WO2021164166A1

WO2021164166A1 - Service data protection method, apparatus and device, and readable storage medium

Info

Publication number: WO2021164166A1
Application number: PCT/CN2020/098032
Authority: WO
Inventors: 邢希双
Original assignee: 苏州浪潮智能科技有限公司
Priority date: 2020-02-20
Filing date: 2020-06-24
Publication date: 2021-08-26
Also published as: CN111310213A

Abstract

Provided are a service data protection method, apparatus and device, and a readable storage medium. The method comprises the following steps: using a secure communication channel to receive an encryption and decryption request sent by a target service program; verifying whether the target service program is legitimate; and if so, using a key to perform encryption and decryption processing on service data corresponding to the encryption and decryption request, and if not, disconnecting the secure communication channel with the target service program. In this method, encryption and decryption protection can be performed on service data by means of a file system filtering driver without a hardware device; in addition, due to the fact that an encryption and decryption request is transmitted by means of a secure communication channel, the legitimacy of a target service program is verified, and the service data is covered by multiple types of protection from multiple protection perspectives, such that the security of the service data can be guaranteed.

Description

Business data protection method, device, equipment and readable storage medium

This application claims the priority of the Chinese patent application filed to the Chinese Patent Office on February 20, 2020, the application number is 202010104952.3, and the invention title is "a business data protection method, device, equipment, and readable storage medium". The entire content is incorporated into this application by reference.

Technical field

The present invention relates to the technical field of data security assurance, in particular to a method, device, equipment and readable storage medium for protecting business data.

Background technique

With the development of new technologies such as cloud computing and big data, the security requirements for cloud hosts and servers are getting higher and higher. The application programs on the cloud host and the server are the bearers of external services, which provide users with the required services by processing a variety of business data. Business data contains a lot of sensitive information. Hackers can easily obtain benefits after obtaining this sensitive information. Therefore, business data has attracted the attention of external hackers, and preventing the leakage of sensitive information in business data has become a top priority. The most commonly used means to protect sensitive information in business data is encryption, including encrypted storage and encrypted transmission. A hacker facing a piece of encrypted business data is equivalent to facing a locked door and cannot obtain any valuable information. Encryption is so important that it determines that the encryption and decryption system should be sufficiently secure and robust.

Encryption and decryption capabilities are usually designed as independent hardware (such as HSM, USB Key), independent systems (such as KMS, KMC), independent chips (such as TPM), independent of the operating system where the application program is located, to achieve sufficient Safety. However, in the actual production environment, some small systems themselves have very low investment. If independent hardware/systems/chips are introduced, system manufacturers will not be able to accept additional hardware costs. In addition, for the security upgrades of some existing business systems, operators or customers are not allowed to add additional hardware/systems/chips.

In summary, how to effectively solve the problem of effectively protecting business data without adding additional encryption and decryption hardware is a technical problem that is urgently needed to be solved by those skilled in the art.

Summary of the invention

The purpose of the present invention is to provide a business data protection method, device, equipment and readable storage medium, so as to effectively protect business data without adding additional encryption and decryption hardware.

In order to solve the above technical problems, the present invention provides the following technical solutions:

A business data protection method applied to file system filter driver, including:

Use the secure communication channel to receive the encryption and decryption request sent by the target business program;

Verify that the target business program is legal;

If so, use the key to perform encryption and decryption processing on the service data corresponding to the encryption and decryption request;

If not, disconnect the secure communication channel with the target business program.

Preferably, it also includes:

The key generation logic is used to update the key periodically.

Preferably, the periodic use of key generation logic to update the key includes:

Regularly use the key generation logic and combine the transformation and combination of the designated data to generate a new key; wherein the designated data includes the MAC address of the hardware network card, the ID of the hardware CPU, the current system time and the currently generated random number;

Using the segment data of the new key to update the segment key data in the designated file.

Preferably, after the file system is restarted, the method further includes:

Read multiple block key data from a designated file that is hidden from the outside, and combine the multiple block key data to obtain the key.

Preferably, the combining multiple block key data to obtain the key includes:

The key combination logic after code obfuscation is used to combine a plurality of the block key data to obtain the key.

