds that the data processing is abnormal.
2. The system of claim 1,
the data security guarantee unit is used for guaranteeing the integrity and the legality of hardware firmware of a system executing an execution environment for executing data processing;
the data security guarantee unit is used for guaranteeing the integrity and the legality of computing system software, computing hardware firmware and application programs used for computing of the data computing unit;
the data security guarantee unit is used for guaranteeing the integrity and the legality of transmission system software, transmission hardware firmware and application programs used for transmission of the data transmission unit;
and the data safety guarantee unit is used for guaranteeing the integrity and the legality of the storage system software, the storage hardware firmware and the application program used for storage of the data storage unit.
3. The system of claim 1,
the data security auditing unit is used for auditing whether a guarantee result obtained by the data security guarantee unit executing guarantee is consistent with an expected guarantee result or not, and under the condition that the guarantee result is consistent with the expected guarantee result, the operation of executing guarantee by the data security guarantee unit is determined to be safe; or, the data security auditing unit is used for auditing whether the guarantee process of the data security guarantee unit for executing guarantee is consistent with the expected guarantee process, and under the condition that the guarantee process of the data security guarantee unit for executing guarantee is inconsistent with the expected guarantee process, the operation of the data security guarantee unit for executing guarantee is determined to be unsafe;
the data security auditing unit is used for auditing whether a calculation result obtained by the data calculation unit executing the data calculation is consistent with an expected calculation result or not, and under the condition that the calculation result is consistent with the expected calculation result, the operation of the data calculation unit executing the data calculation is determined to be safe; or, the data security auditing unit is used for auditing whether the calculation process of the data calculation unit for performing the data calculation is consistent with the expected calculation process, and under the condition that the calculation process of the data calculation unit for performing the data calculation is not consistent with the expected calculation process, the data security auditing unit determines that the operation of the data calculation unit for performing the data calculation is unsafe;
the data security auditing unit is used for auditing whether a transmission result obtained by the data transmission unit transmitting data is consistent with an expected transmission result or not, and determining that the data transmission unit is safe in data transmission operation under the condition that the transmission result is consistent with the expected transmission result; or, the data security auditing unit is used for auditing whether the transmission process of the data transmission unit for transmitting the data is consistent with the expected transmission process, and under the condition that the transmission process of the data transmission unit for transmitting the data is inconsistent with the expected transmission process, the data security auditing unit determines that the operation of the data transmission unit for transmitting the data is unsafe;
the data security auditing unit is used for auditing whether a storage result obtained by storing data in the data storage unit is consistent with an expected storage result or not, and determining that the operation of storing the data in the data storage unit is safe under the condition that the storage result is consistent with the expected storage result; or, the data security auditing unit is used for auditing whether the storage process of the data stored in the data storage unit is consistent with the expected storage process, and determining that the operation of the data stored in the data storage unit is unsafe under the condition that the storage process of the data stored in the data storage unit is inconsistent with the expected storage process.
4. The system of claim 1,
the data security auditing unit is also used for acquiring security auditing data of non-user data, and is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, whether the operation of the data computing unit for performing data computing is safe or not, whether the operation of the data transmission unit for transmitting data is safe or not and whether the operation of the data storage unit for storing data is safe or not according to the acquired security auditing data of the non-user data.
5. The system according to any one of claims 1 to 4,
at least two of the data transmission unit, the data storage unit, the data calculation unit, the data safety guarantee unit, the data safety audit unit and the data calculation control unit are integrated in a hardware safety card.
6. A data security processing method is characterized by comprising the following steps:
securing, by a data security securing unit, a system of an execution environment that executes data processing, a data calculation unit for executing data calculation, a data transmission unit for transmitting data, and a data storage unit for storing data;
auditing whether the operation guaranteed by the data security guarantee unit is safe or not, auditing whether the operation calculated by the data calculation unit is safe or not, auditing whether the operation of the data transmission unit for transmitting data is safe or not and auditing whether the operation of the data storage unit for storing data is safe or not through a data security auditing unit;
and monitoring the execution of the data security guarantee unit and/or the execution of the audit operation by the data security audit unit through a data calculation control unit, and triggering the limited execution or the forbidden execution of the corresponding data processing when the monitoring finds that the data processing is abnormal.
7. A data security processing method is characterized by comprising the following steps:
receiving a data calculation request;
the data calculation is completed through a trusted computing pool to obtain a calculation result, and the calculation result is transmitted to a trusted storage pool and/or a trusted transmission unit, wherein the trusted computing pool is coordinated with a data calculation unit through a data security guarantee unit, a data security audit unit, a data calculation control unit and the data calculation unit to guarantee the security of data calculation operation;
storing the calculation result through the credible storage pool and/or transmitting the calculation result through the credible transmission unit;
