Method and device for constructing network security operating system, electronic equipment and storage medium

Abstract

The invention belongs to the field of network security, and relates to a method and a device for constructing a network security operating system, electronic equipment and a storage medium, and the method comprises the following steps: constructing an autonomously controllable improved microkernel infrastructure; based on the microkernel infrastructure, constructing a full-stack layered security control computing architecture base; constructing intelligent agent components, and deploying a multi-intelligent agent collaborative protection component system; integrating trusted computing and an integrity measurement verification system; performing dynamic adaptation and execution of multiple security policies; and a standardized safety evaluation and adaptive optimization closed loop is established. A trusted computing base is cut from a design source, so that the probability of occurrence of high-risk vulnerabilities is reduced; the real-time defense that the threat is changed and the strategy is changed is realized, and the blind area of the static strategy in resisting the unknown threat is made up; the malicious codes can be blocked before running, and the post passive situation that traditional security software only depends on a feature library for searching and killing is broken; and the contradiction between security capability solidification and threat dynamic evolution is fundamentally solved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to methods, apparatus, electronic devices and storage media for building network security operating systems. Background Technology

[0002] In the current field of cybersecurity, the operating system, as the fundamental core of an information system, directly determines the overall security level of the system. However, existing mainstream cybersecurity operating systems have exposed a series of structural, functional, and mechanistic defects when dealing with increasingly complex, dynamic, and intelligent cyberattacks. These defects are particularly prominent in critical information infrastructure sectors such as energy, transportation, and finance. Specifically, existing technologies have the following shortcomings: High security vulnerabilities pose a significant risk, making intrinsic security difficult to achieve. Existing operating systems are mostly based on traditional monolithic kernel architectures, with massive kernel code (e.g., the Linux kernel exceeds 20 million lines) and bloated Trusted Computing Bases (TCBs). This makes the system kernel a huge attack surface, where even minor code flaws can become fatal security vulnerabilities. Although patching is used to address these vulnerabilities, the fundamental contradiction of "patches lagging behind vulnerabilities" remains unresolved, making it difficult to meet the core requirement of information security for "intrinsic security" (i.e., ensuring security from the source of architectural design).

[0003] Static and rigid security policies cannot dynamically adapt to threats. Traditional security operating systems mostly use pre-configured static security policies, such as fixed access control lists (ACLs) and firewall rules. Once these policies are set, they are difficult to dynamically adjust according to changes in network threat landscape and business scenarios. When facing new and unknown threats (such as zero-day vulnerability attacks and advanced persistent threats (APTs), the response of static policies is severely delayed, failing to achieve real-time and accurate protection, leaving the system vulnerable to attacks. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a method for constructing a network security operating system, employing the following technical solution, including the following steps: Build an independent and controllable improved microkernel infrastructure; Based on the aforementioned microkernel infrastructure, a full-stack, layered security management computing architecture foundation is constructed. Build intelligent agent components and deploy a multi-intelligent agent collaborative protection component system; An integrated trusted computing and integrity measurement and verification system; Dynamically adapt and execute multiple security policies; Establish a standardized safety assessment and adaptive optimization closed loop.

[0005] Preferably, the steps for constructing an autonomous and controllable improved microkernel infrastructure specifically include: Based on the improved / enhanced microkernel approach, a minimal design and service migration are implemented. It integrates real-time operating system scheduling modes to ensure deterministic response. With hardware assistance, secure isolation and autonomous scheduling are achieved.

[0006] Preferably, the step of constructing a full-stack layered security management computing architecture based on the microkernel infrastructure specifically includes: Define a four-layer integrated full-stack security layering model; Configure and manage the collaborative communication mechanism of the computing bus; Establish standardized cross-layer security interfaces and interaction protocols.

[0007] Preferably, the steps of constructing intelligent agent components and deploying a multi-intelligent agent collaborative protection component system specifically include: Build intelligent agent components with specialized division of labor; Set up a multi-agent collaboration mechanism based on event flow and task DAG; Perform collaborative optimization of strategy proxy and detection proxy.

[0008] Preferably, the steps of the integrated trusted computing and integrity measurement verification system specifically include: Establish a static metric initiation chain based on a hardware root of trust; Perform dynamic measurement and behavior whitelist monitoring during runtime; By integrating national cryptographic algorithms, we can launch a full-chain trusted cryptographic service.

[0009] Preferably, the step of dynamically adapting and executing multiple security policies specifically includes: Build a strategy repository that supports multi-model integration and hot reloading; Based on situational awareness, security policies are dynamically generated and adjusted. Perform security policy enforcement and auditing.

[0010] Preferably, the step of establishing a standardized security assessment and adaptive optimization closed loop specifically includes: Built-in security assessment indicator system; Perform automated security self-checks that combine continuous and triggered checks; Based on the evaluation results, strategies, configurations, and adaptive optimization of the system are driven, forming a complete management closed loop of evaluation, analysis, optimization, and verification.

[0011] To address the aforementioned technical problems, the present invention also provides a device for constructing a network security operating system, employing the following technical solution, including: Architecture building modules are used to build autonomous and controllable improved microkernel infrastructures; The foundation construction module is used to build a full-stack layered security management computing architecture foundation based on the microkernel infrastructure. The deployment module is used to build intelligent agent components and deploy a multi-intelligent agent collaborative protection component system. An integration module for integrating trusted computing and integrity measurement and verification systems; The execution module is used for dynamic adaptation and execution of multiple security policies; The optimization module is used to establish a standardized security assessment and adaptive optimization closed loop.

[0012] To address the aforementioned technical problems, the present invention also provides an electronic device that employs the technical solution described below, comprising a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the above-described method for constructing a network security operating system.

[0013] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium, which employs the technical solution described below. The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the above-described method for constructing a network security operating system.

[0014] Compared with the prior art, the present invention has the following main advantages: (1) An improved microkernel architecture that is independently controllable is adopted, which greatly simplifies the kernel-mode functions and moves the drivers and services to the user mode. The trusted computing base is cut off from the design source, which greatly reduces the probability of high-risk vulnerabilities. Even if a certain service is compromised, it cannot directly threaten the kernel, which meets the requirements of the graded protection for the inherently safe architecture design, rather than relying on delayed patches; (2) Establish a dynamic adaptation and execution mechanism for multiple security policies and deploy a multi-intelligent agent collaborative protection system. Each agent can perceive changes in network threat status and business scenarios at runtime, and dynamically adjust access control permissions and protection policies through collaborative decision-making, so as to achieve real-time and accurate defense when the threat changes and the policy changes accordingly, thus making up for the blind spots of static policies in the face of unknown threats; (3) Construct an active immune system, integrate trusted computing and integrity measurement and verification system, and combine it with a full-stack layered security control computing architecture base. From firmware, system loading, kernel modules to application layer services, implement step-by-step measurement and trusted chain transmission. This active immune mechanism of measurement-verification-execution can block malicious code before it runs, breaking the passive situation of traditional security software relying solely on signature database detection after the fact. (4) By continuously collecting attack events and policy execution effects, and feeding them back to the policy generation engine and intelligent agent, the operating system has the growth attributes of self-reflection and self-optimization, realizing the synchronous iteration of security capabilities and new threats, and fundamentally solving the contradiction between the solidification of security capabilities and the dynamic evolution of threats. Attached Figure Description