Preferably, it also includes:

When the file system filter driver is started, its own information is removed from the kernel driver linked list.

Preferably, verifying whether the target business program is legal includes:

Determine whether the ID of the target business program is the ID in the trusted business program table;

If it is, it is determined that the target business procedure is legal;

If not, it is determined that the target business program is illegal.

Preferably, before receiving the encryption/decryption request sent by the target service program through the secure communication channel, the method further includes:

Use the private verification mechanism agreed with the business program to verify the legality of the business program;

After the verification is passed, the ID corresponding to the legal business program is recorded in the trusted business program table.

A business data protection device applied to a file system filter driver, including:

The encryption and decryption request obtaining module is used to receive the encryption and decryption request sent by the target business program through the secure communication channel;

The legality verification module is used to verify whether the target business program is legal;

The encryption and decryption processing module is configured to perform encryption and decryption processing on the business data corresponding to the encryption and decryption request if the target business program is legal;

The data protection module is configured to disconnect the secure communication channel with the target business program if the target business program is illegal.

Preferably, it also includes:

The key update module is used to periodically update the key using key generation logic.

Preferably, the key update module is specifically configured to periodically generate a new key by using the key generation logic in combination with the transformation and combination corresponding to the designated data; wherein the designated data includes the MAC address of the hardware network card , The ID of the hardware CPU, the current system time and the currently generated random number; using the segment data of the new key to update the segment key data in the designated file.

Preferably, it further includes: a key acquisition module, configured to read multiple block key data from a designated file that is hidden from the outside after the file system is restarted, and perform analysis on the multiple block key data Combine to obtain the key.

A business data protection device, including:

Memory, used to store computer programs;

The processor is used to implement the steps of the business data protection method when the computer program is executed.

A readable storage medium having a computer program stored on the readable storage medium, and when the computer program is executed by a processor, the steps of the foregoing business data protection method are realized.

Apply the method provided by the embodiment of the present invention, use a secure communication channel to receive the encryption and decryption request sent by the target business program; verify whether the target business program is legal; if so, use the key to perform encryption and decryption processing on the business data corresponding to the encryption and decryption request ; If not, disconnect the secure communication channel with the target business program.

In order to ensure the security of the key itself, in this embodiment, in order to ensure the security of the business data, the legitimacy of the target business program is first verified. After determining that the target business program is legal, the key is used to perform the encryption and decryption request on the business data corresponding to the encryption and decryption request. Encryption and decryption processing. If it is determined that the target business program is illegal, the secure channel with the target business program can be disconnected directly. It can be seen that in this method, the encryption and decryption protection of the business data can be realized through the file system filter driver without adding hardware equipment. In addition, since the encryption and decryption request is transmitted through the secure communication channel, the legality of the target business program is verified , It realizes multiple protection of business data from multiple protection angles, which can guarantee the security of business data.

Correspondingly, the embodiment of the present invention also provides a business data protection device, equipment and a readable storage medium corresponding to the foregoing business data protection method, which have the foregoing technical effects, and will not be repeated here.

Description of the drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

FIG. 1 is an implementation flowchart of a method for protecting business data in an embodiment of the present invention;

Figure 2 is a schematic structural diagram of a service data protection device in an embodiment of the present invention;

Figure 3 is a schematic structural diagram of a service data protection device in an embodiment of the present invention;

Fig. 4 is a schematic diagram of a specific structure of a service data protection device in an embodiment of the present invention.

Detailed ways

In order to enable those skilled in the art to better understand the solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

In order to facilitate those skilled in the art to better understand the business data protection method provided by the embodiments of the present invention, the acronyms and key terms involved in this document are described below.

KMS: Key Management System, also known as Key Management Center. It is based on the security requirements of banking, mobile, telecommunications and other structures for key management, allowing users to easily create and manage keys, protect the confidentiality, integrity and availability of keys, and meet the needs of users for multi-application and multi-service keys Management needs to meet regulatory and compliance requirements.

HSM: Hardware security module, a dedicated encryption processor designed to protect the life cycle of encryption keys. The hardware security module has become the starting point of the chain of trust by safely managing, processing, and storing encryption keys in a strengthened and tamper-proof device, protecting its encryption infrastructure for the world's most security-conscious organizations.