the data security guarantee unit is used for guaranteeing the security of a data transmission unit in the trusted transmission unit, a data storage unit in the trusted storage pool, the data calculation unit, the data security audit unit and the data calculation control unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, auditing whether the operation of the data computing unit for performing data computing is safe or not, auditing whether the operation of the data transmission unit for transmitting data is safe or not and auditing whether the operation of the data storage unit for storing data is safe or not.
8. The method according to claim 7, wherein, in the case that the data computation request carries a computation policy, a transmission policy and/or a storage policy,
completing data computation through the trusted computing pool comprises: according to the calculation strategy, data calculation is completed through the trusted computing pool;
storing the calculation result through the trusted storage pool, and/or transmitting the calculation result through the trusted transmission unit includes: storing the calculation result through the credible storage pool according to the storage strategy; and/or transmitting the calculation result through the trusted transmission unit according to the transmission strategy.
9. The method of claim 7, comprising at least one of:
the data calculation unit includes: divided according to different computing power: the general calculation unit is a high-speed encryption and decryption calculation unit;
the data storage unit includes: the memory units with different storage speeds are divided according to different storage capacities, and the plaintext memory unit and the ciphertext memory unit are divided according to different security levels;
the data transmission unit includes: the transmission unit with different transmission speeds is divided according to different transmission capacities, and the plaintext transmission unit and the ciphertext transmission unit are divided according to different security levels.
10. The method of claim 7,
completing data computation through the trusted computing pool comprises: selecting a corresponding data computing unit for the data computing request to perform data computing through a computing request shunting engine in the trusted computing pool;
storing the calculation result through the trusted storage pool, and/or transmitting the calculation result through the trusted transmission unit includes: selecting a corresponding data storage unit to store the calculation result through a storage separation engine in the credible storage pool; and/or selecting a corresponding data transmission unit in the credible transmission units by a transmission separation engine to transmit the calculation result.
11. The method according to any one of claims 7 to 10,
at least two of the data transmission unit, the data storage unit, the data calculation unit, the data safety guarantee unit, the data safety audit unit and the data calculation control unit are integrated in a hardware safety card.
12. A data security processing system, comprising: a data security guarantee unit, a data security audit unit and a data calculation control unit, wherein,
the data security guarantee unit is used for guaranteeing the security of a system of an execution environment for executing data processing, the security of a data calculation unit for executing data calculation, the security of a data transmission unit for transmitting data and the security of a data storage unit for storing data;
the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, auditing whether the operation of the data computing unit for performing data computing is safe or not, auditing whether the operation of the data transmission unit for transmitting data is safe or not and auditing whether the operation of the data storage unit for storing data is safe or not;
and the data calculation control unit is used for monitoring the execution of guarantee operation of the data security guarantee unit and/or the execution of audit operation of the data security audit unit, and triggering the limited execution or the forbidden execution of the corresponding data processing when the monitoring finds that the data processing is abnormal.
13. A data security processing system, comprising:
the receiving module is used for receiving a data calculation request;
the first processing module is used for completing data calculation through a trusted computing pool to obtain a calculation result and transmitting the calculation result to a trusted storage pool and/or a trusted transmission unit, wherein the trusted computing pool is coordinated with the data computing unit through a data security guarantee unit, a data security audit unit, a data computing control unit and the data computing unit to guarantee the security of data computing operation;
the second processing module is used for storing the calculation result through the credible storage pool and/or transmitting the calculation result through the credible transmission unit;
the data security guarantee unit is used for guaranteeing the security of a data transmission unit in the trusted transmission unit, a data storage unit in the trusted storage pool, the data calculation unit, the data security audit unit and the data calculation control unit; the data security auditing unit is used for auditing whether the operation guaranteed by the data security guaranteeing unit is safe or not, auditing whether the operation of the data computing unit for performing data computing is safe or not, auditing whether the operation of the data transmission unit for transmitting data is safe or not and auditing whether the operation of the data storage unit for storing data is safe or not.
14. A storage medium storing a program, wherein the program causes a processor to execute the data security processing method according to any one of claims 6 to 11 when the program is executed by the processor.
15. A processor, configured to execute a program, wherein the program is executed to cause the processor to execute the data security processing method according to any one of claims 6 to 11.
16. A hardware security card, comprising: a memory and a processor, wherein the processor is capable of,
the memory stores a computer program;
the processor is configured to execute the computer program stored in the memory, and when the computer program runs, the processor is enabled to execute the data security processing method according to any one of claims 6 to 11.
CN201910295533.XA 2019-04-12 2019-04-12 Data security processing system, method, storage medium, processor and hardware security card Active CN111814157B (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201910295533.XA CN111814157B (en) 2019-04-12 2019-04-12 Data security processing system, method, storage medium, processor and hardware security card
PCT/CN2020/082312 WO2020207292A1 (en) 2019-04-12 2020-03-31 Data security processing system and method, storage medium, processor, and hardware security card