[0015] To more clearly illustrate the solutions in this invention, the accompanying drawings used in the description of the embodiments of this invention will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0016] Figure 1 This is a flowchart of an embodiment of the method for constructing a network security operating system according to the present invention; Figure 2 This is a schematic diagram of the architecture used in the method for constructing a network security operating system of the present invention; Figure 3 This is a schematic diagram of the improved microkernel system architecture used in the method for constructing a network security operating system of the present invention; Figure 4 This is a schematic diagram of the four-in-one architecture of security, trust, strong control strategies and cryptographic support adopted in the method for constructing a network security operating system of the present invention; Figure 5 This is a schematic diagram of the architecture for deployment using the full-stack distributed deployment mode adopted in the method for constructing a network security operating system of the present invention; Figure 6 This is a schematic diagram of a structure of an embodiment of the network security operating system device of the present invention; Figure 7 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention. Detailed Implementation

[0017] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains; the terminology used herein in the specification is for the purpose of describing particular embodiments only and is not intended to limit the invention; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings are used to distinguish different objects and not to describe a particular order.

[0018] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0019] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0020] It should be noted that the method for building a network security operating system provided in the embodiments of the present invention is generally executed by a server / terminal device, and correspondingly, the device for building a network security operating system is generally located in the server / terminal device.

[0021] It should be understood that the number of terminal devices, networks, and servers is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be used.

[0022] Example 1 Please refer to Figure 1 The diagram illustrates a flowchart of an embodiment of the method for constructing a network security operating system according to the present invention. The method for constructing a network security operating system includes the following steps: Step S1: Construct an independent and controllable improved microkernel infrastructure.

[0023] In this embodiment, the electronic device (e.g., a server / terminal device) on which the network security operating system construction method runs can receive the request to construct the network security operating system via a wired or wireless connection. It should be noted that the aforementioned wireless connection methods may include, but are not limited to, 3G / 4G / 5G connections, WiFi connections, Bluetooth connections, WiMAX connections, Zigbee connections, UWB (ultra-wideband) connections, and other currently known or future-developed wireless connection methods.

[0024] In this embodiment, step S1 may specifically include the following steps: S11, based on the improved / enhanced microkernel approach, features a minimal design and service migration.

[0025] Using formal verification and the principle of least privilege, the core functional set of the microkernel is rigorously defined and implemented. The final kernel retains only the following absolutely essential modules: Process / thread scheduler: responsible for allocating CPU time slices.

[0026] Virtual Memory Manager (MMU Driver): Responsible for address space mapping and management.

[0027] Inter-process communication (IPC) mechanism: responsible for message passing between the kernel and user space, and user space services.

[0028] Interrupt and exception handlers: responsible for basic responses to hardware interrupts and software exceptions. Through this design, the SMPOS (Secure Management Platform Operating System) microkernel code size is kept below 50KB, a reduction of over 99.9% compared to monolithic kernels like Linux (tens of millions of lines of code), resulting in an order-of-magnitude reduction in attack surface size.

[0029] All non-core system services, including but not limited to file systems (such as EXT4 and NTFS drivers), network protocol stacks (such as TCP / IP stacks), and device drivers (except for the most basic disk and network card drivers), are moved out of kernel space and run as independent user-space processes (or services). These services communicate with the microkernel and other services through well-defined IPC interfaces.

[0030] Strict address space isolation is enforced between kernel mode and user mode, as well as between different user-mode services, through the hardware memory management unit (MMU). Each user-mode service runs in an independent virtual address space and cannot directly access the memory data of other services or the kernel.

[0031] The purpose of step S11 is to greatly reduce the size of TCB and transfer potential vulnerabilities from the kernel to the isolated user space. Even if a user-space service (such as the file system) is compromised, it is difficult for attackers to directly threaten the kernel and other core services. This achieves fault isolation and improves the overall stability (99.96% in actual tests) and security (TCB vulnerability risk reduced by 90%) of the system.

[0032] S12 integrates the real-time operating system scheduling mode to ensure deterministic response.

[0033] Instead of the fairness scheduling strategy used in general operating systems (such as Linux CFS), a preemptive fixed-priority scheduling algorithm commonly used in hard real-time systems is adopted. Static priorities are pre-assigned to all threads / processes (for example, security event handling threads have the highest priority, followed by critical business threads, and ordinary task threads have the lowest priority).

[0034] By rewriting the interrupt controller driver and scheduler code, the time from the occurrence of a hardware interrupt to the start of execution of the highest priority task is ensured to be deterministic and capped. Specific techniques include: disabling non-preemptive regions in the kernel, optimizing interrupt service routines (ISRs) to perform only minimal work and quickly wake up the corresponding high-priority tasks, and employing a priority inheritance mechanism to prevent priority inversion.

[0035] The scheduler works in conjunction with the network protocol stack and security detection module to identify data packets (i.e., security event streams) carrying security alarms or critical control commands. Once identified, the system immediately and dynamically increases the priority of the thread processing this data stream, ensuring it is scheduled first. A dynamic weighting factor is introduced into the scheduling algorithm. This factor increases sharply when a security event is detected, affecting scheduling decisions.

[0036] The formula for calculating dynamic priority is: .in, : The dynamic priority of the task (the smaller the value, the higher the priority); : The static base priority of the task; Security event weighting factor (0~1), provided by the detection agent, tends to be 1 when a security event occurs; Task deadline; Harmonized weighting coefficients are used to balance security response and real-time requirements.

[0037] This formula will determine the security situation ( ) and the urgency of the task ( This quantification and incorporation into scheduling decisions enables the system to respond rapidly to security threats while ensuring critical business deadlines. Real-world testing shows a deterministic response time of ≤200μs for security events, far exceeding the millisecond (≥2ms) response time of general-purpose systems.

[0038] The purpose of step S12 is to overcome the technical bias of poor performance and non-real-time nature of microkernels, meet the stringent requirements of microsecond-level determinism in scenarios such as energy scheduling and rail transit signal control, and fundamentally avoid production safety accidents caused by response delays.

[0039] S13, based on hardware assistance, performs secure isolation and autonomous scheduling.

[0040] On hardware platforms supporting ARM TrustZone or Intel VT-x / AMD-V, the microkernel itself is placed in a secure world or root mode, while different user-space services (such as management network services and industrial control network services) are placed in different insecure worlds or virtual machines (VMs). Strong physical-level isolation of memory and I / O devices between VMs and between VMs and the hypervisor is achieved through hardware virtualization extensions (such as Stage-2 page tables). This increases the lateral penetration prevention rate to 98%.

