Trusted authorization method, system and related device for service software of trusted controller

Abstract

The invention provides a credible authorization method and system for service software of a credible controller and a related device, and belongs to the technical field of credible controllers, and the method comprises the following steps: respectively collecting hardware feature information and service software operation behavior data of equipment; performing abnormal behavior detection through a pre-trained machine learning model in combination with historical behavior data of business software of the equipment and the collected hardware feature information and business software operation behavior data; and according to the hardware feature information of the equipment, the operation behavior data of the service software and the output result of the machine learning model, generating a unique authorization token through a preset encryption algorithm and a key, and taking the unique authorization token as a certificate for accessing the service software. According to the method, the hardware feature information of the equipment is combined with the operation behavior of the business software for authorization judgment, and an abnormal behavior detection mode of combining the real-time operation behavior of the business software with machine learning is adopted, so that illegal access and operation to the business software can be effectively prevented, and the security of the business software is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of trusted controllers, and in particular relates to a trusted authorization method, system and related devices for business software of a trusted controller. Background Art

[0002] A trusted controller usually refers to a key device or system that is responsible for executing security policies, monitoring network behavior, and ensuring the security of data transmission and storage in a specific network environment. In a business software environment, a trusted controller plays multiple roles such as authorization management, security auditing, and data protection. Trusted authorization refers to ensuring the legitimacy and credibility of business software during authorized use through a series of secure and reliable mechanisms and technical means. It involves multiple aspects such as software license verification, user identity confirmation, and authorization scope control. Through strict authorization control, unauthorized users can be restricted from accessing sensitive data, thereby ensuring the security and privacy of user data. Trusted authorization helps reduce the risk of illegal access and malicious attacks, and improves the stability and reliability of the entire system.

[0003] Trusted authorization of business software of trusted controller is a complex process involving multiple levels, which needs to be realized by means of encryption technology, identity authentication and access control, authorization management system and cloud authorization technology. Through trusted authorization, the security, legality and credibility of business software can be ensured during the authorized use process.

[0004] Formulating a reasonable authorization strategy is the basis for ensuring trusted authorization. The authorization strategy should clarify key elements such as the scope of use of the software, the authorization period, and the number of authorizations. Establishing a sound security mechanism is the key to ensuring trusted authorization. The security mechanism should include encryption technology, identity authentication and access control, log auditing and other aspects. Providing necessary technical support and services is the guarantee for the smooth implementation of trusted authorization. Technical support and services should include the installation, configuration, debugging and daily maintenance of the authorization management system. With the rapid development of information technology, the security of business software has become an important part of enterprise operations that cannot be ignored. However, traditional business software authorization methods often have security risks and complex management. Summary of the invention

[0005] The purpose of the present invention is to provide a trusted controller business software trusted authorization method, system and related devices to address the problems in the above-mentioned prior art, so as to achieve efficient, safe and reliable access control to business software.

[0006] In order to achieve the above object, the present invention has the following technical solutions: In a first aspect, a trusted controller service software trusted authorization method is provided, comprising: Collect the hardware feature information of the device and the business software operation behavior data respectively; Combine the historical behavior data of the device's business software with the collected hardware feature information and business software operation behavior data to detect abnormal behavior through a pre-trained machine learning model; Based on the hardware feature information of the device, the business software operation behavior data, and the output results of the machine learning model, a unique authorization token is generated through a preset encryption algorithm and key as a credential for accessing the business software.

[0007] As a preferred solution, the hardware feature information of the device is collected through the hardware security module of the trusted controller, and the hardware feature information includes the central processing unit CPU serial number and the motherboard model.

[0008] As a preferred solution, the running behavior of the business software is monitored in real time through a software behavior analysis engine, and corresponding business software running behavior data is generated.

[0009] As a preferred solution, the business software operation behavior data includes function call sequence and memory usage.

[0010] As a preferred solution, after a unique authorization token is generated through a preset encryption algorithm and key as a credential for accessing the business software, when a business software access request is received from the access object, the authorization token held by the access object is compared and verified with the authorization token stored in the hardware security module to verify whether the authorization token held by the access object is correct. Only the access object that passes the verification can obtain access rights to the business software.

