A data stream analysis method, system, device and storage medium

Abstract

This application provides a data stream analysis method, system, device, and storage medium. In this embodiment, the data stream analysis system can be divided into a data stream acquisition end and a data stream processing end. The data stream acquisition end runs on the user instance side to collect the data stream to be analyzed occurring on the user instance side, encrypts the data stream, and transmits it to the data stream processing end. The data stream processing end runs in a trusted execution environment (TEX) to decrypt the data stream and perform anomaly analysis on it within the TEX. This completely black-boxes the core processing steps of the data stream within the TEX, effectively improving the security and / or privacy of the data stream analysis process.

Description

TECHNICAL FIELD

[0001] The present application relates to the cloud security field, and in particular to a data flow analysis method, system, device and storage medium. BACKGROUND

[0002] At present, in the field of cloud computing, IDS (intrusion detection system) or IPS (Intrusion Prevention System) and other data flow analysis products can be used to monitor and analyze the data flow occurring in cloud computing.

[0003] These data flow analysis products all analyze and process data flow in the data plaintext state, which provides an opportunity for attackers. Attackers can tamper with data flow analysis results, steal data flow data or bypass data flow analysis strategies by attacking the data flow analysis product itself, so as to achieve the purpose of intruding the data flow.

[0004] This brings security risks to cloud computing. SUMMARY

[0005] Aspects of the present application provide a data flow analysis method, system, device and storage medium to improve the security of the data flow analysis process.

[0006] The data flow analysis system provided by the embodiment of the present application comprises a data flow collection end and a data flow processing end, the data flow collection end runs on the user instance side, and the data flow processing end runs in a trusted execution environment.

[0007] The data flow collection end is configured to collect a to-be-analyzed data flow occurring on the user instance side, and transmit the to-be-analyzed data flow to the data flow processing end after encryption.

[0008] The data flow processing end is configured to decrypt the to-be-analyzed data flow and perform abnormality analysis on the to-be-analyzed data flow in the trusted execution environment.

[0009] The embodiment of the present application also provides a data flow analysis method applicable to the data flow processing end in a data flow analysis system, the data flow processing end runs in a trusted execution environment, the data flow analysis system further comprises a data flow collection end, the data flow collection end runs on the user instance side, and the method comprises the following steps.

[0010] Receiving a to-be-analyzed data flow transmitted by the data flow collection end after encryption;

[0011] Decrypting the to-be-analyzed data flow;

[0012] performing anomaly analysis on the data flow to be analyzed in the trusted execution environment.

[0013] The embodiment of the present application further provides a data flow analysis method, which is suitable for a data flow collection end in a data flow analysis system, wherein the data flow collection end runs on a user instance side, the data flow analysis system further comprises a data flow processing end, the data flow processing end runs in a trusted execution environment, and the method comprises the following steps of:

[0014] collecting a data flow to be analyzed occurring on the user instance side;

[0015] encrypting the data flow to be analyzed by using a first key;

[0016] providing the encrypted data flow to be analyzed to the data flow processing end, so that the data flow processing end decrypts the data flow to be analyzed and performs anomaly analysis on the data flow to be analyzed in the trusted execution environment.

[0017] The embodiment of the present application further provides a computing device, which comprises a memory, a processor and a communication component;

[0018] The memory is used for storing one or more computer instructions;

[0019] The processor is coupled with the memory and the communication component, and is used for creating a trusted execution environment in the computing device, and executing one or more computer instructions corresponding to a data flow processing end in the trusted execution environment, so as to:

[0020] receiving a data flow to be analyzed transmitted by a data flow collection end by encryption;

[0021] decrypting the data flow to be analyzed;

[0022] performing anomaly analysis on the data flow to be analyzed in the trusted execution environment.

[0023] The embodiment of the present application further provides a computing device, which comprises a memory, a processor and a communication component;

[0024] The memory is used for storing one or more computer instructions;

[0025] The processor is coupled with the memory and the communication component, and is used for executing one or more computer instructions corresponding to a data flow collection end, so as to:

[0026] collecting a data flow to be analyzed occurring on a target user instance;

[0027] encrypting the data flow to be analyzed by using a first key;

[0028] The encrypted to-be-analyzed data stream is provided to a data stream processing end running in a trusted execution environment, so that the data stream processing end decrypts the to-be-analyzed data stream and performs abnormality analysis on the to-be-analyzed data stream in the trusted execution environment.

[0029] The application further provides a computer readable storage medium storing computer instructions, which, when executed by one or more processors, cause the one or more processors to perform the data stream analysis method.