[0041] The system maintains a global task-resource affinity table and a task-task correlation table. When a new task arrives or a task's status changes, the scheduler doesn't simply check the priority queue; instead, it quickly calculates the correlation events triggered by the event and dynamically adjusts the resource allocation and scheduling order of related tasks accordingly. For example, when a detection agent (a task) issues an alarm, the affinity of highly correlated response agent and policy agent tasks will be instantly increased, allowing them to be quickly scheduled for execution.

[0042] In the IPC mechanism, capabilities are introduced as access tokens. Each process holds a capability object that serves as its unique credential for accessing specific resources (such as ports, memory regions, and other services). The kernel enforces a check on the validity of capabilities in every IPC call. This fine-grained access control fundamentally prevents privilege escalation and unauthorized access.

[0043] The purpose of step S13 is to achieve strong physical / logical isolation at the kernel level, effectively blocking the lateral movement of threats such as ransomware; and to intelligently optimize resource allocation through a brain-like scheduling algorithm, controlling the latency of critical business flows to ≤100μs under 100,000 concurrent flows, reducing network congestion rate by 95%, and ensuring the smooth operation of core businesses under complex loads.

[0044] The purpose of step S1 is to fundamentally solve the problems of bloat, vulnerabilities, and poor real-time performance associated with the traditional monolithic kernel architecture TCB. By constructing an extremely streamlined, strongly isolated, and highly real-time autonomous microkernel, a reliable, stable, and efficient foundational operating platform is provided for all upper-layer security mechanisms. This is a prerequisite for achieving inherent security and meeting the stringent real-time requirements of critical infrastructure.

[0045] Step S2: Based on the microkernel infrastructure, construct a full-stack layered security management computing architecture foundation.

[0046] In this embodiment, step S2 may specifically include the following steps: S21 defines a four-layer integrated full-stack security layering model.

[0047] Kernel Security Layer (KSL) Definition: Located at the lowest level, it is an improved microkernel built upon step S1. Its responsibilities focus on providing the most basic and core security primitives, including: hardware-level secure boot support, strong process-level and virtualization-level isolation, capability-based access control, and native capture and reporting interfaces for security events (such as memory errors and abnormal system calls). This layer does not directly handle complex security policies but rather provides "atomic operations" for the execution of higher-level policies.

[0048] Middleware Security Layer (MSL) definition: Located above the kernel layer, it provides general-purpose security services at the operating system level. Specific components include: Trusted Cryptography Service Module: Integrates Chinese national cryptographic standards (SM2 / SM3 / SM4 / SM9) and internationally recognized algorithms, providing a unified cryptographic operation API.

[0049] Security policy management module: As a "repository" and "parser" of policies, it stores policy rules for various access control models (MAC, DAC, RBAC, ABAC).

[0050] Identity authentication and authorization services: Provides multi-factor authentication (MFA), single sign-on (SSO), and a unified point of access control (PDP).

[0051] Security Log Auditing Service: Standardized log format, providing high-performance log collection, storage, and retrieval capabilities.

[0052] Application Security Layer (ASL) definition: Provides secure access and operational guarantees for specific business applications. Includes: Secure access proxy: Enables trusted two-way authentication between applications and systems based on certificates or tokens.

[0053] Application sandbox (container-based): Creates an isolated runtime environment for each application or group of applications, restricting its resource access and system calls.

[0054] Security API Gateway: Provides unified management and control over APIs exposed by applications, enabling traffic restrictions, identity verification, parameter filtering, and more.

[0055] The Network Security Layer (NSL) is defined as responsible for protecting the network perimeter and monitoring internal traffic. It includes distributed firewalls, intrusion detection / prevention systems (IDS / IPS), traffic analysis engines, and DDoS mitigation components.

[0056] The purpose of step S21 is to clearly define security responsibilities, enabling each layer of components to be developed, evolved, and deployed independently, while forming an organic whole through a unified interface, thus avoiding functional overlap and unclear responsibilities.

[0057] S22, set up a collaborative communication mechanism for the control computing bus.

[0058] The control and management computing bus adopts a publish-subscribe (Pub-Sub) model. Any component in the system (publisher) can encapsulate security events (such as detecting SQL injection attacks or exceeding thresholds for failed user logins) or control commands (such as blocking IP 192.168.1.100 or switching to MAC policies) into standard format messages and publish them to the bus. Components that are interested in a certain type of event (subscriber) will receive these messages asynchronously.

[0059] Standardized Message Format (SOMN): Defines a lightweight structured message format, such as one based on JSONSchema. Code example follows: { "event_id": "uuid-v4", "timestamp": "ISO8601", "source_layer": "NSL", / / Source layer "source_component": "IPS_Engine", "event_type": "ATTACK_DETECTED", “severity”: “HIGH” “payload”: { "attack_type": "Buffer_Overflow", "target_ip": "10.0.0.5", “target_port”: 80, “signature”: “CVE-2021-12345”, "raw_packet_hash": "sha256..." } } To achieve peak performance, the communication between the kernel layer and the middleware layer employs optimized shared memory and semaphore mechanisms to avoid data copying. Cross-layer message passing uses lightweight binary protocols (such as Protocol Buffers) for serialization and transmits via encrypted channels (such as TLS based on Chinese national cryptographic standards) to ensure confidentiality and integrity. A built-in priority queue on the bus ensures that high-severity events are processed first.

[0060] The purpose of step S22 is to decouple the various security components so that they do not need to know each other's existence and location, but only need to focus on events and instructions; it realizes the real-time, reliable and efficient flow of cross-layer security information and is a collaborative nervous system.

[0061] S23, establish standardized cross-layer security interfaces and interaction protocols.

[0062] Kernel-Middleware Interface: Defines a set of system call extensions and virtual files under / proc or / sys, allowing the middleware security layer to query the kernel security status (such as capability list, isolation domain information) and inject dynamic security policies (such as adding capability restrictions to a process).

[0063] Middleware - Application Interface: Uses RESTful API or gRPC interface. For example, the application obtains an access token by calling POST / api / v1 / auth / token and requests permission decisions by calling GET / api / v1 / policy / check.

[0064] Application-Network Interface: Extends the Socket API to add security context settings options. For example, applications can attach a security tag when creating a Socket, allowing network layer firewalls to execute appropriate filtering rules based on this tag.

[0065] Unified Management Interface: Provides a unified northbound interface for the Security Management Center (SOC), supporting multiple protocols such as SNMP, Syslog, and RESTful API, for status monitoring, unified policy distribution, and report generation.

[0066] The purpose of step S23 is to provide a clear contract to ensure that components developed by different teams can be seamlessly integrated; to reduce the complexity of system integration and maintenance costs, and to improve the overall scalability and maintainability.

[0067] The purpose of step S2 is to establish a unified and standardized security framework that organically integrates previously isolated security components at different levels. By defining clear hierarchical boundaries, interface specifications, and collaboration mechanisms, it provides the impetus for the flow of cross-layer security data, unified management of policies, and collaborative execution of instructions, serving as the backbone for achieving full-stack collaboration.