KMC: The key management center provides encryption key pairs for digital certification centers, and provides related services such as backup, archive, restoration, and update of these key pairs to ensure that they can meet the needs of certification centers and judicial forensics.

USB Key: It is a hardware device with a USB interface. It has a built-in single-chip microcomputer or smart card chip, has a certain storage space, and can store the user's private key and digital certificate.

TPM: Security chip, refers to a security chip that complies with the Trusted Platform Module standard. It can effectively protect the computer and prevent unauthorized users from accessing it. A chip that conforms to the Trusted Platform Module standard must first have the function of generating encryption and decryption keys. In addition, it must be able to perform high-speed data encryption and decryption, and act as an auxiliary processor that protects the BIOS and operating system from being modified.

ioctl: A function that manages the I/O channel of the device in the device driver under the Linux operating system. The application program calls the ioctl function, and the processing logic of the function is in the driver.

DeviceIoControl: A function that directly sends control codes to the specified device driver under the Windows operating system, so that the corresponding mobile device can perform the corresponding operation. The application program calls the DeviceIoControl function, and the processing logic of the function is in the driver.

System security communication method: the secure communication channel, which refers to the way that the application program communicates with the file system filter driver through the ioctl method under the Linux operating system and the DeviceIoControl method (or proprietary API function) under the Windows operating system.

Example one:

Please refer to Figure 1. Figure 1 is a flowchart of a business data protection method in an embodiment of the present invention. The method can be applied to a file system filter driver. The method includes the following steps:

S101. Use a secure communication channel to receive an encryption and decryption request sent by a target service program.

Among them, the secure communication channel can be specifically the ioctl mode under the Linux operating system, and the mode of communicating with the file system filter driver under the Windows operating system through the DeviceIoControl mode (or proprietary API function).

Among them, the encryption and decryption request is a request for encrypting or decrypting business data.

The target business program can be any application. When the target business program needs to encrypt and decrypt business data, memory can be allocated for the business data to be encrypted and decrypted in advance to store the result data of the encryption and decryption. Then, establish a secure communication channel with the file system filter driver.

In this way, the file system filter driver can receive the encryption and decryption request sent by the target business program through the secure communication channel. The encryption and decryption request can specify the business data to be encrypted and decrypted and the memory address for storing the encryption and decryption results.

Preferably, in order to prevent too many illegal business programs from accessing the file system filter driver and occupy system resources, the file system filter driver can also be hidden. Specifically, when the file system filter driver is started, its information is removed from the kernel driver linked list. In this way, the business program cannot find the file system filter driver, and the trusted business program that requires encryption and decryption can inform the file system filter driver of the access method in advance.

S102. Verify whether the target business program is legal.

The legality of the target business program can be verified through the private verification mechanism agreed with the legal business program, and the legality of the business program can also be verified through the ID of the business program. When a private verification mechanism is adopted, the verification process can be agreed with a legal business program in advance, for example, the business program sends specified information to the file system filter driver.

Among them, the specific implementation process of verifying whether the target business program is legal based on ID can include:

Step 1: Determine whether the ID of the target business program is the ID in the trusted business program table;

Step 2. If yes, confirm that the target business procedure is legal;

Step 3. If no, determine that the target business program is illegal.

For ease of description, the above three steps are combined for description.

When judging whether the target business program is legitimate, the ID of the target business program can be obtained, and then the trusted business program table can be traversed to determine whether the target business program ID is included in the trusted business program table. If the ID is included in the trusted task program table, it is determined that the target business program is legal, otherwise the target business program is illegal.

Among them, the trusted business program table is set by pre-writing, or it can be obtained after the legality of the business program is verified through the private verification mechanism agreed with the business program. The following is a detailed description of how to obtain the trust business program table through the private verification mechanism.

Before using the secure communication channel to receive the encryption and decryption request sent by the target business program, the private verification mechanism agreed with the business program can be used to verify the legality of the business program; after the verification is passed, the ID corresponding to the legal business program is recorded in the trust In the business process table. Specifically, when the business program is started, it can communicate and interact with the file system filter driver. The file system filter driver uses a private verification mechanism for the business program to verify the legality of the business program. After the verification is passed, the ID can be recorded in the trusted business program table. middle.