[0011] In a second aspect, a trusted controller business software trusted authorization system is provided, including: The data collection module is used to collect the hardware feature information of the device and the business software operation behavior data respectively; The abnormal behavior detection module is used to detect abnormal behavior through a pre-trained machine learning model by combining the historical behavior data of the device's business software with the collected hardware feature information and business software operation behavior data; The trusted authorization module is used to generate a unique authorization token as a credential for accessing the business software based on the hardware feature information of the device, the business software operation behavior data, and the output results of the machine learning model through a preset encryption algorithm and key.

[0012] As a preferred solution, the data acquisition module monitors the operating behavior of the business software in real time through the software behavior analysis engine, and generates corresponding business software operating behavior data; the business software operating behavior data includes function call sequences and memory usage.

[0013] As a preferred solution, when the trusted authorization module receives a business software access request from an access object, it compares and verifies the authorization token held by the access object with the authorization token stored in the hardware security module to verify whether the authorization token held by the access object is correct. Only the access object that passes the verification can obtain access rights to the business software.

[0014] According to a third aspect, an electronic device is provided, including: A memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the trusted authorization method for trusted controller business software.

[0015] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the trusted authorization method for business software of a trusted controller is implemented.

[0016] Compared with the prior art, the present invention has at least the following beneficial effects: By combining the hardware feature information of the device with the business software operation behavior data for authorization determination, and adopting an abnormal behavior detection method that combines real-time business software operation behavior with machine learning, the present invention can effectively prevent illegal access and operation of business software, thereby improving the security of business software. The present invention adopts an integrated authorization and remote management function, which simplifies traditional certificate management and password maintenance work and reduces management costs. In addition, since the authorization token is generated based on the hardware feature information of the device and the business software operation behavior data, and combined with the output results of the machine learning model, there is no need for frequent identity authentication or password verification, thereby improving the operating efficiency of the business software. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 Flow chart of a trusted authorization method for business software of a trusted controller according to an embodiment of the present invention; Figure 2 A structural block diagram of a trusted authorization system for trusted controller business software according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, ordinary technicians in this field can also obtain other embodiments without making creative work.

[0020] Business software authorization methods often face challenges of security risks and management complexity. These problems mainly stem from multiple links in the design, implementation and maintenance of the authorization mechanism. Among them, the authorization key may be leaked to unauthorized users by internal personnel or stolen through hacker attacks. At the same time, users may bypass the authorization check by modifying the software, using cracking tools or finding software vulnerabilities. As the number of users increases, authorization management becomes complicated, including authorization application, approval, distribution and tracking. Therefore, it is necessary to adopt an automated authorization management system to simplify the process and improve efficiency. The system should support functions such as batch processing, automatic renewal, and remote management. In addition, the software may need to run on multiple versions and platforms, which complicates authorization management. It is necessary to design flexible authorization strategies to support cross-version and cross-platform authorization management, and provide clear version upgrade and migration paths to reduce the workload of users and administrators. Existing authorization technologies, such as cloud-based authorization services and Software as a Service (SaaS) models, can simplify the authorization management process and improve security. However, with the development of technology and changes in the market, authorization strategies and management systems are constantly optimized and updated to adapt to new needs and challenges.

[0021] See also Figure 1 The embodiment of the present invention provides a trusted controller business software trusted authorization method, which mainly includes: S1. Collect the hardware feature information and business software operation behavior data of the device respectively; S2. Combine the historical behavior data of the device with the collected hardware feature information and business software operation behavior data, and perform abnormal behavior detection through a pre-trained machine learning model; To make this step clearer, the training process of the machine learning model is explained in detail below.

[0022] First, a large amount of device hardware feature information, business software operation behavior data and corresponding labels related to the authorized business software are collected. The labels are used to identify whether the data is abnormal behavior.

[0023] Then, the collected data is preprocessed, including data cleaning, normalization and other operations to ensure the quality and consistency of the data.

[0024] Next, select a suitable machine learning algorithm, such as support vector machine, random forest, deep learning, etc. According to the requirements of the machine learning algorithm, divide the preprocessed data into training set and test set.

[0025] Use the training set to train the machine learning model and continuously adjust the parameters of the machine learning model to improve the accuracy and generalization ability of the machine learning model. During the training process, techniques such as cross-validation can be used to evaluate the performance of the machine learning model.

[0026] Finally, the trained machine learning model is evaluated using the test set to ensure that the machine learning model can accurately detect abnormal behavior.

[0027] S3. Based on the hardware feature information of the device, the business software operation behavior data, and the output results of the machine learning model, a unique authorization token is generated through a preset encryption algorithm and key as a credential for accessing the business software.

[0028] The generation of authorization tokens is based on the hardware feature information of the device, the business software operation behavior data, and the output of the machine learning model. First, the hardware feature information is encoded, such as the CPU (Central Processing Unit) serial number and motherboard model are hashed to obtain a fixed-length encoding value.

[0029] Then, the business software operation behavior data is analyzed and key features are extracted. For example, for function call sequences, frequently occurring function call patterns can be extracted; for memory usage, features such as average memory usage and peak memory usage can be extracted.

[0030] The extracted key features are combined with the encoded values ​​of the hardware feature information and combined with the output of the machine learning model. If the machine learning model detects abnormal behavior, some special identification or encryption parameters can be added when generating the authorization token to improve the security of the authorization token.

[0031] Next, the combined information is encrypted using a preset encryption algorithm and key to generate a unique authorization token. The encryption algorithm can be a symmetric encryption algorithm or an asymmetric encryption algorithm, and the key can be managed and distributed by the system administrator.

[0032] The generated authorization token is used as a credential for accessing the business software, which is unique and cannot be forged. Only a legitimate authorization token can gain access to the business software.

[0033] In one possible implementation, the hardware feature information of the device is collected through the hardware security module of the trusted controller. The hardware feature information includes the CPU serial number and motherboard model, etc. This information is not only used to generate an authorization token, but also serves as an input for the machine learning model to identify potential device risks.

[0034] The trusted authorization method for trusted controller service software of the embodiment of the present invention further includes the step of storing the authorization token in a hardware security module, and the hardware security module ensures that the authorization token is not illegally obtained or tampered with.

[0035] The hardware security module of the embodiment of the present invention has encryption and decryption functions, and provides security protection for data transmission and storage.

[0036] The hardware security module (HSM) of the trusted controller plays a vital role in protecting sensitive data and performing critical tasks. The hardware security module is an independent hardware device specially designed to provide high-security protection. It ensures the confidentiality and integrity of data during storage and transmission through hardware-level security mechanisms. The hardware security module of the embodiment of the present invention uses hardware-level encryption algorithms and key management mechanisms to achieve secure storage and transmission of data. The hardware security module provides identity authentication and access control functions to ensure that only authorized users can access sensitive data. The hardware security module supports a variety of encryption standards and protocols to meet the security requirements in different application scenarios.

[0037] Furthermore, the role of the hardware security module in the trusted controller includes: the hardware security module can securely store and manage key information such as encryption keys and sensitive data to prevent data leakage and illegal access. The hardware security module supports secure communication protocols such as SSL (Secure Sockets Layer) / TLS (Transport Layer Security), etc., to ensure that the communication between the trusted controller and other systems or components is encrypted and integrity protected. The hardware security module can verify the integrity of the boot loader and operating system of the trusted controller to ensure that the system startup process is not affected by malicious attacks. The hardware security module provides secure key management functions, including full life cycle management such as key generation, storage, use, update and destruction, to ensure the security and confidentiality of the key.

[0038] The hardware security module of the embodiment of the present invention generally adopts an anti-tampering packaging design and has strong physical protection capabilities to prevent physical attacks and destruction. The hardware security module has a built-in dedicated encryption engine, supports multiple encryption algorithms and protocols, and provides efficient encryption and decryption services. The hardware security module ensures that sensitive data and key operations are executed in an isolated environment through a hardware isolation mechanism to prevent external interference and attacks. The hardware security module supports remote monitoring and traceability functions, can monitor the security status of the system in real time, and trace and respond in a timely manner when a security incident occurs. In summary, the hardware security module of the trusted controller plays an irreplaceable role in protecting sensitive data and performing critical tasks. By adopting a hardware security module, the security and reliability of the system can be significantly improved, providing solid security protection for various application scenarios.

[0039] In a possible implementation, when collecting the business software running behavior data of the device, the running behavior of the business software is monitored in real time by a software behavior analysis engine, and corresponding business software running behavior data is generated.

