A computer encryption method and apparatus for avoiding internal information theft

Abstract

The application discloses a computer encryption method and device for avoiding internal information theft. The method comprises the following steps: receiving a data access request of an external device; obtaining external device attribute data from the data access request, and calculating an external device security value according to the external device attribute data; calculating an allowed access degree of an encryption device to the external device; comparing the external device security value with the allowed access degree to the external device, and performing security auditing on the external device; if the external device security value is greater than the allowed access degree, the auditing is passed, the external device is allowed to access the computer device; and if the external device security value is less than the allowed access degree, the auditing is not passed, and the external device is refused to access the computer device. By using the technical scheme, the external device can be accurately audited, the security of external device access is improved, the security of computer internal data is ensured, and internal information theft is prevented.

Description

Technical Field

[0001] This application relates to the field of computers, and more particularly to a computer encryption method and device for preventing the theft of internal information. Background Technology

[0002] In computer science, computer data refers to the general term for all media containing symbols that can be input into a computer and processed by computer programs. It is a general term for numbers, letters, symbols, and analog quantities that are used to input into electronic computers for processing and have a certain meaning.

[0003] Existing computer equipment typically uses hardware encryption devices such as dongles or firewalls with blacklists and whitelists to protect internal information, preventing unauthorized access to data from external devices. However, hardware encryption increases costs and carries the risk of data loss, while firewall blacklists and whitelists can be easily forged by external devices. Therefore, this invention presents a computer encryption method and device to prevent the theft of internal information and improve data access security. Summary of the Invention

[0004] This application provides a computer encryption method to prevent the theft of internal information, including:

[0005] Step S110: Receive a data access request from an external device;

[0006] Step S120: Obtain external device attribute data from the data access request, and calculate the external device security value based on the external device attribute data;

[0007] Step S130: Calculate the allowed access level of the encryption device to the external device, compare the security value of the external device with the allowed access level to perform a security audit on the external device. If the security value of the external device is greater than the allowed access level, the audit is passed and the external device is allowed to access the computer device. If the security value of the external device is less than the allowed access level, the audit is failed and the external device is denied access to the computer device.

[0008] The computer encryption method described above for preventing the theft of internal information includes external device attribute data in the data access request, such as external device signature, transmission protocol, and service category.

[0009] The computer encryption method described above for preventing the theft of internal information includes the following sub-steps for calculating the security value of an external device:

[0010] Obtain the external device signature from the data access request, and obtain the N signature whitelist stored in the encryption device;

[0011] Calculate the similarity between the external device's signature and a whitelist of N signatures;

[0012] Obtain the transport protocol and service category from the data access request, and calculate the external device security value based on the transport protocol, service category, and calculated address similarity.

[0013] In the computer encryption method described above for preventing the theft of internal information, if the similarity between the external device signature in the data access request and a certain signature whitelist reaches a similarity standard value, the calculated external device security value is compared with the preset security value corresponding to the signature whitelist. If they match, external device access is allowed; otherwise, external device access is denied.

[0014] In the computer encryption method described above for preventing the theft of internal information, if the similarity between the external device signature in the data access request and a certain signature whitelist is lower than a similarity standard value, then step S130 is executed.

[0015] The present invention also provides a computer device for preventing the theft of internal information, comprising:

[0016] The data receiving module receives data access requests from external devices;

[0017] The external device security value calculation module obtains external device attribute data from the data access request and calculates the external device security value based on the external device attribute data.

[0018] The security audit module calculates the allowed access level of the encryption device to external devices, compares the external device's security value with the allowed access level to perform a security audit on the external device. If the external device's security value is greater than the allowed access level, the audit is passed and the external device is allowed to access the computer device. If the external device's security value is less than the allowed access level, the audit is failed and the external device is denied access to the computer device.

[0019] The computer device described above for preventing the theft of internal information includes external device attribute data in the data access request, such as external device signature, transmission protocol, and service category.

[0020] As described above, a computer device for preventing the theft of internal information includes an external device security value calculation module, which is specifically used to obtain an external device signature from a data access request and obtain a whitelist of N signatures stored in an encryption device; calculate the similarity between the external device signature and the whitelist of N signatures; obtain the transmission protocol and service category from the data access request, and calculate the external device security value based on the transmission protocol, service category, and the calculated address similarity.