After determining the legitimacy of the target business program, follow-up operations are performed according to the specific verification results. Specifically, if the target business program is legal, the operation of step S103 is performed; if the target business program is illegal, the operation of step S104 is performed.

S103. Use the key to perform encryption and decryption processing on the service data corresponding to the encryption and decryption request.

Specifically, in practical applications, a key can be used to encrypt and decrypt service data. In order to improve the security of the key, the key itself can be secured. The physical storage of the key data on the hard disk can adopt a block storage method or a random storage method.

Among them, block storage, that is, storing each part of the key data in multiple files, it is difficult for a malicious attacker to find all the files that store the key data. Even after finding all the key files, without knowing the order of these files, the key data cannot be generated.

Among them, random storage, that is, the key data is stored separately in one of multiple similar files. For a malicious attacker, it is difficult to find all similar files that store the key data. Even if I find all similar files, I don't know which file the key is stored in, let alone how to restore the key data.

That is to say, whether it is block storage or random storage, all involved files are hidden, and all involved files are protected by the kernel-driven access control mechanism. These mechanisms ensure the security of the key, which is an important part of the symmetric encryption method.

The following is a detailed description of different key protection storage methods.

The specific implementation process of encrypting and decrypting business data based on the block storage key, including:

Step 1: Read multiple block key data from a designated file that is hidden from the outside, and combine the multiple block key data to obtain a key;

Step 2: Use the key to encrypt and decrypt the service data.

Regarding the above step two, for how to use the key to encrypt and decrypt service data, please refer to the existing process of how to encrypt and decrypt data based on the key for details, which will not be repeated here.

For the above step two, in the embodiment of the present invention, a symmetric encryption and decryption algorithm can be used to perform encryption and decryption processing on the service data.

Specifically, the file system filter driver can be used from the time of startup to any time before the key is used to encrypt and decrypt the business data. It can be seen that the block key data is read from the specified file in), and the key is obtained after combining. In other words, after the file system is restarted, the key is stored in the designated file in blocks, and the designated file is hidden from the outside. In order to ensure the reliability of the block key data, the block key data can be stored in a non-volatile readable storage medium, such as a hard disk or a non-volatile memory.

Among them, after obtaining the block key data, the key can be obtained by combining the block key data. The block key data can be specifically combined by key combination logic.

Preferably, in order to prevent the key combination logic from being stolen and thereby causing the key to be leaked, in this embodiment, code obfuscation can also be performed on the key combination logic. That is, the file system filter driver can use the key combination logic after code obfuscation to combine multiple block key data to obtain the key. In this embodiment, for code obfuscation of the key combination logic, reference may be made to existing code obfuscation methods for details. For example, a flower instruction method can be used to obfuscate the key combination logic.

Preferably, in order to further improve the security of the key, in practical applications, the key generation logic can also be used to update the key periodically. Specifically, the key generation logic can be used to generate a new key periodically in combination with the transformation and combination of the designated data; wherein the designated data includes the MAC address of the hardware network card, the ID of the hardware CPU, and the current system time. And the currently generated random number; use the segment data of the new key to update the segment key data in the specified file. That is, when the key itself is updated, the block key data stored in the specified file is also updated, so that after the system restarts, the currently valid key can be obtained.

In order to avoid the inability to decrypt the data encrypted before the update due to the key update, the encrypted data is also decrypted when the key is updated. Specifically, the file system filter driver periodically modifies the key, and performs the following operations:

a) The file system filter driver is started for the first time after installation, and the initial encryption and decryption key is automatically generated. The initial key is generated in a secure way, for example: the MAC address of the hardware network card, the ID of the hardware CPU, the current system time, and the currently generated random number can be used to transform and combine to generate the key, and the generated key data can be segmented Keep in the designated file, the corresponding generation logic adopts code obfuscation (for example: flower instruction) to ensure the safety of the generation logic.

b). The file system filter driver runs for a period of time (for example: a week, the time is configurable), and the key can be automatically replaced periodically.