[0068] Step S3: Build intelligent agent components and deploy a multi-intelligent agent collaborative protection component system.

[0069] In this embodiment, step S3 may specifically include the following steps: S31 is an intelligent agent component that builds specialized division of labor.

[0070] Policy Agent (PA): Employs a rule engine (such as Drools) and a policy description language (such as a simplified variant of XACML). PA embeds a Policy Decision Point (PDP) and a Policy Management Point (PAP). It subscribes to policy update requests and permission check request events through a management computing bus. When a permission check request is received, PA combines the current subject, object, and environment attributes to retrieve matching policy rules, makes an allow / deny decision, and publishes the result. It supports hot reloading and version rollback of policies.

[0071] Detection Agent (DA): Employs a lightweight edge computing architecture. DAs are distributed across various layers; for example, the network layer DA uses DPDK / XDP technology to achieve line-rate traffic acquisition and feature extraction; the application layer DA performs behavioral analysis by hooking key API calls or parsing structured logs. The core detection algorithm uses lightweight machine learning models, such as: Use isolated forest or autoencoder algorithms on network traffic time-series data to identify traffic that deviates from normal patterns.

[0072] For the sample Its path length in the isolated tree The shorter the score, the more likely it is to be an anomaly. Anomaly score. The calculation formula is: .in: It is the expected value of the path length of the sample in a batch of isolated trees; Given a number of samples The average path length at that time is used for standardization.

[0073] This algorithm does not require pre-labeled attack samples, can effectively discover unknown threats, and has high computational efficiency, making it suitable for running on resource-constrained edge DA.

[0074] Response Agent (RA): RA has a built-in series of executable response playbooks. A playbook consists of a series of atomic actions, such as calling a firewall API to add blocking rules, sending a pause command to a container sandbox, or triggering a vulnerability scanner to scan a specific host. RA interacts with underlying security components through standard APIs (such as NETCONF / YANG and RESTful). It supports graphical orchestration of playbooks and conditional branching (IF-THEN-ELSE).

[0075] Orchestration Agent (OA): OA acts as the system's command center, employing a goal-based planning model. When it receives a high-level security objective (such as containing the spread of ransomware from IP X), OA breaks it down into a series of sub-tasks (such as DA locating infected hosts, PA isolating the host's network, and RA removing malicious processes), generating a directed acyclic graph (DAG) of task dependencies. Then, it distributes the tasks based on the current load and strengths of each agent, monitors the execution status, and handles anomalies such as task failures.

[0076] The purpose of step S31 is to decompose and specialize complex security operation tasks, with each agent focusing on improving the efficiency of its own domain; and to lay the component foundation for automated collaboration.

[0077] S32, set up a multi-agent collaboration mechanism based on event flow and task DAG.

[0078] Event-Task Mapping Rules: Predefined or dynamically learned through machine learning to determine the appropriate handling procedures for different types of security events. For example, "Event Type = Brute Force Attack && Same Source IP && Frequency > 10 times / second" is mapped to the task chain: [DA Verification] -> [PA Temporary IP Blocking] -> [RA Hardening Target Account].

[0079] Task scheduling optimization algorithms: When assigning tasks, OA (Office Automation) systems should consider not only dependencies but also overall processing time (Makespan) and resource utilization. Heuristic scheduling algorithms can be used, such as considering the estimated execution time of each task on different agents. (Task i is on agent j), and is dynamically allocated.

[0080] The simplified formula for the objective function is: ,in: It is the set of tasks assigned to agent j. The goal is to minimize the maximum completion time among all agents, i.e., to shorten the overall processing time.

[0081] Distributed state synchronization: Each agent periodically sends heartbeats and state summaries to the OA. The OA maintains a global, versioned view of task status. When agents need to exchange data directly (such as DA transmitting attack samples to RA), this is done through a point-to-point messaging channel on the control compute bus, and the OA is notified to update the data dependency status.

[0082] The purpose of step S32 is to ensure that multiple agents can work together in an orderly, efficient and conflict-free manner when facing complex security events, like a well-trained special forces unit, to achieve a synergistic effect of 1+1>2.

[0083] S33 performs collaborative optimization of the strategy agent and the detection agent.

[0084] Reinforcement learning strategy optimization: Treat the adjustment of PA's strategy as a reinforcement learning problem.

[0085] State (S): The current security posture of the system, including a combination of indicators such as threat score, false alarm rate, false negative rate, and resource utilization.

[0086] Action (A): Policy adjustment actions that PA can perform, such as adjusting the DDoS detection threshold from 1000pps to 800pps, or enabling stricter parameter filtering rules for a certain type of request.

[0087] Reward (R): A comprehensive reward function, for example: .in: It's the false alarm rate. It is the detection rate. and The resource and latency overhead incurred during strategy execution. It's the weight.

[0088] PA learns the optimal strategy to take in different states by constantly interacting with the environment (i.e. the running system) in order to maximize long-term cumulative rewards and achieve a dynamic balance between detection accuracy, resource efficiency and response speed.

[0089] The evolution of detection models based on federated learning: Each Data Analyst (DA) trains or fine-tunes its local detection model (such as the parameters of an anomaly detection model) locally using the data it collects. To protect privacy and reduce bandwidth consumption, DAs do not upload raw data, but instead periodically encrypt and upload their local model parameter updates (gradients or weights) to the Access Analyst (OA). The OA uses a federated averaging algorithm to aggregate the model updates from all DAs, generating a global, more powerful detection model, which is then distributed to the individual DAs.

[0090] Collaborative intelligence sharing: PA and DA share structured threat intelligence through the STIX / TAXII standard format. When DA discovers a new attack pattern, it can immediately generate and publish STIX observations; PA subscribes to this intelligence and can generate or adjust defense strategies in advance, enabling an evolution from passive response to proactive prevention.

[0091] The purpose of step S33 is to make the system's strategies and detection capabilities no longer static, but to enable it to continuously learn and optimize itself based on actual operating results and external threat intelligence, forming a virtuous cycle of becoming smarter the more it is used.

[0092] Step S3 introduces intelligence and collaboration. By simulating the division of labor and collaboration within a human security team, it constructs a series of intelligent agents with specific professional capabilities and designs an efficient collaboration mechanism to achieve a fully automated and intelligent closed-loop process for security incidents, from perception to handling. This is the core solution to the problem of low levels of intelligence and over-reliance on manual labor.

[0093] Step S4: Integrate trusted computing and integrity measurement verification system.

[0094] In this embodiment, step S4 may specifically include the following steps: S41, Establish a static metric startup chain based on hardware root of trust.

[0095] Trust root anchoring: A standard-compliant Trusted Computing and Trusted Platform Control Module (TPCM) chip is integrated on the server motherboard, or an international TPM 2.0 chip is used. This chip has physical tamper-proof capabilities and internally stores cryptographic keys and platform metric baseline values ​​(PCR initial values).

[0096] Step-by-step measurement process: After the system is powered on, the CPU first executes the initial trusted code (CRTM) embedded in the TPCM.

