WO2020207343A1 - 计算处理方法、系统、设备、存储器、处理器及计算机设备 - Google Patents

计算处理方法、系统、设备、存储器、处理器及计算机设备 Download PDF

Info

Publication number
WO2020207343A1
WO2020207343A1 PCT/CN2020/083155 CN2020083155W WO2020207343A1 WO 2020207343 A1 WO2020207343 A1 WO 2020207343A1 CN 2020083155 W CN2020083155 W CN 2020083155W WO 2020207343 A1 WO2020207343 A1 WO 2020207343A1
Authority
WO
WIPO (PCT)
Prior art keywords
computing
unit
calculation
security
event
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/083155
Other languages
English (en)
French (fr)
Inventor
付颖芳
肖鹏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Publication of WO2020207343A1 publication Critical patent/WO2020207343A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes

Definitions

  • the present invention relates to the field of secure computing, in particular to a computing processing method, system, equipment, memory, processor and computer equipment.
  • virus-killing and firewall methods are generally adopted to defend against the virus's own characteristics. This lags behind the detection of unknown attacks, and the rate of patching to prevent subsequent attacks is low.
  • the following methods are also used in related technologies to ensure computing security. For example, it may monitor memory data through a trusted chip, or execute on a central processing unit (Center Processor Unit, referred to as CPU). Commands or memory data are monitored, but this type of method of monitoring computing security relies on the detection of memory, which is not conducive to protecting user privacy, and it also consumes a lot of computing performance of computing equipment.
  • CPU Central Processing Unit
  • the embodiments of the present invention provide a computing processing method, system, equipment, memory, processor, and computer equipment to at least solve the problem that in related technologies, in order to ensure computing security, there is a dependency on memory, which exposes user privacy and consumes computing performance. Excessive technical problem.
  • a calculation processing method including: receiving a calculation request; using a calculation security assurance unit to measure whether the calculation unit and the calculation security audit unit are safe, and collect the calculation by the calculation security audit unit.
  • the computing security assurance unit completes the guaranteed computing event element; in the case that the computing security assurance unit measures the computing unit and guarantees the security of the computing unit, the computing unit executes computing processing and passes the computing security
  • the audit unit collects the calculation event elements calculated by the calculation unit; according to the calculation event elements guaranteed by the calculation security guarantee unit and the calculation event elements calculated by the calculation unit, the calculation events are generated by the calculation security audit unit
  • the calculation flow characteristics; the calculation security audit unit audits whether the calculation flow characteristics match the predetermined calculation flow characteristics, and in the case of a match, the calculation security is determined.
  • a computing processing method including: receiving a computing request; in the case that the computing unit and the computing security audit unit are secured by a computing security assurance unit, passing the computing security audit
  • the unit collects the calculation event elements guaranteed by the computing security assurance unit and the computing event elements calculated by the computing unit; the computing event elements guaranteed by the computing security assurance unit, and the computing event elements completed by the computing unit Calculation event element, the calculation flow characteristics of the calculation event are generated by the calculation security audit unit; the calculation security audit unit is used to audit whether the calculation flow characteristics match the predetermined calculation flow characteristics, and in the case of matching, determine the calculation security .
  • a computing processing system including: a first receiving unit, configured to receive a computing request; a computing security assurance unit, configured to measure whether the computing unit and the computing security audit unit are safe;
  • the calculation unit is configured to perform calculation processing when the calculation security assurance unit measures the calculation unit and guarantees the security of the calculation unit;
  • the calculation security audit unit is configured to collect the calculation security assurance The calculation event element guaranteed by the unit and the calculation event element calculated by the calculation unit are collected; and the calculation is generated based on the calculation event element guaranteed by the calculation security guarantee unit and the calculation event element calculated by the calculation unit.
  • the calculation flow characteristics of the event; the calculation security audit unit is also used to audit whether the calculation flow characteristics match the predetermined calculation flow characteristics, and in the case of matching, determine the calculation security.
  • a computing processing device including: a second receiving unit and a computing security auditing unit, wherein the second receiving unit is configured to receive a computing request; the computing security The audit unit is used to collect the computing event elements guaranteed by the computing safety assurance unit and the computing event elements completed by the computing unit under the condition that the computing safety assurance unit guarantees the safety of the computing unit and the computing safety audit unit
  • the computing security audit unit is also used to generate the computing flow characteristics of the computing event based on the computing event elements that the computing security assurance unit completes the guarantee, and the computing event elements that the computing unit completes the calculations; the computing security audit The unit is also used to audit whether the calculation flow characteristics match the predetermined calculation flow characteristics, and in the case of matching, determine the calculation safety.
  • a storage medium stores a program, wherein when the program is run by the processor, the processor is caused to perform any of the foregoing calculation processing method.
  • a processor the processor is used to run a program, wherein when the program is run by the processor, the processor executes any of the above calculations Approach.
  • a computer device including: a memory and a processor, the memory storing a computer program; the processor is configured to execute the computer program stored in the memory, When the computer program is executed by the processor, the processor executes the calculation processing method described in any one of the foregoing.
  • the computing unit and the computing security audit unit are secured by the computing security assurance unit, the computing security audit unit collects the computing event elements guaranteed by the computing security assurance unit, and the computing unit completes the collection.
  • Calculated calculation event element according to the calculation event element guaranteed by the calculation security guarantee unit and the calculation event element calculated by the calculation unit, the calculation flow characteristic of the calculation event is generated by the calculation security audit unit;
  • the computing security auditing unit audits whether the computing flow features match the predetermined computing flow features, and in the case of matching, determines the computing security, achieving the purpose of ensuring computing security without reading user data, thereby achieving the cost-free
  • the technical effect of ensuring computing security and avoiding exposure of user privacy thereby solving the technical problems of related technologies, in order to ensure computing security, dependence on memory, exposure of user privacy, and excessive computing performance.
  • Figure 1 shows a block diagram of the hardware structure of a computer terminal used to implement a computing processing method
  • Fig. 2 is a flowchart of a calculation processing method according to Embodiment 1 of the present invention.
  • FIG. 4 is a schematic diagram of the internal structure and functions of a CPU provided according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of the structure of a CPU internal register according to an embodiment of the present invention.
  • Fig. 6 is a schematic diagram of a computing processing system according to a preferred embodiment of the present invention.
  • FIG. 7 is a flowchart of a calculation processing method according to a preferred embodiment of the present invention.
  • Fig. 8 is a structural block diagram of a computing processing system according to an embodiment of the present invention.
  • Figure 9 is a structural block diagram of a computing processing device according to an embodiment of the present invention.
  • Fig. 10 is a structural block diagram of a computer terminal according to an embodiment of the present invention.
  • Calculation flow In a computer, a series of instruction sets complete a certain calculation event. These sets of instructions that complete a certain calculation event and execute in a certain time sequence are called calculation flows.
  • the temporal and spatial characteristics of the computational flow are called computational flow characteristics.
  • the temporal and spatial characteristics of the computational flow may include: instruction execution sequence characteristics, instruction execution time point characteristics, characteristics of electromagnetic signals during instruction execution, memory space sequence accessed during instruction execution, access frequency domain, etc. and instructions Features related to execution.
  • Computational flow feature matching After a certain computational event is completed, if its computational flow feature is consistent with the expected computational flow feature, it is considered that the computational flow feature matches.
  • Computational security refers to the execution environment of the program during the execution of the program, as well as the sequence and spatial characteristics of the instruction set during the calculation process are all expected.
  • Trusted Computing is a trusted computing platform supported by hardware security modules that is widely used in computing and communication systems to improve the overall security of the system.
  • Trusted Platform Module Trusted Platform Module
  • TPM Trusted Platform Module
  • TPCM Trusted Platform Control Module
  • TPM/TPCM A security chip that provides integrity and authenticity protection for evidence, and is generally strengthened by physical means Bind to the computing platform.
  • Credibility measurement at certain specific moments, measure the target to obtain some information of the target (such as the hash value of the file), and compare the value of this information with the pre-recorded standard value to determine the target's Whether the integrity has been destroyed.
  • Firmware refers to the program stored in the hardware that cannot be easily changed, and also refers to the basic hardware where some of the above programs are located.
  • a method embodiment of a calculation processing method is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and Although the logical sequence is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than here.
  • Fig. 1 shows a block diagram of the hardware structure of a computer terminal (or mobile device) for implementing a calculation processing method.
  • the computer terminal 10 may include one or more (shown as 102a, 102b, ..., 102n in the figure) processors (the processors may include but are not limited to microprocessors) MCU or programmable logic device FPGA or other processing device), memory 104 for storing data.
  • the computer terminal 10 can also include: transmission module, display, input/output interface (I/O interface), universal serial bus (USB) port (can be included as one of the ports of the I/O interface), network Interface, power supply and/or camera.
  • I/O interface input/output interface
  • USB universal serial bus
  • FIG. 1 is only for illustration, and does not limit the structure of the above electronic device.
  • the computer terminal 10 may also include more or fewer components than those shown in FIG. 1, or have a different configuration from that shown in FIG.
  • the aforementioned one or more processors and/or other data processing circuits may generally be referred to as "data processing circuits" herein.
  • the data processing circuit can be embodied in whole or in part as software, hardware, firmware or any other combination.
  • the data processing circuit may be a single independent processing module, or be fully or partially integrated into any one of the other elements in the computer terminal 10 (or mobile device).
  • the data processing circuit is used as a kind of processor control (for example, selection of a variable resistance terminal path connected to an interface).
  • the memory 104 may be used to store software programs and modules of application software, such as program instructions/data storage devices corresponding to the calculation processing method in the embodiment of the present invention.
  • the processor executes the software programs and modules stored in the memory 104 by running A functional application and data processing, that is, the calculation and processing method of the application program mentioned above.
  • the memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.
  • the memory 104 may further include a memory remotely provided with respect to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
  • the above-mentioned transmission module is used to receive or send data via a network.
  • the above-mentioned specific examples of the network may include a wireless network provided by the communication provider of the computer terminal 10.
  • the transmission module includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet.
  • the transmission module may be a radio frequency (RF) module, which is used to communicate with the Internet in a wireless manner.
  • RF radio frequency
  • the display may be, for example, a touch screen liquid crystal display (LCD), which may enable a user to interact with the user interface of the computer terminal 10 (or mobile device).
  • LCD liquid crystal display
  • the computer terminal (or mobile device) shown in FIG. 1 may include hardware elements (including circuits) and software elements (including computer-readable media stored on a computer). Code), or a combination of hardware and software components.
  • FIG. 1 is only an example of a specific specific example, and is intended to show the types of components that may be present in the above-mentioned computer device (or mobile device).
  • unknown attack detection for trusted computing provides a method: monitor memory addresses and memory data through trusted chips, calculate a result according to the expected calculation steps, and then compare the result with The calculation results of the CPU are compared, and the trustworthy calculation is determined based on the comparison result.
  • many tests rely on the detection of memory, which is not good for protecting the privacy of users, and it consumes a lot of performance on the device.
  • the dynamic memory cannot be completed. measure.
  • FIG. 2 is a flowchart of a calculation processing method according to Embodiment 1 of the present invention, as shown in Fig. 2, the process includes the following steps:
  • Step S202 receiving a calculation request
  • the execution subject of the foregoing steps may be a computer terminal, for example, a user terminal such as a smart phone, a mobile phone, a tablet computer, a notebook computer, and a smart watch.
  • the execution subject of the foregoing steps may also include a separate chip for performing computing functions, for example, it may be a trusted chip for trusted computing, or other computing chips for ensuring computing security.
  • the execution subject of the above steps may also be a network device such as a server used to perform secure computing functions.
  • receiving a calculation request means receiving a request for performing calculation processing on a calculation event.
  • the calculation request can include one calculation event or multiple calculation events.
  • the multiple events can be distinguished by a certain distinguishing identifier, so as to achieve a certain period of time. It can guarantee the computing security of multiple computing events in an orderly manner.
  • Step S204 measure whether the computing unit and the computing security audit unit are safe by computing the security assurance unit, and collect the computing event elements guaranteed by the computing security assurance unit through the computing security audit unit;
  • the security assurance unit measurement calculation unit and the measurement calculation security audit unit may be performed simultaneously, or there may be a time difference. Proceed, not limited here.
  • the measurement of whether the computing unit is safe by calculating the security assurance unit may include the following aspects: on the one hand, the computing environment of the computing unit is measured by the security assurance unit; on the other hand, the computing security The guarantee unit measures whether the calculation application of the calculation unit is safe. On the other hand, the calculation security guarantee unit measures whether the calculation subject of the calculation unit is legal.
  • measuring whether the computing environment of the computing unit is secure by the computing security assurance unit may include: measuring whether the hardware environment platform of the computing unit is secure through the computing security assurance unit, for example, the basic input output system (BIOS) in the computing environment can be measured, and others
  • the specific hardware firmware, operating system loader (OS Loader), and the integrity of the OS kernel platform and the system are to measure whether the objects in the computing environment are complete and whether they have been tampered with.
  • the measurement can be performed based on the standard value stored by the trusted platform, so as to ensure the credibility of the measurement.
  • the computing security assurance unit measures whether the computing application program of the computing unit is safe, it may include: the integrity of the computing application itself.
  • the calculation can be a CPU or a computing card
  • the calculation of the security assurance unit to measure whether the calculation body of the computing unit is legal can include: measuring the CPU performing the calculation to determine whether it is legal; measuring the computing card that performs the calculation to determine Whether it is legal.
  • the computing card referred to here is a card with computing capability, which can include multiple types, for example, it can be Field-Programmabele Gate Arrary (FPGA for short), graphics processor (Graphics Processing Unit, referred to as GPU), and encryption cards, etc.
  • the following aspects may be included: On the one hand, calculating whether the integrity of the security audit unit is compromised by calculating the security assurance unit metric, including the measurement Calculate whether the integrity of the hardware and software of the security audit unit has been tampered with; on the other hand, calculate whether the security audit unit is legal by calculating the security assurance unit, including measuring the legality of the hardware and software of the calculation security audit unit. Only if the above-mentioned measurement of the aforementioned computing security audit unit is complete and legal, it can be determined that the computing security audit unit is credible and is computationally secure.
  • the computing security assurance unit after the computing security assurance unit measures the computing unit and the computing security auditing unit, there may be results that are credible or untrustworthy. When the credibility measurement result is credible, it is determined that the computing security guarantee unit is safe for the computing unit and the computing security audit unit. In the case that the computing security assurance unit guarantees the computing unit and the computing security audit unit are safe, the computing security audit unit collects the computing event elements guaranteed by the computing security assurance unit and uses them for subsequent audits of the computing security assurance unit. That is, in this optional embodiment, the computing security assurance unit measures the computing security audit unit to ensure the computing security of the computing security audit unit; conversely, the computing security audit unit also completes the guaranteed computing event elements of the computing security assurance unit Auditing, the two restrict each other and improve the overall security of computing.
