WO2020207292A1 - 数据安全处理系统、方法、存储介质、处理器及硬件安全卡 - Google Patents

数据安全处理系统、方法、存储介质、处理器及硬件安全卡 Download PDF

Info

Publication number
WO2020207292A1
WO2020207292A1 PCT/CN2020/082312 CN2020082312W WO2020207292A1 WO 2020207292 A1 WO2020207292 A1 WO 2020207292A1 CN 2020082312 W CN2020082312 W CN 2020082312W WO 2020207292 A1 WO2020207292 A1 WO 2020207292A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
unit
security
calculation
audit
Prior art date
Application number
PCT/CN2020/082312
Other languages
English (en)
French (fr)
Inventor
付颖芳
肖鹏
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2020207292A1 publication Critical patent/WO2020207292A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/606—Protecting data by securing the transmission between two devices or processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data

Definitions

  • the invention relates to the field of secure computing, in particular to a data secure processing system, method, storage medium, processor and hardware security card.
  • the protection of data security is to protect the data itself from the software level. For example, data is encrypted and protected. However, when password encryption is used, the ability of password encryption is lacking. For example, The key that encrypts the data will not be effectively managed. For example, it sometimes appears in the memory in plain text and cannot guarantee the security of data calculations. Moreover, in related technologies, there are few considerations for the protection of data security. For example, sometimes it only considers whether the storage of the data itself is safe, and sometimes only whether the data transmission process is safe and so on. Therefore, the protection of data security is relatively limited, and data security cannot be guaranteed as a whole.
  • the embodiments of the present invention provide a data security processing system, method, storage medium, processor, and hardware security card, so as to at least solve the problem of relatively limited protection of data security in related technologies, which cannot guarantee data security as a whole. technical problem.
  • a data security system including: a data transmission unit for transmitting data, a data storage unit for storing data, a data calculation unit for performing data calculation, and further including:
  • the data security assurance unit is used to ensure the security of the execution environment of the data processing system, the security of the data calculation unit, the security of the data transmission unit, and the security of the data storage unit;
  • the data security audit unit is used to audit the data security assurance Whether the unit performs guaranteed operations is safe, audits whether the operation of the data calculation unit performing data calculations is safe, audits whether the operation of the data transmission unit to transmit data is safe, audits whether the operation of the data storage unit to store data is safe; data calculations
  • the control unit is configured to perform a guarantee operation on the data security guarantee unit, and/or the data security audit unit performs an audit operation to monitor, and when an abnormality is found in the monitoring, the corresponding data processing restricted execution or execution is prohibited.
  • a data security processing method including: using a data security assurance unit to ensure the security of a system in an execution environment for executing data processing, and a data calculation unit for performing data calculations Security, the security of the data transmission unit used to transmit data, and the security of the data storage unit used to store data; the data security audit unit is used to audit whether the data security assurance unit performs the guaranteed operation is safe, and the data calculation unit is audited Whether the operation of performing data calculation is safe, audit whether the operation of data transmission by the data transmission unit is safe, and whether the operation of storing data by the data storage unit is safe; perform a guarantee operation on the data security guarantee unit through the data calculation control unit , And/or the data security audit unit performs an audit operation for monitoring, and when an abnormality is found in the monitoring, the corresponding data processing is triggered to be restricted or prohibited.
  • a data security processing method including: receiving a data calculation request; completing data calculation through a trusted computing pool to obtain a calculation result, and transmitting the calculation result to a trusted The storage pool and/or the trusted transmission unit, wherein the trusted computing pool is coordinated with the data computing unit through a data security assurance unit, a data security audit unit, a data calculation control unit and a data calculation unit to ensure the safety of data calculation operations;
  • the trusted storage pool stores the calculation results and/or transmits the calculation results through the trusted transmission unit; wherein, the data security guarantee unit is used to protect the data in the trusted transmission unit
  • the transmission unit, the data storage unit in the trusted storage pool, the data calculation unit, the data security audit unit, the security of the data calculation control unit; the data security audit unit is used to audit the data security Whether the guarantee unit performs the guaranteed operation is safe, audits whether the data calculation operation performed by the data calculation unit is safe, audits whether the data transmission operation of the data transmission unit is safe, and audits whether
  • a data security processing system including: a data security assurance unit, a data security audit unit, and a data calculation control unit, wherein the data security assurance unit is used to ensure execution The security of the system of the execution environment of data processing, the security of the data calculation unit used to perform data calculations, the security of the data transmission unit used to transmit data, the security of the data storage unit used to store data; the data security audit unit , Used to audit whether the data security guarantee unit performs the guaranteed operation is safe, audit whether the data calculation unit performs the data calculation operation is safe, audit whether the data transmission unit transmits data operation is safe, and audit the data storage unit Whether the operation of storing data is safe; the data calculation control unit is used to perform a guarantee operation on the data security guarantee unit, and/or the data security audit unit performs an audit operation to monitor, and trigger the corresponding Data processing is restricted or prohibited.
  • a storage medium storing a program, wherein when the program is run by a processor, the processor is caused to execute any one of the foregoing Data security processing method.
  • a processor configured to run a program, wherein when the program runs, the processor executes the data security processing method described in any one of the above .
  • a hardware security card including: a memory and a processor, the memory storing a computer program; the processor is configured to execute the computer program stored in the memory When the computer program is executed by the processor, the processor executes the data security processing method described in any one of the foregoing.
  • the data security processing system includes: a data transmission unit, a data storage unit, and a data calculation unit, and further includes: a data security assurance unit for ensuring the security of the system in the execution environment for executing data processing, and the data calculation unit
  • the security of the data transmission unit, the security of the data storage unit is used to audit whether the data security assurance unit performs the guaranteed operation is safe, the data calculation unit performs the data calculation operation, and the data transmission unit transmits data Whether the operation of the data storage unit is safe and whether the operation of the data storage unit is safe;
  • the data calculation control unit is used to perform guarantee operations on the data security assurance unit, and/or the data security audit unit performs audit operations to monitor.
  • Figure 1 is a block diagram of the hardware structure of a data security processing system according to Embodiment 1 of the present invention.
  • FIG. 2 is an abstract hardware security architecture diagram of the data security processing system according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic structural diagram of a data security assurance unit, a data security audit unit, a data calculation unit, and a data transmission unit integrated into a hardware security card according to Embodiment 1 of the present invention
  • FIG. 4 is a schematic structural diagram of a data security assurance unit, a data security audit unit, and a data calculation unit according to Embodiment 1 of the present invention to form a data security processing system after being integrated with the data transmission unit;
  • FIG. 5 is a schematic diagram of the integration of a data security assurance unit and a data security audit unit according to Embodiment 1 of the present invention, and the integration of a data calculation unit and a data transmission unit forms a structural diagram of a data security processing system;
  • FIG. 6 is a flowchart of a data security processing method according to Embodiment 1 of the present invention.
  • FIG. 7 is a flowchart of a data security processing method according to Embodiment 2 of the present invention.
  • FIG. 8 is a hardware architecture diagram corresponding to the data security processing method according to Embodiment 2 of the present invention.
  • FIG. 9 is a structural block diagram of a data security processing system according to Embodiment 3 of the present invention.
  • FIG. 10 is a structural block diagram of a data security processing system according to Embodiment 4 of the present invention.
  • Fig. 11 is a structural block diagram of a hardware security card according to Embodiment 5 of the present invention.
  • Data computing security during the execution of the program, it is ensured that the execution environment of the program is credible, the sensitive data involved in the calculation is not leaked, not tampered with, and the time-space sequence of calculation instructions is not tampered with.
  • Data transmission security refers to the protection of sensitive data from being tampered with or leaked during the transmission of information between two communicating entities.
  • Data storage security It means that sensitive data in the information system is not subject to illegal operations such as unauthorized access, embezzlement, tampering, and deletion.
  • BIOS Basic Input Output System
  • OS Loader Operating System Loader
  • Trusted Computing is a trusted computing platform supported by hardware security modules that is widely used in computing and communication systems to improve the overall security of the system.
  • TPM Trusted Platform Module
  • TPCM Trusted Platform Control Module
  • Credibility measurement at certain specific moments, measure the target to obtain some information of the target (such as the hash value of the file), and compare the value of this information with the pre-recorded standard value to determine the target's Whether the integrity has been destroyed.
  • Firmware refers to the program stored in the hardware that cannot be easily changed, and also refers to the basic hardware where some of the above programs are located.
  • a hardware data security processing system and a data security guarantee method implemented by the hardware data security processing system are provided, thereby effectively improving the data security guarantee capability.
  • data security is systematically guaranteed from four dimensions: platform and system security, data computing security, data transmission security, and data storage security.
  • Fig. 1 is a hardware structure block diagram of a data security processing system according to Embodiment 1 of the present invention.
  • the data security processing system includes: a data transmission unit for transmitting data, a data storage unit for storing data, a data calculation unit for performing data calculations, and a data security assurance unit, data Security audit unit and data calculation control unit, among which,
  • the data security assurance unit is connected to the above-mentioned data transmission unit, data storage unit, data calculation unit, data security audit unit and data calculation control unit, and is used to ensure the security of the system in the execution environment for performing data processing and the security of the data calculation unit, The security of the data transmission unit, the security of the data storage unit; the data security audit unit, connected to the above data transmission unit, data storage unit, data calculation unit, data security guarantee unit and data calculation control unit, used to audit the execution of the data security guarantee unit Whether the guaranteed operation is safe, whether the operation performed by the audit data calculation unit for data calculation is safe, whether the operation of the data transmission unit is safe to transmit data, whether the operation of the audit data storage unit is safe; the data calculation control unit is connected to the above data security The security unit and the data security audit unit are used to perform security operations on the data security security unit, and/or the data security audit unit perform audit operations to monitor, and when an abnormality is found in the monitoring, the corresponding data processing is restricted or prohibited.
  • the data security guarantee unit guarantees the security of the system in the execution environment that executes data processing.
  • the security of the system is a broad understanding of the overall execution environment, which can be understood as a platform and (specific) system
  • the security can mean that the device’s BIOS, hardware firmware, OS Loader and other software and hardware platforms and systems are complete and legal.
  • the following embodiments take "platform and system" as an example to illustrate the system.
  • the data security assurance unit is used to ensure the security of the platform and system of the execution environment for executing data processing, the security of the data computing unit, the security of the data transmission unit, and the security of the data storage unit.
  • data security assurance unit data security is guaranteed from the four dimensions of the data life cycle.
  • the data security processing system can receive the data security calculation request, that is, from the four dimensions of the data life cycle. The above four dimensions of the data life cycle are guaranteed before specific operations are executed, and can be flexibly selected according to specific needs.
  • the data security assurance unit is used to ensure the security of the platform and system of the execution environment for executing data processing, the security of the data computing unit, the security of the data transmission unit, and the security of the data storage unit.
  • the content of the guarantee may be different, but the basic requirements for the guarantee can include: guarantee that the subject of execution is safe, guarantee that the hardware environment of execution is safe, and guarantee that the software program executed is safe, etc. .
  • a data security assurance unit is used to ensure the integrity and legitimacy of the execution environment platform for executing data processing and the hardware firmware of the system; that is, the data security assurance unit protects the execution environment platform for executing data processing And the system is safe, the main consideration is not only to ensure the integrity of the platform and the hardware firmware of the execution environment for data processing, but also to ensure the legitimacy of the platform and the hardware firmware of the execution environment for the data processing.
  • a data security assurance unit guarantees the integrity and legality of the computing system software, computing hardware firmware, and application programs used in the calculation of the data computing unit; that is, the data security assurance unit protects the data computing unit It is safe. It is not only necessary to ensure the integrity and legality of the computing system software of the data computing unit, but also the integrity and legality of the hardware firmware of the data computing unit. It also needs to ensure the computing application used in the calculation of the data computing unit. Completeness and legality. That is, the data security assurance unit guarantees the security of the data computing unit from both the software and hardware levels.
  • the data security guarantee unit is used to guarantee the integrity and legality of the transmission system software, the transmission hardware firmware, and the application programs used in the transmission of the data transmission unit; that is, the data security guarantee unit guarantees the data
  • the transmission unit is safe, and what needs to be guaranteed is not only the integrity and legality of the transmission system software of the data transmission unit, and the integrity and legality of the transmission hardware firmware of the data transmission unit, but also the transmission of the data transmission unit.
  • the integrity and legitimacy of the application program used at the time (for example, the encryption and decryption program is involved when the encryption and decryption transmission is required)
  • the safety of the above-mentioned software and hardware is guaranteed, and the safety of the data transmission unit is guaranteed.
  • a data security assurance unit is used to ensure the integrity and legality of the storage system software, storage hardware firmware, and storage application programs of the data storage unit; that is, the data security assurance unit protects data
  • the storage unit is safe, and what needs to be guaranteed is not only the integrity and legality of the storage system software of the data storage unit, and the integrity and legality of the storage hardware firmware of the data storage unit, but also the protection of the data storage unit.
  • the integrity and legitimacy of the application programs used during storage for example, when encryption and decryption storage is required, the encryption and decryption programs are involved).
  • the data security audit unit is used to audit whether the data security assurance unit performs the guaranteed operation, whether the data calculation unit performs data calculation operations, and whether the data transmission unit transmits data operations is safe, Audit whether the operation of data storage unit storing data is safe, that is, it is used to judge whether the operation guaranteed by the data security guarantee unit is safe by means of calculation and comparison, whether the operation performed by the data calculation unit is safe, and the operation of the data transmission unit to transmit data Is it safe? Is the operation of data storage unit safe?
  • the data security audit unit also conducts audits from the four dimensions of the data security life cycle to determine that the operations performed by each dimension are safe.
  • the data security assurance unit provides security assurance to the data security audit unit, and the data security audit unit audits the security operations of the data security assurance unit, the purpose of mutual restraint of security is achieved, and the dual security assurance is achieved. effect.
  • the audit can use multiple methods, and the simplest matching method can also be used.
  • the matching method is to perform the audit on each dimension. The result of is compared with the expected execution result. If the two are consistent, it is determined that it is safe to perform the corresponding operation in this dimension.
  • the data security audit unit is used to audit whether the guarantee result obtained by the data security guarantee unit performing guarantee is consistent with the expected guarantee result, and if the two are consistent, determine the data security guarantee unit to perform the guarantee operation It is safe. When the two are inconsistent, it is determined that the data security assurance unit performs the guaranteed operation is unsafe; that is, it is determined whether the data security assurance unit performs the guaranteed operation by comparing with the expected guarantee result. .
  • the data security audit unit when used to audit whether the operation performed by the data security guarantee unit is safe, not only can the above-mentioned method of comparing with the expected guarantee result be used, but also in order to detect abnormal guarantees in time and interrupt unsafe guarantees in time Processing (for example, the steps of performing the guarantee are inconsistent with the expected steps, the processing of the process results obtained in the guarantee process is inconsistent with the processing of the expected process results, etc.), the data security audit unit can also be used to audit the data security guarantee unit to perform the guarantee Whether the guarantee process of the data security guarantee process is consistent with the expected guarantee process, if the two are inconsistent, it is determined that the data security guarantee unit performs the guaranteed operation is unsafe.
  • the guarantee process if the guarantee process is found to be inconsistent, without comparing the guarantee results, it can be directly determined that the operation of the data security guarantee unit is insecure, so the abnormal situation can be realized more quickly
  • the suspension of operations improves audit efficiency.
  • the data security audit unit is used to audit whether the calculation result obtained by the data calculation unit performed by the data calculation unit is consistent with the expected calculation result, and if the two are consistent, determine the operation of the data calculation unit to perform the data calculation It is safe. When the two are inconsistent, it is determined that the operation of the data calculation unit to perform data calculation is unsafe; that is, the operation of the data calculation unit to perform data calculation is determined by comparing with the expected calculation result. .
  • the data security audit unit when used to audit whether the calculation operation performed by the data calculation unit is safe, not only can the above-mentioned method of comparing with the expected calculation result be used, but also in order to discover abnormal data calculations and interrupt unsafe data in time Calculation processing (for example, the steps of performing calculations on data are not the expected steps, the processing of the process results obtained in the process of performing calculations on data is inconsistent with the expected processing, etc.), the data security audit unit can also be used to audit the data calculation unit Whether the calculation process performed by the calculation is consistent with the expected calculation process, if the two are inconsistent, it is determined that the calculation operation performed by the data calculation unit is unsafe.
  • the data security audit unit can also be used to audit the data calculation unit Whether the calculation process performed by the calculation is consistent with the expected calculation process, if the two are inconsistent, it is determined that the calculation operation performed by the data calculation unit is unsafe.
  • the data security audit unit is used to audit whether the transmission result obtained by the data transmission unit transmitted by the data transmission unit is consistent with the expected transmission result, and if the two are consistent, it is determined that the operation of the data transmission unit to transmit data is safe If the two are inconsistent, it is determined that the operation of the data transmission unit to transmit data is unsafe; that is, it is determined whether the operation of the data transmission unit to transmit data is safe by comparing with the expected transmission result.
  • the data security audit unit when used to audit whether the operation of the data transmission unit to transmit data is safe, not only can the above-mentioned method of comparing with the expected transmission result be used, but also in order to detect abnormal transmission in time and interrupt unsafe data transmission in time Processing (for example, the transmission method used for data transmission is inconsistent with the expected transmission method (for example, whether to encrypt or decrypt transmission, etc.), whether there is a transfer in the process of data transmission and the expected inconsistency, etc.), the data security audit unit can also be used for auditing Whether the data transmission process of the data transmission unit is consistent with the expected transmission process, if the two are inconsistent, it is determined that the operation of the data calculation unit to transmit data is unsafe. When comparing with the expected transmission process, if the transmission process is found to be inconsistent, you can directly determine that the operation of the data calculation unit to transmit data is unsafe without comparing the transmission results, so that abnormal situations can be realized more quickly Suspend the operation and improve audit efficiency.
  • the data security audit unit is used to audit whether the storage result obtained by the data storage unit storing the data is consistent with the expected storage result, and if the two are consistent, it is determined that the operation of the data storage unit storing data is safe Yes, when the two are inconsistent, it is determined that the operation of the data storage unit to store data is unsafe. That is, it is determined whether the operation of the data storage unit to store data is safe by comparing with the expected storage result.