[0030] In the embodiments of the application, the data stream analysis system can be split into a data stream collection end and a data stream processing end. The data stream collection end can run on a user instance side to collect to-be-analyzed data streams occurring on the user instance side, encrypt the to-be-analyzed data streams, and transmit the encrypted to-be-analyzed data streams to the data stream processing end. The data stream processing end runs in a trusted execution environment, decrypts the to-be-analyzed data streams, and performs abnormality analysis on the to-be-analyzed data streams in the trusted execution environment. This makes the core processing link of the data stream completely black-boxed in the trusted execution environment, thereby effectively improving the security and / or privacy of the data stream analysis process. BRIEF DESCRIPTION OF DRAWINGS

[0031] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and serve to explain the principles of the application. In the drawings:

[0032] Figure 1a A structural schematic diagram of a data stream analysis system according to an example embodiment of the application;

[0033] Figure 1b A detailed structural schematic diagram of a data stream analysis system according to an example embodiment of the application;

[0034] Figure 2 A logic schematic diagram of a data stream analysis scheme according to an example embodiment of the application;

[0035] Figure 3 A flow schematic diagram of a data stream analysis method according to another example embodiment of the application;

[0036] Figure 4 A flow schematic diagram of another data stream analysis method according to another example embodiment of the application;

[0037] Figure 5 A structural schematic diagram of a computing device according to yet another example embodiment of the application. DETAILED DESCRIPTION

[0038] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described below in connection with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0039] At present, data stream analysis products are all analyzed and processed in the data plaintext state, which provides an opportunity for attackers. Therefore, in some embodiments of the present application, the data stream analysis system is divided into a data stream collection end and a data stream processing end, wherein the data stream collection end can be run on the user instance side to collect the data stream to be analyzed occurring on the user instance side, and transmit the data stream to be analyzed after encryption to the data stream processing end; the data stream processing end is run in a trusted execution environment; used to decrypt the data stream to be analyzed, and perform abnormal analysis on the data stream to be analyzed in the trusted execution environment, which makes the core processing link of the data stream completely black-boxed in the trusted execution environment, thereby effectively improving the security and / or privacy of the data stream analysis process.

[0040] The technical solutions provided by the embodiments of the present application will be described in detail below in connection with the drawings.

[0041] Figure 1a A structural schematic diagram of a data stream analysis system provided for an exemplary embodiment of the present application is shown in FIG. 1. As shown in FIG. 1, the system includes a data stream collection end and a data stream processing end. Among them, the data collection end can be run on the user instance side, and the data stream processing end is run in a trusted execution environment. Figure 1a

[0042] ​The trusted execution environment can be a TEE (Trusted Execution Environment). The trusted execution environment can be a secure running environment for data processing. The trusted execution environment can be implemented by a program written in a predetermined programming language (i.e., can be implemented in the form of software) or can be implemented by a specified entity component and a program (i.e., can be implemented in the form of hardware + software). The embodiment is not limited to which form the trusted execution environment is implemented by. The form of implementation can be set according to actual conditions. For example, the trusted execution environment can be implemented by a software aspect TPM (Trusted Platform Module) or a hardware aspect SGX (Software Guard Extensions), ARM Trustzone, AMD PSP (Platform Security Processor), and the like. The trusted execution environment can be a secure and isolated data processing environment from other environments. That is, the processing performed in the trusted execution environment and the data generated in the process of data processing cannot be accessed by other execution environments or application programs outside the executable environment.

[0043] In the embodiment, the user instance side can refer to any user instance existing in a cloud computing scenario. The user instance can be understood as a virtual computing unit in a cloud computing resource, which provides cloud computing services for users. In the embodiment, the user instance can include, but is not limited to, a cloud server instance, a network device instance, and the like. The data stream analysis scheme provided in the embodiment can be used to analyze the data stream occurring on the user instance side. It should be understood that, in the data stream analysis process, only the data stream is usually monitored, and the data stream does not need to be intercepted.

[0044] Reference Figure 1aIn this embodiment, the data stream analysis system can be split into a data stream collection end and a data stream processing end. The data stream collection end can be loaded on the user instance side as a front end and used to collect the data stream to be analyzed occurring on the user instance side. In this embodiment, the data stream collection end can also encrypt the collected data stream to be analyzed so that the data stream to be analyzed is in an encrypted state from the source. In addition, in this embodiment, the data stream analysis system can include multiple data stream collection ends, which can be distributed on multiple user instance sides, and different data stream collection ends can use the same or different keys to encrypt the collected data stream. The data stream processing end only needs to be previously agreed with the data stream processing end to guide the data stream processing end to correctly obtain the decryption key of the data stream. The data stream collection end can transmit the encrypted data stream to be analyzed to the data stream processing end. When there are multiple data stream collection ends, the encrypted data stream to be analyzed provided by the multiple data stream collection ends can be aggregated to the data stream processing end for processing.

[0045] The data stream processing end can be a back end and separated from the non-confidential environment of the user instance side and run in a trusted execution environment. Therefore, in this embodiment, a trusted execution environment can be created for the data stream processing end, and the data stream processing end can be loaded into the trusted execution environment. Details of the creation of the trusted execution environment are not described here. In this embodiment, the currently available or future creation scheme can be used to create the trusted execution environment to provide a trusted execution environment for the data stream processing end. The process of loading the data stream processing end into the trusted execution environment can be slightly different in different types of trusted execution environments, and this embodiment does not exhaustively explain it.