[0040] Furthermore, the business software operation behavior data includes function call sequence and memory usage.

[0041] The software behavior analysis engine is an analysis tool based on big data and artificial intelligence technology, which can collect, process and analyze various data during the software operation process. The software behavior analysis engine can collect and analyze data during the software operation process in real time, find problems in time and take measures. It also uses advanced algorithms and models to process and analyze data to ensure the accuracy and reliability of the results. At the same time, it supports large-scale data processing and analysis, and can cope with the growing amount of data and users. With the continuous development of big data and artificial intelligence technology, the software behavior analysis engine will become more and more intelligent and automated.

[0042] Through the method of the present invention, the hardware security module in the trusted controller provides hardware-level encryption and key management functions, ensuring that the generation, storage, use and destruction of keys during the authorization process are all carried out in a secure environment to prevent key leakage and illegal use. Through the identity authentication mechanism of the trusted controller, it can be ensured that only authorized users or systems can access the business software, effectively preventing unauthorized access and data leakage. The trusted controller can monitor the behavior of the software during operation, including authorization requests, operation records, etc., and conduct audits to promptly detect abnormal behavior and take measures.

[0043] The trusted controller supports dynamic adjustment of authorization policies based on user roles, permissions, time and other conditions to achieve fine-grained authorization management. For example, the access rights of users can be automatically adjusted according to changes in their positions to improve management efficiency. By integrating an automated authorization management system, the trusted controller can automatically handle authorization application, approval, distribution and recycling processes, reduce manual intervention and reduce management costs. The trusted controller can also support multiple operating systems and platforms, realize cross-platform authorization management, and ensure the consistency and security of authorization of business software in different environments.

[0044] The trusted controller of the embodiment of the present invention adopts high availability and fault tolerance design to ensure that the authorization service can still operate normally in the event of a single point failure or network failure, thereby ensuring business continuity. Through the software behavior analysis engine, the trusted controller can identify abnormal behavior patterns during software operation, such as unauthorized access, data leakage, etc., and promptly issue alarms and take measures. The application of the software behavior analysis engine in the trusted authorization of the trusted controller business software not only enhances the security, flexibility and efficiency of software authorization, but also ensures business continuity and compliance, while achieving in-depth analysis and optimization of software behavior. These advantages make the trusted controller an indispensable part of the business software architecture.

[0045] Furthermore, when an embodiment of the present invention receives a business software access request from an access object, the authorization token held by the access object is compared and verified with the authorization token stored in the hardware security module to verify whether the authorization token held by the access object is correct. Only the access object that passes the verification can obtain access rights to the business software.

[0046] Through the authorization method combining hardware features with software behavior and the combination of real-time behavior analysis with machine learning, the present invention can effectively prevent illegal access and operation and improve the security of business software. At the same time, the method of the present invention can be implemented using an integrated authorization device and has a remote management function, which simplifies traditional certificate management and password maintenance work and reduces management costs. In addition, since the authorization token is generated based on hardware features and software behavior, and combined with the output results of the machine learning model, there is no need for frequent identity authentication or password verification, which improves the operating efficiency of the business software.

[0047] Through the above steps, the trusted controller business software trusted authorization method of the present invention can achieve efficient, safe and reliable business software access control, and provide a strong guarantee for the informatization construction of industrial sites.

[0048] See also Figure 2 Another embodiment of the present invention further provides a trusted controller business software trusted authorization system 200, including: The data collection module 201 is used to collect the hardware feature information and the business software operation behavior data of the device respectively; The abnormal behavior detection module 202 is used to perform abnormal behavior detection through a pre-trained machine learning model by combining the historical behavior data of the device's business software and the collected hardware feature information and business software operation behavior data; The trusted authorization module 203 is used to generate a unique authorization token as a credential for accessing the business software based on the hardware feature information of the device, the business software operation behavior data, and the output results of the machine learning model through a preset encryption algorithm and key.

[0049] In a possible implementation, the data acquisition module 201 monitors the operation behavior of the business software in real time through the software behavior analysis engine, and generates corresponding business software operation behavior data, where the business software operation behavior data includes function call sequences and memory usage.