[0097] CRTM measures the integrity of the motherboard BIOS / UEFI firmware, expands the hash value into the PCR register of TPCM, and then hands control over to the BIOS.

[0098] The BIOS measures the code and configuration of the bootloader (such as GRUB), further expanding the PCR.

[0099] The bootloader measures the hash value of the improved microkernel image, the initial memory disk (initrd), and expands the PCR.

[0100] After the microkernel starts, it measures the hash values ​​of the critical drivers and system services that are about to be loaded.

[0101] Policy Enforcement and Arbitration: After each measurement level, the current PCR value is compared with the Golden Measurement value pre-stored in TPCM or the security server. If the comparison fails, the system can choose to stop startup, issue an alert, or enter a restricted repair mode according to preset policies. This process ensures trustworthiness upon startup.

[0102] The purpose of step S41 is to ensure from the source that every piece of code loaded is trustworthy and tamper-proof, effectively defending against low-level malware such as Bootkits and Rootkits, and establishing an unbreakable trust foundation for upper-level security.

[0103] S42 performs dynamic measurement and behavior whitelist monitoring during runtime.

[0104] Computation-Protection Dual-Hierarchy Parallel Architecture: Computing Components: The main system of SMPOS that runs the normal business operating system and applications.

[0105] Protection Component: A standalone, lightweight monitoring system running on a dedicated hardware core or security coprocessor, accessing main system memory via a system bus (such as PCIe) or a dedicated interface. It is based on a formally verified microkernel with extremely simple code and a very small TCB.

[0106] Dynamic Measurement Engine: The protective component has an embedded dynamic measurement module, which is based on the following: Process behavior whitelist: a predefined or learned normal process behavior map, including allowed dynamic link libraries (DLLs), normal system call sequences, normal network connection patterns, etc.

[0107] Kernel code and critical data integrity benchmark: The hash values ​​of kernel code segments and critical data structures (such as system call tables and process lists) are periodically calculated and compared with the benchmark values ​​stored in static metrics.

[0108] Anomaly Detection and Blocking: The protection component monitors the operation of the computing unit in real time. Upon detecting the following anomalies, it immediately alerts the computing unit or directly blocks it via hardware interrupt or System Management Interrupt (SMI): The process is attempting to load a DLL that is not in the whitelist.

[0109] The process's system call sequence deviates significantly from the normal pattern (for example, a text editor process suddenly makes consecutive calls to CreateRemoteThread and WriteProcessMemory).

[0110] The hash value of the kernel code or critical data area has changed.

[0111] The purpose of step S42 is to ensure that even if an attacker exploits an unknown vulnerability to intrude into the system, their malicious behavior will be detected and suppressed in real time due to the whitelist of destructive behaviors or code integrity, thus achieving the effect of being able to enter the system but not being able to cause damage or gain access.

[0112] S43 integrates national cryptographic algorithms to launch end-to-end trusted cryptographic services.

[0113] Implement a high-performance, information security-compliant Trusted Cryptographic Service Module (TCSM) at the middleware security layer. This module is supported by a Hardware Security Module (HSM) or the internal cryptographic engine of the TPCM, and provides a unified API at the top.

[0114] End-to-end application: Identity Authentication: Two-way authentication between the device and the user is achieved using an SM2 digital certificate. In the initiation measurement step 4.1, measurement reports at all levels can be signed using an SM2 private key to ensure the trusted transmission of measurement results.

[0115] Data encryption: The SM4 algorithm is used to encrypt the transmission of sensitive commands, configuration information, and business data on the control and management computing bus. Sensitive data stored is also encrypted using SM4.

[0116] Integrity verification: The SM3 hash algorithm is used to generate hash values ​​for each level of metric. Simultaneously, when transmitting data between systems or modules, SM3 is used to generate Message Authentication Codes (MACs) to prevent data tampering during transmission.

[0117] Key lifecycle management: TCSM provides secure key generation, storage, distribution, use, update and destruction functions, and all key operations are completed within the hardware security boundary.

[0118] The purpose of step S43 is to provide a cryptographic foundation for static measurement, dynamic measurement, and secure communication, ensuring that the transmission of the trust chain, the confidentiality and integrity of data are verifiable and non-repudiable, and meeting national security assessment requirements.

[0119] The purpose of step S4 is to build a dynamic trust chain and immune system that starts from the hardware layer and runs throughout the entire process. By using trusted computing technology, it ensures the integrity of code and data during system startup and runtime, preventing malicious tampering and implantation. This is a key line of defense for achieving proactive immunity and resisting high-level attacks (such as firmware attacks and supply chain attacks).

[0120] Step S5: Perform dynamic adaptation and execution of multiple security policies.

[0121] In this embodiment, step S5 may specifically include the following steps: S51, build a strategy repository that supports multi-model integration and hot reloading.

[0122] Policy Abstraction Layer Design: Define a unified policy description metamodel to abstract the core concepts (such as subject, object, operation, and environment) of different access control models. Specific policy models (such as the Bell-LaPadula model implementation of MAC and the attribute rule set of ABAC) serve as instantiation plugins for this metamodel.

[0123] Dynamic Link Library (DLL) plug-in mechanism: The decision logic for each policy model is encapsulated as an independent DLL (or SO library). The policy management module can dynamically load and unload these DLLs without restarting the system or services. Each DLL needs to implement a set of standard interface functions, such as Initialize, EvaluatePolicy, and Shutdown.

[0124] Policy Conflict Detection and Resolution: When multiple policy models are in effect simultaneously or a single model contains multiple rules, conflicts may arise (one rule allows, another denies). The system has a built-in conflict detection algorithm that employs predefined resolution strategies, such as prioritizing denial over permission, specific rules over general rules, or allowing administrators to define resolution meta-rules.

[0125] The purpose of step S51 is to provide flexibility and scalability in policy. The system can seamlessly switch security models according to different scenarios (such as using RBAC for easy management in peacetime and switching to strict MAC in wartime), and can quickly integrate new security models.

[0126] S52, based on situational awareness, dynamically generate security policies and adjust the security policies.

[0127] Multi-source input fusion: The engine receives and fuses multiple input sources in real time. External Threat Intelligence (TI): Vulnerability information (CVE), lists of malicious IPs / domains, and attack group tactics (TTPs) subscribed through the TAXII protocol.

[0128] Internal detection results: Real-time alerts and risk scores from the detection agent.

[0129] Business context: current business phase (e.g., daily operations, quarterly settlement, attack and defense drills), system load, and status of critical business services.

[0130] Compliance requirements: The current network security level protection level (such as Level 3 protection) needs to be met.

[0131] Policy adjustment rule base: This base contains a large number of pre-defined policy adjustment rules in IF-THEN format. These rules are either written by security experts or derived from machine learning based on historical events. For example: If an external TI report indicates a new vulnerability (CVE-XXXX-XXXX) in Apache Struts2 and an affected version exists in internal assets, then the appropriate action is to temporarily add attack signature filtering rules for this vulnerability to the WAF (application layer) and increase the frequency of dynamic measurement of related processes at the host layer (application security layer).

