Security detection method, device, equipment, storage medium and computer program product

Abstract

This application discloses a security detection method, apparatus, device, storage medium, and computer program product, relating to the field of artificial intelligence technology. The method includes: isolating a modified function file and sending the modified function file to the cloud for security detection; responding to a function installation request, determining a target function file based on the request, and installing the function based on the target function file; and deleting the isolated modified function file upon completion of installation. Because it can quickly isolate files and transmit them to the cloud for security detection when changes are detected in the function files corresponding to local intelligent agent functions, and then install the function using the file downloaded from the cloud after security detection, it ensures rapid detection of local file changes while preventing local installation and ensuring that all installations are judged by the cloud, thus improving security.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to security detection methods, devices, equipment, storage media, and computer program products. Background Technology

[0002] With the advent of Artificial Intelligence (AI), intelligent agent applications have become widely used, and personal assistant agents, represented by OpenClaw, are gradually evolving into comprehensive applications with open application ecosystem capabilities. Users can install third-party skills through vendor skill hubs or by creating their own skills to gain more functionality.

[0003] Currently, the relevant technologies cannot effectively prevent Skill files from being replaced or tampered with after installation. These personal assistant agents are different from ordinary agents; they not only possess user information but are also related to local computer control. Once the Skill is tampered with after installation, it will pose a significant security risk. Summary of the Invention

[0004] The main purpose of this application is to provide a security detection method, apparatus, device, storage medium, and computer program product, which aims to solve the technical problem that related technologies cannot effectively prevent Agent Skill files from being replaced or tampered with after installation.

[0005] To achieve the above objectives, this application proposes a security detection method, the method comprising: The modified function file is isolated and sent to the cloud so that the cloud can perform a security check on the modified function file. The modified function file is a function file of a newly created intelligent agent function or a function file of a modified intelligent agent function. In response to a feature installation request, a target feature file is determined based on the feature installation request, and the feature is installed based on the target feature file. The feature installation request is a request sent by the cloud after confirming that the uploaded modified feature file has passed the security test. Upon completion of installation, the isolated change function files will be cleared.

[0006] Optionally, upon completion of installation, the process of clearing isolated modified function files includes: Upon completion of installation, integrity verification information for the target function files is constructed. If the integrity verification information is consistent with the verification information recorded in the function installation request, then an integrity record corresponding to the target function file is generated based on the integrity verification information. The integrity record is stored in the target database, and the isolated change function file is cleared. The target database is a protected hash database.

[0007] Optionally, storing the integrity record in a target hash database, wherein the target hash database is a protected hash database, includes: The integrity record is signed by a trusted hardware module; Upon completion of the signing process, the integrity record is stored in the target hash database.

[0008] Optionally, the step of constructing the integrity verification information of the target function file upon completion of installation includes: Upon completion of installation, determine the function description file within the target function file; The function description file is read in a secure execution environment using a protected file handle; The function description file is hashed using a preset hash algorithm to generate a description file hash value. Integrity verification information is constructed based on the hash value of the description file.

[0009] Optionally, the preset hash algorithm is an incremental hash algorithm; The step of reading the function description file in a secure execution environment using a protected file handle includes: Determine the file block size based on the file size of the function description file; The function description file is divided according to the file block size to obtain at least one description file block; Streaming descriptor file chunks in a secure execution environment using protected file handles; Accordingly, the step of performing a hash operation on the functional description file using a preset hash algorithm to generate a description file hash value includes: Each description file is read in blocks and then input into a preset hash algorithm for hash operation to generate a description file hash value.

[0010] Optionally, the security detection method further includes: In response to a function execution request, integrity verification information is constructed based on the function file to be executed, wherein the function file to be executed is the function file corresponding to the intelligent agent function to be executed; Extract the integrity record corresponding to the function file to be run from the target database, which is a protected hash database; A security detection result is constructed based on the integrity verification information and the integrity record; If the security test result is successful, a function execution process is constructed, and the function of the intelligent agent to be run is executed based on the function execution process.

[0011] Optionally, constructing a security detection result based on the integrity verification information and the integrity record includes: Detect whether the integrity verification information matches the file hash value in the integrity record, and generate a hash comparison result; The security detection result is constructed based on the hash comparison result.

[0012] Optionally, the step of detecting whether the integrity verification information matches the file hash value in the integrity record and generating a hash comparison result includes: The integrity record is verified by signature using a trusted hardware module; When the signature verification passes, the monotonic count record value is extracted from the integrity record; If the monotonic count record value meets the trust constraint requirements, then it is detected whether the integrity verification information is consistent with the file hash value in the integrity record, and a hash comparison result is generated.

[0013] Optionally, before generating the hash comparison result by detecting whether the integrity verification information is consistent with the file hash value in the integrity record if the monotonic count record value meets the trust constraint requirements, the following steps are included: If the monotonic count record value is less than the monotonic counter value in the integrity verification information, then the monotonic count record value is determined to meet the trust constraint requirements. or, If the monotonic count record value is less than or equal to the current count value in the monotonic counter, then the monotonic count record value is determined to meet the credibility constraint requirements.

[0014] Optionally, the signature verification of the integrity record via a trusted hardware module includes: Extract the installation timestamp from the integrity record; The installation timestamp is verified at all times using a trusted hardware module. If the time-based verification passes, the integrity record is then signed and verified by a trusted hardware module.

[0015] Optionally, after constructing the security detection result based on the integrity verification information and the integrity record, the method further includes: If the security check result is a failure, the function execution request is rejected and the function file to be executed is isolated. A verification failure log is constructed based on the function file to be run; The verification failure log is signed by a trusted hardware module and the signed verification failure log is stored.