  • Step S206 in the case of calculating the security assurance unit metric calculation unit and ensuring the security of the calculation unit, perform calculation processing by the calculation unit, and collect the calculation event elements calculated by the calculation unit through the calculation security audit unit;
  • the computing unit performs computing processing when the computing security guarantee unit guarantees safety. That is, when the computing security guarantee unit guarantees that the computing security itself is safe, the computing unit is started to perform computing processing, which provides a prerequisite for computing security.
  • the computing security audit unit collects the computing event elements calculated by the computing unit, and the computing security audit unit audits the collected computing event elements calculated by the computing unit to realize the calculation after the calculation is completed. Results of the audit. Through the foregoing calculation security guarantee before calculation and the security guarantee of the result after calculation, the overall calculation security of the calculation unit is realized.
  • Step S208 according to the calculation event element guaranteed by the calculation security assurance unit and the calculation event element calculated by the calculation unit, the calculation flow characteristics of the calculation event are generated by the calculation security audit unit;
  • the computing event elements guaranteed by the computing security assurance unit and the computing event elements computed by the computing unit when generating the computing flow characteristics of the computing event through the computing security audit unit, multiple methods can be used Generate the calculation flow characteristics of the calculation event.
  • a statistical method is provided to generate the calculation flow characteristics of the calculation event. That is, the statistics of the spatio-temporal characteristics of the instructions in the instruction set corresponding to the calculation events, for example, include the characteristics of the order of instruction execution, the characteristics of the time point of the instruction, the characteristics of the electromagnetic signal during the execution of the instruction, and the statistics of the time when the instruction is executed. The order of the accessed memory space, the access frequency domain and other features related to the execution of the instruction are counted.
  • Step S210 Audit whether the calculation flow characteristics match the predetermined calculation flow characteristics by the calculation security audit unit, and in the case of matching, determine the calculation security.
  • the foregoing predetermined calculation flow feature used to match the generated calculation flow feature may be obtained in multiple ways.
  • the predetermined calculation flow feature may be obtained from a calculation flow feature library, where the calculation flow
  • the computational flow features in the feature library are generated by machine learning. That is, the computing flow features in the computing flow feature library are standard and credible.
  • the computational flow features in the computational flow feature library can also be continuously modified through machine learning.
  • the source data used to modify the sample may be credible historical data that is continuously accumulated, for example, it may be a computational flow feature that has been confirmed by a credible platform and belongs to computational security.
  • the security of the computing unit and the computing security audit unit are guaranteed by the computing security assurance unit, the computing event elements that the computing security assurance unit completes the guarantee are collected by the computing security audit unit, and the computing calculation unit is completed by the collection computing unit.
  • Event element according to the calculation event element guaranteed by the calculation security assurance unit and the calculation event element calculated by the calculation unit, the calculation flow characteristics of the calculation event are generated by the calculation security audit unit; the calculation flow characteristics and scheduled calculations are audited by the calculation security audit unit Whether the flow features match, and in the case of matching, determine the security of the calculation, achieve the purpose of ensuring the security of the calculation without reading user data, thereby ensuring the security of the calculation without consuming large calculation performance, and avoiding the exposure of users
  • the technical effect of privacy solves the technical problems of reliance on memory in order to ensure computing security in related technologies, exposing user privacy, and consuming excessive computing performance.
  • the computing control unit is used to monitor computing events, and when the computing security assurance unit and/or the computing security audit unit are abnormal, the computing unit is controlled to restrict or prohibit the calculation execution. That is, the computing control unit monitors the abnormal conditions of the computing security assurance unit and/or the computing security audit unit, and when an abnormality is monitored, the computing unit is controlled to perform restricted calculations or prohibit the calculations in time. By controlling the computing process in time, the protection of computing resources is effectively realized and the computing efficiency is improved.
  • calculation event element guaranteed by the computing security guarantee unit and/or the calculation event element calculated by the computing unit may include: non-user data elements.
  • the non-user data element may include: any instruction executed by the calculation, execution time, memory address, electromagnetic signal for executing the calculation, and so on.
  • the above-listed elements of non-user data are only an example and are not limited thereto.
  • the foregoing computing security assurance unit, computing security auditing unit, computing unit, computing control unit, and memory can implement its functions in any form, for example, the foregoing computing security assurance unit, computing security auditing unit, computing unit , At least two of the computing control unit and the memory are integrated in one chip.
  • the computing unit can be implemented in memory; the computing control unit can be integrated with the computing unit, or the computing security assurance unit, or the computing security audit unit in a chip; the computing security assurance unit, computing security audit unit, and computing control unit Integration and so on.
  • FIG. 3 is another flowchart of the calculation processing method according to Embodiment 1 of the present invention, as shown in Fig. 3.
  • the process includes the following steps:
  • Step S302 receiving a calculation request
  • Step S304 in the case that the computing unit and the computing security audit unit are secured by the computing security assurance unit, the computing security audit unit collects the computing event elements guaranteed by the computing security assurance unit, and collects the computing event elements computed by the computing unit;
  • Step S306 according to the calculation event elements that the calculation security guarantee unit completes the guarantee, and the calculation event elements that the calculation unit completes the calculation, generate the calculation flow characteristics of the calculation event through the calculation security audit unit;
  • step S308 the computing security audit unit is used to audit whether the computing flow feature matches the predetermined computing flow feature, and in the case of matching, the computing security is determined.
  • the execution subject of the above steps may be a computing security audit unit, which may be a separate chip for performing computing functions, for example, it may be a trusted computing device.
  • the letter chip can also be integrated into other computing chips used to ensure computing security. It can also be used to integrate network devices such as servers that perform secure computing functions.
  • the computing security audit unit may be used to determine the computing security assurance unit to measure the computing security audit unit and/or computing unit Is the measurement entity of the security safe? Since the measurement is executed in the CPU or in the card, it is necessary to ensure the integrity of the measurement code and the measurement algorithm that execute the measurement, the legitimacy of the measurement subject, and the security of the measurement space.
  • the security of the measurement entity that the computing security assurance unit performs the measurement can be determined first.
  • the computing security audit unit before the computing security is determined by the computing security audit unit to audit whether the computing flow features match the predetermined computing flow features, and in the case of matching, it further includes: The predetermined computational flow feature is acquired from the feature library, where the computational flow feature in the computational flow feature library is generated by means of machine learning.
  • the computational flow features in the computational flow feature library are generated by means of machine learning. That is, the computing flow features in the computing flow feature library are standard and credible.
  • the computational flow features in the computational flow feature library can also be continuously modified through machine learning.
  • the source data used to modify the sample may be credible historical data that is continuously accumulated, for example, it may be a computational flow feature that has been confirmed by a credible platform and belongs to computational security.
  • the computing event element guaranteed by the computing security assurance unit and/or the computing event element computed by the computing unit includes: non-user data elements.
  • the non-user data element may include: any instruction executed by the calculation, execution time, memory address, electromagnetic signal for executing the calculation, and so on.
  • the above-listed elements of non-user data are only an example and are not limited thereto.
  • the computing architecture system mainly includes two components: a computing unit and a memory, that is, computing events are mainly completed through these two components.
  • the calculation unit is the core component of the communication device. Most calculations are run through the calculation unit.
  • FIG. 4 is a schematic diagram of the internal structure and functions of the CPU provided according to an embodiment of the present invention. As shown in FIG. 4, the CPU The main structure includes: clock, register, controller and arithmetic unit.
  • the clock is mainly used to send out the clock signal when the CPU starts timing; and the higher the frequency of the clock signal, the faster the running speed of the CPU; registers are available
  • the memory can also be regarded as a kind of register;
  • the controller is mainly used to read the instructions and data in the memory into the register (that is, other registers except the memory) ;
  • the arithmetic unit is mainly used to calculate the data read into the register from the memory.
  • FIG. 5 is a schematic diagram of the structure of the CPU internal registers provided according to an embodiment of the present invention.
  • the CPU internal registers may include the following types: Accumulation registers, identification registers, program registers, instruction registers, stack registers, base address registers, index registers and general registers. Among them, there can be one accumulation register, identification register, program register, instruction register, and stack register; there can be multiple base address registers, index registers and general registers. A brief description of each type of register is given below.
  • the accumulating register is mainly used to store the data of the operator and the data after the operation;
  • the identification register is mainly used to store the state of the CPU after the operation processing;
  • the program register is mainly used to store the address of the memory where the next instruction is located;
  • the instruction register Mainly used to store instructions, used internally by the CPU, programmers generally cannot read and write this register through the program; stack registers, mainly used to store the starting address of the stack area; base address registers, mainly used to store memory
  • the index register is mainly used to store the relative address of the base address register, and the general-purpose register is mainly used to store arbitrary data.
  • FIG. 6 is a schematic diagram of the computing processing system provided according to the preferred embodiment of the present invention. As shown in FIG. 6, it mainly includes: a computing unit , Computing security assurance unit, computing security audit unit, computing control unit, memory five parts. among them:
  • Calculation unit used to complete calculation function
  • the computing security audit unit is used to audit whether the computing unit or the computing security guarantee unit meets expectations during the application calculation and guarantee calculation.
  • the computing security audit unit has the ability to obtain calculation-related data in non-user data, such as: calculation Any instructions executed, execution time, memory address, etc.;
  • the computing security assurance unit is used to ensure the security of the computing execution environment, such as the basic input output system (Base Input Output System, referred to as BIOS), other hardware firmware, operating system loader (Operation System Loader, referred to as OS Loader), The integrity of the OS kernel platform and system, the integrity of the computing application itself, and the security of the computing security audit unit, such as the integrity and legality of the firmware;
  • BIOS Basic Input Output System
  • OS Loader operating system loader
  • the calculation control unit is used to manage and control calculation control, where the calculation control unit is used to trigger the calculation control unit to control restricted execution or prohibit execution when an abnormality is detected by the calculation security assurance unit or the calculation security audit unit;
  • Memory is used to store some data and addresses related to the computing unit.
  • the computing unit can also be implemented in memory; the computing control unit can be combined with the computing unit, or computing security assurance unit, or computing security audit The unit is integrated in a chip; the computing security assurance unit is integrated with the computing security audit unit, the computing control unit, and so on. That is, the above five parts can be flexibly combined for integration according to needs.
  • FIG. 7 is a flowchart of the calculation processing method provided according to the preferred embodiment of the present invention. As shown in Figure 7, the calculation processing method includes the following steps:
  • Step S702 business computing application request
  • Step S704 Calculate whether the security assurance unit metric calculation unit and the calculation security audit unit are intact and not tampered with, and determine whether they are legal;
  • Step S704' during the measurement calculation process of the measurement calculation unit and the calculation security audit unit of the calculation security assurance unit, the calculation security audit unit will also collect the corresponding calculation event elements executed by the calculation security assurance unit during the measurement process, and enter Step S712;
  • Step S706 in the case that the calculation security assurance unit metric calculation unit and the calculation security audit unit are both legal, perform step S708, otherwise go to step S718;
  • Step S708 start the calculation unit to perform calculation
  • step S710 the computing security audit unit collects related elements of a computing event completed by the computing unit, such as instructions, instruction time, memory address, electromagnetic signals for performing calculations, and other non-user data related elements;
  • step S712 a statistical method can be used according to the collected data to form and complete such calculation flow characteristics
  • Step S714 Compare the obtained computational flow feature with the samples in the computational flow feature library (assuming that the system already has a computational flow feature library, and the samples in the computational flow feature library can be automatically corrected in combination with machine learning) to see if it is If it matches, go to step S716, otherwise go to step S718;
  • Step S720 the calculation result is safely output.
  • the computing security assurance unit and the computing security audit unit are introduced into the calculation process, so that the two and the calculation control unit in the traditional computing structure form a "three-power separation" to avoid single-point risks;
  • the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases the former is Better implementation.
  • the technical solution of the present invention essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, The optical disc) includes several instructions to make a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) execute the method of each embodiment of the present invention.
  • FIG. 8 is a structural block diagram of the computing processing system according to an embodiment of the present invention.
  • the computing processing system 80 It includes: a first receiving unit 82, a computing security guarantee unit 84, a computing unit 86, and a computing security auditing unit 88.
  • the computing processing system will be described below.
  • the first receiving unit 82 is used to receive the calculation request; the calculation security assurance unit 84 is connected to the first receiving unit 82 and is used to measure whether the calculation unit and the calculation security audit unit are secure; the calculation unit 86 is connected to the foregoing calculation security assurance unit 84 is connected to the computing security audit unit 88, and is used to perform calculation processing when the security assurance unit measures the computing unit and guarantees the security of the computing unit; the computing security audit unit 88 is connected to the foregoing computing security assurance unit 84 and computing unit 86 Connection is used to collect the calculation event elements guaranteed by the computing security assurance unit, and the calculation event elements completed by the calculation calculation unit; and according to the calculation event elements guaranteed by the computing security assurance unit, and the calculation event elements completed by the computing unit, Generate the calculation flow characteristics of the calculation event; the calculation security audit unit 88 is also used to audit whether the calculation flow characteristics match the predetermined calculation flow characteristics, and in the case of matching, determine the calculation security.
  • first receiving unit 82 computing security assurance unit 84, computing unit 86, and computing security audit unit 88 correspond to steps S202 to S208 in Embodiment 1.
  • the two modules and the corresponding steps The implementation examples and application scenarios are the same, but are not limited to the content disclosed in the first embodiment. It should be noted that, as a part of the device, the above-mentioned modules can run in the computer terminal 10 provided in the first embodiment.
  • FIG. 9 is a structural block diagram of a computing processing device according to an embodiment of the present invention. As shown in FIG. 9, the computing processing device 90 It includes: a second receiving unit 92 and a computing security auditing unit 88. The computing processing device will be described below.
  • the second receiving unit 92 is configured to receive calculation requests; the computing security audit unit 88 is connected to the above-mentioned second receiving unit 92, and is configured to collect and calculate when the computing unit and the computing security audit unit are secured by the computing security assurance unit.
  • the element generates the calculation flow characteristics of the calculation event; the calculation security audit unit 88 is also used to audit whether the calculation flow characteristics match the predetermined calculation flow characteristics, and in the case of matching, determine the calculation security.
  • the embodiments of the present invention may provide a computer device (or called a computer terminal), and the computer terminal may be any computer terminal device in a computer terminal group.
  • the above-mentioned computer terminal may also be replaced with a terminal device such as a mobile terminal.
  • the foregoing computer terminal may be located in at least one network device among multiple network devices in the computer network.