  • the data security audit unit when used to audit whether the operation of the data storage unit to store data is safe, not only can the above-mentioned method of comparing with the expected storage result be used, but also in order to detect abnormal storage in time and interrupt unsafe data storage in time Processing (for example, the storage properties used in the data storage process (such as temporary storage or permanent storage) are inconsistent with the expected storage properties, the storage speed of data storage is inconsistent with the expected storage speed, etc.), the data security audit unit, can also be used In order to audit whether the storage process of the data storage unit storing data is consistent with the expected storage process, if the two are inconsistent, it is determined that the operation of the data computing unit storing data is unsafe. When comparing with the expected stored procedure, if the stored procedure is found to be inconsistent, you can directly determine that the operation of the data calculation unit to store data is unsafe without comparing the stored results, so abnormal situations can be realized more quickly Suspend the operation and improve audit efficiency.
  • the data security audit unit is also used to obtain security audit data of non-user data, and is used to audit whether the data security assurance unit performs the guaranteed operation according to the obtained security audit data of non-user data. Audit whether the operation of the data calculation unit performing data calculation is safe, whether the operation of the data transmission unit transmitting data is safe, and whether the operation of the data storage unit storing data is safe.
  • the security audit data of the non-user data may include: any instruction executed by the calculation, execution time, memory address, electromagnetic signal for executing the calculation, and so on.
  • the above-listed elements of non-user data are only an example and are not limited thereto. That is, by obtaining the security audit data of non-user data to realize the audit of the execution operations in each dimension, compared with the related technology that needs to read the memory data for auditing, exposing user privacy, it effectively realizes the user data Security protection.
  • the aforementioned data transmission unit, data storage unit, data calculation unit, data security assurance unit, data security audit unit, and data calculation control unit can implement its functions in any form, for example, the aforementioned data transmission unit, At least two of the data storage unit, the data calculation unit, the data security guarantee unit, the data security audit unit, and the data calculation control unit are integrated in a hardware security card.
  • the data computing unit can be integrated with the memory and the data transmission unit in a security chip;
  • the computing control unit can be integrated with the data computing unit, or the data computing security assurance unit, or the data computing security audit unit in a chip;
  • Data calculation security assurance unit, data calculation security audit unit, data calculation control unit are integrated and so on.
  • a data security processing system is also provided.
  • the data security processing system in order to ensure the security of the entire life cycle of data, from the four dimensions of the platform and system security of the execution environment for data processing, data computing security, data transmission security, and data storage security, Security protection is based on hardware.
  • Figure 2 is an abstract hardware security architecture diagram of the data security processing system according to Embodiment 1 of the present invention. As shown in Figure 2, the system mainly includes: a data computing unit, a data security assurance unit, and a data security audit Unit, calculation control unit, memory, data transmission unit, data storage unit, etc. among them:
  • the data calculation unit is mainly used to complete the calculation function
  • the data security assurance unit is used to ensure the security of the platform system environment, such as BIOS, OS Loader, OS kernel platform and system integrity, as well as the integrity of computing applications themselves, and the security of data security audit units and data transmission units.
  • the integrity and legality of other hardware firmware such as storage units;
  • the data security audit unit is used to audit whether the data calculation unit, data security assurance unit, data transmission unit, and data storage unit are in line with expectations during the completion of data calculation, guarantee calculation, data transmission, and data storage. It is capable of obtaining non-user data Calculation related data, such as: calculate any instruction executed, execution time, memory address, etc.;
  • the calculation control unit is used to control the calculation control. This function is to trigger the calculation control unit to control the limited execution or prohibit execution of the calculation when the data security assurance unit or the data security audit unit finds an abnormality;
  • the data transmission unit is used to complete the remote data transmission function
  • the data storage unit is used to complete the data storage function
  • the memory is used to store some data and addresses related to the computing unit.
  • the above-mentioned data calculation unit can be used in the usual central processing unit (Center Processing Unit, referred to as CPU), graphics processor (Graphics Processing Unit, referred to as GPU), on-site editable door Array (Field-Programmabele Gate Arrary, referred to as FPGA) and other computing units, can also be implemented in memory, data transmission unit (for example, Smart Network Interface Controller (or smart network card) (Smart Network Interface Controller, referred to as NIC)
  • the calculation control unit can be integrated with the data calculation unit, or the data calculation security assurance unit, or the data calculation security audit unit in a chip; the data calculation security assurance unit, the data calculation security audit unit, and the data calculation control unit are integrated together and many more.
  • TPM/TPCM is used as two product forms to realize data security protection, that is, used to realize the functions of the above data security assurance unit;
  • Jindai X is a product form to realize data security audit , which is used to realize the function of the above data security audit unit;
  • Trusted high-speed Data Encryption Card (Trusted high-speed Data Encryption Card, or THSDC for short) is a product form that realizes high-speed encryption and decryption calculation, which is used to realize the above The function of the data calculation unit;
  • Smart NIC is a product form of data transmission, which is used to realize the functions of the above data transmission unit.
  • FIG 3 is a schematic diagram of the structure of a data security assurance unit, a data security audit unit, a data calculation unit, and a data transmission unit integrated into a hardware security card according to Embodiment 1 of the present invention.
  • the TPM/TPCM is integrated into a hardware security card.
  • THSDEC and Smart NIC are integrated in a hardware security card entity.
  • FIG 4 is a schematic structural diagram of a data security assurance unit, a data security audit unit, and a data calculation unit after being integrated with the data transmission unit to form a data security processing system according to Embodiment 1 of the present invention.
  • the TPM/TPCM, Jindai X and THSDEC are integrated in a hardware security card entity, and then the hardware security card entity and the data transmission unit SmartNIC perform data transmission.
  • FIG. 5 is a data security assurance unit and data security audit unit integration according to Embodiment 1 of the present invention.
  • the integration of the data calculation unit and the data transmission unit forms a schematic structural diagram of a data security processing system.
  • TPM/TPCM and Jindai X is integrated into a hardware security card entity
  • THSDEC and Smart NIC are integrated into a hardware security card entity, and then the two hardware security card entities coordinate to complete the functions of the data security processing system.
  • FIG. 3, Figure 4 and Figure 5 are all examples of integrating TPM/TPCM and Jindai X.
  • TPM/TPCM is to ensure data security.
  • Jindai X is a product form that realizes data security audit. Data security assurance and data security audit can be separated. Therefore, TPM/TPCM and Jindai X can be separated in specific implementation.
  • the above-mentioned integration in Fig. 3, Fig. 4 and Fig. 5 is only an example, and is not limited to the above-mentioned integrated implementation.
  • FIG. 6 is a flow chart of the data security processing method according to Embodiment 1 of the present invention As shown in Figure 6, the process includes the following steps:
  • Step S602 the data security assurance unit is used to ensure the security of the platform and system of the execution environment for performing data processing, the security of the data computing unit used to perform data calculation, the security of the data transmission unit used to transmit data, and the security of the data storage unit.
  • Step S604 through the data security audit unit, audit whether the data security assurance unit performs the guaranteed operation is safe, audit whether the operation performed by the data calculation unit is safe, audit whether the operation of the data transmission unit is safe to transmit data, and audit whether the data storage unit stores data Is the operation safe;
  • Step S606 The data calculation control unit performs a guarantee operation on the data security assurance unit, and/or the data security audit unit performs an audit operation to monitor, and when an abnormality is found in the monitoring, the corresponding data processing restricted execution or execution is prohibited.
  • the data security assurance unit is used to ensure the security of the platform and system of the execution environment that executes data processing, the security of the data computing unit used to perform data calculation, and the security of the data transmission unit used to transmit data. Security.
  • the security of the data storage unit used to store data can be combined with the functions of the data security assurance unit to perform operations corresponding to the security assurance of each dimension in the data security cycle, which will not be repeated here.
  • the data security audit unit is used to audit whether the operation performed by the data security guarantee unit is safe, whether the operation performed by the data calculation unit is safe, and whether the data transmission operation of the data transmission unit is safe. Whether the operation of the audit data storage unit to store data is safe or not can also be combined with the functions of the data security audit unit to perform operations corresponding to security audits of various dimensions in the data security cycle, which will not be repeated here.
  • the data calculation control unit is used to perform guarantee operations on the data security assurance unit, and/or the data security audit unit performs audit operations to monitor.
  • the corresponding data processing is restricted. Execute or prohibit execution. That is, in the operation of the data security assurance unit to ensure the security of the platform and system of the execution environment that executes data processing, in the operation of the data computing unit used to perform data calculation, in the operation of the data transmission
  • the data calculation control unit can be triggered to control the data calculation unit, the data transmission unit and the data storage The unit performs restricted operations or prohibits performing operations.
  • the data security audit unit when the data security audit unit performs audit operations on the data security assurance unit, data calculation unit, data transmission unit and data storage unit, if an abnormality is found, it can also directly trigger the data calculation control unit to control the data security assurance unit.
  • the computing unit, the data transmission unit, and the data storage unit perform restricted operations or prohibit performing operations.
  • the data security assurance unit completes the security assurance on each dimension of the data security cycle
  • the data security audit unit completes the security audit on each dimension of the data security cycle
  • the data calculation control unit guarantees the data security.
  • the unit and the data security audit unit monitor, and in the event of an exception, trigger the restricted or prohibited execution of data processing. It achieves the purpose of ensuring data security from the platform and system of the execution environment for performing data processing, data storage, data calculation, and data transmission throughout the data life cycle, thereby achieving the technical effect of ensuring data security as a whole, thereby solving the problem of In related technologies, there is a technical problem that the protection of data security is relatively limited, and the data security cannot be guaranteed as a whole.
  • a method embodiment of a data security processing method is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, And, although a logical sequence is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than here.
  • FIG. 7 is a flowchart of a data security processing method according to Embodiment 2 of the present invention. As shown in FIG. 7, the process includes the following steps:
  • Step S702 receiving a data calculation request
  • the execution subject of the foregoing steps may be a computer terminal, for example, a user terminal such as a smart phone, a mobile phone, a tablet computer, a notebook computer, and a smart watch.
  • the execution subject of the foregoing steps may also include a separate chip for performing data security computing functions, for example, it may be a trusted chip for trusted computing, or other computing chips for ensuring data computing security.
  • the execution subject of the above steps may also be a network device such as a server for executing data security computing functions.
  • receiving a data calculation request means receiving a request for performing a secure calculation on data.
  • the data calculation request may include one data calculation request or multiple data calculation requests.
  • the multiple data calculation requests can be distinguished by a certain distinguishing identifier, thereby Realize that the data calculation security of multiple data calculation requests can be guaranteed in an orderly manner within a certain period of time.
  • Step S704 Complete data calculation through the trusted computing pool to obtain the calculation result, and transmit the calculation result to the trusted storage pool and/or the trusted transmission unit, where the trusted computing pool passes through the data security assurance unit and the data security audit unit ,
  • the data calculation control unit coordinates with the data calculation unit to ensure the safety of data calculation operations;
  • the identity of the user who sent the request can be verified. If the verification is legal, the data calculation request is assigned a corresponding The data calculation unit performs data security calculations to ensure the legitimacy of the calculations and avoid the calculations requested by illegal users.
  • appropriate data calculation requests can be allocated according to the calculation requirements carried in the data calculation request, and the load or performance of each data calculation unit.
  • the data calculation unit on the one hand, can meet user requirements to a certain extent, and can save computing resources in a limited manner. In addition, it can also improve computing efficiency to a certain extent.
  • the trusted computing pool may include When requesting data storage or data transmission, when storing or transmitting data, the user who sent the storage request or transmission request can be authenticated first, and if the verification is passed, the data is stored or transmitted , So as to ensure the legitimacy of storage or transmission, and avoid the execution of data storage or data transmission requested by illegal users. It should be noted that the request for secure calculation of data, the request for secure storage of data, and the request for secure transmission of data can be separate and independent, or can be combined in any way.
  • data computing completed through the trusted computing pool can be considered safe and credible.
  • the calculation result is obtained after the calculation is performed on the data.
  • Different calculation results may be applied to different functions and effects. For example, some calculation results need to be stored. Therefore, after the calculation is completed, it is necessary to change The calculation result is transmitted to the trusted storage pool, thereby completing the trusted storage of data. For another example, some calculation results need to be transmitted continuously. Therefore, after the calculation is completed, the calculation results need to be transmitted to the trusted transmission unit, and the trusted transmission unit completes the subsequent transmission.
  • Step S706 storing the calculation result through the trusted storage pool, and/or transmitting the calculation result through the trusted transmission unit;
  • the data security assurance unit is used to ensure the security of the data transmission unit in the trusted transmission unit, the data storage unit in the trusted storage pool, the data calculation unit, the data security audit unit, and the data calculation control unit;
  • the data security audit unit is used for It is used to audit whether the data security guarantee unit performs the guaranteed operation, whether the data calculation unit performs the data calculation operation, whether the data transmission unit transmits data is safe, and the data storage unit stores data.
  • completing the data calculation through the trusted computing pool may include: completing the data calculation through the trusted computing pool according to the calculation strategy; wherein the calculation
  • the strategy may include the requirements involved in various aspects of the execution of the calculation. For example, it may include the execution subject of the execution of the calculation, the execution environment of the execution of the calculation, and the verification conditions for the verification of the calculation results.
  • the data calculation request carries a transmission strategy and/or storage strategy
  • the calculation result is stored through a trusted storage pool, and/or the calculation result is performed through a trusted transmission unit
  • the transmission includes: storing the calculation result through a trusted storage pool according to the storage strategy; and/or, according to the transmission strategy, transmitting the calculation result through the trusted transmission unit.
  • the aforementioned transmission strategy includes some condition requirements involved in transmission, for example, transmission speed, transmission security level, and so on.
  • the storage strategy mentioned above includes some conditions involved in storage, such as storage speed, storage security level, and so on.
  • the above-mentioned data calculation unit may include: divided according to different computing capabilities: general computing unit, high-speed encryption and decryption calculation unit; the above-mentioned data storage unit may include: divided according to different storage capabilities Storage units with different storage speeds, plaintext storage units and ciphertext storage units divided according to different security levels; the above data transmission unit may include: transmission units with different transmission speeds divided according to different transmission capabilities, and plaintext transmission divided according to different security levels Unit and ciphertext transmission unit.
  • the different storage speeds mentioned above can be divided according to requirements. For example, they can be roughly divided into high-speed storage and low-speed storage, and can also be divided into finer high-speed storage, medium-speed storage, and low-speed storage.
  • the security level of ciphertext storage is higher.
  • the different transmission speeds referred to above can be divided according to requirements. For example, they can be roughly divided into high-speed transmission and low-speed transmission, and can also be divided into finer high-speed transmission, medium-speed transmission, and low-speed transmission.
  • the security level of ciphertext transmission is relatively high.
  • the calculation request in the trusted computing pool can be used to split the engine as the data
  • the calculation request selects the corresponding data calculation unit to perform the data calculation; the calculation request shunt engine can specifically select the data used to perform the data calculation according to the calculation requirements carried in the data calculation request and the performance of each data calculation unit to be selected Computing unit.
  • the calculation result when the calculation result is stored through a trusted storage pool, and/or the calculation result is transmitted through a trusted transmission unit, It may include: selecting the corresponding data storage unit to store the calculation result through the storage separation engine in the trusted storage pool; and/or selecting the corresponding data transmission unit in the trusted transmission unit through the transmission separation engine to transmit the calculation result .
  • the aforementioned storage separation engine can select a data storage unit for performing data storage according to the storage requirements carried in the data calculation request and the performance of each data storage unit to be selected.
  • the above-mentioned transmission separation engine may select the data transmission unit for performing data transmission according to the transmission requirements carried in the data calculation request and the performance of each data transmission unit to be selected.
  • the aforementioned data transmission unit, data storage unit, data calculation unit, data security assurance unit, data security audit unit, and data calculation control unit can implement its functions in any form, for example, the aforementioned data transmission unit, data storage At least two of the unit, the data calculation unit, the data security assurance unit, the data security audit unit, and the data calculation control unit are integrated in a hardware security card.
  • the data computing unit can be integrated with the memory and the data transmission unit in a security chip;
  • the computing control unit can be integrated with the data computing unit, or the data computing security assurance unit, or the data computing security audit unit in a chip;
  • Data calculation security assurance unit, data calculation security audit unit, data calculation control unit are integrated and so on.
  • the data security assurance unit completes the security assurance of each dimension of the data security cycle
  • the data security audit unit completes the security audit of each dimension of the data security cycle
  • the data calculation control unit performs data security.
  • the guarantee unit and the data security audit unit monitor, and in the event of an exception, trigger the restricted or prohibited execution of data processing. It achieves the purpose of ensuring data security from the platform and system of the execution environment for performing data processing, data storage, data calculation, and data transmission throughout the data life cycle, thereby achieving the technical effect of ensuring data security as a whole, thereby solving the problem of In related technologies, there is a technical problem that the protection of data security is relatively limited, and the data security cannot be guaranteed as a whole.
  • a data security processing method is provided.
  • the hardware architecture corresponding to the entire method may include: a trusted computing pool, a trusted storage pool, Trusted transmission, etc.
  • FIG. 8 is a hardware architecture diagram corresponding to the data security processing method according to Embodiment 2 of the present invention, as shown in FIG. 8:
  • the trusted computing pool includes data computing units with different computing capabilities. Among them, the general computing unit and the sensitive high-speed encryption and decryption computing unit described in the figure are data computing units with different computing capabilities. It should be noted that no matter which data calculation unit is used for data calculation, the data security assurance unit, data security audit unit, and data calculation control unit will coordinate with the data calculation unit to ensure that the calculation of the data calculation unit is safe. Trusted; In addition, the trusted computing pool can perform local calculations on the data according to the input calculation request, for example, using the local computing resources of the trusted computing pool to perform calculations; it can also perform remote calculations on the data, for example, in the trusted computing pool.
  • the data can be transmitted to a remote server with sufficient computing resources through trusted transmission, and the remote server performs remote computing.
  • the specific calculation method used can be flexibly selected according to the requirements of the calculation request and the computing resources of the trusted computing pool.
  • the trusted storage pool includes storage units with different capabilities. As shown in Figure 8, it can be divided into: plaintext storage (high, medium, and low speed), ciphertext storage (high, medium, and low speed), as shown in Figure 8. It should be noted that when the trusted storage pool stores data, the data can also be stored locally, for example, the local storage resources of the trusted storage pool can be used for storage; the data can also be executed Remote storage, for example, when a trusted storage pool detects that local storage resources are limited, which may affect storage performance, the data can be stored in a remote storage with abundant storage resources through trusted transmission, and the remote storage can store the data remotely .
  • the specific storage method can be flexibly selected according to the requirements of the specific request and the storage resources of the trusted storage pool.