[0016] Furthermore, to achieve the above objectives, this application also proposes a security detection device, which includes: An isolation module is used to isolate the modified function file and send the modified function file to the cloud so that the cloud can perform security checks on the modified function file. The modified function file is a function file of a newly created intelligent agent function or a function file of a modified intelligent agent function. The installation module is used to respond to a function installation request, determine the target function file according to the function installation request, and perform function installation according to the target function file. The function installation request is a request sent by the cloud after confirming that the uploaded modified function file has passed the security test. The cleanup module is used to remove isolated change function files when the installation is complete.

[0017] Optionally, the cleanup module is further configured to construct integrity verification information for the target function file upon completion of installation; if the integrity verification information is consistent with the verification information recorded in the function installation request, then generate an integrity record corresponding to the target function file based on the integrity verification information; store the integrity record in the target database, and clear the isolated modified function files, wherein the target database is a protected hash database.

[0018] Optionally, the cleanup module is further configured to sign the integrity record through a trusted hardware module; and upon completion of the signing, store the integrity record in a target hash database.

[0019] Optionally, the cleanup module is further configured to, upon completion of installation, determine the function description file in the target function file; read the function description file in a secure execution environment using a protected file handle; and perform a hash operation on the function description file using a preset hash algorithm to generate a description file hash value.

[0020] Optionally, the preset hash algorithm is an incremental hash algorithm; The cleanup module is further configured to determine the file block size based on the file size of the function description file; to segment the function description file according to the file block size to obtain at least one description file block; and to stream each description file block in a secure execution environment using a protected file handle. The cleaning module is also used to input the blocks of each description file read in the streaming into a preset hash algorithm for hash operation to generate a description file hash value.

[0021] Optionally, the cleanup module is further configured to, in response to a function execution request, construct integrity verification information based on the function file to be executed, wherein the function file to be executed is the function file corresponding to the intelligent agent function to be executed; extract the integrity record corresponding to the function file to be executed from a target database, wherein the target database is a protected hash database; construct a security detection result based on the integrity verification information and the integrity record; if the security detection result is a successful verification, construct a function execution process, and execute the intelligent agent function to be executed based on the function execution process.

[0022] In addition, to achieve the above objectives, this application also proposes a security detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the security detection method as described above.

[0023] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the security detection method described above.

[0024] In addition, to achieve the above objectives, this application also proposes a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the security detection method described above.

[0025] One or more technical solutions proposed in this application have at least the following technical effects: It can quickly isolate files when changes are detected in the function files corresponding to the local intelligent agent function, and transfer them to the cloud for security testing. After the security test is completed, the installation is performed using the file downloaded from the cloud. This ensures that local file changes can be detected quickly, while blocking the possibility of local installation. It ensures that all installations are judged by the cloud, thus improving security. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1This is a flowchart illustrating an embodiment of the security testing method of this application. Figure 2 This is a schematic diagram of the intelligent agent function download process according to an embodiment of the security detection method of this application; Figure 3 This is a flowchart illustrating Embodiment 2 of the security testing method of this application; Figure 4 This is a flowchart illustrating Embodiment 3 of the security testing method of this application; Figure 5 This is a schematic diagram of the module structure of the security detection device according to an embodiment of this application; Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the security detection method in the embodiments of this application.

[0029] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0030] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0031] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0032] The main solution of this application embodiment is as follows: The modified function file is isolated and sent to the cloud so that the cloud can perform a security check on the modified function file. The modified function file is either a function file for a newly created intelligent agent function or a function file for a locally modified intelligent agent function. In response to a function installation request, a target function file is determined based on the function installation request, and the function is installed based on the target function file. The function installation request is a request sent by the cloud after confirming that the uploaded modified function file has passed the security check. Upon completion of installation, the isolated modified function file is deleted.

[0033] Since the relevant technology is currently unable to effectively prevent Skill files from being replaced or tampered with after installation, and these personal assistant agents are different from ordinary agents, they not only possess user information but are also related to local computer control. Once the Skill is tampered with after installation, it will bring great security risks.

[0034] This application provides a solution that quickly isolates files when changes are detected in the function files corresponding to the local intelligent agent function, and transmits them to the cloud for security testing. After the security testing is completed, the installation is performed using the file downloaded from the cloud. This ensures that local file changes can be detected quickly, while blocking the possibility of local installation and ensuring that all installations are judged by the cloud, thereby improving security.

[0035] It should be noted that the execution subject of this embodiment can be a security detection device. The security detection device can be a device with an intelligent agent installed, such as a mobile terminal, personal computer, server or other electronic device used by the user. It can also be other devices that can achieve the same or similar functions. This embodiment does not limit this. In this embodiment and the following embodiments, the security detection method is described using a security detection device.

[0036] The security detection equipment can also be an electronic device that can control and detect devices equipped with intelligent agents; this embodiment does not limit this.

[0037] Based on this, the embodiments of this application provide a security detection method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the security testing method of this application.

[0038] In this embodiment, the security detection method includes steps S10 to S30: Step S10: Isolate the modified function file and send the modified function file to the cloud so that the cloud can perform a security check on the modified function file. The modified function file is a function file of a newly created intelligent agent function or a function file of a modified intelligent agent function.

[0039] It should be noted that, although the current technology provides a mechanism for verifying the function files of the intelligent agent, this mechanism is only executed during the function installation phase and is no longer verified after installation. Therefore, it cannot effectively prevent the function files from being replaced or tampered with after installation. Based on this, to ensure security, the security detection device can continuously monitor whether the function files have been changed after the intelligent agent function is installed. If changes occur, that is, if a newly created intelligent agent function file exists locally on the device, or if an existing intelligent agent function file on the device has been modified, then it can be determined that a changed function file has been detected. At this point, in order to detect whether there is any risk or whether it has been maliciously tampered with, the changed function file can be isolated and then sent to the cloud. The cloud will then perform security detection to determine whether it contains any content that may pose a risk, such as viruses, backdoors, malicious URLs, and commands.