  • FIG. 10 is a structural block diagram of a computer terminal according to an embodiment of the present invention.
  • the computer terminal 100 may include: one or more (only one is shown in the figure) processor 102, memory 104, and peripheral interfaces for communicating through a radio frequency module, an audio module or a display screen.
  • the memory 104 can be used to store software programs and modules, such as program instructions/modules corresponding to the security vulnerability detection method and device in the embodiment of the present invention.
  • the processor executes various software programs and modules by running the software programs and modules stored in the memory. Functional application and data processing, that is, the detection method for the aforementioned system vulnerability attacks.
  • the memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memories.
  • the memory may further include a memory remotely provided with respect to the processor, and these remote memories may be connected to the computer terminal 100 via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
  • the processor 102 can call the information and application programs stored in the memory through the transmission device to execute the program code of the following steps: receive a calculation request; measure whether the calculation unit and the calculation security audit unit are safe through the calculation security assurance unit, and pass the calculation security audit The unit collects and calculates the calculation event elements guaranteed by the security assurance unit; when the security assurance unit measures the calculation unit and guarantees the security of the calculation unit, the calculation processing is performed by the calculation unit and the calculation is completed by the calculation security audit unit.
  • Calculation event element according to the calculation event element guaranteed by the calculation security assurance unit and the calculation event element completed by the calculation unit, the calculation flow characteristics of the calculation event are generated by the calculation security audit unit; the calculation flow characteristics and reservations are audited by the calculation security audit unit Whether the calculation flow characteristics match, and in the case of matching, determine the calculation safety.
  • the above-mentioned processor may also execute the program code of the following steps: monitor computing events through the computing control unit, and control the computing unit to perform restricted computing when the computing security assurance unit and/or computing security audit unit are abnormal Or prohibit calculation execution.
  • the above-mentioned processor may also execute the program code of the following steps: measuring whether the calculation unit is safe by calculating the safety guarantee unit includes: measuring whether the computing environment of the calculation unit is safe by calculating the safety guarantee unit; measuring the calculation unit by calculating the safety guarantee unit Whether the computing application program is safe; through the computing security assurance unit to measure whether the computing body of the computing unit is legal.
  • the foregoing processor may also execute the program code of the following steps: calculating whether the security audit unit is safe by calculating the security assurance unit measurement includes: calculating whether the integrity of the security audit unit is destroyed by calculating the security assurance unit measurement; The assurance unit measures whether the calculation security audit unit is legal.
  • the foregoing processor may also execute the program code of the following steps: the predetermined calculation flow feature is obtained from a calculation flow feature library, wherein the calculation flow feature in the calculation flow feature library is generated by means of machine learning.
  • the above-mentioned processor may also execute the program code of the following steps: the calculation event element guaranteed by the calculation security guarantee unit and/or the calculation event element calculated by the calculation unit includes: non-user data elements.
  • the above-mentioned processor may also execute the program code of the following steps: at least two of the computing security assurance unit, the computing security audit unit, the computing unit, the computing control unit and the memory are integrated into one chip.
  • the above-mentioned computer terminal can execute the program code of the following steps in the calculation processing method of the application program: receive the calculation request; in the case of ensuring the security of the calculation unit and the calculation security audit unit by the calculation security assurance unit, pass the calculation security
  • the audit unit collects the calculation event elements guaranteed by the calculation security assurance unit and the calculation event elements completed by the calculation calculation unit; the calculation event elements guaranteed by the calculation security assurance unit and the calculation event elements completed by the calculation unit are calculated by the calculation security
  • the audit unit generates the calculation flow characteristics of the calculation event; the calculation security audit unit audits whether the calculation flow characteristics match the predetermined calculation flow characteristics, and in the case of matching, determines the calculation security.
  • the above-mentioned processor may also execute the program code of the following steps: determining, by the computing security audit unit, whether the computing security assurance unit measures the computing security audit unit and/or the measurement entity measured by the computing unit is safe.
  • the above-mentioned processor may also execute the program code of the following steps: after the computing security audit unit audits whether the computing flow feature matches the predetermined computing flow feature, and in the case of matching, before determining the computing security, it also includes: passing The computing security audit unit obtains predetermined computing flow features from the computing flow feature library, where the computing flow features in the computing flow feature library are generated by means of machine learning.
  • the above-mentioned processor may also execute the program code of the following steps: the calculation event element guaranteed by the calculation security guarantee unit and/or the calculation event element calculated by the calculation unit includes: non-user data elements.
  • a calculation processing solution is provided. Ensure the safety of the computing unit and the computing security audit unit through the computing security assurance unit, collect the computing event elements guaranteed by the computing security assurance unit through the computing security audit unit, and collect computing event elements completed by the computing unit; complete the assurance according to the computing security assurance unit
  • the calculation event element of the calculation event element, and the calculation event element that the calculation unit completes the calculation, the calculation flow feature of the calculation event is generated by the calculation security audit unit; the calculation security audit unit is used to audit whether the calculation flow feature matches the predetermined calculation flow feature, and the situation is matched
  • determine the computing security achieve the purpose of ensuring computing security without reading user data, thus achieving the technical effect of ensuring computing security without consuming large computing performance, and avoiding exposure of user privacy, thereby solving the related problems.
  • In technology in order to ensure computing security, there are technical problems that rely on memory, expose user privacy, and consume excessive computing performance.
  • the structure shown in Figure 10 is only for illustration, and the computer terminal can also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, an applause computer, and a mobile Internet device (MID). ), PAD and other terminal equipment.
  • FIG. 10 does not limit the structure of the above electronic device.
  • the computer terminal 10 may also include more or fewer components (such as a network interface, a display device, etc.) than those shown in FIG. 10, or have a configuration different from that shown in FIG.
  • the program can be stored in a computer-readable storage medium, which can be Including: flash disk, read-only memory (Read-Only Memory, ROM), random access device (Random Access Memory, RAM), magnetic disk or optical disk, etc.
  • the embodiment of the present invention also provides a storage medium.
  • the foregoing storage medium may be used to store the program code executed by the calculation processing method provided in the foregoing embodiment 1.
  • the foregoing storage medium may be located in any computer terminal in a computer terminal group in a computer network, or located in any mobile terminal in a mobile terminal group.
  • the storage medium is set to store the program code used to perform the following steps: receive a calculation request; measure whether the calculation unit and the calculation security audit unit are safe through the calculation security assurance unit, and pass the calculation security audit
  • the unit collects and calculates the calculation event elements guaranteed by the security assurance unit; when the security assurance unit measures the calculation unit and guarantees the security of the calculation unit, the calculation processing is performed by the calculation unit and the calculation is completed by the calculation security audit unit.
  • Calculation event element according to the calculation event element guaranteed by the calculation security assurance unit and the calculation event element completed by the calculation unit, the calculation flow characteristics of the calculation event are generated by the calculation security audit unit; the calculation flow characteristics and reservations are audited by the calculation security audit unit Whether the calculation flow characteristics match, and in the case of matching, determine the calculation safety.
  • the storage medium is also configured to store program code for executing the following steps: the computing event is monitored by the computing control unit, and it appears in the computing security assurance unit and/or computing security audit unit When abnormal, the control calculation unit restricts or prohibits calculation execution.
  • the storage medium is further configured to store program code for performing the following steps: measuring whether the computing unit is safe by calculating the safety guarantee unit includes: measuring whether the computing environment of the computing unit is Security; through the computing security assurance unit to measure whether the computing application program of the computing unit is safe; through the computing security assurance unit to measure whether the computing body of the computing unit is legal
  • the storage medium is further configured to store the program code for executing the following steps: calculating whether the security audit unit is safe by calculating the security assurance unit measurement includes: calculating the security audit unit by calculating the security assurance unit measurement Whether the integrity of the security audit unit is compromised; whether the security audit unit is legal by calculating the security assurance unit measurement.
  • the storage medium is further configured to store program code for performing the following steps: the predetermined calculation flow feature is obtained from a calculation flow feature library, wherein the calculation flow feature in the calculation flow feature library passes through Generated by machine learning.
  • the storage medium is further configured to store program code for executing the following steps: computing event elements guaranteed by the computing security assurance unit and/or computing event elements completed by the computing unit include: non Elements of user data.
  • the above-mentioned processor may also execute the program code of the following steps: at least two of the computing security assurance unit, the computing security audit unit, the computing unit, the computing control unit and the memory are integrated into one chip.
  • the storage medium is also configured to store program code for performing the following steps: receiving a calculation request; in the case of ensuring the safety of the computing unit and the computing security audit unit through the computing security assurance unit, passing the computing security audit unit Collect the calculation event elements guaranteed by the calculation security assurance unit, and the calculation event elements calculated by the collection calculation unit; according to the calculation event elements guaranteed by the calculation security guarantee unit, and the calculation event elements completed by the calculation unit, pass the calculation security audit unit Generate the calculation flow characteristics of the calculation event; the calculation security audit unit is used to audit whether the calculation flow characteristics match the predetermined calculation flow characteristics, and in the case of matching, the calculation security is determined.
  • the storage medium is further configured to store program code for executing the following steps: the computing security audit unit determines the metric that the computing security assurance unit measures the computing security audit unit and/or the computing unit Is the entity safe?
  • the storage medium is further configured to store program code for performing the following steps: after the computing security audit unit audits whether the computing flow feature matches the predetermined computing flow feature, and in the case of matching Before determining the computing security, the method further includes: obtaining predetermined computing flow features from the computing flow feature library through the computing security audit unit, where the computing flow features in the computing flow feature library are generated by means of machine learning.
  • the storage medium is further configured to store program code for executing the following steps: computing event elements guaranteed by the computing security assurance unit and/or computing event elements completed by the computing unit include: non Elements of user data.
  • the embodiment of the present invention also provides a processor.
  • the processor can be an independent device or a functional module integrated on a predetermined network device, which can be flexibly selected according to needs.
  • the above-mentioned processor may execute the program code of the following steps: receive a calculation request; measure whether the calculation unit and the calculation security audit unit are safe through the calculation security assurance unit, and collect the calculation security assurance unit through the calculation security audit unit to complete the guarantee The calculation event element of the calculation unit; when the calculation security unit measures the calculation unit and guarantees the security of the calculation unit, the calculation unit performs calculation processing, and the calculation security audit unit collects the calculation event elements completed by the calculation unit; according to the calculation security guarantee The calculation event element guaranteed by the unit and the calculation event element calculated by the calculation unit are generated by the calculation security audit unit to generate the calculation flow characteristics of the calculation event; the calculation security audit unit audits whether the calculation flow characteristics match the predetermined calculation flow characteristics, and In the case of a match, the calculation is safe.
  • the above-mentioned processor may also execute the program code of the following steps: monitor computing events through the computing control unit, and control the computing unit to perform restricted computing when the computing security assurance unit and/or computing security audit unit are abnormal Or prohibit calculation execution.
  • the above-mentioned processor may also execute the program code of the following steps: measuring whether the calculation unit is safe by calculating the safety guarantee unit includes: measuring whether the computing environment of the calculation unit is safe by calculating the safety guarantee unit; measuring the calculation unit by calculating the safety guarantee unit Whether the computing application program is safe; through the computing security assurance unit to measure whether the computing body of the computing unit is legal.
  • the foregoing processor may also execute the program code of the following steps: calculating whether the security audit unit is safe by calculating the security assurance unit measurement includes: calculating whether the integrity of the security audit unit is destroyed by calculating the security assurance unit measurement; The assurance unit measures whether the calculation security audit unit is legal.
  • the foregoing processor may also execute the program code of the following steps: the predetermined calculation flow feature is obtained from a calculation flow feature library, wherein the calculation flow feature in the calculation flow feature library is generated by means of machine learning.
  • the above-mentioned processor may also execute the program code of the following steps: the calculation event element guaranteed by the calculation security guarantee unit and/or the calculation event element calculated by the calculation unit includes: non-user data elements.
  • the above-mentioned processor may also execute the program code of the following steps: at least two of the computing security assurance unit, the computing security audit unit, the computing unit, the computing control unit and the memory are integrated into one chip.
  • the above-mentioned processor may execute the program code of the following steps: receiving a calculation request; in the case that the computing unit and the computing security audit unit are secured by the computing security assurance unit, the computing security assurance unit is collected by the computing security audit unit Computational event elements that are guaranteed to be completed, and calculation event elements that are calculated by the collection and calculation unit; calculation event elements that are guaranteed by the calculation security assurance unit, and calculation event elements that are completed by the calculation unit, and the calculation of the calculation event is generated by the calculation security audit unit
  • Flow characteristics The calculation security audit unit is used to audit whether the calculation flow characteristics match the predetermined calculation flow characteristics, and in the case of matching, the calculation security is determined.
  • the above-mentioned processor may also execute the program code of the following steps: determining, by the computing security audit unit, whether the computing security assurance unit measures the computing security audit unit and/or the measurement entity measured by the computing unit is safe.
  • the above-mentioned processor may also execute the program code of the following steps: after the computing security audit unit audits whether the computing flow feature matches the predetermined computing flow feature, and in the case of matching, before determining the computing security, it also includes: passing The computing security audit unit obtains predetermined computing flow features from the computing flow feature library, where the computing flow features in the computing flow feature library are generated by means of machine learning.
  • the above-mentioned processor may also execute the program code of the following steps: the calculation event element guaranteed by the calculation security guarantee unit and/or the calculation event element calculated by the calculation unit includes: non-user data elements.
  • the disclosed technical content can be implemented in other ways.
  • the device embodiments described above are merely illustrative, for example, the division of units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or integrated into Another system, or some features can be ignored, or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of units or modules, and may be in electrical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of the present invention essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention.
  • the aforementioned storage media include: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Mathematical Physics (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种计算处理方法、系统、设备、存储器、处理器及计算机设备。其中，该方法包括：接收计算请求；通过计算安全保障单元度量计算单元和计算安全审计单元是否安全，并通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素；在计算安全保障单元度量计算单元，并保障计算单元安全的情况下，通过计算单元执行计算处理，并通过计算安全审计单元采集计算单元完成计算的计算事件元素；根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征；通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。