[0046] Taking the adoption of SGX to implement a trusted execution environment as an example, an exemplary process of loading the data stream processing end into the trusted execution environment in this embodiment can be: an enclave (ring or enclave) can be created based on the SGX technology as a trusted execution environment; and a part of the EPC (Enclave Page Cache, enclave page cache) region in the memory can be allocated for the enclave. The CPU can create one or more enclaves at the same time, and the codes run by different enclaves can be the same or different, depending on the use of the corresponding enclave. On this basis, the code of the data stream processing end can be encapsulated in the created enclave in this embodiment, so as to obtain an enclave for processing the data stream, that is, to load the data stream processing end into the trusted execution environment. The memory region corresponding to the above-mentioned EPC is encrypted by the MEE (Memory Encryption Engine) in the CPU, and the content (code and data in the enclave) in the memory region can only be decrypted in the CPU core, and the key for encryption and decryption is generated only when the EPC is started and stored in the CPU. It can be seen that the security boundary of the enclave only contains itself and the CPU, and neither privileged nor non-privileged software can access the enclave, even the operating system administrator and the VMM (virtual machine monitor; or called, Hypervisor) cannot affect the code and data in the enclave, so it has very high security, so based on the TEE, the integrity of the loaded data stream processing end can be ensured, so that the data stream processing process has sufficient security.

[0047] Based on this, for the data stream processing end, the to-be-analyzed data stream can be decrypted, and the to-be-analyzed data stream is analyzed for abnormalities in the trusted execution environment.

[0048] In this way, by running the data stream processing end in the trusted execution environment, the core application of the data stream analysis system can be separated from the non-confidential environment on the user instance side, so that even if an attacker attacks the user instance side, the data stream processing end cannot be hijacked, thereby effectively ensuring that the data stream processing end itself is not attacked.

[0049] In the data stream analysis process, it is usually necessary to determine whether the data stream is abnormal according to the analysis basis. In different types of data stream analysis schemes, the form of the analysis basis can be various, for example, in the analysis scheme of the IDS (Intrusion Detection System) type, the analysis basis can be a feature knowledge base containing a plurality of preset features, and if the to-be-analyzed data stream hits a matching feature in the feature knowledge base, it can be determined to be abnormal.

[0050] Figure 1b A detailed structure diagram of a data flow analysis system provided for an exemplary embodiment of the present application, Figure 2 A logic diagram of a data flow analysis scheme provided for an exemplary embodiment of the present application. Refer to Figure 1b and Figure 2 Optionally, in the present embodiment, the analysis basis for data flow analysis can also be loaded in the trusted execution environment in the form of ciphertext. The ciphertext of the analysis basis refers to the ciphertext generated by encrypting the analysis basis, i.e., the encrypted analysis basis data. In some cases, the ciphertext of the analysis basis can be preloaded in the trusted execution environment, for example, pre-stored in the image file in the trusted execution environment. In this case, the original management end of the analysis basis can encrypt the analysis basis when the analysis basis is built, and write the analysis basis in the form of ciphertext into the trusted execution environment, so as to ensure the security of the analysis basis during the writing process into the trusted execution environment. In this case, if the analysis basis is updated, the original management end of the analysis basis can re-write the ciphertext of the updated analysis basis into the trusted execution environment, so as to ensure the accuracy of the ciphertext of the analysis basis in the trusted execution environment. In other cases, the ciphertext of the analysis basis can also be dynamically loaded into the trusted execution environment after the data flow processing end is started. In this case, the ciphertext of the analysis basis can be stored in a storage area outside the trusted execution environment. It can be understood that the analysis basis is always in the form of ciphertext in the storage area outside the trusted execution environment. An exemplary dynamic loading scheme can be that the data flow processing end initiates a loading instruction for the ciphertext of the analysis basis to the storage area, so as to load the ciphertext of the analysis basis into the trusted execution environment. In addition, in this case, a re-loading instruction for the ciphertext of the analysis basis can also be initiated to the storage area when it is monitored that the ciphertext of the analysis basis is updated, wherein the key used by the ciphertext of the analysis basis can also be changed when the ciphertext of the analysis basis is updated.

[0051] Based on this, in the present embodiment, by loading the ciphertext of the analysis basis for data flow analysis into the trusted execution environment, the ciphertext of the analysis basis can be protected from attacks, and the analysis basis is always in an encrypted state outside the trusted execution environment, which ensures the encryption of the analysis basis in the whole connection path, so that the analysis basis is more secure and completely avoids the leakage of the analysis basis.

[0052] In this embodiment, on the basis of loading the analysis basis in the trusted execution environment in an encrypted state, a key service end is introduced to securely and reliably provide the decryption key corresponding to the analysis basis ciphertext to the data stream processing end. The key service end can be used to securely host the decryption keys for the data stream analysis system, which can include but is not limited to keys for decrypting the analysis basis ciphertext and keys for decrypting the data stream to be analyzed. The keys hosted in the key service end can be pre-set by the user, for example, the user can configure the required keys at each link through the user control end; the keys hosted in the key service end can also be autonomously generated by the key service end according to the specified key generation logic, for example, the key service end can be pre-provisioned with the key generation logic agreed by each encryption party (such as the aforementioned user control end, original management end of the analysis basis, etc.), and generate the required keys at each link as needed to provide to the data stream processing end. In this embodiment, the source of the keys hosted in the key service end is not limited, but by default, the key service end can securely host the keys, that is, the key service end can ensure the security of the keys it hosts. Alternatively, the key service end can use the key management service KMS (Key Management Service) provided in the cloud computing scenario.