  • the data transmission unit in the credible transmission can communicate with the data storage unit and the data calculation unit, and the intercommunication must ensure credible transmission and comply with the credible transmission of the worldwide credible network connection standard. According to the transmission capacity, it can support plain text transmission, low security level or high security level cipher text transmission, etc.
  • data security protection is divided into two stages. In the first stage, the platform and system supporting the data lifecycle security are intact and not tampered with in the device startup stage and are legal; in the second stage, after the device is started, the data is The security assurance in the process of computing (use), storage, and transmission is shown in Figure 8.
  • the general computing unit CPU and the trusted computing unit are taken as examples to illustrate the data security assurance process:
  • the user sends a data calculation request, carrying a calculation strategy, transmission strategy or storage strategy;
  • the calculation request shunt engine receives the user calculation request, identifies the user's identity and the legitimacy of the user platform, and selects the corresponding data calculation unit for data calculation according to the parameters in the user calculation request.
  • the calculation result and transmission strategy are The storage strategy is transmitted to the calculation result output separation engine, and the calculation result output separation engine transmits the calculation result to the trusted storage pool or the data transmission unit in the trusted transmission according to the transmission strategy or storage strategy;
  • the transmission separation engine When the transmission separation engine receives the data, it will transmit the data according to the corresponding mechanism according to the transmission strategy;
  • the storage separation engine When the storage separation engine receives the data, it will store the data accordingly according to the storage strategy.
  • the trusted storage pool and data transmission unit can also rely on worldwide trusted network transmission protocols for data intercommunication.
  • data storage security, data calculation security, data transmission security, and data usage execution environment security can be opened on a hardware security card, so as to ensure data security in a system; in addition, the hardware security card also According to the business demand strategy, flexible and elastic security services can be provided for the business through trusted computing pools, trusted storage pools, data transmission units with different data transmission capabilities, and a secure data use execution environment.
  • the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases the former is Better implementation.
  • the technical solution of the present invention essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, The optical disc) includes several instructions to make a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) execute the method of each embodiment of the present invention.
  • FIG. 9 is a structural block diagram of the data security processing system according to the embodiment 3 of the present invention, as shown in FIG.
  • the data security processing system includes: a data security guarantee unit, a data security audit unit and a data calculation control unit.
  • the data security processing system will be described below.
  • the data security assurance unit is used to ensure the security of the platform and system of the execution environment for performing data processing, the security of the data calculation unit used to perform data calculation, the security of the data transmission unit used to transmit data, and the data used to store data
  • the security of the storage unit; the data security audit unit is connected to the above-mentioned data security assurance unit and the data calculation control unit, and is used to audit whether the data security assurance unit performs guaranteed operations and whether the data calculation unit performs data calculation operations is safe.
  • the data calculation control unit is connected to the above-mentioned data security assurance unit and data security audit unit, and is used to perform security operations on the data security assurance unit, And/or the data security audit unit performs audit operations for monitoring, and when an abnormality is found in the monitoring, the corresponding data processing is triggered to be restricted or prohibited.
  • the data security assurance unit, the data security audit unit, and the data calculation control unit correspond to steps S602 to S606 in the foregoing embodiment 1, and the two modules and the corresponding steps implement the examples and application scenarios The same, but not limited to the content disclosed in the above embodiment 1. It should be noted that the above-mentioned modules can be run in a computer terminal as a part of the device.
  • FIG. 10 is a structural block diagram of the data security processing system according to Embodiment 4 of the present invention, as shown in FIG.
  • the data security processing system 10 includes: a receiving module 102, a first processing module 104, and a second processing module 106.
  • the data security processing system will be described below.
  • the receiving module 102 is used to receive data calculation requests; the first processing module 104 is connected to the receiving module 102 and is used to complete data calculations through the trusted computing pool to obtain the calculation results, and transmit the calculation results to the trusted storage pool and / Or a trusted transmission unit, where the trusted computing pool is coordinated with the data computing unit through the data security assurance unit, the data security audit unit, the data computing control unit and the data computing unit to ensure the security of data computing operations; the second processing module 106 is connected to The above-mentioned first processing module 104 is configured to store the calculation result through the trusted storage pool and/or transmit the calculation result through the trusted transmission unit; wherein, the data security guarantee unit is used to guarantee the data in the trusted transmission unit The transmission unit, the data storage unit in the trusted storage pool, the data calculation unit, the data security audit unit, and the security of the data calculation control unit; the data security audit unit is used to audit whether the data security assurance unit performs the guaranteed operations and audit data calculations Whether the data calculation operation performed by the unit is safe, whether the data transmission operation of the audit
  • the above-mentioned receiving module 102, the first processing module 104 and the second processing module 106 correspond to steps S702 to S706 in Embodiment 2.
  • the examples and application scenarios implemented by the two modules and the corresponding steps The same, but not limited to the content disclosed in the above embodiment 2.
  • the above-mentioned modules can be run in a computer terminal as a part of the device.
  • the embodiment of the present invention may provide a hardware security card, which is used to perform data security calculations, and may be a hardware card in a computer terminal device or a hardware card in a network device.
  • FIG. 11 is a structural block diagram of a hardware security card according to Embodiment 5 of the present invention.
  • the hardware security card 110 includes: a memory 112 and a processor 114, the memory stores computer programs; the processor is used to execute The computer program stored in the memory executes the data security processing method of any one of claims 6 to 11 when the computer program is running.
  • the memory can be used to store software programs and modules, such as the program instructions/modules corresponding to the security vulnerability detection method and device in the embodiment of the present invention.
  • the processor executes various functions by running the software programs and modules stored in the memory. Application and data processing, namely to realize the above-mentioned data security processing method.
  • the memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memories.
  • the memory may further include a memory remotely provided with respect to the processor, and these remote memories may be connected to a computer terminal or a network device through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
  • the processor may call the information and application programs stored in the memory through the transmission device to execute the program code of the following steps: through the data security assurance unit, the platform and system that guarantee the execution environment for executing data processing
  • the audit data security assurance unit performs guarantee Whether the operation of the audit data calculation unit is safe to perform data calculations, whether the operation of the data transmission unit to transmit data is safe, and whether the operation of the data storage unit to store data is safe
  • through the data calculation control unit the data security guarantee unit Perform guarantee operations, and/or the data security audit unit performs audit operations for monitoring.
  • the corresponding data processing is triggered to be restricted or prohibited.
  • the processor may call the information and application programs stored in the memory through the transmission device to execute the program code of the following steps: receive the data calculation request; complete the data calculation through the trusted computing pool to obtain the calculation As a result, the calculation result is transmitted to the trusted storage pool and/or the trusted transmission unit, where the trusted computing pool is coordinated with the data calculation unit through the data security assurance unit, the data security audit unit, the data calculation control unit and the data calculation unit.
  • the security of computing operations; the calculation results are stored through the trusted storage pool, and/or the calculation results are transmitted through the trusted transmission unit; among them, the data security guarantee unit is used to protect the data transmission unit in the trusted transmission unit.
  • the above-mentioned processor may also execute the program code of the following steps: in the case that the calculation strategy, transmission strategy and/or storage strategy are carried in the data calculation request, completing the data calculation through the trusted computing pool includes: according to the calculation strategy , Complete data calculation through the trusted computing pool; store the calculation results through the trusted storage pool, and/or transmit the calculation results through the trusted transmission unit including: storing the calculation results through the trusted storage pool according to the storage strategy ; And/or, according to the transmission strategy, the calculation result is transmitted through the trusted transmission unit.
  • the above-mentioned processor may also execute the program code of the following steps: including at least one of the following: the data calculation unit includes: divided according to different calculation capabilities: a general calculation unit, a high-speed encryption and decryption calculation unit; and a data storage unit includes: Storage units with different storage speeds divided according to different storage capabilities, plaintext storage units and ciphertext storage units divided according to different security levels; data transmission units include: transmission units with different transmission speeds divided according to different transmission capabilities, according to different security levels The divided plaintext transmission unit and ciphertext transmission unit.
  • the data calculation unit includes: divided according to different calculation capabilities: a general calculation unit, a high-speed encryption and decryption calculation unit
  • a data storage unit includes: Storage units with different storage speeds divided according to different storage capabilities, plaintext storage units and ciphertext storage units divided according to different security levels
  • data transmission units include: transmission units with different transmission speeds divided according to different transmission capabilities, according to different security levels The divided plaintext transmission unit and ciphertext transmission unit.
  • the above-mentioned processor may also execute the program code of the following steps: completing data calculation through the trusted computing pool includes: selecting the corresponding data computing unit for the data computing request through the computing request shunt engine in the trusted computing pool to perform data computing Storing the calculation result through the trusted storage pool and/or transmitting the calculation result through the trusted transmission unit includes: selecting the corresponding data storage unit to store the calculation result through the storage separation engine in the trusted storage pool; and /Or, the transmission separation engine selects the corresponding data transmission unit among the trusted transmission units to transmit the calculation result.
  • the above-mentioned processor may also execute the program code of the following steps: at least two of the data transmission unit, the data storage unit, the data calculation unit, the data security assurance unit, the data security audit unit, and the data calculation control unit are integrated into one Hardware security card.
  • the goal of ensuring data security from the platform and system of the execution environment for data processing, data storage, data calculation, and data transmission throughout the data life cycle is achieved, thereby realizing the overall assurance of data security.
  • the technical effect further solves the technical problem that in related technologies, the protection of data security is relatively limited, and the data security cannot be guaranteed as a whole.
  • the embodiment of the present invention also provides a storage medium.
  • the foregoing storage medium may be used to store the program code executed by the data security processing method provided in the foregoing Embodiment 1.
  • the foregoing storage medium may be located in any computer terminal in a computer terminal group in a computer network, or located in any mobile terminal in a mobile terminal group.
  • the storage medium is configured to store program code for executing the following steps: through the data security assurance unit, the security of the platform and system of the execution environment for executing data processing is ensured, For the security of the data computing unit that performs data calculations, the security of the data transmission unit used to transmit data, and the security of the data storage unit used to store data; through the data security audit unit, the data security assurance unit is used to audit whether the guaranteed operation is safe , Audit whether the operation of data calculation by the data calculation unit is safe, whether the operation of data transmission by the data transmission unit is safe, and whether the operation of data storage by the data storage unit is safe; through the data calculation control unit, the data security guarantee unit performs guarantee operations, And/or the data security audit unit performs audit operations for monitoring, and when an abnormality is found in the monitoring, the corresponding data processing is triggered to be restricted or prohibited.
  • the storage medium is configured to store program code for performing the following steps: receiving a data calculation request; completing data calculation through a trusted computing pool to obtain the calculation result, and The calculation result is transmitted to the trusted storage pool and/or the trusted transmission unit, where the trusted computing pool is coordinated with the data calculation unit through the data security assurance unit, the data security audit unit, the data calculation control unit and the data calculation unit to ensure the safety of data calculation operations ;
  • the calculation result is stored through the trusted storage pool, and/or the calculation result is transmitted through the trusted transmission unit; wherein the data security guarantee unit is used to protect the data transmission unit in the trusted transmission unit, and the trusted storage pool
  • the data storage unit, data calculation unit, data security audit unit, and data calculation control unit are safe; the data security audit unit is used to audit whether the data security assurance unit performs guaranteed operations and whether the data calculation unit performs data calculation operations are safe , Audit whether the operation of the data transmission unit to transmit data is safe and whether the operation of the data storage unit to store data is safe.
  • the storage medium is set to store program code for performing the following steps: in the case that the data calculation request carries a calculation strategy, a transmission strategy, and/or a storage strategy, completing data calculation through a trusted computing pool includes: According to the calculation strategy, the data calculation is completed through the trusted computing pool; the calculation result is stored through the trusted storage pool, and/or the calculation result is transmitted through the trusted transmission unit includes: according to the storage strategy, the calculation is performed through the trusted storage pool The result is stored; and/or, according to the transmission strategy, the calculation result is transmitted through the trusted transmission unit.
  • the storage medium is configured to store program code for executing the following steps: including at least one of the following: the data calculation unit includes: divided according to different calculation capabilities: general calculation unit, high-speed encryption and decryption calculation unit; data storage Units include: storage units with different storage speeds divided according to different storage capabilities, plaintext storage units and ciphertext storage units divided according to different security levels; data transmission units include: transmission units with different transmission speeds divided according to different transmission capabilities, according to Plain text transmission unit and cipher text transmission unit divided into different security levels.
  • the storage medium is set to store the program code for performing the following steps: completing data calculation through the trusted computing pool includes: selecting the corresponding data computing unit for the data computing request through the computing request offloading engine in the trusted computing pool Perform data calculations; store the calculation results through the trusted storage pool, and/or transmit the calculation results through the trusted transmission unit, including: selecting the corresponding data storage unit through the storage separation engine in the trusted storage pool to perform the calculation results Storage; and/or, the transmission separation engine selects the corresponding data transmission unit in the trusted transmission unit to transmit the calculation result.
  • the storage medium is configured to store program codes for performing the following steps: at least two of the data transmission unit, the data storage unit, the data calculation unit, the data security assurance unit, the data security audit unit, and the data calculation control unit Integrated in a hardware security card.
  • the embodiment of the present invention also provides a processor.
  • the processor can be an independent device or a functional module integrated on a predetermined network device, which can be flexibly selected according to needs.
  • the above-mentioned processor can execute the program code of the following steps: through the data security assurance unit, the security of the platform and system of the execution environment for executing data processing is ensured, and the data calculation is used to perform data calculation.
  • the security of the unit the security of the data transmission unit used to transmit data, the security of the data storage unit used to store data; through the data security audit unit, the data security assurance unit is audited to ensure that the operation is safe, and the data calculation unit executes the data Whether the calculation operation is safe, whether the data transmission operation of the audit data transmission unit is safe, and whether the data storage unit stores the data is safe; through the data calculation control unit, the data security guarantee unit performs guarantee operations, and/or the data security audit unit Perform audit operations for monitoring. When an abnormality is found in monitoring, the corresponding data processing is triggered to be restricted or prohibited.
  • the above-mentioned processor may execute the program code of the following steps: receiving a data calculation request; completing data calculation through a trusted computing pool to obtain the calculation result, and transmitting the calculation result to the trusted storage pool And/or a trusted transmission unit, where the trusted computing pool is coordinated with the data computing unit through the data security assurance unit, the data security audit unit, the data computing control unit and the data computing unit to ensure the security of data computing operations; the computing is performed through the trusted storage pool
  • the results are stored, and/or the calculation results are transmitted through the trusted transmission unit; wherein the data security guarantee unit is used to ensure the data transmission unit in the trusted transmission unit, the data storage unit in the trusted storage pool, and the data calculation unit ,
  • the data security audit unit the security of the data calculation control unit; the data security audit unit is used to audit whether the data security assurance unit performs the guaranteed operation is safe, the data calculation unit performs the data calculation operation is safe, and the data transmission unit transmits data Whether the operation is safe, and whether the operation of the data storage unit
  • the above-mentioned processor may also execute the program code of the following steps: in the case that the calculation strategy, transmission strategy and/or storage strategy are carried in the data calculation request, completing the data calculation through the trusted computing pool includes: according to the calculation strategy , Complete data calculation through the trusted computing pool; store the calculation results through the trusted storage pool, and/or transmit the calculation results through the trusted transmission unit including: storing the calculation results through the trusted storage pool according to the storage strategy ; And/or, according to the transmission strategy, the calculation result is transmitted through the trusted transmission unit.
  • the above-mentioned processor may also execute the program code of the following steps: including at least one of the following: the data calculation unit includes: divided according to different calculation capabilities: a general calculation unit, a high-speed encryption and decryption calculation unit; and a data storage unit includes: Storage units with different storage speeds divided according to different storage capabilities, plaintext storage units and ciphertext storage units divided according to different security levels; data transmission units include: transmission units with different transmission speeds divided according to different transmission capabilities, according to different security levels The divided plaintext transmission unit and ciphertext transmission unit.
  • the data calculation unit includes: divided according to different calculation capabilities: a general calculation unit, a high-speed encryption and decryption calculation unit
  • a data storage unit includes: Storage units with different storage speeds divided according to different storage capabilities, plaintext storage units and ciphertext storage units divided according to different security levels
  • data transmission units include: transmission units with different transmission speeds divided according to different transmission capabilities, according to different security levels The divided plaintext transmission unit and ciphertext transmission unit.
  • the above-mentioned processor may also execute the program code of the following steps: completing data calculation through the trusted computing pool includes: selecting the corresponding data computing unit for the data computing request through the computing request shunt engine in the trusted computing pool to perform data computing Storing the calculation result through the trusted storage pool and/or transmitting the calculation result through the trusted transmission unit includes: selecting the corresponding data storage unit to store the calculation result through the storage separation engine in the trusted storage pool; and /Or, the transmission separation engine selects the corresponding data transmission unit among the trusted transmission units to transmit the calculation result.
  • the above-mentioned processor may also execute the program code of the following steps: at least two of the data transmission unit, the data storage unit, the data calculation unit, the data security assurance unit, the data security audit unit, and the data calculation control unit are integrated into one Hardware security card.
  • the disclosed technical content can be implemented in other ways.
  • the device embodiments described above are merely illustrative, for example, the division of units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or integrated into Another system, or some features can be ignored, or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of units or modules, and may be in electrical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of the present invention essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention.
  • the aforementioned storage media include: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种数据安全处理系统、方法、存储介质、处理器及硬件安全卡。其中，该系统包括：数据传输单元，数据存储单元，数据计算单元，还包括：数据安全保障单元，用于保障执行数据处理的执行环境的系统的安全，数据计算单元的安全，数据传输单元的安全，数据存储单元的安全；数据安全审计单元，用于审计数据安全保障单元执行保障的操作是否安全，数据计算单元执行数据计算的操作是否安全，数据传输单元传输数据的操作是否安全，数据存储单元存储数据的操作是否安全；数据计算控制单元，用于对数据安全保障单元执行保障操作，和/或数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。