Description

计算处理方法、系统、设备、存储器、处理器及计算机设备
本申请要求2019年04月12日递交的申请号为201910295520.2、发明名称为“计算处理方法、系统、设备、存储器、处理器及计算机设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及安全计算领域，具体而言，涉及一种计算处理方法、系统、设备、存储器、处理器及计算机设备。
背景技术
为保证某个计算事件是安全的，需要对于完成这个计算事件时，保证计算的执行环境未被篡改，及计算执行过程中正确的，这是业务面临的一个痛点问题。保证计算主体合法，以实现计算过程由合法主体执行；保证计算的执行环境未被篡改，以防计算过程数据没有被窃听；保证计算步骤、计算参数等计算特征未被篡改，以保证计算结果与预期结果一致。
在相关技术中，为保证计算安全，一般采用杀病毒、防火墙的方式都是根据病毒的自身特征来防御，这对未知的攻击检测滞后，且打补丁防御后续攻击方式率低下。另外，为防御未知攻击，在相关技术中也有采用以下方式来保证计算安全，例如，或者是通过可信芯片对内存数据进行监控，或者通过对中央处理器(Center Processor Unit，简称为CPU)执行指令或内存数据进行监控，但这类监控计算安全的方法，依赖对于内存的检测，不利于保护用户隐私，而且对计算设备的计算性能消耗也大。
因此，在相关技术中，为保证计算安全，存在对内存的依赖，暴露用户隐私以及耗费计算性能过大的问题。
针对上述的问题，目前尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种计算处理方法、系统、设备、存储器、处理器及计算机设备，以至少解决在相关技术中，为保证计算安全，存在对内存的依赖，暴露用户隐私以及耗费计算性能过大的技术问题。
根据本发明实施例的一个方面，提供了一种计算处理方法，包括：接收计算请求；通 过计算安全保障单元度量计算单元和计算安全审计单元是否安全，并通过所述计算安全审计单元采集所述计算安全保障单元完成保障的计算事件元素；在所述计算安全保障单元度量所述计算单元，并保障所述计算单元安全的情况下，通过所述计算单元执行计算处理，并通过所述计算安全审计单元采集所述计算单元完成计算的计算事件元素；根据所述计算安全保障单元完成保障的计算事件元素，以及所述计算单元完成计算的计算事件元素，通过所述计算安全审计单元生成计算事件的计算流特征；通过所述计算安全审计单元审计所述计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
根据本发明实施例的另一方面，还提供了一种计算处理方法，包括：接收计算请求；在通过计算安全保障单元保障计算单元和计算安全审计单元安全的情况下，通过所述计算安全审计单元采集所述计算安全保障单元完成保障的计算事件元素，以及采集所述计算单元完成计算的计算事件元素；根据所述计算安全保障单元完成保障的计算事件元素，以及所述计算单元完成计算的计算事件元素，通过所述计算安全审计单元生成计算事件的计算流特征；通过所述计算安全审计单元审计所述计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
根据本发明实施例的另一方面，还提供了一种计算处理系统，包括：第一接收单元，用于接收计算请求；计算安全保障单元，用于度量计算单元和计算安全审计单元是否安全；所述计算单元，用于在所述计算安全保障单元度量所述计算单元，并保障所述计算单元安全的情况下，执行计算处理；所述计算安全审计单元，用于采集所述计算安全保障单元完成保障的计算事件元素，以及采集所述计算单元完成计算的计算事件元素；并根据所述计算安全保障单元完成保障的计算事件元素，以及所述计算单元完成计算的计算事件元素，生成计算事件的计算流特征；所述计算安全审计单元，还用于审计所述计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
根据本发明实施例的另一方面，还提供了一种计算处理设备，包括：第二接收单元和计算安全审计单元，其中，所述第二接收单元，用于接收计算请求；所述计算安全审计单元，用于在通过计算安全保障单元保障计算单元和计算安全审计单元安全的情况下，采集所述计算安全保障单元完成保障的计算事件元素，以及采集所述计算单元完成计算的计算事件元素；所述计算安全审计单元，还用于根据所述计算安全保障单元完成保障的计算事件元素，以及所述计算单元完成计算的计算事件元素，生成计算事件的计算流特征；所述计算安全审计单元，还用于审计所述计算流特征与预定计算流特征是否匹配， 并在匹配的情况下，确定计算安全。
根据本发明实施例的另一方面，还提供了一种存储介质，所述存储介质存储有程序，其中，在所述程序被处理器运行时使得处理器执行上述任意一项所述的计算处理方法。
根据本发明实施例的另一方面，还提供了一种处理器，所述处理器用于运行程序，其中，所述程序被处理器运行时使得所述处理器执行上述任意一项所述的计算处理方法。
根据本发明实施例的另一方面，还提供了一种计算机设备，包括：存储器和处理器，所述存储器存储有计算机程序；所述处理器，用于执行所述存储器中存储的计算机程序，所述计算机程序被所述处理器运行时使得所述处理器执行上述任意一项所述的计算处理方法。
在本发明实施例中，通过计算安全保障单元保障计算单元和计算安全审计单元安全,通过所述计算安全审计单元采集所述计算安全保障单元完成保障的计算事件元素，以及采集所述计算单元完成计算的计算事件元素；根据所述计算安全保障单元完成保障的计算事件元素，以及所述计算单元完成计算的计算事件元素，通过所述计算安全审计单元生成计算事件的计算流特征；通过所述计算安全审计单元审计所述计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全，达到了不用读取用户数据保证计算安全的目的，从而实现了在不耗费较大计算性能的情况下保证计算安全，以及避免暴露用户隐私的技术效果，进而解决了在相关技术中，为保证计算安全，存在对内存的依赖，暴露用户隐私以及耗费计算性能过大的技术问题。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1示出了一种用于实现计算处理方法的计算机终端的硬件结构框图；
图2是根据本发明实施例1的计算处理方法的流程图；
图3是根据本发明实施例1的计算处理方法的另一流程图；
图4是根据本发明实施例提供的CPU的内部结构及功能示意图；
图5是根据本发明实施例提供的CPU内部寄存器的结构示意图；
图6是根据本发明优选实施方式提供的计算处理系统的示意图；
图7是根据本发明优选实施方式提供的计算处理方法的流程图；
图8是根据本发明实施例的计算处理系统的结构框图；
图9是根据本发明实施例的计算处理设备的结构框图；
图10是根据本发明实施例的一种计算机终端的结构框图。
具体实施方式
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
首先，在对本申请实施例进行描述的过程中出现的部分名词或术语适用于如下解释：
计算流：在计算机中，由一串指令集来完成某个计算事件，这些完成某个计算事件，按一定时序执行的指令集称为计算流。
计算流特征：完成某个计算事件，计算流所表现的时空特征称为计算流特征。其中，计算流所表现的时空特征可以包括：指令执行顺序特征，指令执行时间点特征、指令执行时电磁信号所表现的特征，指令执行时所访问的内存空间顺序，访问频域等等与指令执行时相关的特征。
计算流特征匹配：完成某个计算事件，如果其计算流特征与预期的计算流特征一致，就认为计算流特征匹配。
计算安全：是指程序执行过程中，程序的执行环境，以及计算过程中的指令集时序、空间上的特征均是预期的。
可信计算：可信计算(Trusted Computing，简称为TC)是在计算和通信系统中广泛使用基于硬件安全模块支持下的可信计算平台，以提高系统整体的安全性。
可信平台模块(Trusted Platform Module，TPM)/可信平台控制模块(Trusted Platform  Control Module，TPCM)(TPM/TPCM)：为证据提供完整性和真实性保障的安全芯片，一般通过物理方式被强绑定到计算平台。
可信度量：在某些特定的时刻，对目标进行度量，得到目标的某些信息(比如对文件的散列值)，将这些信息的值与事先记录的标准值进行比较，从而判断目标的完整性是否被破坏。
固件：是指存储在硬件中不能够被轻易更改的程序，也泛指一些上述程序所在的基础硬件。
实施例1
根据本发明实施例，还提供了一种计算处理方法的方法实施例，需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
本申请实施例一所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。图1示出了一种用于实现计算处理方法的计算机终端(或移动设备)的硬件结构框图。如图1所示，计算机终端10(或移动设备10)可以包括一个或多个(图中采用102a、102b，……，102n来示出)处理器(处理器可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器104。除此以外，还可以包括：传输模块、显示器、输入/输出接口(I/O接口)、通用串行总线(USB)端口(可以作为I/O接口的端口中的一个端口被包括)、网络接口、电源和/或相机。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，计算机终端10还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
应当注意到的是上述一个或多个处理器和/或其他数据处理电路在本文中通常可以被称为“数据处理电路”。该数据处理电路可以全部或部分的体现为软件、硬件、固件或其他任意组合。此外，数据处理电路可为单个独立的处理模块，或全部或部分的结合到计算机终端10(或移动设备)中的其他元件中的任意一个内。如本申请实施例中所涉及到的，该数据处理电路作为一种处理器控制(例如与接口连接的可变电阻终端路径的选择)。
存储器104可用于存储应用软件的软件程序以及模块，如本发明实施例中的计算处理方法对应的程序指令/数据存储装置，处理器通过运行存储在存储器104内的软件程序 以及模块，从而执行各种功能应用以及数据处理，即实现上述的应用程序的计算处理方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至计算机终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
上述传输模块用于经由一个网络接收或者发送数据。上述的网络具体实例可包括计算机终端10的通信供应商提供的无线网络。在一个实例中，传输模块包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输模块可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
显示器可以例如触摸屏式的液晶显示器(LCD)，该液晶显示器可使得用户能够与计算机终端10(或移动设备)的用户界面进行交互。
此处需要说明的是，在一些可选实施例中，上述图1所示的计算机终端(或移动设备)可以包括硬件元件(包括电路)、软件元件(包括存储在计算机可读介质上的计算机代码)、或硬件元件和软件元件两者的结合。应当指出的是，图1仅为特定具体实例的一个实例，并且旨在示出可存在于上述计算机设备(或移动设备)中的部件的类型。
基于上述对相关技术说明，在相关技术中，针对可信计算的未知攻击检测提供了一种方法：通过可信芯片监控内存地址及内存数据，按预期计算步骤计算得到一个结果，该结果再与CPU的计算结果进行比较，依据比较结果来判定可信计算是否是安全的。这种在程序动态的计算安全的度量过程中，很多检测依赖对内存的检测，这不利保护用户的隐私，对设备消耗性能也大，且对一些动态编译的应用程序，还无法完成内存的动态度量。
另外，在有些方案中，还通过CPU监控部件监控CPU执行指令及内存数据，比较CPU的相应计算结果与监控的计算结果是否相等，来评估CPU的计算行为是否安全的。例如，监控A+B＝C，指令执行，CPU会从内存取A和B，运算得C，CPU监控部件会监控到加运算指令，及CPU取的内存数据；CPU监控部件也取A和B，并进行加运算得C’；如果C＝C’，那么就认为计算符合预期,因此，确定CPU的计算行为是否安全的。但这也存在以下问题：由于CPU监控部件的运算频率没CPU指令快，其采集频率跟不上CPU指令运算频率，因而可能存在漏采，攻击漏报风险；而且因为增加指令监控 及计算监控，耗费设备系统性能较大；另外，如上，因为读取用户内存数据，还可能暴露用户隐私。
针对相关技术中所存在的上述问题，基于在上述运行环境下，本申请提供了如图2所示的计算处理方法。图2是根据本发明实施例1的计算处理方法的流程图，如图2所法，该流程包括如下步骤：
步骤S202，接收计算请求；
作为一种可选的实施例，上述步骤的执行主体可以是一种计算机终端，例如，智能手机，移动电话，平板电脑，笔记本电脑，智能手表等用户终端。上述步骤的执行主体也可以是包括用于执行计算功能的单独芯片，例如，可以是用于可信计算的可信芯片，还可以其它用于保证计算安全的其它计算芯片。上述步骤的执行主体还可以是用于执行安全计算功能的服务器等网络设备。
作为一种可选的实施例，接收计算请求，即是接收用于请求对计算事件进行计算处理的请求。需要说明的是，计算请求中可以包括一个计算事件，也可以包括多个计算事件，在包括多个计算事件时，可以通过一定的区分标识对多个事件进行区分，从而实现在一定时间段内能够有序地对多个计算事件的计算安全进行保障。
步骤S204，通过计算安全保障单元度量计算单元和计算安全审计单元是否安全，并通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素；
作为一种可选的实施例，通过计算安全保障单元度量计算单元和计算安全审计单元是否安全时，可以是通过计算安全保障单元度量计算单元和度量计算安全审计单元同时进行，也可以有时间差地进行，在此不进行限定。
作为一种可选的实施例，通过计算安全保障单元度量计算单元是否安全时，可以包括以下方面：一方面，通过计算安全保障单元度量计算单元的计算环境是否安全；另一方面，通过计算安全保障单元度量计算单元的计算应用程序是否安全，还一方面，通过计算安全保障单元度量计算单元的计算主体是否合法。其中，通过计算安全保障单元度量计算单元的计算环境是否安全可以包括：通过计算安全保障单元度量计算单元的硬件环境平台是否安全，例如，可以度量计算环境中的基本输入输出系统(BIOS)，其它具体硬件固件、操作系统加载器(OS Loader),以及OS内核平台及系统的完整性，即度量计算环境中的对象是否是完整的，是否被篡改。具体度量时，可以依据可信平台存储的标准值进行度量，从而保证度量的可信。在通过计算安全保障单元度量计算单元的计算应用程序是否安全时，可以包括：计算应用程序自身的完整性。即度量用于执行计算的 程序是否被篡改，在被篡改时确定执行计算的程序是不安全的，即计算也就不安全。由于执行计算的可以是CPU或者运算卡，通过计算安全保障单元度量计算单元的计算主体是否合法可以包括：对执行计算的CPU进行度量，确定其是否合法；对执行计算的运算卡进行度量，确定是否其是否合法。需要说明的是，这里所指的运算卡是一种具有计算能力的卡，可以包括多种类型，例如，可以是现场可编辑门阵列(Field－Programmabele Gate Arrary,简称为FPGA)，图形处理器(Graphics Processing Unit，简称为GPU)，以及加密卡等。