c) Before the key replacement, the file system filter driver informs each application in the trusted business program table that the key is to be replaced.

d) After the business application receives the key replacement notification, it uses a secure communication channel to connect to the file system filter driver, decrypts the encrypted data, and sends a complete notification to the filter driver after decryption.

e) After the file system filter driver receives the notification of completion of all business applications, it uses a secure method to generate a new key (the generation method/process is the same as the first generation of the key).

f) After the new key is generated, the file system filter driver notifies each application in the trusted service program table, and the key replacement is completed.

g) After the business application receives the notification of the completion of the key replacement, it uses a secure communication channel to connect to the file system filter driver to encrypt the data that needs to be encrypted.

h). The subsequent encryption and decryption operations of the business application all rely on the new key after the replacement.

The specific realization of the random storage key: There are multiple files in the system that can be used for key data storage. The following uses eight files as an example to describe the storage key in detail.

The eight files are randomly distributed in different positions on the hard disk. The eight files are logically ordered, and the order is only known by the filter driver. When the filter driver needs to write the key data to the hard disk, it first randomly generates a random number between 1 and 8, and then writes the key data and the random number into a file in the corresponding order after the key data and the random number are XORed. Then exclude the file written with the key data, and randomly generate a new random number between 1 and 7. You can write 7 files with dummy data (the length of the dummy data is the same as the length of the key data file, from the content Unable to judge the difference), and then add a label to a fixed position of the file corresponding to the new random number (the label indicates that this is a file that needs to be recognized by the system), and write the file sequence number in another fixed position of the file (in 8 The corresponding sequence number in the file).

After the filter driver is restarted, the contents of 8 files are read in sequence. When the contents of a certain file contain a mark, the file serial number is read in a fixed position of the file, and the file containing the key data is found according to the file serial number. Content, after XOR the relevant content with the serial number, the actual key data is obtained.

Preferably, in order to reduce the occupation of system resources, after the encryption and decryption of the business data requested by the target business program for encryption and decryption is completed, the secure communication channel with the target business program can be disconnected.

S104. Disconnect the secure communication channel with the target business program.

When it is determined that the target business program is illegal, there is no need to respond to the requested encryption and decryption request at this time, and the secure communication channel can be directly disconnected at this time.

In order to facilitate those skilled in the art to better understand the business data protection method provided by the embodiments of the present invention, the foregoing business data protection method will be described in detail below with reference to specific application scenarios as an example.

It can be seen from the foregoing that the business data protection method disclosed in the embodiment of the present invention is a pure software encryption and decryption method for application programs based on file system filter drive. This method has the characteristics of low external dependence, simple deployment and high security. The core of the method is to add a file system filter driver to the operating system where the application program is located, and realize key file hiding and access protection through the file system filter driver. Manually install the file system filter driver on the operating system that needs to be deployed (no additional installation program, higher security) and set random startup. When a business application is started for the first time, its application ID is passed to the file system filter driver using a secure communication channel. The file system filter driver removes itself from the kernel driver list at startup. When the file system filter driver receives the application ID transmitted by the business application, it first verifies the legitimacy of the business application, and then saves the application ID to the kernel space memory. The file system filter driver saves the key data used for encryption and decryption to the kernel space memory, and saves it in sections to a number of designated files. The file attribute for saving the key data is set to hidden, and ordinary users cannot view these files. When the file system filter driver is running, it monitors the files that store the key data, intercepts file access, and all access to these files will be denied. When business applications need to use encryption and decryption functions, use the system's secure communication method to pass plain text to obtain cipher text or pass cipher text to obtain plain text. The combination of business application and file system filter driver gives full play to the filter driver's ability to intercept file access in real time, hide itself, and the application cannot bypass and access its memory. It strongly guarantees the security of the encryption and decryption process and prevents business applications. The confidentiality of the program has been breached.

The salient feature of this method is that the file system filter driver is used to save and protect the key. The business application program encrypts and decrypts sensitive data through the system secure communication method (ie, secure communication channel). Any program other than the business application program cannot use the filter driver to provide With the encryption and decryption function, all programs cannot obtain and view the encryption and decryption keys.