[0053] Reference Figure 1a Alternatively, in this embodiment, the user instance side and the trusted execution environment can be distributed in different virtual machines, and a secure channel is pre-established between the two virtual machines; the data stream collection end transmits the encrypted data stream to be analyzed to the data stream processing end through the secure channel. Distributing the trusted execution environment in a virtual machine different from the user instance side can completely separate the data stream processing end from the non-confidential environment of the user instance side, thereby further improving the security of the data stream processing end. In this case, considering that in the cloud computing environment, virtual machines are usually only allowed to communicate and interact through local secure channels (such as vscok, a technology for data transmission between virtual machines), in this embodiment, the Hypervisor can provide a secure vscok data channel, and a virtual network device (such as tun) can be constructed in the virtual machine carrying the trusted execution environment, and the network interface of the virtualized network device and the original vsock front end on the virtual machine are configured together. In this way, a secure and encrypted communication channel can be formed between the virtual network device, the vsock front end in the virtual machine carrying the trusted execution environment, the Hypervisor providing a secure vscok data channel, and the vsock front end in the virtual machine carrying the user instance, which can serve as a secure channel between the two virtual machines. The secure channel constructed in this way can support complete and compatible network communication services, thereby ensuring secure communication between the data stream collection end and the data stream processing end.

[0054] On this basis, referring to Figure 1b and Figure 2 , the data stream processing end can request two aspects of decryption keys from the key service end: the first key for decrypting the data stream to be analyzed and the second key for decrypting the analysis based on the ciphertext. In this embodiment, the key service end can verify the data stream processing end in terms of remote attestation and / or access rights, and return the key to the data stream processing end if the data stream processing end passes the verification, so as to ensure the secure transmission of the key.

[0055] An exemplary verification scheme of remote attestation can be: the data stream processing end can construct the measurement information for remote attestation; send the key request carrying the measurement information to the key service end to obtain the first key and / or the second key returned by the key management service end in the case that the data stream processing end is determined not to be tampered with according to the measurement information, wherein the measurement information can contain the hash value and other information for describing the integrity of the data stream processing end. In this exemplary scheme, the data stream analysis system can also provide a user control end for users. The user control end can be used to configure the reporting information for remote attestation for the data stream processing end; provide the reporting information to the key service end, so that the key service end determines whether the data stream processing end is tampered with by comparing the measurement information and the reporting information when receiving the key request, wherein the reporting information can contain the hash value and other information for describing the integrity of the data stream processing end. The reporting information can be pre-stored in the key service end, or stored in the RAM (Resource Access Management) of the access control service end, in which case the key service end and the access control service end can cooperate to realize the verification of remote attestation. It is worth noting that the above-mentioned verification scheme of remote attestation is only exemplary, and the details of the scheme are not limited thereto.

[0056] An exemplary access permission verification scheme can be that the data flow analysis system can further provide a user control terminal for a user, which can be used to specify a data flow processing terminal that can access the first key and the second key in the key service terminal; the key service terminal is further configured to: determine whether the data flow processing terminal has access permission for the first key and the second key when receiving a key request; and return the first key and the second key to the data flow processing terminal if it is determined that the data flow processing terminal has access permission for the first key and the second key. In this exemplary scheme, the data flow processing terminal with access permission can be pre-authorized for each key hosted in the key service terminal, for example, an enclave with access permission can be specified for each key hosted in the key service terminal. In this way, the data flow processing terminal can carry identity information in the key request for the key service terminal to verify whether it has access permission for the first key or the second key it requests. In this exemplary embodiment, the access permission can be pre-stored in the key service terminal or in the RAM of the access control service terminal, and the key service terminal and the access control service terminal can cooperate to verify the access permission. It should be noted that the above-mentioned access control verification scheme is only exemplary, and the details of the scheme are not limited thereto.

[0057] For the key service terminal, the data flow processing terminal needs to pass the verification of each dimension to be pre-stored before the key service terminal returns the key requested by the data flow processing terminal; and if the data flow processing terminal does not pass the verification of any dimension, the key service terminal will not return the key requested by the data flow processing terminal, so as to ensure the security of the key hosted by the key service terminal. In addition, a secure channel is pre-established between the key service terminal and the trusted execution environment, so that the key service terminal can transmit the key to the data flow processing terminal through the secure channel, so as to ensure the security of the key in the transmission process.

[0058] Accordingly, in this embodiment, the keys required for decryption at each link are strictly managed, and the keys are provided to the data flow processing terminal only after ensuring the trustworthiness, correctness and integrity of the data flow processing terminal, which ensures strict decryption permission verification.

[0059] In this embodiment, the data stream processing end needs to perform two decryption operations in the trusted execution environment: on the one hand, as mentioned above, the data stream to be analyzed transmitted to the data stream processing end can be large, and the encryption keys used by different data streams to be analyzed can not be completely the same, therefore, the data stream processing end can request different first keys from the key server for different data streams to be analyzed, and the data stream processing end can use different first keys to respectively decrypt the corresponding data streams to be analyzed. Of course, different data streams to be analyzed can also use the same encryption key, so that the data stream processing end only needs to obtain the common first key from the key server, and the data stream processing end can use the common first key to respectively decrypt different data streams to be analyzed. On the other hand, the data stream processing end can also use the requested second key to decrypt the analysis basis data from the ciphertext. As mentioned above, the analysis basis ciphertext can be updated, and the encryption keys used by different versions of the analysis basis ciphertext can be different, in this case, the data stream processing end can request a new key from the key server when monitoring that the analysis basis ciphertext is updated, to use the new key to solve the updated analysis basis ciphertext. In addition, the request time of the first key and the second key can be different, and the data stream processing end can determine the request time of the first key and the second key respectively, and there is no need to request the first key and the second key at the same time. Obviously, the request frequency of the second key will be less.