Description

数据安全处理系统、方法、存储介质、处理器及硬件安全卡
本申请要求2019年04月12日递交的申请号为201910295533.X、发明名称为“数据安全处理系统、方法、存储介质、处理器及硬件安全卡”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及安全计算领域，具体而言，涉及一种数据安全处理系统、方法、存储介质、处理器及硬件安全卡。
背景技术
在相关技术中，对数据的安全进行保护均是对数据本身从软件层面进行保护的，例如，对数据进行加密保护，但采用密码加密的方式时，密码加密的能力存在一定的欠缺，比如，对数据进行加密的密钥并不会进行有效地管理，例如，有时会以明文的方式出现在内存中无法保证数据的计算安全。而且，在相关技术中，对数据的安全的保护考虑的方面较少，例如，有时仅仅考虑数据的存储本身是否安全，有时仅仅考虑数据的传输过程是否安全等等。因此，对数据安全的保护较为局限，无法从整体保证数据的安全。
因此，在相关技术中，存在对数据安全的保护较为局限，无法从整体保证数据的安全的问题。
针对上述的问题，目前尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种数据安全处理系统、方法、存储介质、处理器及硬件安全卡，以至少解决在相关技术中，存在对数据安全的保护较为局限，无法从整体保证数据的安全的技术问题。
根据本发明实施例的一个方面，提供了一种数据安全系统，包括：用于传输数据的数据传输单元，用于存储数据的数据存储单元，用于执行数据计算的数据计算单元，还包括：数据安全保障单元，用于保障执行数据处理的执行环境的系统的安全，数据计算单元的安全，数据传输单元的安全，数据存储单元的安全；数据安全审计单元，用于审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据传输单元传输数据的操作是否安全，审计所述数据存 储单元存储数据的操作是否安全；数据计算控制单元，用于对所述数据安全保障单元执行保障操作，和/或所述数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
根据本发明实施例的另一方面，还提供了一种数据安全处理方法，包括：通过数据安全保障单元，保障执行数据处理的执行环境的系统的安全，用于执行数据计算的数据计算单元的安全，用于传输数据的数据传输单元的安全，用于存储数据的数据存储单元的安全；通过数据安全审计单元，审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据传输单元传输数据的操作是否安全，审计所述数据存储单元存储数据的操作是否安全；通过数据计算控制单元，对所述数据安全保障单元执行保障操作，和/或所述数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
根据本发明实施例的另一方面，还提供了一种数据安全处理方法，包括：接收数据计算请求；通过可信计算池完成数据计算，得到计算结果，并将所述计算结果传送给可信存储池和/或可信传输单元，其中，所述可信计算池通过数据安全保障单元，数据安全审计单元，数据计算控制单元与数据计算单元进行协调，保障数据计算操作的安全；通过所述可信存储池对所述计算结果进行存储，和/或通过所述可信传输单元对所述计算结果进行传输；其中，所述数据安全保障单元用于保障所述可信传输单元中的数据传输单元，所述可信存储池中的数据存储单元，所述数据计算单元，所述数据安全审计单元，所述数据计算控制单元的安全；所述数据安全审计单元用于审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据传输单元传输数据的操作是否安全，审计所述数据存储单元存储数据的操作是否安全。
根据本发明实施例的另一方面，还提供了一种数据安全处理系统，包括：数据安全保障单元，数据安全审计单元和数据计算控制单元，其中，所述数据安全保障单元，用于保障执行数据处理的执行环境的系统的安全，用于执行数据计算的数据计算单元的安全，用于传输数据的数据传输单元的安全，用于存储数据的数据存储单元的安全；所述数据安全审计单元，用于审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据传输单元传输数据的操作是否安全，审计所述数据存储单元存储数据的操作是否安全；所述数据计算控制单元，用于对所述数据安全保障单元执行保障操作，和/或所述数据安全审计单元执行审计操作 进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
根据本发明实施例的另一方面，还提供了一种数据安全处理系统，包括：接收模块，用于接收数据计算请求；第一处理模块，用于通过可信计算池完成数据计算，得到计算结果，并将所述计算结果传送给可信存储池和/或可信传输单元，其中，所述可信计算池通过数据安全保障单元，数据安全审计单元，数据计算控制单元与数据计算单元进行协调，保障数据计算操作的安全；第二处理模块，用于通过所述可信存储池对所述计算结果进行存储，和/或通过所述可信传输单元对所述计算结果进行传输；其中，所述数据安全保障单元用于保障所述可信传输单元中的数据传输单元，所述可信存储池中的数据存储单元，所述数据计算单元，所述数据安全审计单元，所述数据计算控制单元的安全；所述数据安全审计单元用于审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据传输单元传输数据的操作是否安全，审计所述数据存储单元存储数据的操作是否安全。
根据本发明实施例的另一方面，还提供了一种存储介质，所述存储介质存储有程序，其中，在所述程序被处理器运行时使得所述处理器执行上述任意一项所述的数据安全处理方法。
根据本发明实施例的另一方面，还提供了一种处理器，所述处理器用于运行程序，其中，所述程序运行时使得所述处理器执行上述任意一项所述的数据安全处理方法。
根据本发明实施例的另一方面，还提供了一种硬件安全卡，包括：存储器和处理器，所述存储器存储有计算机程序；所述处理器，用于执行所述存储器中存储的计算机程序，所述计算机程序被处理器运行时使得所述处理器执行上述任意一项所述的数据安全处理方法。
在本发明实施例中，数据安全处理系统包括：数据传输单元，数据存储单元，数据计算单元，还包括：数据安全保障单元，用于保障执行数据处理的执行环境的系统的安全，数据计算单元的安全，数据传输单元的安全，数据存储单元的安全；数据安全审计单元，用于审计数据安全保障单元执行保障的操作是否安全，数据计算单元执行数据计算的操作是否安全，数据传输单元传输数据的操作是否安全，数据存储单元存储数据的操作是否安全；数据计算控制单元，用于对数据安全保障单元执行保障操作，和/或数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行，达到了从执行数据处理的执行环境的系统，数据存储、数据计算、数据传输整个数据的生命周期来保证数据安全的目的，从而实现了从整体保证数据安全的技 术效果，进而解决了在相关技术中，存在对数据安全的保护较为局限，无法从整体保证数据的安全的技术问题。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例1的数据安全处理系统的硬件结构框图；
图2是根据本发明实施例1的数据安全处理系统的抽象硬件安全架构图；
图3是根据本发明实施例1数据安全保障单元，数据安全审计单元，数据计算单元以及数据传输单元集成于一张硬件安全卡的结构示意图；
图4是根据本发明实施例1的数据安全保障单元，数据安全审计单元，数据计算单元进行集成后与数据传输单元形成数据安全处理系统的结构示意图；
图5是根据本发明实施例1的数据安全保障单元和数据安全审计单元的集成，数据计算单元和数据传输单元的集成形成数据安全处理系统的结构示意图；
图6是根据本发明实施例1的数据安全处理方法的流程图；
图7是根据本发明实施例2的数据安全处理方法的流程图；
图8是根据本发明实施例2的数据安全处理方法对应的硬件架构图；
图9是根据本发明实施例3的数据安全处理系统的结构框图；
图10是根据本发明实施例4的数据安全处理系统的结构框图；
图11是根据本发明实施例5的硬件安全卡的结构框图。
具体实施方式
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样 使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
首先，在对本申请实施例进行描述的过程中出现的部分名词或术语适用于如下解释：
数据计算安全：是指程序执行过程中，保障程序的执行环境是可信的，参与计算的敏感数据不外泄，不被篡改，计算指令时空序列不被篡改。
数据传输安全：是指两通信实体之间进行信息互通时，能保障敏感数据在传输过程中不被篡改、不外泄。
数据存储安全：是指信息系统中敏感数据不被无权访问、盗用、篡改、删除等非法操作。
系统的安全：是用于执行数据处理的执行环境的平台及系统的安全，是指设备的基本输入输出系统(Base Input Output System，简称为BIOS)，硬件固件、操作系统加载器(Operation System Loader，简称为OS Loader)等软硬件平台及系统是完整合法的。
可信计算：可信计算(Trusted Computing)是在计算和通信系统中广泛使用基于硬件安全模块支持下的可信计算平台，以提高系统整体的安全性。
可信平台模块(Trusted Platform Module，TPM)/可信平台控制模块(Trusted Platform Control Module，TPCM)(TPM/TPCM)：为证据提供完整性和真实性保障的安全芯片，一般通过物理方式被强绑定到计算平台。
可信度量：在某些特定的时刻，对目标进行度量，得到目标的某些信息(比如对文件的散列值)，将这些信息的值与事先记录的标准值进行比较，从而判断目标的完整性是否被破坏。
固件：是指存储在硬件中不能够被轻易更改的程序，也泛指一些上述程序所在的基础硬件。
实施例1
针对在相关技术中，存在对数据安全的保护较为局限，无法从整体保证数据的问 题，数据安全从数据生命周期来说,主要需要从四个维度来保障，即数据存储、数据计算、数据传输、及支撑数据周期的平台及系统是安全的(需要说明的是，这里的平台及系统安全也可以理解为数据计算的执行环境安全)。
另外，基于硬件部件去保护数据安全，相比于传统软件保护数据安全，无论从性能还是安全性上均提升很多(比如，硬件的加解密计算速度高于软计算，加解密硬件实现比加解密软件实现在密钥生成和保护上有很大安全优势)。
基于此，在本发明实施例中，提供了一种硬件的数据安全处理系统，及基于该硬件的数据安全处理系统实现的数据安全保障方法，从而有效地提升数据安全保障能力。在该基于硬件的数据安全处理系统中，主要从平台及系统安全、数据计算安全、数据传输安全、数据存储安全四个维度成体系的保障数据安全。
本申请实施例1所提供的硬件的数据安全处理系统的实施例可以在移动终端、计算机终端或者类似的运算装置中执行。图1是根据本发明实施例1的数据安全处理系统的硬件结构框图。如图1所示，该数据安全处理系统包括：用于传输数据的数据传输单元，用于存储数据的数据存储单元，用于执行数据计算的数据计算单元，还包括：数据安全保障单元，数据安全审计单元以及数据计算控制单元，其中，
数据安全保障单元，连接至上述数据传输单元，数据存储单元，数据计算单元，数据安全审计单元以及数据计算控制单元，用于保障执行数据处理的执行环境的系统的安全，数据计算单元的安全，数据传输单元的安全，数据存储单元的安全；数据安全审计单元，连接至上述数据传输单元，数据存储单元，数据计算单元，数据安全保障单元以及数据计算控制单元，用于审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全；数据计算控制单元，连接至上述数据安全保障单元以及数据安全审计单元，用于对数据安全保障单元执行保障操作，和/或数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
作为一个可选的实施例，数据安全保障单元保障执行数据处理的执行环境的系统的安全，其中，这里的系统的安全，是一个整体执行环境的广义理解，可以理解为平台及(具体)系统的安全，例如，可以是指设备的BIOS，硬件固件、OS Loader等软硬件平台及系统是完整合法的。为具体说明技术方案，以下的实施例中以“平台及系统”为例 对系统进行说明。
作为一个可选的实施例，数据安全保障单元，用于保障执行数据处理的执行环境的平台及系统的安全，数据计算单元的安全，数据传输单元的安全，数据存储单元的安全。依据该数据安全保障单元从数据生命周期的四个维度保障了数据的安全。具体地，在分别对上述数据生命周期的四个维度进行保障时，可以在数据安全处理系统接收到数据安全计算请求开始即从上述数据生命周期的四个维度均进行保障，也可以在分别针对上述数据生命周期的四个维度分别开始执行具体操作之前进行保障，可以依据具体需求灵活选择。
作为一个可选的实施例，数据安全保障单元，用于保障执行数据处理的执行环境的平台及系统的安全，数据计算单元的安全，数据传输单元的安全，数据存储单元的安全。针对不同的维度的保障，保障的内容可能有些不同，但基本要求保障的内容均可以包括：保障执行的主体是安全的，保障执行的硬件环境是安全的，保障执行的软件程序是安全的等。
作为一个可选的实施例，数据安全保障单元，用于保障执行数据处理的执行环境的平台及系统的硬件固件的完整性和合法性；即数据安全保障单元保障执行数据处理的执行环境的平台及系统是安全的，主要考虑的是不仅保障执行数据处理的执行环境的平台及系统的硬件固件的完整性，还要保障执行数据处理的执行环境的平台及系统的硬件固件的合法性。
作为一个可选的实施例，数据安全保障单元，保障所述数据计算单元的计算系统软件、计算硬件固件以及计算用到的应用程序的完整性和合法性；即数据安全保障单元保障数据计算单元是安全的，不仅需要保障数据计算单元的计算系统软件的完整性和合法性，需要保障数据计算单元的硬件固件的完整性和合法性，还需要保障数据计算单元计算时所采用的计算应用程序的完整性和合法性。即数据安全保障单元从软、硬件两个层面保障数据计算单元的安全性。
作为一个可选的实施例，数据安全保障单元，用于保障所述数据传输单元的传输系统软件、传输硬件固件以及传输用到的应用程序的完整性和合法性；即数据安全保障单元保障数据传输单元是安全的，需要保障的也不仅是保障数据传输单元的传输系统软件的完整性和合法性，保障数据传输单元的传输硬件固件的完整性和合法性，而且也需要保障数据传输单元传输时用到的应用程序(例如，需要加解密传输时，涉及到加解密程 序)的完整性和合法性。在上述软硬件两个层面的安全保障了，数据传输单元的安全就保障了。
作为一个可选的实施例，数据安全保障单元，用于保障所述数据存储单元的存储系统软件、存储硬件固件以及存储用到的应用程序的完整性和合法性；即数据安全保障单元保障数据存储单元是安全的，需要保障的也不仅是保障数据存储单元的存储系统软件的完整性和合法性，保障数据存储单元的存储硬件固件的完整性和合法性，而且也需要保障数据存储单元的存储时用到的应用程序(例如，需要加解密存储时，涉及到加解密程序)的完整性和合法性。采用上述保障方法，实现了在软硬件两个层面对数据存储单元的安全进行了保障。
在一个优选的实施例中，数据安全审计单元，用于审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全，即用于通过计算比较的方式，判断数据安全保障单元执行保障的操作是否安全，数据计算单元执行数据计算的操作是否安全，数据传输单元传输数据的操作是否安全，数据存储单元存储数据的操作是否安全。一方面，数据安全审计单元也从数据安全生命周期的四个维度来分别进行审计，确定各个维度执行各自操作的操作是安全的。另一方面，由于数据安全保障单元对数据安全审计单元进行了安全保障，而数据安全审计单元又对数据安全保障单元的保障操作进行审计，实现了相互制约安全的目的，达到了双重保证安全的效果。
在数据安全审计单元对数据安全周期的上述四个维度进行审计时，审计所采用的方法可以多种，也可以采用最为简便的匹配方法，其中，该匹配方法即是将对在各个维度上执行的结果与预期执行结果进行比较，如果两者一致的情况下，则确定在该维度上执行对应操作是安全的。
作为一个可选的实施例，数据安全审计单元，用于审计数据安全保障单元执行保障所得的保障结果与预期保障结果是否一致，在两者一致的情况下，确定数据安全保障单元执行保障的操作是安全的，在两者不一致的情况下，确定数据安全保障单元执行保障的操作是不安全的；即通过与预期保障结果进行比较的方式，确定数据安全保障单元执行保障的操作是否是安全的。另外，在数据安全审计单元用于审计所述数据安全保障单元执行保障的操作是否安全时，不仅可以采用上述与预期保障结果进行比较的方式，而且为了及时发现异常保障以及及时中断不安全的保障处理(例如，执行保障的步骤与预 期步骤不一致，对保障过程所得的过程结果的处理与预期过程结果的处理不一致等)，数据安全审计单元，还可以用于审计所述数据安全保障单元执行保障的保障过程与预期保障过程是否一致，在两者不一致的情况下，确定所述数据安全保障单元执行保障的操作是不安全的。采用与预期保障过程比较的方式时，如果发现保障过程不一致，在不用比较保障结果的情况下就可以直接确定数据安全保障单元执行保障的操作是不安全的，因而可以更为快速地实现异常情况的中止操作，提高了审计效率。
作为一个可选的实施例，数据安全审计单元，用于审计数据计算单元执行数据计算所得的计算结果与预期计算结果是否一致，在两者一致的情况下，确定数据计算单元执行数据计算的操作是安全的，在两者不一致的情况下，确定数据计算单元执行数据计算的操作是不安全的；即通过与预期计算结果进行比较的方式，确定数据计算单元执行数据计算的操作是否是安全的。另外，在数据安全审计单元用于审计所述数据计算单元执行计算的操作是否安全时，不仅可以采用上述与预期计算结果进行比较的方式，而且为了及时发现异常数据计算以及及时中断不安全的数据计算处理(例如，对数据执行计算的步骤并非预期步骤，对数据执行计算的过程中所得的过程结果的处理与预期处理不一致等)，数据安全审计单元，还可以用于审计所述数据计算单元执行计算的计算过程与预期计算过程是否一致，在两者不一致的情况下，确定所述数据计算单元执行计算的操作是不安全的。采用与预期计算过程比较的方式时，如果发现计算过程不一致，在不用比较计算结果的情况下就可以直接确定数据计算单元执行计算的操作是不安全的，因而可以更为快速地实现异常情况的中止操作，提高了审计效率。