Among them, the file system filter driver: The file system filter driver is implemented at the kernel layer of the operating system where the business application is located, and can be manually installed and configured to automatically start with the system. The file system filter driver automatically reads the block key data in the specified file and combines it into key data when it is started. If there is no block key data, it means that the file system filter driver is started after the first installation and will automatically generate encryption and decryption keys. key. When the operating system restarts, because the file system filter driver is located in the kernel space, it will start before all applications, which can well protect the key data in the specified file from being damaged. The file system filter driver receives the application ID issued by the business application and stores the application ID in the kernel linked list. After the filter driver generates the key, it saves the key data in the kernel memory and saves the key data in blocks in a designated file. The file system filter driver intercepts access to each file storing the key data in real time, and all applications' access to these files will be denied. The file system filter driver performs key replacement on a regular basis.

The file system filter driver receives the application ID of the application, and the processing steps are as follows:

a), first verify the legality of the business procedure. The legality verification adopts the private verification mechanism agreed by the business application and the file system filter driver, and the corresponding verification logic in the file system filter driver adopts code obfuscation (for example: flower instructions) to ensure the security of the verification logic. Application requests that fail the verification will be ignored.

b) After the verification is passed, the application ID is saved in the kernel linked list (a specific trust business program table).

c) When the file system filter driver monitors the service application exit, it will automatically delete the corresponding application ID information from the kernel linked list.

After the file system filter driver receives the encryption and decryption request of the business application, it can perform the following operations:

a), first verify the legality of the business procedure. Application requests that fail the verification can be ignored.

b). Determine whether the application ID requested for encryption and decryption is consistent with the saved application ID, if not, ignore this behavior.

c). If the application ID requested for encryption and decryption is consistent with the saved application ID, for the encryption and decryption request, use the key saved by the filter driver and the general security algorithm (for example: AES) for encryption and decryption, and copy the result to the application The buffer provided by the program.

Among them, business application: using the business data protection method provided by the embodiment of the present invention, the application needs to establish a connection with the file system filter driver when it is started, and then send its own application ID to the file system filter driver, and receive the file After the feedback of the system filter driver is successful, it can request encryption and decryption of the business data from the file system filter driver. After the file system filter driver is loaded, it removes itself from the kernel module linked list, so applications other than business applications cannot find the filter driver.

Specifically, the steps for a business application to issue an application ID are as follows:

a). The business application obtains its own application ID.

b) Use the system's secure communication method and a private authentication mechanism to establish a connection with the file system filter driver.

c). Send the application ID to the file system filter driver.

d) After receiving the success message of the file system filter driver, disconnect it.

Specifically, the steps for a business application to encrypt and decrypt business data are as follows:

a) The business application program allocates memory to store the encryption and decryption result data.

c). Pass the requested plaintext or ciphertext to the file system filter driver.

d). Obtain the result data returned by the file system filter driver.

e). Disconnect the file system filter driver.

f). After the encryption and decryption results are used, delete the allocated memory.

It can be seen that the business data protection method proposed by the embodiment of the present invention obtains its own application ID in the business application, passes the application ID to the file system filter driver through the system security communication method and a private authentication mechanism, and uses the additional application ID when needed. Sending request data to the file system filter driver during the decryption function. By adding a file system filter driver to the kernel layer of the operating system where the business application is located, the file system filter driver removes itself from the kernel module linked list after it is started to hide from the application, and saves the application ID linked list in the kernel memory of the file system filter driver And the key data generated in a secure manner, the key data is permanently stored in blocks in the designated hidden file, and the file system filter driver intercepts all access to the saved key file, and all accesses will fail. The file system filter driver is integrated in the operating system kernel, runs with the operating system, and is not perceived by upper-level applications. This method can guarantee the confidentiality and availability of application business sensitive data to the greatest extent without resorting to independent hardware/system/chip.

Embodiment two:

Corresponding to the above method embodiment, the embodiment of the present invention also provides a business data protection device, which can be applied to file system filter driver. The business data protection device described below and the business data protection method described above can interact with each other. Corresponding reference.