[0040] The security testing equipment can be pre-configured with isolation zones. Files in the isolation zones can be prevented from running or from obtaining the corresponding permissions. The isolation zones can be implemented based on hardware-level isolation. For example, the security testing equipment can be pre-integrated with components that provide hardware security functions, such as TrustZone. TrustZone is a hardware security technology provided by the ARM architecture. It achieves hardware-level isolation by dividing the system into two execution environments: a secure world and a normal world. In this case, isolation zones can be divided based on this principle. When isolating files, files with modified functions can be moved to the isolation zone.

[0041] Step S20: In response to the function installation request, determine the target function file according to the function installation request, and perform function installation according to the target function file.

[0042] It should be noted that the feature installation request can be a request sent by the cloud after confirming that the uploaded modified feature file has passed the security check.

[0043] In practical use, to ensure security, if the cloud determines that there is no security risk in the modified function file, it will store the modified function file and use it as the target function file to be installed. Based on the target function file, it will send a function installation request to the security detection device. At this time, the security detection device will determine the target function file according to the function installation request and perform function installation according to the target function file.

[0044] In practical applications, if the target function file is directly set in the function installation request in the cloud, then the execution process of determining the target function file based on the function installation request can be to extract the target function file from the function installation request. If the cloud does not directly set the target function file in the function installation request, the function installation request will contain a link to download the target function file. In this case, the execution flow for determining the target function file based on the function installation request can be to extract the link from the function installation request and download the target function file according to the link.

[0045] Whether the target function file is set by the cloud based on its size or determined by a pre-set transmission method in the cloud is not limited in this embodiment.

[0046] Step S30: Upon completion of installation, clear the isolated change function files.

[0047] In actual use, if the installation is complete, it means that the function corresponding to the modified function file has been installed. At this time, the modified function file no longer needs to be isolated, and the isolated modified function file in the isolation area can be cleared.

[0048] It should be noted that the installation is not performed by directly modifying the function files, but by downloading the target function files according to the instructions in the cloud. This is to ensure that the installation of all intelligent agent functions is recorded in the cloud and verified accordingly, thus guaranteeing security.

[0049] In a specific implementation, users can also actively request to download new intelligent agent functions from the cloud. In this case, the cloud will also take the function file corresponding to the intelligent agent function selected and downloaded by the user as the target function file and send the corresponding function installation request to the security detection device. In this case, the installation can still perform the corresponding detection process as in step S20. This embodiment does not impose any restrictions on this.

[0050] To make it easier to understand, let's first combine... Figure 2 This explanation is provided, but it does not limit the scope of this solution. Figure 2 This is a schematic diagram of the intelligent agent function download process in this embodiment.

[0051] like Figure 2 As shown, users can create an account in the Skill Hub and select an Agent Skill (also known as Skill) installation package that has passed security verification. After selection, if the user needs to modify the Agent Skill, they need to complete the customization within the Skill Hub platform. The Skill Hub platform will then repackage and sign the package, save the record to the user's account data, and download it. If the user does not need to modify it, the record will be saved to form an associated record and downloaded directly. Once the user confirms the download (e.g., by clicking the download button), the cloud will use the function file corresponding to the agent function selected by the user as the target function file and send the corresponding function installation request to the security detection device. The function file (file and related information) corresponding to the Agent Skill will be sent to the security detection device through the function installation request.

[0052] Among them, the above-mentioned files can be function execution files, and the relevant information can be function description files. The function description files can contain information such as the file name, hash value, algorithm, and signature of each function execution file in Agent Skill.

[0053] This embodiment provides a security detection method that can quickly isolate files when changes are detected in the function files corresponding to the local intelligent agent function, and transmit them to the cloud for security detection. After the security detection is completed, the file downloaded from the cloud is used for installation, ensuring that local file changes can be detected quickly, while blocking the possibility of local installation and ensuring that all installations are judged by the cloud, thereby improving security.

[0054] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 Step S30 includes steps S301 to S303: Step S301: Upon completion of installation, construct the integrity verification information for the target function file.

[0055] It should be noted that, after the function installation is complete, in order to ensure that the subsequent functions can run correctly and to ensure that the function files are not tampered with, it is actually possible to first check whether the installed target function files are complete. At this time, the integrity verification information of the target function files can be constructed first.

[0056] In a specific implementation, to ensure verification efficiency, step S301 in this embodiment may include: Upon completion of installation, determine the function description file within the target function file; The function description file is read in a secure execution environment using a protected file handle; The function description file is hashed using a preset hash algorithm to generate a description file hash value. Integrity verification information is constructed based on the hash value of the description file.

[0057] It should be noted that the function files of the intelligent agent function can include function execution files and function description files. The function execution files are used to provide relevant information for the specific function execution, such as code and parameters. The function description file is a description file used to describe the information of each file of the function execution files. This description file can contain information such as the file name, file hash value, algorithm, and signature of each function execution file.

[0058] In practical use, whether the function execution file has been tampered with can be verified by the information recorded in the function description file. Therefore, it is essential to determine whether the function description file has been tampered with. At this point, the function description file in the target function file can be located. Then, the function description file can be read in the secure execution environment through the protected handle. Finally, the function description file is hashed using a preset hash algorithm to generate a description file hash value. After that, the generated description file hash value (also known as the description file signature certificate fingerprint) is combined with the package name, version number, description file storage path, file size, hash value, installation source, installation timestamp, etc. of the intelligent agent function's function file to form integrity verification information.

[0059] The preset hash algorithm can be the SHA-256 algorithm, but other hash algorithms can also be used. This embodiment does not limit this.

[0060] In specific implementations, in some cases, if the agent's functions are complex and the function description file may be large, in order to ensure that the reader does not consume too many resources, the preset hash algorithm used can be an incremental hash algorithm. In this case, the step of reading the function description file in a secure execution environment through a protected file handle, as described in this embodiment, may include: Determine the file block size based on the file size of the function description file; The function description file is divided according to the file block size to obtain at least one description file block; Streaming descriptor file chunks in a secure execution environment using protected file handles; Accordingly, the step of performing a hash operation on the functional description file using a preset hash algorithm to generate a description file hash value includes: Each description file is read in blocks and then input into a preset hash algorithm for hash operation to generate a description file hash value.