作为一种可选的实施例，通过计算安全保障单元度量计算安全审计单元是否安全时，可以包括以下方面：一方面，通过计算安全保障单元度量计算安全审计单元的完整性是否被破坏，包括度量计算安全审计单元的硬件和软件的完整性是否被篡改；另一方面，通过计算安全保障单元度量计算安全审计单元是否合法，包括度量计算安全审计单元的硬件和软件是否合法。只有上述对上述计算安全审计单元的度量是完整的，且合法的，即可以确定计算安全审计单元是可信的，是计算安全的。
作为一种可选的实施例，在计算安全保障单元对计算单元和计算安全审计单元进行度量后，可能存在度量可信的结果，也可能存在度量不可信的结果。在度量可信结果为可信时，则确定计算安全保障单元对计算单元和计算安全审计单元是保障安全的。在计算安全保障单元保障计算单元和计算安全审计单元是安全的情况下，通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素，用于后续对计算安全保障单元进行审计。即在本可选的实施例中，计算安全保障单元对计算安全审计单元进行度量，保障计算安全审计单元的计算安全；反过来，计算安全审计单元也对计算安全保障单元完成保障的计算事件元素进行审计，两者相互制约，提高了计算的整体安全性。
步骤S206，在计算安全保障单元度量计算单元，并保障计算单元安全的情况下，通过计算单元执行计算处理，并通过计算安全审计单元采集计算单元完成计算的计算事件元素；
作为一种可选的实施例，计算单元在计算安全保障单元保障安全的情况下，执行计算处理。即在计算安全保障单元保障计算安全本身是安全的情况下，启动计算单元执行计算处理，为计算安全提供了前提。
作为一种可选的实施例，通过计算安全审计单元采集计算单元完成计算的计算事件元素,由计算安全审计单元对采集的计算单元完成计算的计算事件元素进行审计，实现对计算执行完后计算结果的审计。通过上述在计算前的计算安全保障，以及计算后的结果 的安全保障，实现了计算单元的整体计算安全。
步骤S208，根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征；
作为一种可选的实施例，根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征时，可以采用多种方式生成计算事件的计算流特征。在本可选的实施例中，提供了一种统计的方法来生成计算事件的计算流特征。即对计算事件所对应的指令集中的指令的时空特征进行统计，例如，包括对指令执行顺序特征，指令执行时间点特征、指令执行时电磁信号所表现的特征进行统计，还包括对指令执行时所访问的内存空间顺序，访问频域等等与指令执行时相关的特征进行统计。
步骤S210，通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
作为一种可选的实施例，上述用于匹配生成的计算流特征的预定计算流特征可以通过多种方式获取，例如，该预定计算流特征可以从计算流特征库中获取，其中，计算流特征库中的计算流特征通过机器学习的方式生成。即在该计算流特征库中的计算流特征是标准的，可信的。另外，计算流特征库中的计算流特征还可以通过机器学习不断地进行修正。用于对样本进行修正的源数据可以是不断积累的可信的历史数据，例如，可以是通过可信平台已经确认过的属于计算安全的计算流特征。
在上述实施例及优选实施例中，通过计算安全保障单元保障计算单元和计算安全审计单元安全,通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素，以及采集计算单元完成计算的计算事件元素；根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征；通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全，达到了不用读取用户数据保证计算安全的目的，从而实现了在不耗费较大计算性能的情况下保证计算安全，以及避免暴露用户隐私的技术效果，进而解决了在相关技术中，为保证计算安全，存在对内存的依赖，暴露用户隐私以及耗费计算性能过大的技术问题。
作为一种可选的实施例，通过计算控制单元对计算事件进行监控，并在计算安全保障单元和/或计算安全审计单元出现异常时，控制计算单元受限计算执行或禁止计算执行。即通过计算控制单元对计算安全保障单元和/或计算安全审计单元的异常情况进行监 控，在监控到异常时，及时控制计算单元受限计算执行或者禁止计算执行。通过及时对计算过程进行控制，有效地实现了计算资源的保护，计算效率的提高。
需要说明的是，上述计算安全保障单元完成保障的计算事件元素和/或计算单元完成计算的计算事件元素可以包括：非用户数据的元素。例如，该非用户数据的元素可以包括：计算执行的任何指令、执行时间、内存地址,以及执行计算的电磁信号等等。上述所列举的非用户数据的元素仅仅为一种举例，并不限于此。
另外，需要说明的是，上述计算安全保障单元，计算安全审计单元，计算单元，计算控制单元和内存可以以任何形式来实现其功能，例如，上述计算安全保障单元，计算安全审计单元，计算单元，计算控制单元和内存中的至少两者集成于一块芯片中。举例来说，计算单元可在内存中实现；计算控制单元可以和计算单元、或计算安全保障单元、或计算安全审计单元集成在一块芯片中；计算安全保障单元和计算安全审计单元、计算控制单元集成在一起等等。
针对相关技术中所存在的上述问题，基于在上述运行环境下，本申请提供了如图3所示的计算处理方法。图3是根据本发明实施例1的计算处理方法的另一流程图，如图3所法，该流程包括如下步骤：
步骤S302，接收计算请求；
步骤S304，在通过计算安全保障单元保障计算单元和计算安全审计单元安全的情况下，通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素，以及采集计算单元完成计算的计算事件元素；
步骤S306，根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征；
步骤S308，通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
作为一种可选的实施例，上述步骤的执行主体可以是一种计算安全审计单元，该计算安全审计单元可以是用于执行计算功能的单独芯片，例如，可以是用于可信计算的可信芯片，还可以集成于其它用于保证计算安全的计算芯片。还可以是用于集成于执行安全计算功能的服务器等网络设备。
作为一种可选的实施例，在通过计算安全保障单元保障计算单元和计算安全审计单元是否安全之前，可以通过计算安全审计单元确定计算安全保障单元对计算安全审计单元和/或计算单元进行度量的度量实体是否安全。由于度量是在CPU里执行或者是在卡 里执行，因此，需要保证执行度量的度量代码和度量算法的完整性，度量主体的合法性，以及度量空间的安全性等。对于本实施例而言，在采用计算安全保障单元对计算单元和计算安全审计单元度量是否安全之前，可以先对计算安全保障单元执行度量的度量实体的安全性进行确定。
作为一种可选的实施例，在通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全之前，还包括：通过计算安全审计单元从计算流特征库中获取预定计算流特征，其中，计算流特征库中的计算流特征通过机器学习的方式生成。
其中，计算流特征库中的计算流特征通过机器学习的方式生成。即在该计算流特征库中的计算流特征是标准的，可信的。另外，计算流特征库中的计算流特征还可以通过机器学习不断地进行修正。用于对样本进行修正的源数据可以是不断积累的可信的历史数据，例如，可以是通过可信平台已经确认过的属于计算安全的计算流特征。
作为一种可选的实施例，计算安全保障单元完成保障的计算事件元素和/或计算单元完成计算的计算事件元素包括：非用户数据的元素。例如，该非用户数据的元素可以包括：计算执行的任何指令、执行时间、内存地址,以及执行计算的电磁信号等等。上述所列举的非用户数据的元素仅仅为一种举例，并不限于此。
在通信设备中，计算架构系统主要包括计算单元和内存两个部件，即主要通过这两个部件来完成计算事件。计算单元是通信设备的核心部件，大多数计算都是通过计算单元运行的，以CPU为例，图4是根据本发明实施例提供的CPU的内部结构及功能示意图，如图4所示，CPU的主要结构包括：时钟，寄存器，控制器以及运算器，其中，时钟，主要用于负责发出CPU开始计时时的时钟信号；并且时钟信号的频率越高，CPU的运行速度越快；寄存器，可用来暂存指令，数据等处理对象，其中，内存也可以当作是寄存器的一种；控制器，主要用于把内存上的指令、数据等读入寄存器(即除内存之外的其它寄存器)；运算器，主要用于负责运算从内存读入寄存器的数据。
在CPU的内部结构中，其内部寄存器也可以包括多种，图5是根据本发明实施例提供的CPU内部寄存器的结构示意图，如图5所示，该CPU内部寄存器可以包括以下几种类型：累加寄存器，标识寄存器，程序寄存器，指令寄存器，栈寄存器，基址寄存器，变址寄存器和通用寄存器。其中，累加寄存器，标识寄存器，程序寄存器，指令寄存器，栈寄存器可以有一个；基址寄存器，变址寄存器和通用寄存器可以有多个。下面对各个类型的寄存器进行简单说明。累加寄存器，主要用于存储执行运算器的数据和运算后的 数据；标识寄存器，主要用于存储运算处理后的CPU的状态；程序寄存器，主要用于存储下一条指令所在内存的地址；指令寄存器，主要用于存储指令，CPU内部使用，程序员一般情况下无法通过程序对该寄存器进行读写操作；栈寄存器，主要用于存储栈区的起始地址；基址寄存器，主要用于存储内存的起始地址；变址寄存器，主要用于存储基址寄存器的相对地址，以及通用寄存器，主要用于存储任意数据。
需要说明的是，后续所描述的计算安全监控部件所要采集的数据，也以CPU为计算单元进行阐述，但是CPU在本申请中仅为一种示例，计算安全架构系统及计算安全监控方法不限定CPU计算单元。
基于上述实施例及优选实施例，提供了一种优选实施方式。为了保障计算安全，本发明优选实施方式中，设计了一种新的计算处理系统，图6是根据本发明优选实施方式提供的计算处理系统的示意图，如图6所示，主要包括：计算单元、计算安全保障单元、计算安全审计单元、计算控制单元、内存五部分。其中：
计算单元，用于完成计算功能；
计算安全审计单元，用于审计计算单元或计算安全保障单元在完成应用计算及保障计算过程中是否是符合预期，其中，该计算安全审计单元具备获取非用户数据中的计算相关数据，比如：计算执行的任何指令、执行时间、内存地址等；
计算安全保障单元，用于保障计算执行环境的安全，比如，基本输入输出系统(Base Input Output System，简称为BIOS)，其它硬件固件、操作系统加载器(Operation System Loader，简称为OS Loader),OS内核平台及系统的完整性，以及计算应用程序自身的完整性，及计算安全审计单元的安全，比如固件的完整性及合法性；
计算控制单元，用于管控计算控制，其中，该计算控制单元，用于在计算安全保障单元或计算安全审计单元发现异常时，触发计算控制单元控制计算受限执行或禁止执行；
内存，用于存储计算单元相关的一些数据及地址。
需要说明的是，上述计算处理系统中所包括的这五部分不限于实现形式，比如，计算单元也可在内存中实现；计算控制单元可以和计算单元、或计算安全保障单元、或计算安全审计单元集成在一块芯片中；计算安全保障单元和计算安全审计单元、计算控制单元集成在一起等等。即上述五部分可以依据需要灵活地进行组合进行集成。
基于上述计算处理系统，在本发明优选实施方式中，还提供了一种计算处理方法，或者称为一种计算安全保障方法，图7是根据本发明优选实施方式提供的计算处理方法的流程图，如图7所示，该计算处理方法包括如下步骤：
步骤S702，业务计算应用请求；
步骤S704，计算安全保障单元度量计算单元及计算安全审计单元是否是完整未被篡改的，且判断其是否是合法的；
步骤S704’，计算安全保障单元在度量计算单元、及计算安全审计单元的度量计算过程中，计算安全审计单元也会采集计算安全保障单元在执行度量过程中所执行的相应的计算事件元素，进入步骤S712；
步骤S706，在计算安全保障单元度量计算单元及计算安全审计单元均合法的情况下，执行步骤S708，否则转到步骤S718；
步骤S708，启动计算单元执行计算；
步骤S710，计算安全审计单元采集计算单元完成某个计算事件的相关元素，比如指令，指令时间，内存地址，执行计算的电磁信号等等非用户数据的相关元素；
步骤S712，根据采集的数据可以采用统计方法，形成完成此类的计算流特征；
步骤S714，将得到的计算流特征与计算流特征库中的样本进行比较(假设系统已经有个计算流特征库，并且可以结合机器学习方法自动修正计算流特征库中的样本)，看其是否匹配，如果匹配执行步骤S716，否则执行步骤S718；
步骤S716，默认计算安全，进入步骤S720；
步骤S718，报警计算控制单元有风险，计算控制单元控制计算进入权限受限模式，或者禁止计算执行；
步骤S720，计算结果安全输出。
通过上述优选实施方式，能够实现以下有益效果：
(1)将计算安全保障单元、计算安全审计单元引入计算过程，使得两者与传统计算结构中的计算控制单元形成“三权分立”，避免单点风险；
(2)通过保障计算执行环境安全，感知计算过程中的计算流特征是否符合预期来提升计算安全的保障；
(3)因为没像相关技术那样去采集用户数据，因此，采用上述优选实施方式保证了用户隐私不被泄露；
(4)避免用户数据的采集和计算，这样减少设备性能损耗；
(5)因为采用机器学习统计方法去识别计算流特征，因此，能防御未知攻击。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明并不受所描述的动作顺序的限制， 因为依据本发明，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本发明所必须的。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例的方法。
实施例2
根据本发明实施例，还提供了一种用于实施上述计算处理方法的计算处理系统，图8是根据本发明实施例的计算处理系统的结构框图，如图8所示，该计算处理系统80包括：第一接收单元82，计算安全保障单元84，计算单元86，计算安全审计单元88，下面对该计算处理系统进行说明。
第一接收单元82，用于接收计算请求；计算安全保障单元84，与上述第一接收单元82连接，用于度量计算单元和计算安全审计单元是否安全；计算单元86，与上述计算安全保障单元84和计算安全审计单元88连接，用于在计算安全保障单元度量计算单元，并保障计算单元安全的情况下，执行计算处理；计算安全审计单元88，与上述计算安全保障单元84和计算单元86连接，用于采集计算安全保障单元完成保障的计算事件元素，以及采集计算单元完成计算的计算事件元素；并根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，生成计算事件的计算流特征；计算安全审计单元88，还用于审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
此处需要说明的是，上述第一接收单元82，计算安全保障单元84，计算单元86，计算安全审计单元88对应于实施例1中的步骤S202至步骤S208，两个模块与对应的步骤所实现的实例和应用场景相同，但不限于上述实施例一所公开的内容。需要说明的是，上述模块作为装置的一部分可以运行在实施例一提供的计算机终端10中。