As shown in Figure 2, the device includes the following modules:

The encryption and decryption request obtaining module 101 is configured to receive the encryption and decryption request sent by the target business program by using the secure communication channel;

The legality verification module 102 is used to verify whether the target business program is legal;

The encryption and decryption processing module 103 is configured to perform encryption and decryption processing on the business data corresponding to the encryption and decryption request by using the key if the target business program is legal;

The data protection module 104 is configured to disconnect the secure communication channel with the target business program if the target business program is illegal.

Using the device provided by the embodiment of the present invention, the secure communication channel is used to receive the encryption and decryption request sent by the target business program; verify whether the target business program is legal; if so, use the key to perform encryption and decryption processing on the business data corresponding to the encryption and decryption request ; If not, disconnect the secure communication channel with the target business program.

In order to ensure the security of the key itself, in this embodiment, in order to ensure the security of the business data, the legitimacy of the target business program is first verified. After determining that the target business program is legal, the key is used to perform the encryption and decryption request on the business data corresponding to the encryption and decryption request. Encryption and decryption processing. If it is determined that the target business program is illegal, the secure channel with the target business program can be disconnected directly. It can be seen that in this device, the file system filter driver can realize the encryption and decryption protection of business data without adding hardware equipment. In addition, since the encryption and decryption request is transmitted through the secure communication channel, the legality of the target business program is verified , It realizes multiple protection of business data from multiple protection angles, which can guarantee the security of business data.

In a specific embodiment of the present invention, it further includes:

The key update module is used to update the key regularly using the key generation logic.

In a specific embodiment of the present invention, the key update module is specifically configured to periodically use the key generation logic to generate a new key in combination with the transformation and combination corresponding to the designated data; wherein, the designated data includes The MAC address of the hardware network card, the ID of the hardware CPU, the current system time and the currently generated random number; use the segment data of the new key to update the segment key data in the specified file.

In a specific embodiment of the present invention, it further includes: a key acquisition module, which is used to read multiple block key data from a designated file that is hidden from the outside after the file system is restarted, and to Combine the pieces of key data to obtain the key.

In a specific embodiment of the present invention, the key acquisition module is specifically configured to use the key combination logic after code obfuscation to combine multiple block key data to obtain the key.

In a specific embodiment of the present invention, it further includes: a driver stealth module, which is used to extract its own information from the kernel driver linked list when the file system filter driver is started.

In a specific embodiment of the present invention, the legality verification module 102 is specifically used to determine whether the ID of the target business program is an ID in the trusted business program table; if it is, it is determined that the target business program is legal; if not, then Determine that the target business program is illegal.

In a specific embodiment of the present invention, it further includes: a trust business program table acquisition module, which is used to use the private verification mechanism agreed with the business program before receiving the encryption and decryption request sent by the target business program through the secure communication channel. The legality of the business program is verified; after the verification is passed, the ID corresponding to the legal business program is recorded in the trusted business program table.

Embodiment three:

Corresponding to the above method embodiment, the embodiment of the present invention also provides a service data protection device. The service data protection device described below and the service data protection method described above can be referenced correspondingly.

As shown in Figure 3, the service data protection equipment includes:

The memory D1 is used to store computer programs;

The processor D2 is configured to implement the steps of the business data protection method in the foregoing method embodiment when the computer program is executed.

Specifically, please refer to FIG. 4, which is a schematic diagram of the specific structure of a business data protection device provided by this embodiment. The business data protection device may have relatively large differences due to different configurations or performance, and may include one or more processes. A central processing unit (CPU) 322 (for example, one or more processors), a memory 332, and one or more storage media 330 (for example, one or more storage devices with a large amount of data) storing application programs 342 or data 344. Among them, the memory 332 and the storage medium 330 may be short-term storage or persistent storage. The program stored in the storage medium 330 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the data processing device. Furthermore, the central processing unit 322 may be configured to communicate with the storage medium 330, and execute a series of instruction operations in the storage medium 330 on the service data protection device 301.

The business data protection device 301 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input and output interfaces 358, and/or one or more operating systems 341. For example, Windows Server ^TM , Mac OS X ^TM , Unix ^TM , Linux ^TM , FreeBSD ^TM and so on.