[0061] It should be noted that the file size can refer to the total number of bytes in the function description file; correspondingly, the aforementioned file block size can be the size of each block when the function description file is divided into multiple smaller blocks. In this embodiment, the file block size can be dynamically determined based on the file size and the amount of resources allocated to read the description file, in order to optimize reading and verification efficiency.

[0062] In practical use, description file chunking can refer to the sub-chunks of a function description file after it has been divided based on the file block size.

[0063] In practical applications, after the description file is divided into blocks, the contents of each description file block can be read sequentially in a secure execution environment according to the data order of the file, through the protected file handle. The contents of each description file block read in the stream are then input into a preset hash algorithm for hash operation to calculate the hash value of each description file block. After the last file block is input into the incremental hash algorithm, the incremental hash algorithm can generate the hash value corresponding to the complete functional description file, that is, the description file hash value.

[0064] Step S302: If the integrity verification information is consistent with the verification information recorded in the function installation request, then generate an integrity record corresponding to the target function file based on the integrity verification information.

[0065] In practical use, in order to ensure that the security testing equipment can detect whether the target function file is complete or has been tampered with, the cloud can set the generated verification information and send it to the security testing equipment together with the function installation request. At this time, the security testing equipment can compare the generated integrity verification information with the verification information recorded in the function installation request. If the two are consistent, it means that the target function file is complete and has not been tampered with. Therefore, the integrity record corresponding to the target function file can be generated based on the integrity verification information.

[0066] In practical use, to ensure that the record can be checked for rollback later, a monotonic counter can be set in the security detection device. When generating the integrity record, the count value in the monotonic counter can be extracted and combined with the integrity verification information to construct the integrity record. At this time, the integrity record can include the package name, version number, description file storage path, file size, hash value, installation source, installation timestamp, description file hash value, and the count value of the monotonic counter of the intelligent agent function file.

[0067] Step S303: Store the integrity record in the target database and clear the isolated change function files.

[0068] In practical use, after the integrity record is determined, it can be stored in the target database, which can be a protected hash database.

[0069] In a specific implementation, to ensure the validity of security records, step S303 in this embodiment may include: The integrity record is signed by a trusted hardware module; Upon completion of the signing process, the integrity record is stored in the target hash database.

[0070] It should be noted that trusted hardware modules can be components that provide hardware-level security functions within a security detection system, such as TrustZone, Trusted Execution Environment (TEE), and Hardware Security Module (HSM). TrustZone refers to a hardware security technology provided by the ARM architecture, which achieves hardware-level isolation by dividing the system into two execution environments: a secure world and a normal world. The secure world runs security-related code and data, providing hardware-level protection, while the normal world runs ordinary user-space code. A TEE can be a secure area provided by the main processor for running trusted applications or code, providing an execution environment isolated from the operating system to ensure the security of applications, code, and data running within it. An HSM can be a physical device used to manage and protect digital keys, perform encryption operations, and provide secure authentication functions, providing hardware-level security protection to ensure the secure storage and processing of keys and sensitive data.

[0071] To ensure that the monotonic counter is not tampered with, it can be set in a secure execution environment or in a hardware security module.

[0072] In practical applications, trusted hardware modules can provide secure storage, signing functionality, and anti-tampering mechanisms to ensure the security and trustworthiness of files or operations. Secure storage refers to the module providing a secure storage area for storing sensitive data (such as keys, signature records, etc.); the signing function means the module can use hardware-level keys to sign data, ensuring data integrity and immutability; and the anti-tampering mechanism prevents external attackers from tampering with or forging data.

[0073] At this point, in order to ensure that the integrity record can be verified in the future and to ensure the validity of the integrity record, the integrity record can be passed to the trusted hardware module for signing by calling the API of the trusted hardware module. After signing, the integrity record is then stored in the target hash database.

[0074] In order to facilitate the search of integrity records, a corresponding function identifier can be set for the intelligent agent function corresponding to the installed target function file. Then, the function identifier is associated with the integrity record and stored in the target hash database.

[0075] This embodiment provides a security detection method. Upon installation completion, this embodiment constructs integrity verification information for the target function file. If the integrity verification information matches the verification information recorded in the function installation request, an integrity record corresponding to the target function file is generated based on the integrity verification information. The integrity record is stored in a target database, and isolated modified function files are cleared. The target database is a protected hash database. Because the constructed integrity verification information is compared with the verification information transmitted from the cloud upon installation completion, it ensures that the function file corresponding to the installed intelligent agent function does not have significant security risks, thus improving security. Furthermore, the construction and storage of the integrity record ensures that, if needed later, the integrity record can be used to verify whether the function file corresponding to the intelligent agent function has been tampered with, providing a basis for subsequent security detection.

[0076] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description and will not be repeated hereafter. Based on this, please refer to Figure 4; after step S30, steps S40 to S70 are also included: Step S40: In response to the function run request, construct integrity verification information based on the function file to be run.

[0077] It should be noted that a function execution request can be a request sent to the security detection device when a user calls a certain intelligent agent function, and the function file to be executed can be the function file corresponding to the intelligent agent function to be executed by the user.

[0078] The intelligent agent function to be run can be any intelligent agent function that has been installed.

[0079] In practical use, the function operation request can carry the function identifier and startup parameters of the intelligent agent function to be operated. When the security detection device receives the function operation request, it can determine the intelligent agent function to be operated based on the function identifier.

[0080] In practical applications, integrity verification information can include information such as the package name, version number, description file storage path, file size, hash value, installation source, installation timestamp, and description file hash value of the intelligent agent function's function file. Its construction method is the same as the integrity verification information mentioned above. For specific implementation, please refer to the above method, which will not be repeated here.