实施例3
根据本发明实施例，还提供了一种用于实施上述计算处理方法的计算处理设备，图9是根据本发明实施例的计算处理设备的结构框图,如图9所示，该计算处理设备90包括： 第二接收单元92和计算安全审计单元88，下面对该计算处理设备进行说明。
第二接收单元92，用于接收计算请求；计算安全审计单元88，连接于上述第二接收单元92，用于在通过计算安全保障单元保障计算单元和计算安全审计单元安全的情况下，采集计算安全保障单元完成保障的计算事件元素，以及采集计算单元完成计算的计算事件元素；计算安全审计单元88，还用于根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，生成计算事件的计算流特征；计算安全审计单元88，还用于审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
实施例4
本发明的实施例可以提供一种计算机设备(或称计算机终端)，该计算机终端可以是计算机终端群中的任意一个计算机终端设备。可选地，在本实施例中，上述计算机终端也可以替换为移动终端等终端设备。
可选地，在本实施例中，上述计算机终端可以位于计算机网络的多个网络设备中的至少一个网络设备。
可选地，图10是根据本发明实施例的一种计算机终端的结构框图。如图10所示，该计算机终端100可以包括：一个或多个(图中仅示出一个)处理器102、存储器104、以及通过射频模块，音频模块或者显示屏通信的外设接口。
其中，存储器104可用于存储软件程序以及模块，如本发明实施例中的安全漏洞检测方法和装置对应的程序指令/模块，处理器通过运行存储在存储器内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的系统漏洞攻击的检测方法。存储器可包括高速随机存储器，还可以包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器可进一步包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至计算机终端100。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
处理器102可以通过传输装置调用存储器存储的信息及应用程序，以执行下述步骤的程序代码：接收计算请求；通过计算安全保障单元度量计算单元和计算安全审计单元是否安全，并通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素；在计算安全保障单元度量计算单元，并保障计算单元安全的情况下，通过计算单元执行计算处理，并通过计算安全审计单元采集计算单元完成计算的计算事件元素；根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计 算安全审计单元生成计算事件的计算流特征；通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
可选的，上述处理器还可以执行如下步骤的程序代码：通过计算控制单元对计算事件进行监控，并在计算安全保障单元和/或计算安全审计单元出现异常时，控制计算单元受限计算执行或禁止计算执行。
可选的，上述处理器还可以执行如下步骤的程序代码：通过计算安全保障单元度量计算单元是否安全包括：通过计算安全保障单元度量计算单元的计算环境是否安全；通过计算安全保障单元度量计算单元的计算应用程序是否安全；通过计算安全保障单元度量计算单元的计算主体是否合法。
可选的，上述处理器还可以执行如下步骤的程序代码：通过计算安全保障单元度量计算安全审计单元是否安全包括：通过计算安全保障单元度量计算安全审计单元的完整性是否被破坏；通过计算安全保障单元度量计算安全审计单元是否合法。
可选的，上述处理器还可以执行如下步骤的程序代码：预定计算流特征从计算流特征库中获取，其中，计算流特征库中的计算流特征通过机器学习的方式生成。
可选的，上述处理器还可以执行如下步骤的程序代码：计算安全保障单元完成保障的计算事件元素和/或计算单元完成计算的计算事件元素包括：非用户数据的元素。
可选的，上述处理器还可以执行如下步骤的程序代码：计算安全保障单元，计算安全审计单元，计算单元，计算控制单元和内存中的至少两者集成于一块芯片中。
在本实施例中，上述计算机终端可以执行应用程序的计算处理方法中以下步骤的程序代码：接收计算请求；在通过计算安全保障单元保障计算单元和计算安全审计单元安全的情况下，通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素，以及采集计算单元完成计算的计算事件元素；根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征；通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
可选的，上述处理器还可以执行如下步骤的程序代码：通过计算安全审计单元确定计算安全保障单元对计算安全审计单元和/或计算单元进行度量的度量实体是否安全。
可选的，上述处理器还可以执行如下步骤的程序代码：在通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全之前，还包括：通过计算安全审计单元从计算流特征库中获取预定计算流特征，其中，计算流特 征库中的计算流特征通过机器学习的方式生成。
可选的，上述处理器还可以执行如下步骤的程序代码：计算安全保障单元完成保障的计算事件元素和/或计算单元完成计算的计算事件元素包括：非用户数据的元素。
采用本发明实施例，提供了一种计算处理的方案。通过计算安全保障单元保障计算单元和计算安全审计单元安全,通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素，以及采集计算单元完成计算的计算事件元素；根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征；通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全，达到了不用读取用户数据保证计算安全的目的，从而实现了在不耗费较大计算性能的情况下保证计算安全，以及避免暴露用户隐私的技术效果，进而解决了在相关技术中，为保证计算安全，存在对内存的依赖，暴露用户隐私以及耗费计算性能过大的技术问题。
本领域普通技术人员可以理解，图10所示的结构仅为示意，计算机终端也可以是智能手机(如Android手机、iOS手机等)、平板电脑、掌声电脑以及移动互联网设备(Mobile Internet Devices，MID)、PAD等终端设备。图10其并不对上述电子装置的结构造成限定。例如，计算机终端10还可包括比图10中所示更多或者更少的组件(如网络接口、显示装置等)，或者具有与图10所示不同的配置。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令终端设备相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：闪存盘、只读存储器(Read-Only Memory，ROM)、随机存取器(Random Access Memory，RAM)、磁盘或光盘等。
实施例5
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以用于保存上述实施例1所提供的计算处理方法所执行的程序代码。
可选地，在本实施例中，上述存储介质可以位于计算机网络中计算机终端群中的任意一个计算机终端中，或者位于移动终端群中的任意一个移动终端中。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：接收计算请求；通过计算安全保障单元度量计算单元和计算安全审计单元是否安全，并通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素；在计算安全保障单元度量计算单元，并保障计算单元安全的情况下，通过计算单元执行计算处理，并通过 计算安全审计单元采集计算单元完成计算的计算事件元素；根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征；通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
可选地，在本实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：通过计算控制单元对计算事件进行监控，并在计算安全保障单元和/或计算安全审计单元出现异常时，控制计算单元受限计算执行或禁止计算执行。
可选地，在本实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：通过计算安全保障单元度量计算单元是否安全包括：通过计算安全保障单元度量计算单元的计算环境是否安全；通过计算安全保障单元度量计算单元的计算应用程序是否安全；通过计算安全保障单元度量计算单元的计算主体是否合法。
可选地，在本实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：通过计算安全保障单元度量计算安全审计单元是否安全包括：通过计算安全保障单元度量计算安全审计单元的完整性是否被破坏；通过计算安全保障单元度量计算安全审计单元是否合法。
可选地，在本实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：预定计算流特征从计算流特征库中获取，其中，计算流特征库中的计算流特征通过机器学习的方式生成。
可选地，在本实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：计算安全保障单元完成保障的计算事件元素和/或计算单元完成计算的计算事件元素包括：非用户数据的元素。
可选的，上述处理器还可以执行如下步骤的程序代码：计算安全保障单元，计算安全审计单元，计算单元，计算控制单元和内存中的至少两者集成于一块芯片中。
在本实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：接收计算请求；在通过计算安全保障单元保障计算单元和计算安全审计单元安全的情况下，通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素，以及采集计算单元完成计算的计算事件元素；根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征；通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
可选地，在本实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：通过计算安全审计单元确定计算安全保障单元对计算安全审计单元和/或计算单元进行度量的度量实体是否安全。
可选地，在本实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：在通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全之前，还包括：通过计算安全审计单元从计算流特征库中获取预定计算流特征，其中，计算流特征库中的计算流特征通过机器学习的方式生成。
可选地，在本实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：计算安全保障单元完成保障的计算事件元素和/或计算单元完成计算的计算事件元素包括：非用户数据的元素。
实施例6
本发明的实施例还提供了一种处理器。该处理器可以为一个独立的器件，也可以是集成于预定网络设备上的功能模块，可以依据需要灵活选择。
在本实施例中，上述处理器可以执行如下步骤的程序代码：接收计算请求；通过计算安全保障单元度量计算单元和计算安全审计单元是否安全，并通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素；在计算安全保障单元度量计算单元，并保障计算单元安全的情况下，通过计算单元执行计算处理，并通过计算安全审计单元采集计算单元完成计算的计算事件元素；根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征；通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
可选的，上述处理器还可以执行如下步骤的程序代码：通过计算控制单元对计算事件进行监控，并在计算安全保障单元和/或计算安全审计单元出现异常时，控制计算单元受限计算执行或禁止计算执行。
可选的，上述处理器还可以执行如下步骤的程序代码：通过计算安全保障单元度量计算单元是否安全包括：通过计算安全保障单元度量计算单元的计算环境是否安全；通过计算安全保障单元度量计算单元的计算应用程序是否安全；通过计算安全保障单元度量计算单元的计算主体是否合法。
可选的，上述处理器还可以执行如下步骤的程序代码：通过计算安全保障单元度量计算安全审计单元是否安全包括：通过计算安全保障单元度量计算安全审计单元的完整 性是否被破坏；通过计算安全保障单元度量计算安全审计单元是否合法。
可选的，上述处理器还可以执行如下步骤的程序代码：预定计算流特征从计算流特征库中获取，其中，计算流特征库中的计算流特征通过机器学习的方式生成。
可选的，上述处理器还可以执行如下步骤的程序代码：计算安全保障单元完成保障的计算事件元素和/或计算单元完成计算的计算事件元素包括：非用户数据的元素。
可选的，上述处理器还可以执行如下步骤的程序代码：计算安全保障单元，计算安全审计单元，计算单元，计算控制单元和内存中的至少两者集成于一块芯片中。
在本实施例中，上述处理器可以执行如下步骤的程序代码：接收计算请求；在通过计算安全保障单元保障计算单元和计算安全审计单元安全的情况下，通过计算安全审计单元采集计算安全保障单元完成保障的计算事件元素，以及采集计算单元完成计算的计算事件元素；根据计算安全保障单元完成保障的计算事件元素，以及计算单元完成计算的计算事件元素，通过计算安全审计单元生成计算事件的计算流特征；通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
可选的，上述处理器还可以执行如下步骤的程序代码：通过计算安全审计单元确定计算安全保障单元对计算安全审计单元和/或计算单元进行度量的度量实体是否安全。
可选的，上述处理器还可以执行如下步骤的程序代码：在通过计算安全审计单元审计计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全之前，还包括：通过计算安全审计单元从计算流特征库中获取预定计算流特征，其中，计算流特征库中的计算流特征通过机器学习的方式生成。
可选的，上述处理器还可以执行如下步骤的程序代码：计算安全保障单元完成保障的计算事件元素和/或计算单元完成计算的计算事件元素包括：非用户数据的元素。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
在本发明的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (16)