[0060] It is worth noting that the decryption process of the data stream to be analyzed and the analysis basis ciphertext only occurs in the trusted execution environment, which ensures the security of the decryption process, and also ensures the security of the decrypted data stream to be analyzed and the analysis basis data. In the trusted execution environment, the data stream processing end can safely use the plaintext to use the analysis basis data and the data stream to be analyzed, and under the protection of the trusted execution environment, these plaintext data will not be leaked, and there is no risk of being attacked. In addition, although the analysis process of the data stream processing end on the data stream to be analyzed is still in plaintext, since the data stream processing end is completely black-boxed in the trusted execution environment, the operator of the cloud computing cannot obtain the plaintext content of the data stream, which can ensure the privacy of the data stream, and can technically prove the privacy protection of the customer data, solving the problem that the plaintext analysis method in the existing data stream analysis scheme cannot guarantee the data privacy.

[0061] Reference Figure 1b and Figure 2 After the above decryption operation is completed, the data stream processing end can perform abnormal analysis on the decrypted data stream to be analyzed according to the analysis basis data in the trusted execution environment. Among them, the data stream processing end can perform abnormal analysis on the data stream to be analyzed according to the preset processing logic, which will not be described in detail, and the processing logic in this embodiment can be configured according to actual needs.

[0062] On this basis, in the embodiment, the data stream processing end can also report the analysis result of the to-be-analyzed data stream to the management and control center in the management and control plane in an encrypted manner, instead of providing it to the user instance side. This can effectively prevent attackers from hijacking the analysis result at the user instance side.

[0063] It should be understood that, in addition to the implementation manner of loading the analysis basis in a ciphertext state in the trusted execution environment as described above, other implementation manners can also be adopted in the embodiment to support the abnormal analysis function of the data stream processing end. For example, the analysis basis can be stored in other confidential computing products in a ciphertext form, and the data stream processing end can access the analysis basis in a remote manner, and meet the security goals of full-link encryption and black-boxing in the embodiment.

[0064] In summary, in the embodiment, data stream analysis can be implemented based on confidential computing technology. By taking advantage of the trusted execution environment in confidential computing, the data stream analysis system can be split into a front end (data stream collection end) and a back end (data stream processing end), and the back end is run in the trusted execution environment to separate from the non-confidential part of the user instance side. The analysis basis for data stream analysis can also be loaded in the trusted execution environment in a ciphertext form. This can make the data stream processing end itself and the analysis basis ciphertext more secure. More importantly, the data stream and the analysis basis data outside the trusted execution environment are always in an encrypted state, and the multi-dimensional verification of the data stream processing end by the key service end can ensure that the decryption key is securely delivered to the data stream processing end. The decryption operation performed by the data stream processing end only occurs in the trusted execution environment, which ensures that the user data is fully encrypted. Moreover, the analysis and processing process of the data stream processing end on the data stream is completely black-boxed in the trusted execution environment, which fundamentally guarantees the privacy of the user data.

[0065] Figure 3 A flowchart of a data stream analysis method provided by another exemplary embodiment of the present application is shown. Referring to Figure 3 The method can be applied to a data stream processing end in a data stream analysis system. The data stream processing end is run in a trusted execution environment. The data stream analysis system also includes a data stream collection end run in a user instance side. The method includes the following steps.

[0066] Step 300: receiving a to-be-analyzed data stream transmitted by the data stream collection end in an encrypted manner;

[0067] Step 301: decrypting the to-be-analyzed data stream;

[0068] Step 302: performing abnormal analysis on the to-be-analyzed data stream in the trusted execution environment.

[0069] In an optional embodiment, step 301 can comprise: requesting a first key for decrypting the encrypted data stream to be analyzed from a key service end, the key service end being configured to securely host keys for data stream analysis systems; decrypting the encrypted data stream to be analyzed by using the first key; requesting a second key for decrypting the analysis basis ciphertext loaded in the trusted execution environment from the key service end; and decrypting the analysis basis ciphertext by using the second key to obtain the analysis basis data.

[0070] Step 302 can comprise: performing anomaly analysis on the decrypted data stream to be analyzed according to the analysis basis data in the trusted execution environment.

[0071] In an optional embodiment, in the process of requesting the first key and / or the second key from the key service end, the method can comprise:

[0072] constructing measurement information for remote attestation;

[0073] sending the key request carrying the measurement information to the key service end to obtain the first key and / or the second key returned by the key management service end in the case that the key management service end determines that the data stream processing end is not tampered according to the measurement information.

[0074] In an optional embodiment, the data stream analysis system further comprises a user control end, the user control end can configure report information for remote attestation for the data stream processing end, and provide the report information to the key service end, so that the key service end determines whether the data stream processing end is tampered by comparing the measurement information and the report information when receiving the key request; in the process of constructing the measurement information for remote attestation, the method can comprise: constructing the measurement information according to the construction logic consistent with the report information, and the measurement information can comprise a hash value and other information for describing the integrity of the data stream processing end.