[0081] Step S50: Extract the integrity record corresponding to the function file to be run from the target database, where the target database is a protected hash database.

[0082] In practical use, in order to ensure security, it is necessary to verify whether the corresponding function file is complete and whether it has been tampered with before the intelligent agent's function is executed. Therefore, the integrity record corresponding to the function file to be run can be extracted from the target database.

[0083] Step S60: Construct a security detection result based on the integrity verification information and the integrity record.

[0084] In practical use, integrity verification information and integrity records can be compared to determine whether the function file to be run is complete and whether it has been tampered with, and corresponding security detection results can be generated.

[0085] In a specific implementation, to ensure detection efficiency, step S60 in this embodiment may include: Detect whether the integrity verification information matches the file hash value in the integrity record, and generate a hash comparison result; The security detection result is constructed based on the hash comparison result.

[0086] It should be noted that in order to perform a quick comparison, the amount of data to be compared needs to be reduced. Hash values ​​can be used to quickly determine whether a file has been tampered with. Therefore, the integrity verification information can be compared with the file hash value in the integrity record to generate a hash comparison result. If the hash comparison result is consistent, the security check result can be set to verification passed; otherwise, if the hash comparison result is inconsistent, the security check result can be set to verification failed.

[0087] In the process of verification, for the sake of efficiency, only the integrity verification information can be compared with the description file hash value in the integrity record. In this case, the above file hash value only refers to the description file hash value. If there is sufficient time and efficiency is not a primary concern, then once the integrity verification information matches the hash value of the description file in the integrity record, the hash value of each function execution file can be further extracted from the function description file. Based on this hash value, it can be used to further detect whether each function execution file has been tampered with.

[0088] The specific detection method can be adapted to actual needs, and this embodiment does not impose any restrictions on it.

[0089] In a specific implementation, to further improve security, the step of detecting whether the integrity verification information is consistent with the file hash value in the integrity record and generating a hash comparison result, as described in this embodiment, may include: The integrity record is verified by signature using a trusted hardware module; When the signature verification passes, the monotonic count record value is extracted from the integrity record; If the monotonic count record value meets the trust constraint requirements, then it is detected whether the integrity verification information is consistent with the file hash value in the integrity record, and a hash comparison result is generated.

[0090] It should be noted that, in order to further improve security, before checking whether the integrity verification information and the file hash value in the integrity record are consistent, the integrity record can be checked for trustworthiness first. Therefore, the integrity record can be signed and verified using a trusted hardware module first. Then, the monotonic count record value in the integrity record is checked to see if it meets the trust constraint requirements. Only when both checks pass can the integrity verification information and the file hash value in the integrity record be checked to generate a hash comparison result. If the signature verification or monotonic count record value does not meet the trusted constraint requirements, it can be determined that the integrity record has been tampered with. In this case, further testing can be discontinued, and the security test result can be directly set as verification failed.

[0091] In practical use, since the integrity record has been signed by the trusted hardware module before being stored, the signature information must be stored in the trusted hardware module. At this time, the trusted hardware module can be used to sign the integrity record again to generate signature information. The currently generated signature information is compared with the previously stored signature information. If the two are consistent, the signature can be determined to be successful. Alternatively, the signature information corresponding to the integrity record stored in the trusted hardware module can be parsed to generate signature verification information. This signature verification information can then be compared with the integrity record. If they match, the signature is considered successful.

[0092] The specific signature verification method used can be set according to actual needs, and this embodiment does not impose any restrictions on it.

[0093] In a specific implementation, the trust constraint requirement can be set to ensure that the monotonic count record value in the integrity record is less than the current monotonic counter value. In this embodiment, if the monotonic count record value meets the trust constraint requirement, before detecting whether the integrity verification information is consistent with the file hash value in the integrity record and generating the hash comparison result, the following may also be included: If the monotonic count record value is less than the monotonic counter value in the integrity verification information, then the monotonic count record value is determined to meet the trust constraint requirements. or, If the monotonic count record value is less than or equal to the current count value in the monotonic counter, then the monotonic count record value is determined to meet the credibility constraint requirements.

[0094] It should be noted that, based on actual needs, the administrator of the security detection equipment can instruct the equipment to update the count value in the monotonic counter only when it is necessary to store an integrity record. In this case, only the monotonic count record value needs to be compared with the current count value in the monotonic counter, resulting in: If the monotonic count record value is less than or equal to the current count value in the monotonic counter, it means that the monotonic count record value was generated previously. At this time, it can be determined that no rollback attack has occurred, and the monotonic count record value meets the trust constraint requirements, that is, the integrity record is determined to be trustworthy. If the monotonic count record value is greater than the current count value in the monotonic counter, it means that the monotonic count record value was not previously generated. At this time, it can be determined that a rollback attack may have occurred, and the monotonic count record value does not meet the trust constraint requirements. The security test result can be directly set to verification failure.

[0095] Based on actual needs, the administrators of the security testing equipment can instruct the equipment to update the count value in the monotonic counter whenever it stores integrity records, constructs integrity verification information, or performs other operations. At this point, the monotonic counter value recorded in the integrity verification information is the current count value of the monotonic counter at the instant of judgment. Therefore, by comparing the monotonic counter value in the integrity verification information, we can conclude: If the monotonic count record value is less than the monotonic counter value in the integrity verification information, it means that the monotonic count record value was generated previously. At this time, it can be determined that no rollback attack has occurred, and the monotonic count record value meets the trust constraint requirements, that is, the integrity record is determined to be trustworthy. If the monotonic count record value is greater than or equal to the monotonic counter value in the integrity verification information, it means that the monotonic count record value was not previously generated. In this case, it can be determined that a rollback attack may have occurred, and the monotonic count record value does not meet the trust constraint requirements. The security test result can be directly set as verification failure.