[0132] If the system enters attack and defense drill mode and the business load is less than the threshold, then the policy action is to set the sensitivity of all security detection engines to the highest level and enable full traffic logging.

[0133] Strategy Simulation and Impact Assessment: Before officially issuing the adjusted strategy, the engine can simulate the strategy adjustment in a sandbox environment to assess its impact on business performance (such as increased latency and decreased throughput) and security improvement (such as the types of attacks that can be blocked), and generate an assessment report for OA or administrator decision-making.

[0134] The purpose of step S52 is to compress the long-cycle process of manually analyzing threats -> manually writing policies -> manually issuing them into a closed loop of minutes or even seconds with automatic detection -> automatic generation -> simulation verification -> automatic issuance, which greatly improves the agility of security operations and maintenance.

[0135] S53, to perform security policy enforcement and auditing.

[0136] Policy Enforcement Point (PEP) Deployment: Embedding policy enforcement points on critical kernel paths. For example: File Access Permissions (PEP): At the Virtual File System (VFS) layer, interception and permission checks are performed at the entry points of system calls such as open, read, and write.

[0137] Network access PEP: Filters connection requests and data packets at the socket layer of the network protocol stack or at Netfilter hook points.

[0138] Inter-process communication (PEP): In the microkernel's IPC mechanism, it checks whether the sender has the capability to send a message to the receiver.

[0139] To avoid complex policy calculations for every access (especially in the ABAC model), the system implements a high-performance policy decision cache (PDC) alongside the kernel or PEP. For frequent access requests with stable decision results, the PEP first queries the PDC. The cache is managed using algorithms such as LRU and has an expiration time; when the policy changes, the relevant cache entries are proactively cleared.

[0140] All policy decisions (whether allow or deny) are logged in the security audit log. Log entries include timestamps, subjects, objects, actions, decision results, policy rule IDs used, and the location of the decision's PEP. Audit logs are immediately associated using an SM3 hash chain after generation, and log summaries are periodically stored in the TPCM's PCR register or uploaded to an external audit server to prevent subsequent tampering.

[0141] The purpose of step S53 is to ensure that security policies can be executed efficiently and enforced at the kernel level, achieving strict compliance; at the same time, to provide a complete operation trajectory, meet the security audit requirements of the information security compliance system, and provide a data foundation for post-event tracing and policy optimization.

[0142] Step S6: Establish a standardized safety assessment and adaptive optimization closed loop.

[0143] In this embodiment, step S6 may specifically include the following steps: S61 has a built-in security assessment indicator system.

[0144] Standard knowledge base construction: National standards and industry specifications are structured and parsed to form a machine-readable security requirements knowledge graph. Nodes in the graph represent security requirements (such as identity authentication, access control, and security auditing), and edges represent the relationships and dependencies between requirements.

[0145] The system's built-in security assessment and adaptation agent component automatically extracts all corresponding security requirements from the knowledge graph based on the user-selected assessment target (such as Level 3 Security Protection), and transforms them into specific, executable, and measurable check items (TestCase). For example, the requirement to identify and authenticate login users is transformed into check items: checking whether the system has a password complexity policy configured, checking whether there are accounts with blank passwords, and checking whether the login failure handling function is enabled.

[0146] Check item to system capability mapping: The system maintains a capability mapping table that associates each check item with the specific module, configuration parameter, or API in the system responsible for implementing that security function. This allows the evaluation engine to know where to obtain data to verify whether a requirement is met.

[0147] The purpose of step S61 is to transform abstract, textual security standards into specific, automated assessment tasks, thereby turning compliance assessment from a months-long expert project into a periodically automated process.

[0148] S62 performs automated safety self-checks that combine continuous and triggered checks.

[0149] The assessment agent performs a comprehensive self-check covering all assessment indicators according to a pre-set schedule (e.g., every Sunday at 2 AM). This is similar to a system undergoing a regular full-body checkup.

[0150] The system monitors for critical configuration change events (such as firewall rule modifications, user permission changes, and software package updates). Once such a change occurs, the assessment agent immediately triggers a targeted local assessment to check whether the change introduces new security risks or disrupts the existing compliance status.

[0151] When a serious security incident occurs in the system (such as a successful intrusion is detected), the assessment agent will automatically initiate an in-depth forensic assessment, which will not only check the current status, but also analyze the root cause of the incident and assess the systemic defects in the existing protection system.

[0152] The assessment agent collects the necessary assessment data non-intrusively through standard management and control bus interfaces, reading the / proc and / sys file systems, and calling the self-check APIs provided by each component, thus avoiding any impact on production operations.

[0153] The purpose of step S62 is to achieve continuous monitoring and real-time verification of the security status, ensuring that the system has a clear understanding of its own security health at all times, and can promptly detect health deterioration caused by changes or attacks.

[0154] S63, based on the evaluation results, drives the adaptive optimization of strategies, configurations and systems, forming a complete management closed loop of evaluation-analysis-optimization-verification.

[0155] After the evaluation agent completes its self-check, it generates a structured evaluation report, indicating the pass / fail status, evidence, and risk level of each check. For items that fail, the system initiates root cause analysis (RCA), using knowledge graphs and system topology to analyze whether the failure was due to configuration errors, missing policies, software vulnerabilities, or architectural flaws.

[0156] The system has a built-in remediation script library, which contains standardized remediation steps for common security issues. For example, for a failed check to discover a weak password account, the remediation script might be: [RA] Force the user to change their password on their next login; [PA] Temporarily raise the login failure lockout threshold for the account. OA will automatically match and recommend the appropriate remediation script based on the assessment results and root cause. Complex or high-risk remediations require administrator approval.

[0157] After the remediation action is executed, the evaluation agent will immediately or later trigger a targeted evaluation to verify whether the problem has been truly resolved. The entire process of "evaluation -> analysis -> optimization -> verification" will be fully recorded and formed into a case study. Successful remediation scripts will be optimized and solidified into the script library; recurring problems will trigger a deeper architectural review or strategy optimization (feedback to step five).

[0158] The purpose of step S63 is to transform security assessment from an audit activity into an engine driving continuous security improvement of the system. The system can not only identify problems, but also automatically or assistedly solve them, and learn from the experience to achieve an automated, intelligent closed loop of security operations and continuous evolution of capabilities.

[0159] Figure 2This is a schematic diagram of the architecture used in the method for constructing a network security operating system according to the present invention. Figure 2 As shown, this architecture includes an improved microkernel component, an SMPOS management and computing architecture base, a multi-security policy dynamic adaptation agent component, a collaborative protection agent component, and a security assessment adaptation agent component.

[0160] The improved microkernel module adopts an improvement / enhancement approach to simplify and enhance the microkernel design, retaining core functions and migrating non-core services to user space.

[0161] SMPOS is a management and control computing architecture foundation that constructs a full-stack layered architecture consisting of a kernel security layer, a middleware security layer, an application security layer, and a network security layer, and achieves collaboration between each layer through a management and control computing bus.

