Software automatic segmentation method, system, storage medium, computer equipment, terminal

Abstract

The invention belongs to the technical field of application program security area division, and discloses a software automatic division method, system, storage medium, computer equipment, and terminal, that is, the MulTEE partition framework. Users need to first annotate security-sensitive application program data; MulTEE will automatically Divide the application program into untrusted modules and multiple secure modules, each security module is the smallest program slice of the sensitive data, use backward data flow analysis to identify code that may affect the confidentiality of sensitive data, use the previous Slices are used to identify code that may affect the integrity of sensitive data; security-sensitive modules are deployed in security zones to protect them from attacks. The present invention evaluates MulTEE on Memcached database, LibreSSL cryptography library and Digital Bitbox bitcoin wallet, and the results show that it achieves smaller TCB size with acceptable performance overhead.

Description

technical field [0001] The invention belongs to the technical field of application security zone division, and in particular relates to a software automatic division method, system, storage medium, computer equipment and terminal. Background technique [0002] Currently, applications are increasingly deployed in third-party data centers and public cloud environments that are not fully trusted, such as Amazon AWS and Microsoft Azure. This places very high demands on cloud data centers, which must protect sensitive data from attackers with the highest privileges, such as system administrators. The use of encryption technology to protect sensitive data has relatively large restrictions on the operations that can be performed. Although fully homomorphic encryption technology allows users to perform arbitrary operations, it will generate large computational overhead. A new direction in protecting applications in untrusted environments is to use the trusted execution mechanisms p...

AI Technical Summary

Problems solved by technology

[0009] When using the SGX function to protect the application, the application needs to be modified and refactored, which has strict requirements on the developer and requires a complex trade-off between performance and security. Currently, there is no suitable theory to Support developers how to divide applications in multiple security zones

[0010] The segmentation problem of multi-security zone applications first needs to solve the problem of segmentation method, that is, how to reasonably divide the application program into multiple modules, and reduce the coupling between modules as much as possible, because the mutual calls between modules Will introduce a large performance overhead

Images