[0075] In an optional embodiment, the user control end in the data stream analysis system further specifies the data stream processing end that can access the first key and the second key in the key service end, and the method can comprise:

[0076] carrying the identity information of the data stream processing end in the key request to send to the key service end, so that the key service end judges whether the data stream processing end has access authority for the first key and the second key when receiving the key request; and returning the first key and the second key to the data stream processing end in the case that it is determined that the data stream processing end has access authority for the first key and the second key.

[0077] In an optional embodiment, the method can further comprise:

[0078] If the ciphertext of the analysis is stored in a storage area outside the trusted execution environment, a load command for the ciphertext of the analysis is sent to the storage area to load the ciphertext of the analysis into the trusted execution environment.

[0079] In an optional embodiment, the method may further include:

[0080] If an update to the ciphertext used for analysis is detected, a command to reload the ciphertext used for analysis is sent to the storage area.

[0081] Request a third key from the key management terminal to decrypt the updated ciphertext used for analysis;

[0082] The updated ciphertext was decrypted using a third key.

[0083] In one optional embodiment, the user instance and the trusted execution environment are distributed in different virtual machines, and a secure channel is pre-established between the two virtual machines; the data stream acquisition end transmits the encrypted data stream to be analyzed to the data stream processing end through security information.

[0084] In an optional embodiment, the method may further include:

[0085] The analysis results of the data stream to be analyzed will be encrypted and reported to the control center in the control plane, instead of being provided to the user instance side.

[0086] It is worth noting that the technical details of the above embodiments of the data stream analysis method can be found in the relevant descriptions of the data stream processing end in the foregoing system embodiments. To save space, they will not be repeated here, but this should not cause any loss to the scope of protection of this application.

[0087] Figure 4 A flowchart illustrating another data flow analysis method provided as an exemplary embodiment of this application. (Reference) Figure 4 This method is applicable to the data stream acquisition end of a data stream analysis system, which runs on the user instance side. The data stream analysis system also includes a data stream processing end, which runs in a trusted execution environment. The method includes:

[0088] Step 400: Collect the data stream to be analyzed that occurs on the user instance side;

[0089] Step 401: Encrypt the data stream to be analyzed;

[0090] Step 402: Provide the encrypted data stream to be analyzed to the data stream processing end, so that the data stream processing end can decrypt the data stream to be analyzed and perform anomaly analysis on the data stream to be analyzed in a trusted execution environment. The specific processing logic of the data stream processing end can be found in [reference needed]. Figure 3 The description in the relevant embodiments.

[0091] It is worth noting that the technical details in the above embodiments of the data stream analysis method can refer to the related description of the data stream collection end in the aforementioned system embodiments for brevity, which will not be repeated here, but this should not cause the loss of the scope of protection of the present application.

[0092] It should be noted that in some of the processes described in the above embodiments and accompanying drawings, a plurality of operations appear in a specific order, but it should be clear that these operations can be executed or in parallel without the order in which they appear in this text. The serial numbers of the operations, such as 301, 302, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes can include more or fewer operations, and these operations can be executed in sequence or in parallel. It should be noted that the "first", "second", etc. described herein are used to distinguish different keys, etc., and do not represent the order of precedence. Also, "first" and "second" are not of different types.

[0093] Figure 5 A structural schematic diagram of a computing device is provided for another exemplary embodiment of the present application. The computing device can be a virtual machine, instance, physical server, etc. in a cloud computing scenario, and the implementation form of the computing device is not limited in the present embodiment. As shown in the figure, the computing device includes a memory 50, a processor 51, and a communication component 52. Figure 5 As shown in the figure, the computing device includes a memory 50, a processor 51, and a communication component 52.

[0094] The processor 51 is coupled to the memory 50 and is configured to create a trusted execution environment in the computing device and execute one or more computer instructions corresponding to the data stream processing end in the trusted execution environment, so as to:

[0095] receive the encrypted data stream to be analyzed transmitted by the data stream collection end;

[0096] decrypt the data stream to be analyzed;

[0097] perform anomaly analysis on the data stream to be analyzed in the trusted execution environment.

[0098] In an optional embodiment, in the decryption process, the processor 51 can be configured to: request a first key for decrypting the data stream to be analyzed from a key server, the key server being configured to securely host the key for decryption; decrypt the encrypted data stream to be analyzed using the first key; request a second key for decrypting the analysis basis ciphertext loaded in the trusted execution environment from the key server; and decrypt the analysis basis ciphertext using the second key to obtain the analysis basis data.

[0099] In the process of performing the anomaly analysis on the to-be-analyzed data stream in the trusted execution environment, the processor 51 can be configured to perform the anomaly analysis on the decrypted to-be-analyzed data stream according to the analysis basis data in the trusted execution environment.

[0100] In an optional embodiment, in the process of requesting the first key and / or the second key from the key server, the processor 51 can be configured to:

[0101] construct the measurement information for remote attestation;

[0102] send the key request carrying the measurement information to the key server to obtain the first key and / or the second key returned by the key management server in the case where the data stream processing end is determined not to be tampered with according to the measurement information.

[0103] In an optional embodiment, the data stream analysis system further comprises a user control end, the user control end can configure report information for remote attestation for the data stream processing end, and provide the report information to the key server, so that the key server determines whether the data stream processing end is tampered with by comparing the measurement information and the report information when receiving the key request; in the process of constructing the measurement information for remote attestation, the processor 51 can be configured to: construct the measurement information according to the construction logic consistent with the report information, and the measurement information can comprise a hash value and other information for describing the integrity of the data stream processing end.