The steps in the business data protection method described above can be implemented by the structure of the business data protection device.

Embodiment four:

Corresponding to the above method embodiment, the embodiment of the present invention also provides a readable storage medium, and a readable storage medium described below and a service data protection method described above can be referenced correspondingly.

A readable storage medium in which a computer program is stored, and when the computer program is executed by a processor, the steps of the business data protection method in the foregoing method embodiment are implemented.

The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk, or an optical disk that can store program codes. Readable storage medium.

Professionals may further realize that the units and algorithm steps of the examples described in the embodiments disclosed in this article can be implemented by electronic hardware, computer software, or a combination of the two, in order to clearly illustrate the possibilities of hardware and software. Interchangeability, in the above description, the composition and steps of each example have been generally described in accordance with the function. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of the present invention.

Claims

A business data protection method, characterized in that it is applied to a file system filter driver, and includes:

Use the secure communication channel to receive the encryption and decryption request sent by the target business program;

Verify that the target business program is legal;

If so, use the key to perform encryption and decryption processing on the service data corresponding to the encryption and decryption request;

If not, disconnect the secure communication channel with the target business program.
The business data protection method according to claim 1, further comprising:

The key generation logic is used to update the key periodically.
The service data protection method according to claim 2, wherein said periodically updating said key using key generation logic comprises:

Regularly use the key generation logic and combine the transformation and combination of the designated data to generate a new key; wherein the designated data includes the MAC address of the hardware network card, the ID of the hardware CPU, the current system time and the currently generated random number;

Using the segment data of the new key to update the segment key data in the designated file.
The business data protection method according to claim 1, wherein after the file system is restarted, the method further comprises:

Read multiple block key data from a designated file that is hidden from the outside, and combine the multiple block key data to obtain the key.
The service data protection method according to claim 4, wherein the combining multiple block key data to obtain the key comprises:

The key combination logic after code obfuscation is used to combine a plurality of the block key data to obtain the key.
The business data protection method according to claim 1, further comprising:

When the file system filter driver is started, its own information is removed from the kernel driver linked list.
The business data protection method according to claim 1, wherein verifying whether the target business program is legal comprises:

Determine whether the ID of the target business program is the ID in the trusted business program table;

If it is, it is determined that the target business procedure is legal;

If not, it is determined that the target business program is illegal.
The service data protection method according to claim 7, characterized in that, before said using the secure communication channel to receive the encryption and decryption request sent by the target service program, the method further comprises:

Use the private verification mechanism agreed with the business program to verify the legality of the business program;

After the verification is passed, the ID corresponding to the legal business program is recorded in the trusted business program table.
A business data protection device, which is characterized in that it is applied to a file system filter driver, and includes:

The encryption and decryption request obtaining module is used to receive the encryption and decryption request sent by the target business program through the secure communication channel;

The legality verification module is used to verify whether the target business program is legal;

The encryption and decryption processing module is configured to perform encryption and decryption processing on the business data corresponding to the encryption and decryption request if the target business program is legal;

The data protection module is configured to disconnect the secure communication channel with the target business program if the target business program is illegal.
The service data protection device according to claim 9, further comprising:

The key update module is used to periodically update the key using key generation logic.
The service data protection device according to claim 10, wherein the key update module is specifically configured to periodically generate a new key by using the key generation logic in combination with the transformation and combination corresponding to the specified data; Wherein, the designated data includes the MAC address of the hardware network card, the ID of the hardware CPU, the current system time and the currently generated random number; the segment data of the new key is used to block the segment in the designated file The key data is updated.
The business data protection device according to claim 9, further comprising: a key acquisition module, configured to read multiple blocks from a designated file that is hidden from the outside after the file system is restarted Key data, and combine multiple block key data to obtain the key.
A business data protection device, which is characterized in that it comprises:

Memory, used to store computer programs;

The processor is configured to implement the steps of the service data protection method according to any one of claims 1 to 8 when the computer program is executed.
A readable storage medium, characterized in that a computer program is stored on the readable storage medium, and when the computer program is executed by a processor, the steps of the business data protection method according to any one of claims 1 to 8 are realized .