作为一个可选的实施例，数据安全审计单元，用于审计数据传输单元传输数据所得的传输结果与预期传输结果是否一致，在两者一致的情况下，确定数据传输单元传输数据的操作是安全的，在两者不一致的情况下，确定数据传输单元传输数据的操作是不安全的；即通过与预期传输结果进行比较的方式，确定数据传输单元传输数据的操作是否是安全的。另外，在数据安全审计单元用于审计所述数据传输单元传输数据的操作是否安全时，不仅可以采用上述与预期传输结果进行比较的方式，而且为了及时发现异常传输以及及时中断不安全的数据传输处理(例如，数据传输所采用的传输方式与预期传输方式不一致(比如，是否加解密传输等)，数据传输过程中是否存在中转与预期不一致等)，数据安全审计单元，还可以用于审计所述数据传输单元传输数据的传输过程与预期传输过程是否一致，在两者不一致的情况下，确定所述数据计算单元传输数据的操作 是不安全的。采用与预期传输过程比较的方式时，如果发现传输过程不一致，在不用比较传输结果的情况下就可以直接确定数据计算单元传输数据的操作是不安全的，因而可以更为快速地实现异常情况的中止操作，提高了审计效率。
作为一个可选的实施例，数据安全审计单元，用于审计数据存储单元存储数据所得的存储结果与预期存储结果是否一致，在两者一致的情况下，确定数据存储单元存储数据的操作是安全的，在两者不一致的情况下，确定数据存储单元存储数据的操作是不安全的。即通过与预期存储结果进行比较的方式，确定数据存储单元存储数据的操作是否是安全的。另外，在数据安全审计单元用于审计所述数据存储单元存储数据的操作是否安全时，不仅可以采用上述与预期存储结果进行比较的方式，而且为了及时发现异常存储以及及时中断不安全的数据存储处理(例如，数据存储过程中所采用的存储性质(比如，临时存储还是永久存储等)与预期存储性质不一致，数据存储的存储速度与预期存储速度不一致等)，数据安全审计单元，还可以用于审计所述数据存储单元存储数据的存储过程与预期存储过程是否一致，在两者不一致的情况下，确定所述数据计算单元存储数据的操作是不安全的。采用与预期存储过程比较的方式时，如果发现存储过程不一致，在不用比较存储结果的情况下就可以直接确定数据计算单元存储数据的操作是不安全的，因而可以更为快速地实现异常情况的中止操作，提高了审计效率。
作为一个可选的实施例，数据安全审计单元，还用于获取非用户数据的安全审计数据，用于根据获取的非用户数据的安全审计数据，审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全。其中，该非用户数据的安全审计数据可以包括：计算执行的任何指令、执行时间、内存地址,以及执行计算的电磁信号等等。上述所列举的非用户数据的元素仅仅为一种举例，并不限于此。即通过获取非用户数据的安全审计数据来实现对在各个维度上的执行操作进行审计，相比于相关技术需要读取内存数据来进行审计，暴露用户隐私而言，有效地实现了对用户数据的安全保护。
另外，需要说明的是，上述数据传输单元，数据存储单元，数据计算单元，数据安全保障单元，数据安全审计单元，数据计算控制单元可以以任何形式来实现其功能，例如，上述数据传输单元，数据存储单元，数据计算单元，数据安全保障单元，数据安全审计单元，数据计算控制单元中的至少两者集成于一块硬件安全卡中。举例来说，数据 计算单元可以与内存、数据传输单元集成于一块安全芯片中实现；计算控制单元可以和数据计算单元、或数据计算安全保障单元、或数据计算安全审计单元集成在一块芯片中；数据计算安全保障单元和数据计算安全审计单元、数据计算控制单元集成在一起等等。
在本发明优选实施方式中，还提供了一种数据安全处理系统。在该优选实施方式所提供的数据安全处理系统中，为了保障数据整个生命周期的安全，从执行数据处理的执行环境的平台及系统安全、数据计算安全，数据传输安全、数据存储安全四维度，基于硬件进行安全保护，图2是根据本发明实施例1的数据安全处理系统的抽象硬件安全架构图，如图2所示，该系统主要包括：数据计算单元、数据安全保障单元、数据安全审计单元、计算控制单元、内存、数据传输单元、数据存储单元等。其中：
数据计算单元主要用来完成计算功能；
数据安全保障单元用来保障平台系统环境的安全，比如BIOS，OS Loader,OS内核平台及系统的完整性，以及计算应用程序自身的完整性，及数据安全审计单元、数据传输单元的安全，数据存储单元等其它硬件固件的完整性及合法性；
数据安全审计单元用来审计数据计算单元、数据安全保障单元、数据传输单元、数据存储单元在完成数据计算、保障计算、数据传输、数据存储过程中是否是符合预期的，其具备获取非用户数据的计算相关数据，比如：计算执行的任何指令、执行时间、内存地址等；
计算控制单元用来管控计算控制，该功能是数据安全保障单元或数据安全审计单元发现异常时，触发计算控制单元控制计算受限执行或禁止执行；
数据传输单元用来完成数据的远程传输功能；
数据存储单元用来完成数据的存储功能；
内存用来存储计算单元相关的一些数据及地址。
注：上述各个部分不限于实现形式，比如,上述数据计算单元可在通常的中央处理器(Center Processing Unit,简称为CPU)、图形处理器(Graphics Processing Unit,简称为GPU)、现场可编辑门阵列(Field－Programmabele Gate Arrary,简称为FPGA)等计算单元中实现，也可在内存、数据传输单元(例如，智能网络接口控制器(或称智能网卡)(Smart Network Interface Controller，简称为NIC)中实现；计算控制单元可以和数据计算单元、或数据计算安全保障单元、或数据计算安全审计单元集成在一块 芯片中；数据计算安全保障单元和数据计算安全审计单元、数据计算控制单元集成在一起等等。
例如，下面列举上述数据计算单元、数据安全保障单元、数据安全审计单元、计算控制单元、内存、数据传输单元、数据存储单元之间集成的几种方式。需要说明的是，下列组合仅仅为举例，并不限定其它组合的实施方式。需要说明的是，在以下举例中，以TPM/TPCM为实现数据安全保障的两种产品形态，即用于实现上述数据安全保障单元的功能；以jindai X为实现数据安全审计的一种产品形态，即用于实现上述数据安全审计单元的功能；可信高速数据加密卡(Trusted high-speed Data Encryption Card，或者简称为THSDC)为实现高速加解密计算的一种产品形态，即用于实现上述数据计算单元的功能；Smart NIC为数据传输的一种产品形态，即用于实现上述数据传输单元的功能。
图3是根据本发明实施例1数据安全保障单元，数据安全审计单元，数据计算单元以及数据传输单元集成于一张硬件安全卡的结构示意图，如图3所示，将TPM/TPCM，jindai X，THSDEC以及Smart NIC集成于一张硬件安全卡实体中。
图4是根据本发明实施例1的数据安全保障单元，数据安全审计单元，数据计算单元进行集成后与数据传输单元形成数据安全处理系统的结构示意图，如图4所示，将TPM/TPCM，jindai X和THSDEC集成于一张硬件安全卡实体中，之后该硬件安全卡实体与数据传输单元Smart NIC进行数据传输。
图5是根据本发明实施例1的数据安全保障单元和数据安全审计单元的集成，数据计算单元和数据传输单元的集成形成数据安全处理系统的结构示意图，如图5所示，TPM/TPCM和jindai X集成于一张硬件安全卡实体中，将THSDEC和Smart NIC集成于一张硬件安全卡实体中，之后由两张硬件安全卡实体共同协调完成数据安全处理系统的功能。
需要说明的是，上述图3，图4以及图5中均是以TPM/TPCM和jindai X集成在一起而进行举例的，在具体实现时，如上所述，TPM/TPCM是实现数据安全保障的产品形态，jindai X是实现数据安全审计的产品形态，实现数据安全保障和实现数据安全审计是可以分开的，因此，TPM/TPCM和jindai X在具体实现时是可以分开的。上述图3，图4以及图5中集成在一起仅是一种举例，并不限于上述集成的实现方式。
基于上述实施例或是优选实施方式所提供的数据安全处理系统，在本发明实施例 中，还提供了一种数据安全处理方法,图6是根据本发明实施例1的数据安全处理方法的流程图，如图6所示，该流程包括如下步骤：
步骤S602,通过数据安全保障单元，保障执行数据处理的执行环境的平台及系统的安全，用于执行数据计算的数据计算单元的安全，用于传输数据的数据传输单元的安全，用于存储数据的数据存储单元的安全；
步骤S604,通过数据安全审计单元，审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全；
步骤S606,通过数据计算控制单元，对数据安全保障单元执行保障操作，和/或数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
在一个可选的实施例中，通过数据安全保障单元，保障执行数据处理的执行环境的平台及系统的安全，用于执行数据计算的数据计算单元的安全，用于传输数据的数据传输单元的安全，用于存储数据的数据存储单元的安全，可以结合上述数据安全保障单元的功能来执行对数据安全周期中各个维度的安全保障对应的操作，在此不赘述。
在一个可选的实施例中，通过数据安全审计单元，审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全，也可以结合上述数据安全审计单元的功能来执行对数据安全周期中各个维度的安全审计对应的操作，在此也不赘述。
在一个可选的实施例中，通过数据计算控制单元，对数据安全保障单元执行保障操作，和/或数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。即在数据安全保障单元在对执行数据处理的执行环境的平台及系统进行安全保障的操作中，在对用于执行数据计算的数据计算单元进行安全保障的操作中，在对用于传输数据的数据传输单元进行安全保障的操作中，在对用于存储数据的数据存储单元进行安全保障的操作中，只要发现了异常，即可以触发数据计算控制单元控制数据计算单元，数据传输单元以及数据存储单元执行受限操作，或者禁止执行操作。另外，在数据安全审计单元执行对数据安全保障单元，数据计算单元，数据传输单元以及数据存储单元执行审计的操作中，如果发现异常，也可以直接触发数据计算 控制单元控制数据安全保障单元，数据计算单元，数据传输单元以及数据存储单元执行受限操作，或者禁止执行操作。
在本发明实施例中，通过数据安全保障单元完成对数据安全周期各个维度上的安全保障，通过数据安全审计单元完成对数据安全周期各个维度上的安全审计，以及数据计算控制单元对数据安全保障单元和数据安全审计单元进行监控，并在发生异常的情况下，触发数据处理受限执行或禁止执行。达到了从执行数据处理的执行环境的平台及系统，数据存储、数据计算、数据传输整个数据的生命周期来保证数据安全的目的，从而实现了从整体保证数据安全的技术效果，进而解决了在相关技术中，存在对数据安全的保护较为局限，无法从整体保证数据的安全的技术问题。
实施例2
根据本发明实施例，还提供了一种数据安全处理方法的方法实施例，需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
本申请实施例2所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。图7是根据本发明实施例2的数据安全处理方法的流程图，如图7所示，该流程包括如下步骤：
步骤S702，接收数据计算请求；
作为一种可选的实施例，上述步骤的执行主体可以是一种计算机终端，例如，智能手机，移动电话，平板电脑，笔记本电脑，智能手表等用户终端。上述步骤的执行主体也可以是包括用于执行数据安全计算功能的单独芯片，例如，可以是用于可信计算的可信芯片，还可以其它用于保证数据计算安全的其它计算芯片。上述步骤的执行主体还可以是用于执行数据安全计算功能的服务器等网络设备。
作为一种可选的实施例，接收数据计算请求，即是接收用于请求对数据执行安全计算的请求。需要说明的是，数据计算请求中可以包括一个数据计算请求，也可以包括多个数据计算请求，在包括多个数据计算请求时，可以通过一定的区分标识对多个数据计算请求进行区分，从而实现在一定时间段内能够有序地对多个数据计算请求的数据计算安全进行保障。
步骤S704，通过可信计算池完成数据计算，得到计算结果，并将计算结果传送给可 信存储池和/或可信传输单元，其中，可信计算池通过数据安全保障单元，数据安全审计单元，数据计算控制单元与数据计算单元进行协调，保障数据计算操作的安全；
作为一种可选的实施例，针对接收到的数据计算请求，在执行数据安全计算之前，可以先对发送请求的用户的身份进行验证，在验证合法的情况下，为该数据计算请求分配对应的数据计算单元执行数据安全计算，从而保证计算的合法性，避免执行非法用户请求的计算。
作为一种可选的实施例，在要执行数据安全计算时，可以依据数据计算请求中所携带的计算要求，以及各个数据计算单元的负荷或者性能，为该接收到的数据计算请求分配合适的数据计算单元，这样一方面可以在一定程度上满足用户要求，而且能够有限地节省计算资源，另外，还能在一定程度上提高计算效率。
作为一种可选的实施例，在接收到的数据计算请求之后，由于一些数据计算请求中可能包括对数据的存储请求,或者对数据的传输请求，因此，可信计算池在接收到对包括对数据的存储请求或者对数据的传输请求时，在对数据进行存储或者传输时，可以先对发送存储请求或者传输请求的用户进行身份验证，在验证通过的情况下，对数据进行存储或者传输，从而保证存储或者传输的合法性，避免执行非法用户请求的数据存储或数据传输。需要说明的是，请求对数据的安全计算，请求对数据的安全存储，以及请求对数据的安全传输可以是各自分开独立的，也可以是任意结合的。
作为一种可选的实施例，由于数据计算池是通过可信计算池完成的，而可信计算池又通过数据安全保障单元，数据安全审计单元，数据计算控制单元与数据计算单元进行协调，保障数据计算操作的安全，因此，通过可信计算池完成的数据计算即可以认为是安全的，可信的。
作为一种可选的实施例，对数据执行计算后得到计算结果，不同的计算结果可能应用于不同的功能和作用，例如，有些计算结果是需要进行存储的，因此，在计算完成后需要将计算结果传送给可信存储池，从而完成数据的可信存储。又例如，有些计算结果是需要继续传输的，因此，在计算完成后需要将计算结果传送给可信传输单元，由可信传输单元完成后续的传输。
步骤S706，通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输；
其中，数据安全保障单元用于保障可信传输单元中的数据传输单元，可信存储池中 的数据存储单元，数据计算单元，数据安全审计单元，数据计算控制单元的安全；数据安全审计单元用于审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全。
作为一种可选的实施例，在数据计算请求中携带有计算策略的情况下，通过可信计算池完成数据计算可以包括：依据计算策略，通过可信计算池完成数据计算；其中，该计算策略可以包括执行计算的各个方面所涉及的要求，例如，可以包括执行计算的执行主体，执行计算的执行环境，以及对计算结果执行验证的验证条件等。
作为一种可选的实施例，在数据计算请求中携带有传输策略和/或存储策略的情况下，通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输包括：依据存储策略，通过可信存储池对计算结果进行存储；和/或，依据传输策略，通过可信传输单元对计算结果进行传输。其中，上述所指的传输策略包括传输所涉及的一些条件要求，例如，传输的速度，传输的安全等级等。上述所指的存储策略包括存储所涉及的一些条件，例如，存储的速度，存储的安全等级等。
作为一种可选的实施例，对应地，上述数据计算单元可以包括：依据不同的计算能力划分的：通用计算单元，高速加解密计算单元；上述数据存储单元可以包括：依据不同存储能力划分的不同存储速度的存储单元，依据不同安全级别划分的明文存储单元和密文存储单元；上述数据传输单元可以包括：依据不同传输能力划分的不同传输速度的传输单元，依据不同安全级别划分的明文传输单元和密文传输单元。需要说明的是，上述所指的不同存储速度可以依据需求进行划分，例如，可以分为大致的高速存储和低速存储，也可以划分为较细的高速存储，中速存储以及低速存储等。相对于明文存储而言，密文存储的安全等级要高。上述所指的不同传输速度可以依据需求进行划分，例如，可以分为大致的高速传输和低速传输，也可以划分为较细的高速传输，中速传输以及低速传输等。同样，相对于明文传输而言，密文传输的安全等级相对要高。
作为一种可选的实施例，为使得分配的用于执行计算的数据计算单元准确，高效，在通过可信计算池完成数据计算时，可以通过可信计算池中的计算请求分流引擎为数据计算请求选择对应的数据计算单元执行数据计算；其中，该计算请求分流引擎具体可以依据数据计算请求中携带的计算要求，以及各个待选择的数据计算单元的性能来选择用于执行数据计算的数据计算单元。
作为一种可选的实施例，为提高数据的存储效率和/或数据的传输效率，在通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输时，可以包括：通过可信存储池中的存储分离引擎选择对应的数据存储单元对计算结果进行存储；和/或，通过传输分离引擎选择可信传输单元中的对应的数据传输单元对计算结果进行传输。同样，上述存储分离引擎可以依据数据计算请求中携带的存储要求，以及各个待选择的数据存储单元的性能来选择用于执行数据存储的数据存储单元。上述传输分离引擎可以依据数据计算请求中携带的传输要求，以及各个待选择的数据传输单元的性能来选择用于执行数据传输的数据传输单元。
需要说明的是，上述数据传输单元，数据存储单元，数据计算单元，数据安全保障单元，数据安全审计单元，数据计算控制单元可以以任何形式来实现其功能，例如，上述数据传输单元，数据存储单元，数据计算单元，数据安全保障单元，数据安全审计单元，数据计算控制单元中的至少两者集成于一块硬件安全卡中。举例来说，数据计算单元可以与内存、数据传输单元集成于一块安全芯片中实现；计算控制单元可以和数据计算单元、或数据计算安全保障单元、或数据计算安全审计单元集成在一块芯片中；数据计算安全保障单元和数据计算安全审计单元、数据计算控制单元集成在一起等等。
在上述数据安全处理方法中，通过数据安全保障单元完成对数据安全周期各个维度上的安全保障，通过数据安全审计单元完成对数据安全周期各个维度上的安全审计，以及数据计算控制单元对数据安全保障单元和数据安全审计单元进行监控，并在发生异常的情况下，触发数据处理受限执行或禁止执行。达到了从执行数据处理的执行环境的平台及系统，数据存储、数据计算、数据传输整个数据的生命周期来保证数据安全的目的，从而实现了从整体保证数据安全的技术效果，进而解决了在相关技术中，存在对数据安全的保护较为局限，无法从整体保证数据的安全的技术问题。