[0021] As described above, a computer device for preventing the theft of internal information is provided, wherein if the similarity between the external device signature in the data access request and a certain signature whitelist reaches a similarity standard value, a comparison module is triggered; the comparison module is specifically used to compare the calculated external device security value with the preset security value corresponding to the signature whitelist, and if they are the same, external device access is allowed, otherwise external device access is denied.

[0022] In a computer device described above for preventing the theft of internal information, if the similarity between the external device signature in the data access request and a certain signature whitelist is lower than a similarity standard value, a security audit module is triggered.

[0023] The beneficial effects achieved by this application are as follows: By adopting the technical solution of this application, the security audit of external devices can be accurately performed, the security of access to external devices can be improved, the security of internal computer data can be guaranteed, and the theft of internal information can be prevented. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0025] Figure 1 This is a schematic diagram of a computer device provided in an embodiment of this application to prevent the theft of internal information;

[0026] Figure 2 This is a flowchart of a computer encryption method to prevent the theft of internal information, provided in an embodiment of this application. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] Example 1

[0029] like Figure 1As shown, Embodiment 1 of this application provides a computer device to prevent the theft of internal information, including at least an encryption device and a storage device. The storage device stores computer data, and the encryption device provides security protection for the computer data in the storage device to prevent external devices from arbitrarily accessing the computer data. The encryption device can be a combination of hardware and software in the computer device, or it can be a device such as a firewall implemented by software, which is not limited here.

[0030] like Figure 2 As shown, the encryption device performs a computer encryption method to prevent the theft of internal information, the method specifically including the following steps:

[0031] Step 110: Receive data access requests from external devices;

[0032] In this embodiment, the encryption device is installed in a computer device. After the receiving component of the computer device receives a data access request from an external device, it first sends the data access request to the encryption device for device security analysis. The external device attribute data in the data access request includes, but is not limited to, the external device's signature (such as the external device's address, device security identification attributes, etc.), transmission protocol, service category, etc.

[0033] Step 120: Obtain external device attribute data from the data access request, and calculate the external device security value based on the external device attribute data;

[0034] Specifically, the encryption device calculates the security value of the external device, which includes the following sub-steps:

[0035] S121. Obtain the external device signature from the data access request, and obtain the N signature whitelist stored in the encryption device;

[0036] S122. Calculate the similarity between the external device's signature and a whitelist of N signatures;

[0037] S123. Obtain the transmission protocol and service category from the data access request, and calculate the external device security value based on the transmission protocol, service category and the calculated address similarity.

[0038] Specifically, the encryption device uses a formula based on the external device attribute data. Calculate the safety value of external devices, where A Q ψ1 represents the security value of the external device; ψ2 represents the proportion of the external device's business category that belongs to the computer equipment business category; ψ1 represents the proportion of the external device's business category that does not belong to the computer equipment business category. This indicates whether the external device's transmission protocol is a secure protocol acceptable to the encryption device. If so, then... otherwise This represents the similarity between the external device address and the i-th address whitelist of the encryption device, where i ranges from 1 to N, and N is the total number of address whitelists of the encryption device.

[0039] In this embodiment, the encryption device whitelist stores the feature codes of external devices that are allowed to be directly accessed. The external device feature code in the data access request is compared with the feature code whitelist to calculate the similarity, resulting in N similarity values. If the similarity with a certain feature code whitelist reaches the similarity standard value (generally 100%, but can also be set according to actual needs), the calculated external device security value is compared with the preset security value corresponding to the feature code whitelist (each feature code in the encryption device whitelist stores a corresponding preset security value, which is set by the encryption device when storing the whitelist). If they match, external device access is allowed; otherwise, external device access is denied. If the similarity with a certain feature code whitelist is lower than the similarity standard value, step 130 is executed.

[0040] Step 130: Calculate the access level allowed by the encryption device to the external device, compare the security value of the external device with the access level to perform a security audit on the external device. If the security value of the external device is greater than the access level, the audit is passed and the external device is allowed to access the computer device. If the security value of the external device is less than the access level, the audit is failed and the external device is denied access to the computer device.