[0162] The proxy component dynamically adapts to multiple security policies, supporting the integration and dynamic adjustment of various security policy models to meet different security level requirements.

[0163] The collaborative protection agent component, including policy agent, detection agent, response agent and collaborative scheduling agent, realizes automated handling of security incidents throughout the entire process; the security assessment and adaptation module complies with the national standard for secure operating systems and the cybersecurity level protection guidelines, supports security assessment and self-inspection, and solves the long-standing pain points of existing technologies in critical infrastructure scenarios, such as security and real-time imbalance, non-closed-loop protection and insufficient stability.

[0164] Figure 3 This is a schematic diagram of the improved microkernel system architecture used in the method for constructing a network security operating system according to the present invention. Figure 3 As shown, this microkernel system employs an improvement / enhancement method to optimize the microkernel design, achieving a deep integration of independent controllability and high real-time performance. It can prioritize the handling of security incidents, ensure the transmission of critical business flows, and optimize resource allocation, meeting the stringent standards for response speed in industrial control and critical infrastructure. This includes: streamlining core kernel functions, retaining only minimal core modules such as process scheduling and memory management, migrating non-core services such as the file system and network protocol stack to user space, reducing the size of the Trusted Computing Base (TCB), and minimizing security vulnerability risks; enhancing kernel isolation mechanisms by introducing hardware-assisted virtualization (Hypervisor) and Memory Management Unit (MMU) technologies to achieve strong isolation between kernel space and user space, and between different user space services; embedding a trusted root component to build a trust chain from the hardware layer to the kernel layer, providing fundamental support for full-stack security; and technical support that integrates existing technologies for managing and controlling computing.

[0165] This microkernel system constructs a full-stack autonomous real-time security system from the kernel layer to the application layer, achieving a leapfrog improvement in core performance indicators compared to existing technologies.

[0166] Figure 4This is a schematic diagram of the four-in-one architecture of security, trust, strong control strategies, and cryptographic support adopted in the method for constructing a network security operating system of this invention. Figure 4 As shown, the secure boot mechanism is as follows: During the system boot phase, the integrity of the improved microkernel is measured through the hardware root of trust, and a complete trust chain of "hardware root of trust - bootloader - kernel - application" is constructed to ensure that only certified legitimate code can be loaded and run, and to prevent malicious code from being implanted during the system boot phase. Secure operation executes security policies, multiple intelligent agents collaboratively collect system and network data, detect potential security threats, and enforce mandatory access control policies, including: Mandatory Access Control (MAC): Unlike traditional discretionary access control (DAC), MAC adopts a mandatory access control policy. The system forcibly determines access permissions based on the preset security labels of the subject (user / process) and the object (file / resource), thereby preventing unauthorized operations and abuse of permissions from the mechanism. Based on the threat landscape and business scenarios, security policies are dynamically adjusted and implemented, including enhanced vulnerability protection: integrating technologies such as non-execution stack protection, address space randomization, and abnormal behavior detection to form a comprehensive protection system against common vulnerabilities such as buffer overflows and code injection.

[0167] National Cryptographic Compliant Encrypted Communication: Fully supports national cryptographic algorithms such as SM2 (asymmetric encryption), SM3 (hash algorithm), and SM4 (symmetric encryption), and performs end-to-end encryption and integrity verification on the transmission process of control commands, business data, and configuration information to resist data eavesdropping, tampering, and man-in-the-middle attacks.

[0168] Meanwhile, in response to detected security incidents, the system automatically performs actions such as blocking, isolation, and repair; and completes security assessments and generates assessment reports in accordance with standard requirements.

[0169] Figure 5 This is a schematic diagram of the architecture used in the method for constructing a network security operating system according to the present invention, employing a full-stack distributed deployment mode. For example... Figure 5 As shown, the architecture includes: Hardware layer: Deploy server hardware equipped with a Trusted Root Chip (TPCM / TPM) to provide a hardware-level trust foundation for the system; configure CPU and memory management units that support hardware virtualization to ensure the implementation of kernel isolation mechanisms; Kernel layer: Deploy an improved microkernel, with the kernel core code size controlled to within 50KB, retaining only core functions such as process scheduling, memory management, and interrupt handling; through address space isolation between kernel mode and user mode, non-core services can run independently in user mode; Middleware layer: Deploys core middleware such as trusted cryptographic service module, security policy management module, and multi-intelligent agent scheduling module; among which, trusted cryptographic service module supports SM2 / SM3 / SM4 national cryptographic algorithms, providing encryption and authentication services for the entire stack; Application layer: Deploy application components such as secure access proxy for business applications and security assessment self-testing tools to support secure integration of third-party business systems; Network layer: Deploy network security components such as distributed intrusion detection systems (IDS), firewalls, and traffic analysis agents to achieve full-dimensional protection of network boundaries and internal traffic.

[0170] The beneficial effects of implementing this embodiment are: (1) An improved microkernel architecture that is independently controllable is adopted, which greatly simplifies the kernel-mode functions and moves the drivers and services to the user mode. The trusted computing base is cut off from the design source, which greatly reduces the probability of high-risk vulnerabilities. Even if a certain service is compromised, it cannot directly threaten the kernel, which meets the requirements of the graded protection for the inherently safe architecture design, rather than relying on delayed patches; (2) Establish a dynamic adaptation and execution mechanism for multiple security policies and deploy a multi-intelligent agent collaborative protection system. Each agent can perceive changes in network threat status and business scenarios at runtime, and dynamically adjust access control permissions and protection policies through collaborative decision-making, so as to achieve real-time and accurate defense when the threat changes and the policy changes accordingly, thus making up for the blind spots of static policies in the face of unknown threats; (3) Construct an active immune system, integrate trusted computing and integrity measurement and verification system, and combine it with a full-stack layered security control computing architecture base. From firmware, system loading, kernel modules to application layer services, implement step-by-step measurement and trusted chain transmission. This active immune mechanism of measurement-verification-execution can block malicious code before it runs, breaking the passive situation of traditional security software relying solely on signature database detection after the fact. (4) By continuously collecting attack events and policy execution effects, and feeding them back to the policy generation engine and intelligent agent, the operating system has the growth attributes of self-reflection and self-optimization, realizing the synchronous iteration of security capabilities and new threats, and fundamentally solving the contradiction between the solidification of security capabilities and the dynamic evolution of threats.

[0171] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0172] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0173] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0174] Example 2 Further reference Figure 6 As a response to the above Figure 1 The implementation of the method shown in this invention provides an embodiment for constructing a network security operating system device, which is similar to... Figure 1 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0175] like Figure 6As shown, the network security operating system construction device 70 described in this embodiment includes: an architecture construction module 71, a foundation construction module 72, a deployment module 73, an integration module 74, an execution module 75, and an optimization module 76. Wherein: Architecture building module 71 is used to build an autonomous and controllable improved microkernel infrastructure; The base construction module 72 is used to build a full-stack layered security management computing architecture base based on the microkernel infrastructure. Deployment module 73 is used to build intelligent agent components and deploy a multi-intelligent agent collaborative protection component system; Integration module 74 is used to integrate trusted computing and integrity measurement and verification systems; Execution module 75 is used for dynamic adaptation and execution of multiple security policies; Optimization module 76 is used to establish a standardized safety assessment and adaptive optimization closed loop.