  1. 一种计算处理方法，其特征在于，包括：
    接收计算请求；
    通过计算安全保障单元度量计算单元和计算安全审计单元是否安全，并通过所述计算安全审计单元采集所述计算安全保障单元完成保障的计算事件元素；
    在所述计算安全保障单元度量所述计算单元，并保障所述计算单元安全的情况下，通过所述计算单元执行计算处理，并通过所述计算安全审计单元采集所述计算单元完成计算的计算事件元素；
    根据所述计算安全保障单元完成保障的计算事件元素，以及所述计算单元完成计算的计算事件元素，通过所述计算安全审计单元生成计算事件的计算流特征；
    通过所述计算安全审计单元审计所述计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
  2. 根据权利要求1所述的方法，其特征在于，还包括：
    通过计算控制单元对所述计算事件进行监控，并在所述计算安全保障单元和/或所述计算安全审计单元出现异常时，控制所述计算单元受限计算执行或禁止计算执行。
  3. 根据权利要求1所述的方法，其特征在于，通过计算安全保障单元度量计算单元是否安全包括：
    通过所述计算安全保障单元度量所述计算单元的计算环境是否安全；
    通过所述计算安全保障单元度量所述计算单元的计算应用程序是否安全；
    通过所述计算安全保障单元度量所述计算单元的计算主体是否合法。
  4. 根据权利要求1所述的方法，其特征在于，通过计算安全保障单元度量所述计算安全审计单元是否安全包括：
    通过所述计算安全保障单元度量所述计算安全审计单元的完整性是否被破坏；
    通过所述计算安全保障单元度量所述计算安全审计单元是否合法。
  5. 根据权利要求1所述的方法，其特征在于，
    所述预定计算流特征从计算流特征库中获取，其中，所述计算流特征库中的计算流特征通过机器学习的方式生成。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述计算安全保障单元完成保障的计算事件元素和/或所述计算单元完成计算的计算事件元素包括：非用户数据的元素。
  7. 根据权利要求6所述的方法，其特征在于，所述计算安全保障单元，所述计算安全审计单元，所述计算单元，计算控制单元和内存中的至少两者集成于一块芯片中。
  8. 一种计算处理方法，其特征在于，包括：
    接收计算请求；
    在通过计算安全保障单元保障计算单元和计算安全审计单元安全的情况下，通过所述计算安全审计单元采集所述计算安全保障单元完成保障的计算事件元素，以及采集所述计算单元完成计算的计算事件元素；
    根据所述计算安全保障单元完成保障的计算事件元素，以及所述计算单元完成计算的计算事件元素，通过所述计算安全审计单元生成计算事件的计算流特征；
    通过所述计算安全审计单元审计所述计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
  9. 根据权利要求8所述的方法，其特征在于，还包括：
    通过所述计算安全审计单元确定所述计算安全保障单元对所述计算安全审计单元和/或所述计算单元进行度量的度量实体是否安全。
  10. 根据权利要求8所述的方法，其特征在于，在通过所述计算安全审计单元审计所述计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全之前，还包括：
    通过所述计算安全审计单元从计算流特征库中获取所述预定计算流特征，其中，所述计算流特征库中的计算流特征通过机器学习的方式生成。
  11. 根据权利要求8至10中任一项所述的方法，其特征在于，所述计算安全保障单元完成保障的计算事件元素和/或所述计算单元完成计算的计算事件元素包括：非用户数据的元素。
  12. 一种计算处理系统，其特征在于，包括：
    第一接收单元，用于接收计算请求；
    计算安全保障单元，用于度量计算单元和计算安全审计单元是否安全；
    所述计算单元，用于在所述计算安全保障单元度量所述计算单元，并保障所述计算单元安全的情况下，执行计算处理；
    所述计算安全审计单元，用于采集所述计算安全保障单元完成保障的计算事件元素，以及采集所述计算单元完成计算的计算事件元素；并根据所述计算安全保障单元完成保障的计算事件元素，以及所述计算单元完成计算的计算事件元素，生成计算事件的 计算流特征；
    所述计算安全审计单元，还用于审计所述计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
  13. 一种计算处理设备，其特征在于，包括：第二接收单元和计算安全审计单元，其中，
    所述第二接收单元，用于接收计算请求；
    所述计算安全审计单元，用于在通过计算安全保障单元保障计算单元和计算安全审计单元安全的情况下，采集所述计算安全保障单元完成保障的计算事件元素，以及采集所述计算单元完成计算的计算事件元素；
    所述计算安全审计单元，还用于根据所述计算安全保障单元完成保障的计算事件元素，以及所述计算单元完成计算的计算事件元素，生成计算事件的计算流特征；
    所述计算安全审计单元，还用于审计所述计算流特征与预定计算流特征是否匹配，并在匹配的情况下，确定计算安全。
  14. 一种存储介质，其特征在于，所述存储介质存储有程序，其中，在所述程序被处理器运行时使得所述处理器执行权利要求1至11中任意一项所述的计算处理方法。
  15. 一种处理器，其特征在于，所述处理器用于运行程序，其中，所述程序被所述处理器运行时使得所述处理器执行权利要求1至11中任意一项所述的计算处理方法。
  16. 一种计算机设备，其特征在于，包括：存储器和处理器，
    所述存储器存储有计算机程序；
    所述处理器，用于执行所述存储器中存储的计算机程序，所述计算机程序被所述处理器运行时使得所述处理器执行权利要求1至11中任意一项所述的计算处理方法。
PCT/CN2020/083155 2019-04-12 2020-04-03 计算处理方法、系统、设备、存储器、处理器及计算机设备 Ceased WO2020207343A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910295520.2A CN111814205B (zh) 2019-04-12 2019-04-12 计算处理方法、系统、设备、存储器、处理器及计算机设备
CN201910295520.2 2019-04-12