[0096] In a specific implementation, before performing signature verification, it is also possible to check whether the installation time is correct. In this case, the step of verifying the integrity record through a trusted hardware module, as described in this embodiment, may include: Extract the installation timestamp from the integrity record; The installation timestamp is verified at all times using a trusted hardware module. If the time-based verification passes, the integrity record is then signed and verified by a trusted hardware module.

[0097] It should be noted that if the installation timestamp in the integrity record is not earlier than the current time, or not earlier than the time when the integrity verification information was constructed, it can be concluded that the integrity record is likely to be forged or tampered with. In this case, the time verification can be determined to fail, and the security test result can be directly set to verification failure. If the installation timestamp in the integrity record is earlier than the current time and / or earlier than the construction time of the integrity verification information, it means that the installation time of the function recorded in the integrity record is normal, and subsequent testing can be performed.

[0098] Understandably, by verifying the timestamp, integrity records with obviously abnormal installation timestamps can be directly excluded, saving resources needed for unnecessary signature verification.

[0099] Step S70: If the security detection result is that the verification is passed, then construct the function execution process and execute the function of the intelligent agent to be run based on the function execution process.

[0100] In practical use, if the security check result is passed, it means that the function file to be run is complete and has not been tampered with. Therefore, a function execution process can be created and used to execute the function of the intelligent agent to be run, providing services to the user.

[0101] In a specific implementation, to facilitate subsequent analysis or tracing, step S60 in this embodiment may further include: A verification failure log is constructed based on the function file to be run; The verification failure log is signed by a trusted hardware module and the signed verification failure log is stored.

[0102] Understandably, any unexpected behavior or state discovered during the security check process may indicate that the function file to be run may have been tampered with, replaced, or has other security issues. In practical applications, during the security check of the function file to be run, the system can check the hash value, signature certificate fingerprint, monotonic counter value, etc. of the function file. If any of these checks fail, the function file of the intelligent agent function to be run is considered abnormal.

[0103] In practical use, when building a verification failure log, different failure types can be classified according to the reason for the failure. Failure types may include, but are not limited to, inconsistent hash values, signature certificate verification failure, and monotonic counter values ​​not meeting the trust constraints.

[0104] It should be understood that the aforementioned verification failure log can be a log used to record detailed information about the verification failure of the function file to be run. The log may record the exception type of the function file to be run, the identifier or file content of the function file to be run, timestamps, etc., for subsequent security audits and evidence collection.

[0105] It should also be understood that the aforementioned hardware security modules can be devices or modules used to provide hardware-level security functions, such as TrustZone, TEE, or HSM devices. These modules can be used to securely store keys, perform signing operations, etc. In this embodiment, the security detection device can use the key provided by the HSM to sign the verification failure log to ensure the immutability and trustworthiness of the verification failure log.

[0106] In practical applications, when security testing equipment verifies the hash value, signature certificate fingerprint, and monotonic counter value of the function to be run, if an anomaly is detected, it can record the specific reason for the verification failure and determine the anomaly type based on the reason. Then, the security testing equipment can combine the failure type, the identifier or content of the function file to be run, and the timestamp into a verification failure log, and sign the verification failure log using the API provided by HSM. Finally, the signed verification failure log is stored in secure storage (such as a target database) to provide data support for subsequent security analysis and enhance traceability.

[0107] It should be noted that, since the user may call the corresponding function files that have been installed and not modified before when the intelligent agent function is executed, the steps S40-S70 described in this embodiment can actually be executed before or after any of the steps S10-S30 above. This embodiment is only for ease of understanding and does not make any specific limitations on it.

[0108] This embodiment provides a security detection method. In response to a function execution request, it constructs integrity verification information based on a function file to be executed, where the function file is the file corresponding to the intelligent agent function to be executed. It extracts integrity records corresponding to the function file from a protected hash database. A security detection result is constructed based on the integrity verification information and the integrity record. If the security detection result is successful, a function execution process is constructed, and the intelligent agent function to be executed is executed based on the function execution process. Because this embodiment can construct integrity verification information based on the function file to be executed before the intelligent agent function runs, and perform security detection based on the integrity verification information and the integrity record constructed during the installation of the intelligent agent function, it determines whether the function file to be executed has been tampered with. Only if it has not been tampered with is the corresponding function execution process created to execute the intelligent agent function. This ensures that security threats to the installed intelligent agent function can be detected in a timely manner before it runs, avoiding security risks caused by local tampering of the installed intelligent agent function.

[0109] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the security detection method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0110] This application also provides a security detection device, please refer to... Figure 5 The safety detection device includes: The isolation module 10 is used to isolate the modified function file and send the modified function file to the cloud so that the cloud can perform security checks on the modified function file. The modified function file is a function file of a newly created intelligent agent function or a function file of a modified intelligent agent function. Installation module 20 is used to respond to a function installation request, determine a target function file according to the function installation request, and perform function installation according to the target function file. The function installation request is a request sent by the cloud after confirming that the uploaded modified function file has passed the security test. Cleanup module 30 is used to remove isolated change function files when installation is complete.

[0111] The security detection device provided in this application, employing the security detection method described in the above embodiments, can solve the technical problem that related technologies cannot effectively prevent Agent Skill files from being replaced or tampered with after installation. Compared with the prior art, the beneficial effects of the security detection device provided in this application are the same as those of the security detection method provided in the above embodiments, and other technical features in the security detection device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0112] This application provides a security detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the security detection method in Embodiment 1 above.

[0113] The following is for reference. Figure 6 The diagram illustrates a structural schematic suitable for implementing the security detection device in the embodiments of this application. The security detection device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The security detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0114] like Figure 6 As shown, the security detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the security detection device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the security detection device to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows security detection devices with various systems, it should be understood that it is not required to implement or possess all of the systems shown. More or fewer systems may be implemented alternatively.