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910295533.XA CN111814157B (en) 2019-04-12 2019-04-12 Data security processing system, method, storage medium, processor and hardware security card

Publications (2)

Publication Number Publication Date
CN111814157A true CN111814157A (en) 2020-10-23
CN111814157B CN111814157B (en) 2022-12-27

Family

ID=72751902

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910295533.XA Active CN111814157B (en) 2019-04-12 2019-04-12 Data security processing system, method, storage medium, processor and hardware security card

Country Status (2)

Country Link
CN (1) CN111814157B (en)
WO (1) WO2020207292A1 (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117395033B (en) * 2023-09-22 2024-05-03 广州尚全信息技术有限公司 Data security supervision method and system

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090300474A1 (en) * 2008-05-29 2009-12-03 Centralytics, Inc. Computer-based architecture using remotely-controlled electronic grid-based calculators
CN103269343A (en) * 2013-05-21 2013-08-28 福建畅云安鼎信息科技有限公司 Business data safety control platform
CN104794410A (en) * 2015-03-23 2015-07-22 中国科学院软件研究所 Database security protection method based on dependable computing technology
US20170024408A1 (en) * 2015-07-21 2017-01-26 International Business Machines Corporation File system monitoring and auditing via monitor system having user-configured policies
CN106991329A (en) * 2017-03-31 2017-07-28 山东超越数控电子有限公司 A kind of trust calculation unit and its operation method based on domestic TCM
CN108270716A (en) * 2016-12-30 2018-07-10 绵阳灵先创科技有限公司 A kind of audit of information security method based on cloud computing
CN108600178A (en) * 2018-03-28 2018-09-28 深圳市银之杰科技股份有限公司 A kind of method for protecting and system, reference platform of collage-credit data
CN108810018A (en) * 2018-07-12 2018-11-13 南方电网科学研究院有限责任公司 A kind of mobile application detection cloud platform

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060191007A1 (en) * 2005-02-24 2006-08-24 Sanjiva Thielamay Security force automation
US8656482B1 (en) * 2012-08-20 2014-02-18 Bitdefender IPR Management Ltd. Secure communication using a trusted virtual machine
CN104268254A (en) * 2014-10-09 2015-01-07 浪潮电子信息产业股份有限公司 Security state analysis and statistics method
CN109376542A (en) * 2018-09-30 2019-02-22 苏州浪潮智能软件有限公司 A kind of security hardening system schema for embedded financial terminal

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090300474A1 (en) * 2008-05-29 2009-12-03 Centralytics, Inc. Computer-based architecture using remotely-controlled electronic grid-based calculators
CN103269343A (en) * 2013-05-21 2013-08-28 福建畅云安鼎信息科技有限公司 Business data safety control platform
CN104794410A (en) * 2015-03-23 2015-07-22 中国科学院软件研究所 Database security protection method based on dependable computing technology
US20170024408A1 (en) * 2015-07-21 2017-01-26 International Business Machines Corporation File system monitoring and auditing via monitor system having user-configured policies
CN108270716A (en) * 2016-12-30 2018-07-10 绵阳灵先创科技有限公司 A kind of audit of information security method based on cloud computing
CN106991329A (en) * 2017-03-31 2017-07-28 山东超越数控电子有限公司 A kind of trust calculation unit and its operation method based on domestic TCM
CN108600178A (en) * 2018-03-28 2018-09-28 深圳市银之杰科技股份有限公司 A kind of method for protecting and system, reference platform of collage-credit data
CN108810018A (en) * 2018-07-12 2018-11-13 南方电网科学研究院有限责任公司 A kind of mobile application detection cloud platform

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
丁顺福等: ""基于云架构的数据交换共享平台研究与设计"", 《通讯世界》 *

Also Published As

Publication number Publication date
CN111814157B (en) 2022-12-27
WO2020207292A1 (en) 2020-10-15

Similar Documents

Publication Publication Date Title
EP3937424B1 (en) Blockchain data processing methods and apparatuses based on cloud computing
CN109858265B (en) Encryption method, device and related equipment
RU2679721C2 (en) Attestation of host containing trusted execution environment
CN100447763C (en) Safety chip and information safety processor and processing method
US7313705B2 (en) Implementation of a secure computing environment by using a secure bootloader, shadow memory, and protected memory
US9054865B2 (en) Cryptographic system and methodology for securing software cryptography
US20200026882A1 (en) Methods and systems for activating measurement based on a trusted card
WO2019104988A1 (en) Plc security processing unit and bus arbitration method thereof
CN105447406A (en) Method and apparatus for accessing storage space
CN108615154B (en) Block chain digital signature system based on hardware encryption protection and using process
US20200104528A1 (en) Data processing method, device and system
US20190258782A1 (en) Securing temporal digital communications via authentication and validation for wireless user and access devices with securitized containers
CN110874494B (en) Method, device and system for processing password operation and method for constructing measurement trust chain
CN112257086B (en) User privacy data protection method and electronic equipment
CN110875819B (en) Password operation processing method, device and system
US20220129544A1 (en) Apparatus and Method for Disk Attestation
WO2021218278A1 (en) Method for processing data, and computing device
CN110245495B (en) BIOS checking method, configuration method, device and system
CN112016090B (en) Secure computing card, and measuring method and system based on secure computing card
CN110750791A (en) Method and system for guaranteeing physical attack resistance of trusted execution environment based on memory encryption
CN111814157B (en) Data security processing system, method, storage medium, processor and hardware security card
CN111859379B (en) Processing method and device for protecting data model
US9135449B2 (en) Apparatus and method for managing USIM data using mobile trusted module
US20210326443A1 (en) Executing sotware
CN111209544B (en) Web application security protection method and device, electronic equipment and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant