A trusted root-based full-link data security protection system and method

Abstract

The application discloses a kind of whole-link data security protection system and method based on trusted root, belong to the technical field of information security;Link data transmission structure includes several substructures, substructure includes operating system, application program, internal hardware and transmission channel as encryption object, encrypt encryption object, and encryption content is as follows: set trusted platform module as trusted root encryption tool;Operating system includes identity authentication password and authority management;Application program encryption includes login password and hierarchical application lock;Internal hardware includes BIOS, hard disk and memory data encryption;Communication encryption determination module is arranged at both ends of transmission channel;The application adopts the above system and method, and based on trusted platform module (TPM) as hardware trusted root realizes operating system identity authentication and authority management, system application program hierarchical encryption mechanism, hardware layer data encryption module and transmission channel double-end encryption process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data transmission, and in particular to a full-link data security protection system and method based on a trusted root. BACKGROUND

[0002] In the current high-speed development of digital economy, the liquidity and value density of data as a core production factor have significantly improved, but the security threats that come with it also show the characteristics of full-link penetration and concealment evolution. The traditional security protection system faces many challenges: the lack of trust measurement, the existing system relies on software layer encryption and boundary protection (such as firewalls, IDS), but cannot verify the integrity of underlying components such as hardware firmware and boot chain. Attackers can use UEFI firmware vulnerabilities or supply chain pollution to implant persistent backdoors, rendering encryption mechanisms useless. When dynamic prevention breaks down, data flows across cloud, terminal, and edge devices, and traditional solutions can only achieve single-point static prevention, lacking real-time blocking capabilities for runtime risks such as memory tampering and unauthorized API calls within the processing link. Audit of a certain financial institution showed that 68% of the leaks were caused by misuse of internal processing links. SUMMARY

[0003] The purpose of the present application is to provide a full-link data security protection system and method based on a trusted root, which uses an independently set hardware chip as a trusted root and uses the trusted root as an underlying trust structure. Because the independently set hardware chip is tamper-proof, it extends a set of link data transmission methods based on the trusted root as the base.

[0004] To achieve the above purpose, the present application provides a full-link data security protection system based on a trusted root, which includes a plurality of substructures in the link data transmission structure. The substructure includes an operating system, an application program, internal hardware, and a transmission channel as an encryption object, and the encryption object is encrypted. The encryption content is as follows:

[0005] A trusted platform module is set as a trusted root encryption tool;

[0006] The operating system includes identity authentication passwords and permission management;

[0007] The application program encryption includes login passwords and hierarchical application locks;

[0008] The internal hardware includes data encryption of BIOS, hard disk, and memory;

[0009] A communication encryption determination module is provided at both ends of the transmission channel.

[0010] Preferably, the encryption content corresponds to the following:

[0011] The trusted platform module is specifically configured as a security chip TPM, and corresponds to implementation of hardware verification, software verification, an independent storage area, and trust transmission.

[0012] The identity authentication password in the operating system is stored in the independent storage area, the authority management has different authority settings corresponding to different identity authentication passwords, and the settings related to the authority are stored in the independent storage area.

[0013] The login password of the application program is stored in the hard disk of the internal hardware, and the hierarchical application lock is stored in the settings of the authority management, so as to limit the application use authority under different identity authentication passwords.

[0014] In the internal hardware, the trusted platform module verifies the data in the BIOS, the hard disk and the memory, and the verification is realized through the hardware verification of the trusted platform module.

[0015] In the transmission channel, the transmission channel is an optical fiber or a network cable, the communication encryption measurement module encrypts the communication content, and the communication encryption measurement modules at both ends authenticate each other.

[0016] Preferably, in the trusted platform authentication module, the hardware verification is used to verify the current internal hardware information, and when the hardware does not change, the hardware verification is passed.

[0017] The software verification verifies the program in the current hard disk, and when the program does not change, the software verification is passed.

[0018] The independent storage area is set independently of other hardware and is used to store encryption-related content.

[0019] Trust transmission, when the trusted platform authentication module completes the sub-structure verification, the trust information is transmitted to the next sub-structure, otherwise the process is terminated.

[0020] Preferably, the communication encryption measurement module is in communication connection with the trusted platform authentication module, authentication information is added in the process of transmitting information, the communication encryption measurement module realizes the authentication of information and the accuracy of the next sub-structure through the verification of bidirectional authentication information.

[0021] A full-link data security protection method based on a trusted root includes the following steps:

[0022] Step 1: In the link data transmission structure, each sub-structure is provided with a trusted authentication platform module;

[0023] Step 2: The trusted authentication platform realizes the trust verification of the sub-structure itself;

[0024] Step 3: Through the communication encryption measurement module, information is transmitted to the next sub-structure;

[0025] Step four: when the communication encryption determination module or the trusted authentication platform fails to pass the verification, stop the transmission of the current link data.

[0026] Preferably, the trusted authentication platform realizes the specific process of the trust verification of the substructure itself in step two as follows: the trusted authentication platform first verifies the hash value of the BIOS and internal hardware firmware in the substructure startup process, stores it in an independent storage area, and if the hash value matches the pre-stored value, then verifies whether the package name and version number of the application program in the hard disk are consistent with the default, and when the verification result is consistent, it is normally started; otherwise, the startup is prevented.

[0027] Preferably, the process of transmitting information to the next substructure through the communication encryption determination module in step three is as follows: in the upstream communication encryption determination module, a plurality of sets of level sequences are set as encryption sequences, and the content of the encryption sequence is added to the information in the transmission channel according to the cycle time, and when the corresponding encryption sequence is detected in the downstream communication encryption determination module, it is judged that the information is correct, otherwise the link data transmission is stopped.

[0028] Therefore, the application adopts the above-mentioned full-link data security protection system and method based on a trusted root, which has the following advantages:

[0029] In the application, a hardware-level trust anchor is realized by a TPM chip, a complete trust chain from the BIOS firmware, the operating system and the application is constructed, when the verification fails, the link data transmission is stopped, information leakage is avoided, the firmware is automatically verified in the pre-startup stage of the substructure, the supply chain attack is blocked, the memory and process integrity are maintained during running, and the implantation attack is avoided.

[0030] The technical solutions of the embodiments of the application will be further described in detail below with reference to the drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 The flowchart of the full-link data security protection method based on a trusted root of the application. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical scheme and advantages of the embodiments of the application clearer, the technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are part of the embodiments of the application, rather than all the embodiments. The components of the embodiments of the application described and shown in the drawings can be arranged and designed in various different configurations. The specific model specifications need to be selected and determined according to the actual specifications of the device. The specific selection calculation method adopts the existing technology in the art, and therefore will not be described in detail.

[0033] EMBODIMENT

[0034] like Figure 1 As shown, this invention provides a full-link data security protection system based on a root of trust. The link data transmission structure includes several substructures, each including an operating system, application program, internal hardware, and transmission channel as encryption objects. The encryption objects are encrypted, and the specific encryption content is as follows:

[0035] The Trusted Platform Module is configured as a trusted root encryption tool; the Trusted Platform Module is specifically configured as a security chip TPM, which implements hardware verification, software verification, independent storage area and trust transfer.

[0036] In the Trusted Platform Authentication module, hardware verification is used to verify the current internal hardware information. If the hardware has not changed, the hardware verification will pass.

[0037] The software verification checks the programs currently on the hard drive. If the programs have not changed, the software verification passes.

[0038] Independent storage area: A storage area separate from other hardware, used to store encrypted content;

[0039] Trust transfer: Once the trusted platform authentication module has completed the verification of a substructure, it will pass the trust information to the next substructure; otherwise, the process will terminate.

[0040] The operating system includes authentication passwords and access control. Authentication passwords in the operating system are stored in a separate storage area, and access control has different permission settings for different authentication passwords. These permission-related settings are also stored in a separate storage area.

[0041] Application encryption includes login passwords and tiered application locks; the application login password is stored on the internal hardware hard drive, and the tiered application locks are stored in the permission management settings, which restrict the application's access permissions under different authentication passwords.

[0042] The internal hardware includes data encryption for BIOS, hard drive, and memory; the Trusted Platform Module verifies the data in BIOS, hard drive, and memory through hardware verification.

[0043] Communication encryption testing modules are installed at both ends of the transmission channel. The transmission channel is either an optical fiber or a network cable. The communication encryption testing module encrypts the communication content. The communication encryption testing module is connected to the trusted platform authentication module and adds authentication information during the transmission process. Through the verification of the two-way authentication information, the communication encryption testing module realizes the authentication of the information and the accuracy of the next substructure.

[0044] A method for end-to-end data security protection based on root of trust includes the following steps:

[0045] Step one: in the link data transmission structure, each substructure is provided with a trusted authentication platform module;

[0046] Step two: the trust verification of the substructure itself is realized through the trusted authentication platform, and the specific process is as follows:

[0047] In the substructure startup process, the trusted authentication platform first checks the hash value of BIOS and internal hardware firmware, stores it in an independent storage area, and if the hash value matches the pre-stored value, then checks whether the package name model of the application program in the hard disk is consistent with the default one, and when the check result is consistent, it is normal to start; otherwise, it is prevented from starting;

[0048] Step three: through the communication encryption determination module, information is transmitted to the next substructure.