[0104] In an optional embodiment, the user control end in the data stream analysis system further specifies the data stream processing end that can access the first key and the second key in the key server, and the processor 51 can be configured to:

[0105] carry the identity information of the data stream processing end in the key request and send it to the key server, so that the key server determines whether the data stream processing end has the access right to the first key and the second key when receiving the key request, and returns the first key and the second key to the data stream processing end in the case where it is determined that the data stream processing end has the access right to the first key and the second key.

[0106] In an optional embodiment, the processor 51 can be configured to:

[0107] If the analysis basis ciphertext is stored in a storage area outside the trusted execution environment, an instruction for loading the analysis basis ciphertext from the storage area to the trusted execution environment is initiated.

[0108] In an optional embodiment, the processor 51 can be configured to:

[0109] In the case where it is monitored that the analysis basis ciphertext is updated, an instruction for loading the analysis basis ciphertext again from the storage area is initiated.

[0110] Request a third key from the key management terminal to decrypt the updated ciphertext used for analysis;

[0111] The updated ciphertext was decrypted using a third key.

[0112] In one optional embodiment, the user instance and the trusted execution environment are distributed in different virtual machines, and a secure channel is pre-established between the two virtual machines; the data stream acquisition end transmits the encrypted data stream to be analyzed to the data stream processing end through security information.

[0113] In an alternative embodiment, processor 51 may be used for:

[0114] The analysis results of the data stream to be analyzed will be encrypted and reported to the control center in the control plane, instead of being provided to the user instance side.

[0115] Furthermore, such as Figure 5 As shown, the computing device also includes other components such as a power supply component 53. Figure 5 The diagram only shows some components and does not mean that the computing device includes only these components. Figure 5 The components shown.

[0116] It is worth noting that the technical details of the above-mentioned embodiments of the computing device can be referred to the relevant descriptions of the data stream processing end in the foregoing system embodiments. To save space, they will not be repeated here, but this should not cause any loss to the scope of protection of this application.

[0117] In some other possible designs, based on and Figure 5 Using the same computing device structure, this application may also provide a computing device for executing the relevant functional logic of the data stream acquisition terminal in the aforementioned system embodiments. In this computing device, the processor 51 can be used to execute one or more computer instructions corresponding to the data stream acquisition terminal for:

[0118] Collect the data stream to be analyzed from the target user instance;

[0119] Encrypt the data stream to be analyzed;

[0120] The encrypted data stream to be analyzed is provided to the data stream processing terminal running in the trusted execution environment, so that the data stream processing terminal can decrypt the data stream to be analyzed; anomaly analysis is performed on the data stream to be analyzed in the trusted execution environment.

[0121] It is worth noting that the technical details of the above-mentioned embodiments of the computing device can be referred to the relevant description of the data stream acquisition end in the foregoing system embodiments. To save space, they will not be repeated here, but this should not cause any loss to the scope of protection of this application.

[0122] Accordingly, the embodiments of the present application also provide a computer readable storage medium storing a computer program, the computer program being executed to implement each step that can be executed by a computing device in the method embodiments.

[0123] The memory in the above Figure 5 is configured to store computer programs and can be configured to store other various data to support operations on the computing platform. Examples of these data include instructions of any application program or method for operating on the computing platform, contact data, phonebook data, messages, pictures, videos, etc. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0124] The communication component in the above Figure 5 is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as a WiFi, 2G, 3G, 4G / LTE, 5G, or the like mobile communication network, or a combination thereof. In an example embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In an example embodiment, the communication component further includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0125] The power supply component in the above Figure 5 supplies power to various components of the device where the power supply component is located. The power supply component can include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device where the power supply component is located.

[0126] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage media, etc.) containing computer usable program code.

[0127] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0128] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks.

[0129] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0130] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0131] The memory can include non-persistent memory and / or persistent memory, such as flash memory, read-only memory (ROM), and / or volatile or non-volatile random access memory (RAM), among others. The memory is an example of computer readable media.