[0115] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0116] The security detection device provided in this application, employing the security detection method described in the above embodiments, can solve the technical problem that related technologies cannot effectively prevent Agent Skill files from being replaced or tampered with after installation. Compared with the prior art, the beneficial effects of the security detection device provided in this application are the same as those of the security detection method provided in the above embodiments, and other technical features of this security detection device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0117] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0118] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0119] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the security detection method described in the above embodiments.

[0120] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0121] The aforementioned computer-readable storage medium may be included in the security testing equipment; or it may exist independently and not be assembled into the security testing equipment.

[0122] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a security detection device, the security detection device: isolates the modified function file and sends the modified function file to the cloud, so that the cloud performs security detection on the modified function file, wherein the modified function file is a function file for a newly created intelligent agent function locally or a function file for a locally modified intelligent agent function; responds to a function installation request, determines a target function file according to the function installation request, and performs function installation according to the target function file, wherein the function installation request is a request sent by the cloud after determining that the uploaded modified function file has passed security detection; and upon completion of installation, deletes the isolated modified function file.

[0123] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Python, Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0124] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0125] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0126] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described security detection method. This solves the technical problem that related technologies cannot effectively prevent Agent Skill files from being replaced or tampered with after installation. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the security detection method provided in the above embodiments, and will not be elaborated upon here.

[0127] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the security detection method described above.

[0128] The computer program product provided in this application can solve the technical problem that related technologies cannot effectively prevent Agent Skill files from being replaced or tampered with after installation. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the security detection method provided in the above embodiments, and will not be repeated here.

[0129] All user-related data involved in this application (such as user privacy data, user behavior data, etc.) were obtained with the user's permission or consent; that is to say, when this application is used in a specific product or technology, user permission is required to obtain and process the relevant data, and the processing of the relevant data must comply with the relevant laws, regulations and regulatory standards of the relevant countries and regions.

[0130] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

[0131] This application discloses A1, a security detection method, the security detection method comprising: The modified function file is isolated and sent to the cloud so that the cloud can perform a security check on the modified function file. The modified function file is a function file of a newly created intelligent agent function or a function file of a modified intelligent agent function. In response to a feature installation request, a target feature file is determined based on the feature installation request, and the feature is installed based on the target feature file. The feature installation request is a request sent by the cloud after confirming that the uploaded modified feature file has passed the security test. Upon completion of installation, the isolated change function files will be cleared.

[0132] A2. The security detection method as described in A1, wherein clearing the isolated modified function files upon completion of installation includes: Upon completion of installation, integrity verification information for the target function files is constructed. If the integrity verification information is consistent with the verification information recorded in the function installation request, then an integrity record corresponding to the target function file is generated based on the integrity verification information. The integrity record is stored in the target database, and the isolated change function file is cleared. The target database is a protected hash database.

[0133] A3. The security detection method as described in A2, wherein storing the integrity record in a target hash database, wherein the target hash database is a protected hash database, includes: The integrity record is signed by a trusted hardware module; Upon completion of the signing process, the integrity record is stored in the target hash database.

[0134] A4. The security detection method as described in A2, wherein constructing integrity verification information for the target functional file upon completion of installation includes: Upon completion of installation, determine the function description file within the target function file; The function description file is read in a secure execution environment using a protected file handle; The function description file is hashed using a preset hash algorithm to generate a description file hash value. Integrity verification information is constructed based on the hash value of the description file.

[0135] A5. In the security detection method described in A4, the preset hash algorithm is an incremental hash algorithm; The step of reading the function description file in a secure execution environment using a protected file handle includes: Determine the file block size based on the file size of the function description file; The function description file is divided according to the file block size to obtain at least one description file block; Streaming descriptor file chunks in a secure execution environment using protected file handles; Accordingly, the step of performing a hash operation on the functional description file using a preset hash algorithm to generate a description file hash value includes: Each description file is read in blocks and then input into a preset hash algorithm for hash operation to generate a description file hash value.

[0136] A6. The security detection method as described in any one of A1-A5, wherein the security detection method further comprises: In response to a function execution request, integrity verification information is constructed based on the function file to be executed, wherein the function file to be executed is the function file corresponding to the intelligent agent function to be executed; Extract the integrity record corresponding to the function file to be run from the target database, which is a protected hash database; A security detection result is constructed based on the integrity verification information and the integrity record; If the security test result is successful, a function execution process is constructed, and the function of the intelligent agent to be run is executed based on the function execution process.

[0137] A7. The security detection method as described in A6, wherein constructing the security detection result based on the integrity verification information and the integrity record includes: Detect whether the integrity verification information matches the file hash value in the integrity record, and generate a hash comparison result; The security detection result is constructed based on the hash comparison result.

[0138] A8. The security detection method as described in A7, wherein detecting whether the integrity verification information is consistent with the file hash value in the integrity record and generating a hash comparison result includes: The integrity record is verified by signature using a trusted hardware module; When the signature verification passes, the monotonic count record value is extracted from the integrity record; If the monotonic count record value meets the trust constraint requirements, then it is detected whether the integrity verification information is consistent with the file hash value in the integrity record, and a hash comparison result is generated.

[0139] A9. The security detection method as described in A8, before generating the hash comparison result by detecting whether the integrity verification information is consistent with the file hash value in the integrity record if the monotonic count record value meets the trust constraint requirements, includes: If the monotonic count record value is less than the monotonic counter value in the integrity verification information, then the monotonic count record value is determined to meet the trust constraint requirements. or, If the monotonic count record value is less than or equal to the current count value in the monotonic counter, then the monotonic count record value is determined to meet the credibility constraint requirements.

[0140] A10. The security detection method as described in A8, wherein the signature verification of the integrity record by a trusted hardware module includes: Extract the installation timestamp from the integrity record; The installation timestamp is verified at all times using a trusted hardware module. If the time-based verification passes, the integrity record is then signed and verified by a trusted hardware module.