[0176] The beneficial effects of implementing this embodiment are: it cuts the trusted computing base from the design source, reducing the probability of high-risk vulnerabilities; it enables real-time defense that changes strategies as threats change, making up for the blind spots of static strategies when dealing with unknown threats; it can block malicious code before it runs, breaking the passive situation of traditional security software that relies solely on signature-based detection; and it fundamentally solves the contradiction between the solidification of security capabilities and the dynamic evolution of threats.

[0177] Example 3 To address the aforementioned technical problems, embodiments of the present invention also provide an electronic device. Please refer to [link / reference needed]. Figure 7 , Figure 7 This is a basic structural block diagram of the electronic device in this embodiment.

[0178] The aforementioned electronic device 8 includes a memory 81, a processor 82, and a network interface 83 that are interconnected via a system bus. It should be noted that only the electronic device 8 with components 81, 82, and 83 is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the electronic device described here is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0179] The aforementioned electronic devices can be computing devices such as desktop computers, laptops, handheld computers, and cloud servers. These electronic devices can interact with users via keyboards, mice, remote controls, touchpads, or voice-activated devices.

[0180] The aforementioned memory 81 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the aforementioned memory 81 may be an internal storage unit of the aforementioned electronic device 8, such as the hard disk or memory of the electronic device 8. In other embodiments, the aforementioned memory 81 may also be an external storage device of the aforementioned electronic device 8, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the electronic device 8. Of course, the aforementioned memory 81 may also include both internal storage units and external storage devices of the aforementioned electronic device 8. In this embodiment, the aforementioned memory 81 is typically used to store the operating system and various application software installed on the aforementioned electronic device 8, such as computer-readable instructions for constructing a network security operating system. In addition, the aforementioned memory 81 can also be used to temporarily store various types of data that have been output or will be output.

[0181] In some embodiments, the processor 82 described above may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 82 is typically used to control the overall operation of the electronic device 8. In this embodiment, the processor 82 is used to execute computer-readable instructions stored in the memory 81 or to process data, for example, to execute the computer-readable instructions for the method of constructing a network security operating system.

[0182] The aforementioned network interface 83 may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the aforementioned electronic device 8 and other electronic devices.

[0183] The beneficial effects of implementing this embodiment are: it cuts the trusted computing base from the design source, reducing the probability of high-risk vulnerabilities; it enables real-time defense that changes strategies as threats change, making up for the blind spots of static strategies when dealing with unknown threats; it can block malicious code before it runs, breaking the passive situation of traditional security software that relies solely on signature-based detection; and it fundamentally solves the contradiction between the solidification of security capabilities and the dynamic evolution of threats.

[0184] Example 4 The present invention also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the method for constructing a network security operating system as described above.

[0185] The beneficial effects of implementing this embodiment are: it cuts the trusted computing base from the design source, reducing the probability of high-risk vulnerabilities; it enables real-time defense that changes strategies as threats change, making up for the blind spots of static strategies when dealing with unknown threats; it can block malicious code before it runs, breaking the passive situation of traditional security software that relies solely on signature-based detection; and it fundamentally solves the contradiction between the solidification of security capabilities and the dynamic evolution of threats.

[0186] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0187] Obviously, the embodiments described above are merely some embodiments of the present invention, not all embodiments. The accompanying drawings show preferred embodiments of the present invention, but do not limit the patent scope of the present invention. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the patent protection scope of this invention.

Claims

1. A method of constructing a network security operating system, the method comprising: Includes the following steps: ​ Build an independent and controllable improved microkernel infrastructure; Based on the aforementioned microkernel infrastructure, a full-stack, layered security management computing architecture foundation is constructed. Build intelligent agent components and deploy a multi-intelligent agent collaborative protection component system; An integrated trusted computing and integrity measurement and verification system; Dynamically adapt and execute multiple security policies; Establish a standardized safety assessment and adaptive optimization closed loop.

2. The method of building a network security operating system of claim 1, wherein, The specific steps for constructing an autonomous and controllable improved microkernel infrastructure include: Based on the improved / enhanced microkernel approach, a minimal design and service migration are implemented. It integrates real-time operating system scheduling modes to ensure deterministic response. With hardware assistance, secure isolation and autonomous scheduling are achieved.

3. The method of building a network security operating system of claim 1, wherein, The steps for constructing a full-stack, layered security management computing architecture based on the microkernel infrastructure specifically include: Define a four-layer integrated full-stack security layering model; Configure and manage the collaborative communication mechanism of the computing bus; Establish standardized cross-layer security interfaces and interaction protocols.

4. The method of building a network security operating system of claim 1, wherein, The steps for constructing intelligent agent components and deploying a multi-intelligent agent collaborative protection component system specifically include: Build intelligent agent components with specialized division of labor; Set up a multi-agent collaboration mechanism based on event flow and task DAG; Perform collaborative optimization of strategy proxy and detection proxy.

5. The method for constructing a network security operating system according to claim 1, characterized in that, The steps of the integrated trusted computing and integrity measurement verification system specifically include: Establish a static metric initiation chain based on a hardware root of trust; Perform dynamic measurement and behavior whitelist monitoring during runtime; By integrating national cryptographic algorithms, we can launch a full-chain trusted cryptographic service.

6. The method for constructing a network security operating system according to claim 1, characterized in that, The steps for dynamically adapting and executing multiple security policies specifically include: Build a strategy repository that supports multi-model integration and hot reloading; Based on situational awareness, security policies are dynamically generated and adjusted. Perform security policy enforcement and auditing.

7. The method for constructing a network security operating system according to any one of claims 1 to 6, characterized in that, The steps for establishing a standardized security assessment and adaptive optimization closed loop specifically include: Built-in security assessment indicator system; Perform automated security self-checks that combine continuous and triggered checks; Based on the evaluation results, strategies, configurations, and adaptive optimization of the system are driven, forming a complete management closed loop of evaluation, analysis, optimization, and verification.

8. A device for constructing a network security operating system, characterized in that, include: Architecture building modules are used to build autonomous and controllable improved microkernel infrastructures; The foundation construction module is used to build a full-stack layered security management computing architecture foundation based on the microkernel infrastructure. The deployment module is used to build intelligent agent components and deploy a multi-intelligent agent collaborative protection component system. An integration module for integrating trusted computing and integrity measurement and verification systems; The execution module is used for dynamic adaptation and execution of multiple security policies; The optimization module is used to establish a standardized security assessment and adaptive optimization closed loop.

9. An electronic device, characterized in that, The system includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the method for constructing a network security operating system as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the method for constructing a network security operating system as described in any one of claims 1 to 7.

Images