[0132] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0133] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or apparatus that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent in such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0134] The above only describes the embodiments of the present application and is not intended to limit the present application. Those skilled in the art can make various changes and modifications to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A data stream analysis system comprising a data stream collection end and a data stream processing end, the data stream collection end running on a user instance side, and the data stream processing end running in a trusted execution environment; the data stream collection end is configured to collect a data stream to be analyzed occurring on the user instance side, and transmit the data stream to be analyzed after encryption to the data stream processing end; The data stream processing end is configured to request a first key for decrypting the data stream to be analyzed from a key service end, and the key service end is configured to securely host the key for decryption for the data stream analysis system. decrypt the encrypted data stream to be analyzed by using the first key; request a second key for decrypting an analysis basis ciphertext loaded in the trusted execution environment from the key server; decrypt the analysis basis ciphertext by using the second key to obtain analysis basis data; perform abnormality analysis on the decrypted data stream to be analyzed according to the analysis basis data in the trusted execution environment. 2.The system of claim 1, wherein in the process of requesting the first key and / or the second key from the key server, the data stream processing end is configured to: construct measurement information for remote attestation; send a key request carrying the measurement information to the key server to obtain the first key and / or the second key returned by the key server in the case that the key server determines that the data stream processing end is not tampered according to the measurement information. 3.The system of claim 2, further comprising a user control end, wherein the user control end is configured to: configure report information for remote attestation for the data stream processing end; provide the report information to the key server, so that the key server determines whether the data stream processing end is tampered by comparing the measurement information and the report information when receiving the key request. 4.The system of claim 1, further comprising a user control end, wherein the user control end is further configured to: specify the data stream processing end that can access the first key and the second key in the key server; the key server is further configured to determine whether the data stream processing end has access rights to the first key and the second key when receiving the key request, and return the first key and the second key to the data stream processing end in the case that the data stream processing end is determined to have the access rights to the first key and the second key. 5.The system of claim 1, wherein the data stream processing end is further configured to: if the analysis basis ciphertext is stored in a storage area outside the trusted execution environment, initiate a loading instruction for the analysis basis ciphertext to the storage area to load the analysis basis ciphertext into the trusted execution environment. 6.The system of claim 5, wherein the data stream processing end is further configured to: if the analysis basis ciphertext is monitored to be updated, initiate a re-loading instruction for the analysis basis ciphertext to the storage area; request a third key for decrypting the updated analysis basis ciphertext from the key server; decrypt the updated analysis basis ciphertext by using the third key.

7. The system of claim 1, wherein the user instance side and the trusted execution environment are distributed in different virtual machines, and a secure channel is pre-established between the two virtual machines; and the data stream collection end transmits the encrypted data stream to be analyzed to the data stream processing end through the secure channel.

8. The system of claim 1, wherein the data stream processing end is further configured to: encrypt and report the analysis result of the data stream to be analyzed to a control center in a control plane, and not provide the analysis result to the user instance side.

9. A data stream analysis method, applicable to a data stream processing end in a data stream analysis system, wherein the data stream processing end runs in a trusted execution environment, and the data stream analysis system further comprises a data stream collection end running in a user instance side, and the method comprises: receiving the encrypted data stream to be analyzed transmitted by the data stream collection end; requesting a first key for decrypting the data stream to be analyzed from a key service end, wherein the key service end is configured to securely host the key for decryption for the data stream analysis system; decrypting the encrypted data stream to be analyzed by using the first key; requesting a second key for decrypting the analysis basis ciphertext loaded in the trusted execution environment from the key service end; decrypting the analysis basis ciphertext by using the second key to obtain analysis basis data; and performing abnormal analysis on the decrypted data stream to be analyzed according to the analysis basis data in the trusted execution environment.

10. A data stream analysis method, applicable to a data stream collection end in a data stream analysis system, wherein the data stream collection end runs in a user instance side, and the data stream analysis system further comprises a data stream processing end running in a trusted execution environment, and the method comprises: collecting a data stream to be analyzed occurring in the user instance side; encrypting the data stream to be analyzed; providing the encrypted data stream to be analyzed to the data stream processing end, so that the data stream processing end requests a first key for decrypting the data stream to be analyzed from a key service end, wherein the key service end is configured to securely host the key for decryption for the data stream analysis system; decrypting the encrypted data stream to be analyzed by using the first key; requesting a second key for decrypting the analysis basis ciphertext loaded in the trusted execution environment from the key service end; decrypting the analysis basis ciphertext by using the second key to obtain analysis basis data; and performing abnormal analysis on the decrypted data stream to be analyzed according to the analysis basis data in the trusted execution environment.

11. A computing device comprising a memory, a processor and a communication component; the memory is configured to store one or more computer instructions; the processor is coupled with the memory and the communication component, and is configured to create a trusted execution environment in the computing device, and execute one or more computer instructions corresponding to a data stream processing end in the trusted execution environment, so as to: receive a data stream to be analyzed encrypted and transmitted by a data stream collection end; ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ requesting a first key for decrypting the encrypted data stream to be analyzed from a key service end, the key service end being configured to securely host keys for data stream analysis systems; decrypting the encrypted data stream to be analyzed by using the first key; requesting a second key for decrypting the analysis basis ciphertext loaded in the trusted execution environment from the key service end; decrypting the analysis basis ciphertext by using the second key to obtain analysis basis data; performing anomaly analysis on the decrypted data stream to be analyzed according to the analysis basis data in the trusted execution environment. 12.A computing device comprising a memory, a processor and a communication component; the memory is configured to store one or more computer instructions; the processor is coupled with the memory and the communication component, and is configured to execute the one or more computer instructions corresponding to a data stream collection end, so as to: collect a data stream to be analyzed generated by a target user instance; encrypt the data stream to be analyzed by using a first key; provide the encrypted data stream to be analyzed to a data stream processing end running in a trusted execution environment, so that the data stream processing end requests a first key for decrypting the data stream to be analyzed from a key service end, the key service end being configured to securely host keys for data stream analysis systems; decrypt the encrypted data stream to be analyzed by using the first key; request a second key for decrypting the analysis basis ciphertext loaded in the trusted execution environment from the key service end; decrypt the analysis basis ciphertext by using the second key to obtain analysis basis data; perform anomaly analysis on the decrypted data stream to be analyzed according to the analysis basis data in the trusted execution environment. 13.A computer-readable storage medium storing computer instructions, which when executed by one or more processors, cause the one or more processors to perform the data stream analysis method of any one of claims 9-10.

Images