[0041] Specifically, the encryption device uses the formula Calculate the allowed access to external devices, where FW represents the allowed access of the encryption device to external devices; φ ip This indicates whether the external device's IP address belongs to an illegal IP domain of the computer device; if so, then φ ip φ is 0 otherwise ip =0; D1 represents the number of bytes in the data segment that the external device wants to access that are authorized to be accessed by the computer device, and D2 represents the number of bytes in the data segment that the external device wants to access that are not authorized to be accessed by the computer device; H S This indicates the security level of an external device's service category as belonging to the core services of the computer equipment. If the external device's service category does not belong to the core services, then H... S If the setting is 1, and it pertains to core business operations, then the H setting is based on the preset core business security level. S The value of .

[0042] By comparing the calculated security value of the external device with the calculated permission value of the encryption device for the external device, it is possible to accurately perform security audits even if the external device is not on the computer's whitelist, thereby improving the security of external device access, ensuring the security of internal computer data, and preventing the theft of internal information.

[0043] Example 2

[0044] Embodiment 2 of the present invention provides a computer device for preventing the theft of internal information, comprising:

[0045] The data receiving module receives data access requests from external devices; the external device attribute data in the data access request includes the external device's signature, transmission protocol, and service category.

[0046] The external device security value calculation module obtains external device attribute data from the data access request and calculates the external device security value based on the external device attribute data.

[0047] The external device security value calculation module is specifically used to obtain the external device signature from the data access request and obtain the N signature whitelist stored in the encryption device; calculate the similarity between the external device signature and the N signature whitelist; obtain the transmission protocol and service category from the data access request, and calculate the external device security value based on the transmission protocol, service category and the calculated address similarity.

[0048] If the external device signature in the data access request has a similarity standard value with a certain signature whitelist, the comparison module is triggered. The comparison module is specifically used to compare the calculated external device security value with the preset security value corresponding to the signature whitelist. If they match, the external device access is allowed; otherwise, the external device access is denied.

[0049] If the similarity between the external device signature in the data access request and a certain signature whitelist is lower than the similarity standard value, the security audit module will be triggered.

[0050] The security audit module calculates the allowed access level of the encryption device to external devices, compares the external device's security value with the allowed access level to perform a security audit on the external device. If the external device's security value is greater than the allowed access level, the audit is passed and the external device is allowed to access the computer device. If the external device's security value is less than the allowed access level, the audit is passed and the external device is denied access to the computer device.

[0051] Corresponding to the above embodiments, the present invention provides a computer storage medium, including: at least one memory and at least one processor;

[0052] The memory is used to store one or more program instructions;

[0053] A processor is used to run one or more program instructions to implement a computer encryption method to prevent the theft of internal information.

[0054] Corresponding to the above embodiments, this embodiment of the invention provides a computer-readable storage medium containing one or more program instructions, which are executed by a processor to provide a computer encryption method to prevent the theft of internal information.

[0055] The embodiments disclosed in this invention provide a computer-readable storage medium storing computer program instructions that, when executed on a computer, cause the computer to perform the aforementioned computer encryption method for preventing the theft of internal information.

[0056] In this embodiment of the invention, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0057] The various methods, steps, and logic diagrams disclosed in the embodiments of this invention can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor reads information from the storage medium and, in conjunction with its hardware, completes the steps of the above methods.

[0058] The storage medium can be memory, such as volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.

[0059] Among them, non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory.

[0060] Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (Synchlink DRAM, SLDRAM), and direct memory bus RAM (DRRAM).

[0061] The storage media described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memory.