在一个优选的实施方式中，提供了一种数据安全处理方法，在该数据安全处理方法中，依数据整个生命周期，整个方法对应的硬件架构可包括：可信计算池、可信存储池、可信传输等。图8是根据本发明实施例2的数据安全处理方法对应的硬件架构图，如图8所示：
可信计算池包括不同计算能力的数据计算单元，其中，图中所描述的通用计算单元、敏感高速加解密计算单元就是不同计算能力的数据计算单元一种。需要说明的是，无论采用哪种数据计算单元进行数据计算，数据安全保障单元、数据安全审计单元、数 据计算控制单元都会与数据计算单元进行协调工作，来保障数据计算单元的计算是安全的，可信的；另外，可信计算池依据输入的计算请求，可以对数据执行本地计算，例如，采用可信计算池本地的计算资源执行计算；也可以对数据执行远程计算，例如，在可信计算池检测到本地的计算资源有限，可能会影响到计算效率时，可以通过可信传输将数据传输到计算资源充足的远程服务器，由远程服务器执行远程计算。具体采用哪种计算方式，可以依据计算请求的要求，以及可信计算池的计算资源而灵活选择。
可信存储池包括不同能力的存储单元组成，其中，如图8中，可以依据存储性能及安全存储等级划分为：明文存储(有高、中、低速之分)、密文存储(有高、中、低速之分)等；需要说明的是，可信存储池对数据进行存储时，也可以对数据执行本地存储，例如，采用可信存储池本地的存储资源进行存储；也可以对数据执行远程存储，例如，在可信存储池检测到本地的存储资源有限，可能会影响到存储性能时，可以通过可信传输将数据存储到存储资源丰富的远程存储器，由远程存储器对数据进行远程存储。具体采用哪种存储方式，可以依据具体请求的要求，以及可信存储池的存储资源而灵活选择。
可信传输中的数据传输单元可以和数据存储单元及数据计算单元进行互通，互通要保证可信传输，符合世界范围内的可信网络连接标准的可信传输。依据传输能力可以支持明文传输、低安全级别或高安全级别的密文传输等。
需要说明的是，数据安全保障分两阶段，第一阶段，设备启动阶段支撑数据生命周期安全的平台及系统是完整未被篡改，且是合法的；第二阶段，设备启动之后的，数据在计算(使用)、存储、传输过程中的安全保障，如图8所示，在图8中，以通用计算单元CPU和可信计算单元为例，阐述数据安全保障流程：
(1)用户发出数据计算请求，携带计算策略、传输策略或存储策略；
(2)计算请求分流引擎收到用户计算请求，鉴别用户身份及用户平台合法性，根据用户计算请求中的参数选择相应数据计算单元进行数据计算，当计算结束后，将计算结果及传输策略、存储策略传输给计算结果输出分离引擎，计算结果输出分离引擎依据传输策略或存储策略将计算结果传送给可信存储池或可信传输中的数据传输单元；
(3)当传输分离引擎收到数据后，会依据传输策略对数据进行相应机制的传输；
(4)当存储分离引擎收到数据后，会依据存储策略对数据进行相应存储。
(5)可信存储池和数据传输单元也可以依赖世界范围内的可信网络传输协议进行数 据互通。
通过上述优选实施方式，可以在一张硬件安全卡上，将数据存储安全、数据计算安全、数据传输安全、及数据使用执行环境安全打通，成体系的保障数据安全；另外，该硬件安全卡还可以依据业务需求策略，通过可信计算池、可信存储池、不同数据传输能力的数据传输单元、及安全的数据使用执行环境为业务提供灵活的弹性安全服务。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明并不受所描述的动作顺序的限制，因为依据本发明，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本发明所必须的。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例的方法。
实施例3
根据本发明实施例，还提供了一种用于实施上述实施例1的数据安全处理方法的数据安全处理系统，图9是根据本发明实施例3的数据安全处理系统的结构框图，如图9所示，该数据安全处理系统包括：数据安全保障单元，数据安全审计单元和数据计算控制单元，下面对该数据安全处理系统进行说明。
数据安全保障单元，用于保障执行数据处理的执行环境的平台及系统的安全，用于执行数据计算的数据计算单元的安全，用于传输数据的数据传输单元的安全，用于存储数据的数据存储单元的安全；数据安全审计单元，连接至上述数据安全保障单元和数据计算控制单元，用于审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全；数据计算控制单元，连接至上述数据安全保障单元和数据安全审计单元，用于对数据安全保障单元执行保障操作，和/或数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止 执行。
此处需要说明的是，上述数据安全保障单元，数据安全审计单元和数据计算控制单元对应于上述实施例1中的步骤S602至步骤S606，两个模块与对应的步骤所实现的实例和应用场景相同，但不限于上述实施例1所公开的内容。需要说明的是，上述模块作为装置的一部分可以运行在计算机终端中。
实施例4
根据本发明实施例，还提供了一种用于实施上述实施例2的数据安全处理方法的数据安全处理系统，图10是根据本发明实施例4的数据安全处理系统的结构框图,如图10所示，该数据安全处理系统10包括：接收模块102，第一处理模块104和第二处理模块106，下面对该数据安全处理系统进行说明。
接收模块102，用于接收数据计算请求；第一处理模块104，连接至上述接收模块102，用于通过可信计算池完成数据计算，得到计算结果，并将计算结果传送给可信存储池和/或可信传输单元，其中，可信计算池通过数据安全保障单元，数据安全审计单元，数据计算控制单元与数据计算单元进行协调，保障数据计算操作的安全；第二处理模块106，连接至上述第一处理模块104，用于通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输；其中，数据安全保障单元用于保障可信传输单元中的数据传输单元，可信存储池中的数据存储单元，数据计算单元，数据安全审计单元，数据计算控制单元的安全；数据安全审计单元用于审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全。
此处需要说明的是，上述接收模块102，第一处理模块104和第二处理模块106对应于实施例2中的步骤S702至步骤S706，两个模块与对应的步骤所实现的实例和应用场景相同，但不限于上述实施例2所公开的内容。需要说明的是，上述模块作为装置的一部分可以运行在计算机终端中。
实施例5
本发明的实施例可以提供一种硬件安全卡，该硬件安全卡用于执行数据安全计算，可以是计算机终端设备中的一个硬件卡，也可以是网络设备中的硬件卡。
图11是根据本发明实施例5的硬件安全卡的结构框图，如图5所示，该硬件安全卡110，包括：存储器112和处理器114，存储器存储有计算机程序；处理器，用于执行存 储器中存储的计算机程序，计算机程序运行时执行权利要求6至11中任意一项的数据安全处理方法。
其中，存储器可用于存储软件程序以及模块，如本发明实施例中的安全漏洞检测方法和装置对应的程序指令/模块，处理器通过运行存储在存储器内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述数据安全处理方法。存储器可包括高速随机存储器，还可以包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器可进一步包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至计算机终端或者网络设备。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
在一个可选地实施方式中，处理器可以通过传输装置调用存储器存储的信息及应用程序，以执行下述步骤的程序代码：通过数据安全保障单元，保障执行数据处理的执行环境的平台及系统的安全，用于执行数据计算的数据计算单元的安全，用于传输数据的数据传输单元的安全，用于存储数据的数据存储单元的安全；通过数据安全审计单元，审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全；通过数据计算控制单元，对数据安全保障单元执行保障操作，和/或数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
在另一个可选地实施方式中，处理器可以通过传输装置调用存储器存储的信息及应用程序，以执行下述步骤的程序代码：接收数据计算请求；通过可信计算池完成数据计算，得到计算结果，并将计算结果传送给可信存储池和/或可信传输单元，其中，可信计算池通过数据安全保障单元，数据安全审计单元，数据计算控制单元与数据计算单元进行协调，保障数据计算操作的安全；通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输；其中，数据安全保障单元用于保障可信传输单元中的数据传输单元，可信存储池中的数据存储单元，数据计算单元，数据安全审计单元，数据计算控制单元的安全；数据安全审计单元用于审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全。
可选的，上述处理器还可以执行如下步骤的程序代码：在数据计算请求中携带有计 算策略、传输策略和/或存储策略的情况下，通过可信计算池完成数据计算包括：依据计算策略，通过可信计算池完成数据计算；通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输包括：依据存储策略，通过可信存储池对计算结果进行存储；和/或，依据传输策略，通过可信传输单元对计算结果进行传输。
可选的，上述处理器还可以执行如下步骤的程序代码：包括以下至少之一：数据计算单元包括：依据不同的计算能力划分的：通用计算单元，高速加解密计算单元；数据存储单元包括：依据不同存储能力划分的不同存储速度的存储单元，依据不同安全级别划分的明文存储单元和密文存储单元；数据传输单元包括：依据不同传输能力划分的不同传输速度的传输单元，依据不同安全级别划分的明文传输单元和密文传输单元。
可选的，上述处理器还可以执行如下步骤的程序代码：通过可信计算池完成数据计算包括：通过可信计算池中的计算请求分流引擎为数据计算请求选择对应的数据计算单元执行数据计算；通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输包括：通过可信存储池中的存储分离引擎选择对应的数据存储单元对计算结果进行存储；和/或，通过传输分离引擎选择可信传输单元中的对应的数据传输单元对计算结果进行传输。
可选的，上述处理器还可以执行如下步骤的程序代码：数据传输单元，数据存储单元，数据计算单元，数据安全保障单元，数据安全审计单元，数据计算控制单元中的至少两者集成于一块硬件安全卡中。
通过采用上述硬件安全卡，达到了从执行数据处理的执行环境的平台及系统，数据存储、数据计算、数据传输整个数据的生命周期来保证数据安全的目的，从而实现了从整体保证数据安全的技术效果，进而解决了在相关技术中，存在对数据安全的保护较为局限，无法从整体保证数据的安全的技术问题。
实施例6
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以用于保存上述实施例1所提供的数据安全处理方法所执行的程序代码。
可选地，在本实施例中，上述存储介质可以位于计算机网络中计算机终端群中的任意一个计算机终端中，或者位于移动终端群中的任意一个移动终端中。
可选地，在本实施例的一个实施方式中，存储介质被设置为存储用于执行以下步骤的程序代码：通过数据安全保障单元，保障执行数据处理的执行环境的平台及系统的安 全，用于执行数据计算的数据计算单元的安全，用于传输数据的数据传输单元的安全，用于存储数据的数据存储单元的安全；通过数据安全审计单元，审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全；通过数据计算控制单元，对数据安全保障单元执行保障操作，和/或数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
可选地，在本实施例的另一个实施方式中，存储介质被设置为存储用于执行以下步骤的程序代码：接收数据计算请求；通过可信计算池完成数据计算，得到计算结果，并将计算结果传送给可信存储池和/或可信传输单元，其中，可信计算池通过数据安全保障单元，数据安全审计单元，数据计算控制单元与数据计算单元进行协调，保障数据计算操作的安全；通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输；其中，数据安全保障单元用于保障可信传输单元中的数据传输单元，可信存储池中的数据存储单元，数据计算单元，数据安全审计单元，数据计算控制单元的安全；数据安全审计单元用于审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全。
可选的，存储介质被设置为存储用于执行以下步骤的程序代码：在数据计算请求中携带有计算策略、传输策略和/或存储策略的情况下，通过可信计算池完成数据计算包括：依据计算策略，通过可信计算池完成数据计算；通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输包括：依据存储策略，通过可信存储池对计算结果进行存储；和/或，依据传输策略，通过可信传输单元对计算结果进行传输。
可选的，存储介质被设置为存储用于执行以下步骤的程序代码：包括以下至少之一：数据计算单元包括：依据不同的计算能力划分的：通用计算单元，高速加解密计算单元；数据存储单元包括：依据不同存储能力划分的不同存储速度的存储单元，依据不同安全级别划分的明文存储单元和密文存储单元；数据传输单元包括：依据不同传输能力划分的不同传输速度的传输单元，依据不同安全级别划分的明文传输单元和密文传输单元。
可选的，存储介质被设置为存储用于执行以下步骤的程序代码：通过可信计算池完 成数据计算包括：通过可信计算池中的计算请求分流引擎为数据计算请求选择对应的数据计算单元执行数据计算；通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输包括：通过可信存储池中的存储分离引擎选择对应的数据存储单元对计算结果进行存储；和/或，通过传输分离引擎选择可信传输单元中的对应的数据传输单元对计算结果进行传输。
可选的，存储介质被设置为存储用于执行以下步骤的程序代码：数据传输单元，数据存储单元，数据计算单元，数据安全保障单元，数据安全审计单元，数据计算控制单元中的至少两者集成于一块硬件安全卡中。
实施例7
本发明的实施例还提供了一种处理器。该处理器可以为一个独立的器件，也可以是集成于预定网络设备上的功能模块，可以依据需要灵活选择。
在本实施例的一个优选实施方式中，上述处理器可以执行如下步骤的程序代码：通过数据安全保障单元，保障执行数据处理的执行环境的平台及系统的安全，用于执行数据计算的数据计算单元的安全，用于传输数据的数据传输单元的安全，用于存储数据的数据存储单元的安全；通过数据安全审计单元，审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全；通过数据计算控制单元，对数据安全保障单元执行保障操作，和/或数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
在本实施例的一个优选实施方式中，上述处理器可以执行如下步骤的程序代码：接收数据计算请求；通过可信计算池完成数据计算，得到计算结果，并将计算结果传送给可信存储池和/或可信传输单元，其中，可信计算池通过数据安全保障单元，数据安全审计单元，数据计算控制单元与数据计算单元进行协调，保障数据计算操作的安全；通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输；其中，数据安全保障单元用于保障可信传输单元中的数据传输单元，可信存储池中的数据存储单元，数据计算单元，数据安全审计单元，数据计算控制单元的安全；数据安全审计单元用于审计数据安全保障单元执行保障的操作是否安全，审计数据计算单元执行数据计算的操作是否安全，审计数据传输单元传输数据的操作是否安全，审计数据存储单元存储数据的操作是否安全。
可选的，上述处理器还可以执行如下步骤的程序代码：在数据计算请求中携带有计算策略、传输策略和/或存储策略的情况下，通过可信计算池完成数据计算包括：依据计算策略，通过可信计算池完成数据计算；通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输包括：依据存储策略，通过可信存储池对计算结果进行存储；和/或，依据传输策略，通过可信传输单元对计算结果进行传输。
可选的，上述处理器还可以执行如下步骤的程序代码：包括以下至少之一：数据计算单元包括：依据不同的计算能力划分的：通用计算单元，高速加解密计算单元；数据存储单元包括：依据不同存储能力划分的不同存储速度的存储单元，依据不同安全级别划分的明文存储单元和密文存储单元；数据传输单元包括：依据不同传输能力划分的不同传输速度的传输单元，依据不同安全级别划分的明文传输单元和密文传输单元。
可选的，上述处理器还可以执行如下步骤的程序代码：通过可信计算池完成数据计算包括：通过可信计算池中的计算请求分流引擎为数据计算请求选择对应的数据计算单元执行数据计算；通过可信存储池对计算结果进行存储，和/或通过可信传输单元对计算结果进行传输包括：通过可信存储池中的存储分离引擎选择对应的数据存储单元对计算结果进行存储；和/或，通过传输分离引擎选择可信传输单元中的对应的数据传输单元对计算结果进行传输。
可选的，上述处理器还可以执行如下步骤的程序代码：数据传输单元，数据存储单元，数据计算单元，数据安全保障单元，数据安全审计单元，数据计算控制单元中的至少两者集成于一块硬件安全卡中。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
在本发明的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示 的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (16)