[0141] A11. The security detection method as described in A6, after constructing the security detection result based on the integrity verification information and the integrity record, further includes: If the security check result is a failure, the function execution request is rejected and the function file to be executed is isolated. A verification failure log is constructed based on the function file to be run; The verification failure log is signed by a trusted hardware module and the signed verification failure log is stored.

[0142] This application also discloses B12, a security detection device, the security detection device comprising: An isolation module is used to isolate the modified function file and send the modified function file to the cloud so that the cloud can perform security checks on the modified function file. The modified function file is a function file of a newly created intelligent agent function or a function file of a modified intelligent agent function. The installation module is used to respond to a function installation request, determine the target function file according to the function installation request, and perform function installation according to the target function file. The function installation request is a request sent by the cloud after confirming that the uploaded modified function file has passed the security test. The cleanup module is used to remove isolated change function files when the installation is complete.

[0143] B13. The security detection device as described in B12, wherein the cleaning module is further configured to construct integrity verification information of the target function file upon completion of installation; if the integrity verification information is consistent with the verification information recorded in the function installation request, then generate an integrity record corresponding to the target function file based on the integrity verification information; store the integrity record in the target database, and clear the isolated modified function file, wherein the target database is a protected hash database.

[0144] B14. In the security detection device described in B13, the cleanup module is further configured to sign the integrity record through a trusted hardware module; and upon completion of the signing, store the integrity record in the target hash database.

[0145] B15. The security detection device as described in B13, wherein the cleaning module is further configured to, upon completion of installation, determine the function description file in the target function file; read the function description file in a secure execution environment through a protected file handle; and perform a hash operation on the function description file using a preset hash algorithm to generate a description file hash value.

[0146] B16. The security detection device as described in B15, wherein the preset hash algorithm is an incremental hash algorithm; The cleanup module is further configured to determine the file block size based on the file size of the function description file; to segment the function description file according to the file block size to obtain at least one description file block; and to stream each description file block in a secure execution environment using a protected file handle. The cleaning module is also used to input the blocks of each description file read in the streaming into a preset hash algorithm for hash operation to generate a description file hash value.

[0147] B17. The security detection device as described in B12, wherein the cleaning module is further configured to, in response to a function execution request, construct integrity verification information based on a function file to be executed, wherein the function file to be executed is a function file corresponding to a smart agent function to be executed; extract integrity records corresponding to the function file to be executed from a target database, wherein the target database is a protected hash database; construct a security detection result based on the integrity verification information and the integrity record; and if the security detection result is a successful verification, construct a function execution process and execute the smart agent function to be executed based on the function execution process.

[0148] This application also discloses C18, a security detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the security detection method as described above.

[0149] This application also discloses D19, a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the security detection method described above.

[0150] This application also discloses E20, a computer program product comprising a computer program that, when executed by a processor, implements the steps of the security detection method described above.

Claims

1. A security detection method, characterized in that, The security detection method includes: The modified function file is isolated and sent to the cloud so that the cloud can perform a security check on the modified function file. The modified function file is a function file of a newly created intelligent agent function or a function file of a modified intelligent agent function. In response to a feature installation request, a target feature file is determined based on the feature installation request, and the feature is installed based on the target feature file. The feature installation request is a request sent by the cloud after confirming that the uploaded modified feature file has passed the security test. Upon completion of installation, the isolated change function files will be cleared.

2. The security detection method as described in claim 1, characterized in that, Upon completion of installation, the isolated modified function files will be cleared, including: Upon completion of installation, integrity verification information for the target function files is constructed. If the integrity verification information is consistent with the verification information recorded in the function installation request, then an integrity record corresponding to the target function file is generated based on the integrity verification information. The integrity record is stored in the target database, and the isolated change function file is cleared. The target database is a protected hash database.

3. The security detection method as described in claim 2, characterized in that, The step of storing the integrity record in a target hash database, wherein the target hash database is a protected hash database, includes: The integrity record is signed by a trusted hardware module; Upon completion of the signing process, the integrity record is stored in the target hash database.

4. The security detection method as described in claim 2, characterized in that, The step of constructing integrity verification information for the target function file upon completion of installation includes: Upon completion of installation, determine the function description file within the target function file; The function description file is read in a secure execution environment using a protected file handle; The function description file is hashed using a preset hash algorithm to generate a description file hash value. Integrity verification information is constructed based on the hash value of the description file.

5. The security detection method as described in claim 4, characterized in that, The preset hash algorithm is an incremental hash algorithm; The step of reading the function description file in a secure execution environment using a protected file handle includes: Determine the file block size based on the file size of the function description file; The function description file is divided according to the file block size to obtain at least one description file block; Streaming descriptor file chunks in a secure execution environment using protected file handles; Accordingly, the step of performing a hash operation on the functional description file using a preset hash algorithm to generate a description file hash value includes: Each description file is read in blocks and then input into a preset hash algorithm for hash operation to generate a description file hash value.

6. The security detection method according to any one of claims 1-5, characterized in that, The security detection method also includes: In response to a function execution request, integrity verification information is constructed based on the function file to be executed, wherein the function file to be executed is the function file corresponding to the intelligent agent function to be executed; Extract the integrity record corresponding to the function file to be run from the target database, which is a protected hash database; A security detection result is constructed based on the integrity verification information and the integrity record; If the security test result is successful, a function execution process is constructed, and the function of the intelligent agent to be run is executed based on the function execution process.

7. A safety detection device, characterized in that, The safety detection device includes: An isolation module is used to isolate the modified function file and send the modified function file to the cloud so that the cloud can perform security checks on the modified function file. The modified function file is a function file of a newly created intelligent agent function or a function file of a modified intelligent agent function. The installation module is used to respond to a function installation request, determine the target function file according to the function installation request, and perform function installation according to the target function file. The function installation request is a request sent by the cloud after confirming that the uploaded modified function file has passed the security test. The cleanup module is used to remove isolated change function files when the installation is complete.

8. A safety detection device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the security detection method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the security detection method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the security detection method as described in any one of claims 1 to 6.

Images