[0050] In one possible implementation, when the trusted authorization module 203 receives a business software access request from an access object, it compares and verifies the authorization token held by the access object with the authorization token stored in the hardware security module to verify whether the authorization token held by the access object is correct. Only the access object that passes the verification can obtain access rights to the business software.

[0051] Another embodiment of the present invention further provides an electronic device, comprising: A memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the trusted controller business software trusted authorization method.

[0052] Another embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the trusted authorization method for trusted controller business software is implemented.

[0053] Exemplarily, the instructions stored in the memory may be divided into one or more modules / units, which are stored in a computer-readable storage medium and executed by the processor to complete the trusted authorization method for trusted controller business software described in an embodiment of the present invention. The one or more modules / units may be a series of computer-readable instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the server.

[0054] The electronic device may be a computing device such as a smart phone, a notebook, a PDA, and a cloud server. The electronic device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the electronic device may also include more or fewer components, or a combination of certain components, or different components, for example, the electronic device may also include an input / output device, a network access device, a bus, etc.

[0055] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0056] The memory may be an internal storage unit of the server, such as a hard disk or memory of the server. The memory may also be an external storage device of the server, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the server. Furthermore, the memory may include both an internal storage unit of the server and an external storage device. The memory is used to store the computer-readable instructions and other programs and data required by the server. The memory may also be used to temporarily store data that has been output or is to be output.

[0057] It should be noted that the information interaction, execution process and other contents between the above-mentioned module units are based on the same concept as the method embodiment. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0058] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0059] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera device / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0060] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0061] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A trusted controller business software trusted authorization method, characterized in that: include: Collect the hardware feature information of the device and the business software operation behavior data respectively; Combine the historical behavior data of the device's business software with the collected hardware feature information and business software operation behavior data to detect abnormal behavior through a pre-trained machine learning model; Based on the hardware feature information of the device, the business software operation behavior data, and the output results of the machine learning model, a unique authorization token is generated through a preset encryption algorithm and key as a credential for accessing the business software.

2. The trusted authorization method for trusted controller business software according to claim 1, characterized in that: The hardware feature information of the device is collected through the hardware security module of the trusted controller. The hardware feature information includes the central processing unit CPU serial number and motherboard model.

3. The trusted authorization method for trusted controller business software according to claim 1, characterized in that: The software behavior analysis engine monitors the running behavior of business software in real time and generates corresponding business software running behavior data.

4. The trusted controller business software trusted authorization method according to claim 3, characterized in that: The business software operation behavior data includes function call sequence and memory usage.

5. The trusted authorization method for trusted controller business software according to claim 1, characterized in that: After a unique authorization token is generated through a preset encryption algorithm and key as a credential for accessing the business software, when a business software access request is received from the access object, the authorization token held by the access object is compared and verified with the authorization token stored in the hardware security module to verify whether the authorization token held by the access object is correct. Only the access object that passes the verification can obtain access to the business software.

6. A trusted controller business software trusted authorization system, characterized in that: include: The data collection module is used to collect the hardware feature information of the device and the business software operation behavior data respectively; The abnormal behavior detection module is used to detect abnormal behavior through a pre-trained machine learning model by combining the historical behavior data of the device's business software with the collected hardware feature information and business software operation behavior data; The trusted authorization module is used to generate a unique authorization token as a credential for accessing the business software based on the hardware feature information of the device, the business software operation behavior data, and the output results of the machine learning model through a preset encryption algorithm and key.

7. The trusted controller business software trusted authorization system according to claim 6, characterized in that: The data acquisition module monitors the operation behavior of the business software in real time through the software behavior analysis engine, and generates corresponding business software operation behavior data; the business software operation behavior data includes function call sequence and memory usage.

8. The trusted controller business software trusted authorization system according to claim 6, characterized in that: When the trusted authorization module receives a business software access request from an access object, it compares and verifies the authorization token held by the access object with the authorization token stored in the hardware security module to verify whether the authorization token held by the access object is correct. Only the access object that passes the verification can obtain access rights to the business software.

9. An electronic device, characterized in that: include: A memory storing at least one instruction; and a processor, which executes instructions stored in the memory to implement the trusted authorization method for business software of a trusted controller according to any one of claims 1 to 5.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the trusted controller service software trusted authorization method according to any one of claims 1 to 5 is implemented.

Images