  1. 一种数据安全处理系统，其特征在于，包括：用于传输数据的数据传输单元，用于存储数据的数据存储单元，用于执行数据计算的数据计算单元，还包括：
    数据安全保障单元，用于保障执行数据处理的执行环境的系统的安全，数据计算单元的安全，数据传输单元的安全，数据存储单元的安全；
    数据安全审计单元，用于审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据传输单元传输数据的操作是否安全，审计所述数据存储单元存储数据的操作是否安全；
    数据计算控制单元，用于对所述数据安全保障单元执行保障操作，和/或所述数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
  2. 根据权利要求1所述的系统，其特征在于，
    所述数据安全保障单元，用于保障执行数据处理的执行环境的系统的硬件固件的完整性和合法性；
    所述数据安全保障单元，用于保障所述数据计算单元的计算系统软件、计算硬件固件以及计算用到的应用程序的完整性和合法性；
    所述数据安全保障单元，用于保障所述数据传输单元的传输系统软件、传输硬件固件以及传输用到的应用程序的完整性和合法性；
    所述数据安全保障单元，用于保障所述数据存储单元的存储系统软件、存储硬件固件以及存储用到的应用程序的完整性和合法性。
  3. 根据权利要求1所述的系统，其特征在于，
    所述数据安全审计单元，用于审计所述数据安全保障单元执行保障所得的保障结果与预期保障结果是否一致，在两者一致的情况下，确定所述数据安全保障单元执行保障的操作是安全的；或者，所述数据安全审计单元，用于审计所述数据安全保障单元执行保障的保障过程与预期保障过程是否一致，在两者不一致的情况下，确定所述数据安全保障单元执行保障的操作是不安全的；
    所述数据安全审计单元，用于审计所述数据计算单元执行数据计算所得的计算结果与预期计算结果是否一致，在两者一致的情况下，确定所述数据计算单元执行数据计算的操作是安全的；或者，所述数据安全审计单元，用于审计所述数据计算单元执行数据计算的计算过程与预期计算过程是否一致，在两者不一致的情况下，确定所述数据计算 单元执行数据计算的操作是不安全的；
    所述数据安全审计单元，用于审计所述数据传输单元传输数据所得的传输结果与预期传输结果是否一致，在两者一致的情况下，确定所述数据传输单元传输数据的操作是安全的；或者，所述数据安全审计单元，用于审计所述数据传输单元传输数据的传输过程与预期传输过程是否一致，在两者不一致的情况下，确定所述数据传输单元传输数据的操作是不安全的；
    所述数据安全审计单元，用于审计所述数据存储单元存储数据所得的存储结果与预期存储结果是否一致，在两者一致的情况下，确定所述数据存储单元存储数据的操作是安全的；或者，所述数据安全审计单元，用于审计所述数据存储单元存储数据的存储过程与预期存储过程是否一致，在两者不一致的情况下，确定所述数据存储单元存储数据的操作是不安全的。
  4. 根据权利要求1所述的系统，其特征在于，
    所述数据安全审计单元，还用于获取非用户数据的安全审计数据，用于根据获取的所述非用户数据的安全审计数据，审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据传输单元传输数据的操作是否安全，审计所述数据存储单元存储数据的操作是否安全。
  5. 根据权利要求1至4中任一项所述的系统，其特征在于，
    所述数据传输单元，所述数据存储单元，所述数据计算单元，所述数据安全保障单元，所述数据安全审计单元，所述数据计算控制单元中的至少两者集成于一块硬件安全卡中。
  6. 一种数据安全处理方法，其特征在于，包括：
    通过数据安全保障单元，保障执行数据处理的执行环境的系统的安全，用于执行数据计算的数据计算单元的安全，用于传输数据的数据传输单元的安全，用于存储数据的数据存储单元的安全；
    通过数据安全审计单元，审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据传输单元传输数据的操作是否安全，审计所述数据存储单元存储数据的操作是否安全；
    通过数据计算控制单元，对所述数据安全保障单元执行保障操作，和/或所述数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
  7. 一种数据安全处理方法，其特征在于，包括：
    接收数据计算请求；
    通过可信计算池完成数据计算，得到计算结果，并将所述计算结果传送给可信存储池和/或可信传输单元，其中，所述可信计算池通过数据安全保障单元，数据安全审计单元，数据计算控制单元与数据计算单元进行协调，保障数据计算操作的安全；
    通过所述可信存储池对所述计算结果进行存储，和/或通过所述可信传输单元对所述计算结果进行传输；
    其中，所述数据安全保障单元用于保障所述可信传输单元中的数据传输单元，所述可信存储池中的数据存储单元，所述数据计算单元，所述数据安全审计单元，所述数据计算控制单元的安全；所述数据安全审计单元用于审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据传输单元传输数据的操作是否安全，审计所述数据存储单元存储数据的操作是否安全。
  8. 根据权利要求7所述的方法，其特征在于，在所述数据计算请求中携带有计算策略、传输策略和/或存储策略的情况下，
    通过所述可信计算池完成数据计算包括：依据所述计算策略，通过所述可信计算池完成数据计算；
    通过所述可信存储池对所述计算结果进行存储，和/或通过所述可信传输单元对所述计算结果进行传输包括：依据所述存储策略，通过所述可信存储池对所述计算结果进行存储；和/或，依据所述传输策略，通过所述可信传输单元对所述计算结果进行传输。
  9. 根据权利要求7所述的方法，其特征在于，包括以下至少之一：
    所述数据计算单元包括：依据不同的计算能力划分的：通用计算单元，高速加解密计算单元；
    所述数据存储单元包括：依据不同存储能力划分的不同存储速度的存储单元，依据不同安全级别划分的明文存储单元和密文存储单元；
    所述数据传输单元包括：依据不同传输能力划分的不同传输速度的传输单元，依据不同安全级别划分的明文传输单元和密文传输单元。
  10. 根据权利要求7所述的方法，其特征在于，
    通过所述可信计算池完成数据计算包括：通过所述可信计算池中的计算请求分流引擎为所述数据计算请求选择对应的数据计算单元执行数据计算；
    通过所述可信存储池对所述计算结果进行存储，和/或通过所述可信传输单元对所述 计算结果进行传输包括：通过所述可信存储池中的存储分离引擎选择对应的数据存储单元对所述计算结果进行存储；和/或，通过传输分离引擎选择所述可信传输单元中的对应的数据传输单元对所述计算结果进行传输。
  11. 根据权利要求7至10中任一项所述的方法，其特征在于，
    所述数据传输单元，所述数据存储单元，所述数据计算单元，所述数据安全保障单元，所述数据安全审计单元，所述数据计算控制单元中的至少两者集成于一块硬件安全卡中。
  12. 一种数据安全处理系统，其特征在于，包括：数据安全保障单元，数据安全审计单元和数据计算控制单元，其中，
    所述数据安全保障单元，用于保障执行数据处理的执行环境的系统的安全，用于执行数据计算的数据计算单元的安全，用于传输数据的数据传输单元的安全，用于存储数据的数据存储单元的安全；
    所述数据安全审计单元，用于审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据传输单元传输数据的操作是否安全，审计所述数据存储单元存储数据的操作是否安全；
    所述数据计算控制单元，用于对所述数据安全保障单元执行保障操作，和/或所述数据安全审计单元执行审计操作进行监控，在监控发现异常时，触发对应的数据处理受限执行或禁止执行。
  13. 一种数据安全处理系统，其特征在于，包括：
    接收模块，用于接收数据计算请求；
    第一处理模块，用于通过可信计算池完成数据计算，得到计算结果，并将所述计算结果传送给可信存储池和/或可信传输单元，其中，所述可信计算池通过数据安全保障单元，数据安全审计单元，数据计算控制单元与数据计算单元进行协调，保障数据计算操作的安全；
    第二处理模块，用于通过所述可信存储池对所述计算结果进行存储，和/或通过所述可信传输单元对所述计算结果进行传输；
    其中，所述数据安全保障单元用于保障所述可信传输单元中的数据传输单元，所述可信存储池中的数据存储单元，所述数据计算单元，所述数据安全审计单元，所述数据计算控制单元的安全；所述数据安全审计单元用于审计所述数据安全保障单元执行保障的操作是否安全，审计所述数据计算单元执行数据计算的操作是否安全，审计所述数据 传输单元传输数据的操作是否安全，审计所述数据存储单元存储数据的操作是否安全。
  14. 一种存储介质，其特征在于，所述存储介质存储有程序，其中，在所述程序被处理器运行时使得所述处理器执行权利要求6至11中任意一项所述的数据安全处理方法。
  15. 一种处理器，其特征在于，所述处理器用于运行程序，其中，所述程序运行时使得所述处理器执行权利要求6至11中任意一项所述的数据安全处理方法。
  16. 一种硬件安全卡，其特征在于，包括：存储器和处理器，
    所述存储器存储有计算机程序；
    所述处理器，用于执行所述存储器中存储的计算机程序，所述计算机程序运行时使得所述处理器执行权利要求6至11中任意一项所述的数据安全处理方法。
PCT/CN2020/082312 2019-04-12 2020-03-31 数据安全处理系统、方法、存储介质、处理器及硬件安全卡 WO2020207292A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910295533.X 2019-04-12
CN201910295533.XA CN111814157B (zh) 2019-04-12 2019-04-12 数据安全处理系统、方法、存储介质、处理器及硬件安全卡