[0049] Step four: when the communication encryption determination module or the trusted authentication platform fails to pass the check, the current link data transmission is stopped.

[0050] The process of transmitting information to the next substructure through the communication encryption determination module in step three is as follows:

[0051] In the upstream communication secret determination module, a plurality of sets of level sequences are set as encryption sequences, and the content of the encryption sequence is added to the information in the transmission channel according to the cycle time, and when the corresponding encryption sequence is detected in the downstream communication secret determination module, it is judged that the information is correct, otherwise the link data transmission is stopped.

[0052] Therefore, the application adopts a full-link data security protection system and method based on a trusted root, which extends a set of link data transmission methods based on the trusted root as the base through the trusted root as the bottom trust structure, realizes the hardware-level trust anchor through the TPM chip, constructs the complete trust chain from the BIOS firmware, the operating system and the application, and when the check fails, the link data transmission is stopped to avoid information leakage. In the pre-startup stage of the substructure, the firmware is automatically checked, the supply chain attack is blocked, the memory and process integrity are maintained during runtime, and the implantation attack is avoided.

[0053] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application but not to limit them, although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can still be modified or replaced by equivalents, and these modifications or equivalent replacements cannot make the modified technical solutions deviate from the spirit and scope of the technical solutions of the present application.

Claims

1. A full-link data security protection system based on a root of trust, characterized in that: The data transmission link structure includes several substructures, including the operating system, application programs, internal hardware, and transmission channel as encryption objects. These objects are then encrypted, and the encryption content is as follows: Configure the Trusted Platform Module as a trusted root encryption tool; The operating system includes authentication passwords and access control. Application encryption includes login passwords and tiered application locks; Internal hardware includes data encryption for BIOS, hard drive, and memory; Communication encryption measurement modules are installed at both ends of the transmission channel; The encrypted content corresponds to the following: The Trusted Platform Module is specifically configured as a security chip TPM, which implements hardware verification, software verification, independent storage area and trust transfer. The authentication password in the operating system is stored in a separate storage area. The permission management has different permission settings for different authentication passwords, and the permission-related settings are stored in the separate storage area. The application's login password is stored in the internal hardware's hard drive, and the hierarchical application lock is stored in the permission management settings, which restricts the application's usage permissions under different authentication passwords; Internally, the Trusted Platform Module verifies the data in the BIOS, hard drive, and memory through hardware verification. In the transmission channel, which is an optical fiber or a network cable, the communication encryption test module encrypts the communication content, and the communication encryption test modules at both ends authenticate each other. In the trusted platform module, hardware verification is used to verify the current internal hardware information. If the hardware has not changed, the hardware verification will pass. The software verification checks the programs currently on the hard drive. If the programs have not changed, the software verification passes. Independent storage area: A storage area separate from other hardware, used to store encrypted content; Trust transfer: Once the trusted platform module has completed the verification of a substructure, it will pass the trust information to the next substructure; otherwise, the process will terminate.

2. The end-to-end data security protection system based on a root of trust as described in claim 1, characterized in that: The communication encryption measurement module is connected to the trusted platform module and adds authentication information during information transmission. Through the verification of two-way authentication information, the communication encryption measurement module realizes the authentication of information and the accuracy of the next substructure.

3. A method for end-to-end data security protection based on a root of trust, comprising the end-to-end data security protection system based on a root of trust as described in any one of claims 1-2, characterized in that, Includes the following steps: Step 1: In the data transmission structure of the link, each substructure is equipped with a trusted platform module; Step 2: Implement trust verification of the substructure itself through the trusted platform module; Step 3: Transmit information to the next substructure via the communication encryption measurement module; Step 4: When the communication encryption test module or trusted platform module fails the verification, stop the transmission of data on the current link.

4. The end-to-end data security protection method based on a root of trust as described in claim 3, characterized in that: In step two, the specific process of the trusted platform module implementing the trust verification of the substructure itself is as follows: During the substructure startup process, the trusted platform module first verifies the hash value of the BIOS and internal hardware firmware and stores it in an independent storage area. If the hash value matches the pre-stored value, it then checks whether the package name and version number of the application in the hard disk are consistent with the default. When the verification result is consistent, the system starts normally. Otherwise, prevent startup. ‌ 5. The end-to-end data security protection method based on a root of trust as described in claim 3, characterized in that: In step three, the process of transmitting information to the next substructure through the communication encryption measurement module is as follows: In the upstream communication confidentiality measurement module, several sets of level sequences are set as encryption sequences. The content of the encryption sequence is added to the information in the transmission channel according to the periodic time. When the downstream communication confidentiality measurement module detects the corresponding encryption sequence, it is determined that the information is correct; otherwise, the link data transmission is stopped.

Images