Publications (1)

Publication Number Publication Date
WO2020207343A1 true WO2020207343A1 (zh) 2020-10-15

Family

ID=72752129

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/083155 Ceased WO2020207343A1 (zh) 2019-04-12 2020-04-03 计算处理方法、系统、设备、存储器、处理器及计算机设备

Country Status (2)

Country Link
CN (1) CN111814205B (zh)
WO (1) WO2020207343A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101271498A (zh) * 2008-03-25 2008-09-24 浙江大学 在linux操作系统通过威胁链表和安全链表实现可信计算的方法
CN101515316A (zh) * 2008-02-19 2009-08-26 北京工业大学 一种可信计算终端及可信计算方法
CN101515933A (zh) * 2009-03-16 2009-08-26 中兴通讯股份有限公司 一种网络设备的软硬件完整性检测方法及系统
US20160048678A1 (en) * 2011-07-29 2016-02-18 Microsoft Technology Licensing, Llc Trustzone-based integrity measurements and verification using a software-based trusted platform module
CN106775716A (zh) * 2016-12-15 2017-05-31 中国科学院沈阳自动化研究所 一种基于度量机制的可信plc启动方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7409370B2 (en) * 2003-06-30 2008-08-05 Intel Corporation Secured and selective runtime auditing services using a trusted computing device
US9870410B2 (en) * 2014-09-15 2018-01-16 Microsoft Technology Licensing, Llc Constructed data stream for enhanced event processing
CN107133520B (zh) * 2016-02-26 2021-05-14 华为技术有限公司 云计算平台的可信度量方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101515316A (zh) * 2008-02-19 2009-08-26 北京工业大学 一种可信计算终端及可信计算方法
CN101271498A (zh) * 2008-03-25 2008-09-24 浙江大学 在linux操作系统通过威胁链表和安全链表实现可信计算的方法
CN101515933A (zh) * 2009-03-16 2009-08-26 中兴通讯股份有限公司 一种网络设备的软硬件完整性检测方法及系统
US20160048678A1 (en) * 2011-07-29 2016-02-18 Microsoft Technology Licensing, Llc Trustzone-based integrity measurements and verification using a software-based trusted platform module
CN106775716A (zh) * 2016-12-15 2017-05-31 中国科学院沈阳自动化研究所 一种基于度量机制的可信plc启动方法

Also Published As

Publication number Publication date
CN111814205A (zh) 2020-10-23
CN111814205B (zh) 2023-11-14

Similar Documents

Publication Publication Date Title
US11089016B2 (en) Secure system on chip
JP5551130B2 (ja) サーバ管理コプロセッササブシステム内部のｔｃｐａによる信頼性の高いプラットフォームモジュール機能のカプセル化
KR101458780B1 (ko) 다단계 락스텝 무결성 보고 메커니즘 제공
CN110383256B (zh) 一种内核完整性保护方法及装置
CN110875819B (zh) 密码运算处理方法、装置及系统
CN110334515B (zh) 一种基于可信计算平台生成度量报告的方法及装置
CN110321715A (zh) 可信度量方法、装置及处理器
JP2012195016A (ja) 計算機システム内のセキュリティ侵害を識別して防ぐためのシステムと方法
CN101989242A (zh) 一种提高soc系统安全的总线监视器及其实现方法
US20220043914A1 (en) Securing node groups
WO2021139308A1 (zh) 云服务器监控方法、装置、设备及存储介质
CN111177726B (zh) 一种系统漏洞检测方法、装置、设备及介质
CN111651769B (zh) 获取安全启动的度量方法和装置
EP3185166A1 (en) Trusted metric method and device
CN112016090A (zh) 安全计算卡，基于安全计算卡的度量方法及系统
US8800052B2 (en) Timer for hardware protection of virtual machine monitor runtime integrity watcher
US11251976B2 (en) Data security processing method and terminal thereof, and server
WO2020207343A1 (zh) 计算处理方法、系统、设备、存储器、处理器及计算机设备
CN111625831B (zh) 可信安全的度量方法和装置
CN119577853A (zh) 内存数据访问方法及装置
EP4095725B1 (en) Electronic device and security protection method
CN111814157B (zh) 数据安全处理系统、方法、存储介质、处理器及硬件安全卡
JP5069406B2 (ja) 計算機システム内のセキュリティ侵害を識別して防ぐためのシステムと方法
CN115694987A (zh) 应用程序跨资源池访问异常的检测方法及装置
CN116360913A (zh) 一种安全配置方法、特权域、云平台、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20788533

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20788533

Country of ref document: EP

Kind code of ref document: A1