Publications (1)

Publication Number Publication Date
WO2020207292A1 true WO2020207292A1 (zh) 2020-10-15

Family

ID=72751902

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/082312 WO2020207292A1 (zh) 2019-04-12 2020-03-31 数据安全处理系统、方法、存储介质、处理器及硬件安全卡

Country Status (2)

Country Link
CN (1) CN111814157B (zh)
WO (1) WO2020207292A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117395033A (zh) * 2023-09-22 2024-01-12 广州尚全信息技术有限公司 一种数据安全监管方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060191007A1 (en) * 2005-02-24 2006-08-24 Sanjiva Thielamay Security force automation
US20140137115A1 (en) * 2012-08-20 2014-05-15 Bitdefender IPR Management Ltd. Secure Communication Using a Trusted Virtual Machine
CN104268254A (zh) * 2014-10-09 2015-01-07 浪潮电子信息产业股份有限公司 一种安全态势分析统计方法
CN104796290A (zh) * 2015-04-24 2015-07-22 广东电网有限责任公司信息中心 一种数据安全管控方法及平台
CN109376542A (zh) * 2018-09-30 2019-02-22 苏州浪潮智能软件有限公司 一种用于嵌入式金融终端的安全加固系统方案

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090300474A1 (en) * 2008-05-29 2009-12-03 Centralytics, Inc. Computer-based architecture using remotely-controlled electronic grid-based calculators
CN103269343B (zh) * 2013-05-21 2017-08-25 福建畅云安鼎信息科技有限公司 业务数据安全管控平台
CN104794410B (zh) * 2015-03-23 2018-01-09 中国科学院软件研究所 一种基于可信计算技术的数据库安全保护方法
US10462183B2 (en) * 2015-07-21 2019-10-29 International Business Machines Corporation File system monitoring and auditing via monitor system having user-configured policies
CN108270716A (zh) * 2016-12-30 2018-07-10 绵阳灵先创科技有限公司 一种基于云计算的信息安全审计方法
CN106991329A (zh) * 2017-03-31 2017-07-28 山东超越数控电子有限公司 一种基于国产tcm的可信计算单元及其运行方法
CN108600178A (zh) * 2018-03-28 2018-09-28 深圳市银之杰科技股份有限公司 一种征信数据的安全保障方法及系统、征信平台
CN108810018A (zh) * 2018-07-12 2018-11-13 南方电网科学研究院有限责任公司 一种移动应用检测云平台

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060191007A1 (en) * 2005-02-24 2006-08-24 Sanjiva Thielamay Security force automation
US20140137115A1 (en) * 2012-08-20 2014-05-15 Bitdefender IPR Management Ltd. Secure Communication Using a Trusted Virtual Machine
CN104268254A (zh) * 2014-10-09 2015-01-07 浪潮电子信息产业股份有限公司 一种安全态势分析统计方法
CN104796290A (zh) * 2015-04-24 2015-07-22 广东电网有限责任公司信息中心 一种数据安全管控方法及平台
CN109376542A (zh) * 2018-09-30 2019-02-22 苏州浪潮智能软件有限公司 一种用于嵌入式金融终端的安全加固系统方案

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117395033A (zh) * 2023-09-22 2024-01-12 广州尚全信息技术有限公司 一种数据安全监管方法及系统
CN117395033B (zh) * 2023-09-22 2024-05-03 广州尚全信息技术有限公司 一种数据安全监管方法及系统

Also Published As

Publication number Publication date
CN111814157B (zh) 2022-12-27
CN111814157A (zh) 2020-10-23

Similar Documents

Publication Publication Date Title
Mofrad et al. A comparison study of intel SGX and AMD memory encryption technology
CN109858265B (zh) 一种加密方法、装置及相关设备
EP2913956B1 (en) Management control method and device for virtual machines
JP6484255B2 (ja) 信頼実行環境を含むホストのアテステーション
TWI570589B (zh) 用以提供受信任計算之裝置
US7313705B2 (en) Implementation of a secure computing environment by using a secure bootloader, shadow memory, and protected memory
CN108055133B (zh) 一种基于区块链技术的密钥安全签名方法
EP2583410B1 (en) Single-use authentication methods for accessing encrypted data
KR101067399B1 (ko) 대칭 키 암호화에 기초한 데이터의 저장 및 검색을 위한, 컴퓨팅 장치에서 구현되는 방법, 시스템 및 복수의 명령어를 저장하는 하나 이상의 컴퓨터 판독가능 매체
US11841806B1 (en) System, apparatus and method for integrity protecting tenant workloads in a multi-tenant computing environment
Strackx et al. Efficient isolation of trusted subsystems in embedded systems
KR100996784B1 (ko) 공개 키 암호화에 기초한 데이터의 저장 및 검색을 위한, 컴퓨팅 장치에서 구현되는 방법, 시스템 및 복수의 명령어를 저장하는 하나 이상의 컴퓨터 판독가능 매체
US9424430B2 (en) Method and system for defending security application in a user's computer
KR101176646B1 (ko) 상태 검증을 사용하는 보호된 오퍼레이팅 시스템 부팅을 위한 시스템 및 방법
US20170359333A1 (en) Context based switching to a secure operating system environment
WO2019104988A1 (zh) Plc的安全处理单元及其总线仲裁方法
CN105447406A (zh) 一种用于访问存储空间的方法与装置
WO2021164166A1 (zh) 一种业务数据保护方法、装置、设备及可读存储介质
US20200026882A1 (en) Methods and systems for activating measurement based on a trusted card
Xia et al. TinMan: Eliminating confidential mobile data exposure with security oriented offloading
WO2014121510A1 (zh) 实现云计算网络防攻击的方法、设备和网络
US10853086B2 (en) Information handling systems and related methods for establishing trust between boot firmware and applications based on user physical presence verification
US10339307B2 (en) Intrusion detection system in a device comprising a first operating system and a second operating system
CN110245495B (zh) Bios校验方法、配置方法、设备及系统
Kourai et al. Secure offloading of legacy IDSes using remote VM introspection in semi-trusted clouds

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20788274

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20788274

Country of ref document: EP

Kind code of ref document: A1