[0062] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using a combination of hardware and software. When applied as software, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of computer programs from one place to another. Storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0063] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A computer encryption method for avoiding internal information theft, characterized by, The method comprises the following steps: Step S110, receiving a data access request of an external device; Step S120, obtaining external device attribute data from the data access request, and calculating an external device security value according to the external device attribute data; Step S130, calculating an allowed access degree of the encryption device to the external device, comparing the external device security value with the allowed access degree to perform a security audit on the external device, if the external device security value is greater than the allowed access degree, the audit is passed, the external device is allowed to access the computer device, and if the external device security value is less than the allowed access degree, the audit is failed, and the external device is refused to access the computer device; Specifically, the external device attribute data is obtained from the data access request, and the encryption device adopts the formula to calculate the external device security value, wherein A Q represents the security value of the external device; ψ1 represents the proportion of the service category of the external device belonging to the computer device service category; ψ2 represents the proportion of the service category of the external device not belonging to the computer device service category; represents whether the transmission protocol of the external device is a safe protocol that can be recognized by the encryption device, and if so, otherwise represents the similarity between the external device address and the i-th address white list of the encryption device, i is valued from 1 to N, and N is the total number of address white lists of the encryption device.

2. The computer encryption method of claim 1, wherein, The external device attribute data in the data access request comprises an external device characteristic code, a transmission protocol and a service category.

3. The computer encryption method of claim 2, wherein the computer encryption method is characterized by, The external device security value is calculated, and the calculation specifically comprises the following sub-steps: The external device characteristic code is obtained from the data access request, and N characteristic code white lists stored in the encryption device are obtained; The similarity of the external device characteristic code and the N characteristic code white lists is calculated; The transmission protocol and the service category are obtained from the data access request, and the external device security value is calculated according to the transmission protocol, the service category and the calculated address similarity.

4. The computer encryption method of preventing internal information from being stolen according to claim 3, wherein, If the similarity of the external device characteristic code in the data access request and a certain characteristic code white list reaches a similarity standard value, the calculated external device security value is compared with a preset security value corresponding to the characteristic code white list, if yes, the external device is allowed to access, otherwise the external device is refused to access.

5. The computer encryption method of claim 3, wherein the computer encryption method is characterized by, If the similarity of the external device characteristic code in the data access request and a certain characteristic code white list is lower than the similarity standard value, step S130 is performed.

6. A computer device that prevents internal information from being stolen, characterized by, The method comprises the following steps: A data receiving module receives a data access request of an external device; An external device security value calculation module obtains external device attribute data from the data access request, and calculates an external device security value according to the external device attribute data; A security audit module calculates an allowed access degree of the encryption device to the external device, compares the external device security value with the allowed access degree to perform a security audit on the external device, if the external device security value is greater than the allowed access degree, the audit is passed, the external device is allowed to access the computer device, and if the external device security value is less than the allowed access degree, the audit is failed, and the external device is refused to access the computer device; Specifically, the external device attribute data is obtained from the data access request, and the encryption device adopts the formula to calculate the external device security value, wherein A Q represents the security value of the external device; ψ1 represents the proportion of the business category of the external device belonging to the computer device business category; ψ2 represents the proportion of the business category of the external device not belonging to the computer device business category; represents whether the transmission protocol of the external device is a safe protocol that can be recognized by the encryption device, and if so, otherwise represents the similarity between the external device address and the i-th address whitelist of the encryption device, i is valued from 1 to N, and N is the total number of address whitelists of the encryption device.

7. The computer device of claim 6, wherein, The external device attribute data in the data access request comprises an external device characteristic code, a transmission protocol and a service category.

8. The computer device of claim 7, wherein, The external device security value calculation module is specifically configured to obtain the external device characteristic code from the data access request, and obtain N characteristic code white lists stored in the encryption device; The similarity of the external device characteristic code and the N characteristic code white lists is calculated; the transmission protocol and the service category are obtained from the data access request, and the external device security value is calculated according to the transmission protocol, the service category and the calculated address similarity.

9. The computer device of claim 8, wherein, If the similarity of the external device characteristic code in the data access request and a certain characteristic code white list reaches a similarity standard value, a comparison module is triggered; the comparison module is specifically configured to compare the calculated external device security value with a preset security value corresponding to the characteristic code white list, if yes, the external device is allowed to access, otherwise the external device is refused to access.

10. The computer device of claim 8, wherein, If the external device feature code in the data access request is similar to a certain feature code whitelist below a similarity standard value, a security audit module is triggered.

Images