Operating system security control method and system based on risk detection

Abstract

The present invention relates to the field of security control technology, and in particular to a risk detection-based operating system security control method and system, which describes a set of system operation control processes, including client clean operating system installation, hardware information recording and configuration, security mechanism implantation, trust verification and data backup under the control of an authentication microsystem. By installing a clean operating system on a trusted client and generating a system template under the supervision of an authentication microsystem, and then recording and configuring the client hardware information, the implantation and trust authentication of a trusted root system are achieved. During the operation of the client, data is identified, located, packaged, encrypted and backed up to a server to ensure the integrity and recoverability of key data. This method effectively improves the security and reliability of the system, while simplifying management and maintenance work, and adapting to a variety of high-security standard environmental requirements.

Description

Technical Field

[0001] The present invention relates to the field of security control technology, and in particular to an operating system security control method and system based on risk detection. Background Art

[0002] The background technology of the present invention mainly relates to the field of computer security, especially focusing on security control and management at the operating system level. With the rapid development of information technology, computer systems and the data stored and processed by them are facing increasingly severe security threats, such as malware infection, data leakage, unauthorized access, etc. Especially in environments with extremely high security requirements such as enterprises, government agencies and financial institutions, how to ensure the security of computer equipment from startup to operation and the integrity of data has become an urgent problem to be solved.

[0003] Traditional security control methods usually include installing antivirus software, using firewalls, and performing regular security updates and patch applications. However, these methods are mostly passive defenses and mainly focus on security protection at the network transmission level or application level. They often lack effective control measures for security threats and vulnerabilities at the operating system level. In addition, once a client device is hacked, traditional methods make it difficult to track and identify the root cause of the security incident, and cannot effectively prevent the spread of malicious behavior.

[0004] In response to these problems, some advanced security technologies and methods have been proposed, such as trusted computing technology, virtualization technology, encryption technology, etc. However, these technologies often require a complex implementation process, pose challenges to compatibility and integration with existing systems, and may have a significant impact on end-user operating habits and system performance.

[0005] The above existing technologies all have the problem raised by this background technology: how to ensure the security of computer equipment and the integrity of data from startup to operation has become a problem that needs to be solved urgently. In order to solve the above problem, this application designs an operating system security control method and system based on risk detection. Summary of the invention

[0006] The technical problem to be solved by the present invention is to address the deficiencies in the prior art and provide an operating system security control method and system based on risk detection. First, a pure operating system is installed on a trusted client, a trusted system template is generated, and the trusted system template is uploaded to a server to form a trusted root system in the server. Secondly, the client hardware information is configured and the trusted root system is implanted into the client. Finally, after the template is implanted and run, the data during the operation is transmitted back to the server for backup.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] The operating system security control method based on risk detection includes the following steps:

[0009] S1: Under the supervision of the authentication microsystem, a risk assessment value is calculated for the client's hardware environment and network environment, and whether to install a pure operating system is determined based on the risk assessment value;

[0010] S2: If the risk assessment value is less than or equal to the system risk threshold, install a clean operating system on the client and generate a system template;

[0011] S3: Optimizing the system template according to the client hardware information, and implanting the optimized system template into the client;

[0012] S4: After the template is implanted and run, the client will encrypt and back up the data during the operation to the server through blockchain technology.

[0013] The step of calculating the risk assessment value for the client's hardware environment and network environment includes:

[0014] S1.1: Under the supervision of the authentication microsystem, dynamically scan the hardware environment of the client and extract hardware status information, wherein the hardware status information includes CPU status information, memory integrity status information, hard disk encryption status information and peripheral device interface status information;

[0015] S1.2: Under the supervision of the authentication microsystem, dynamically detect the network environment of the client and extract network status information, wherein the network status information includes IP address stability information, network delay information, data integrity information and intrusion detection information;

[0016] S1.3: The variables in the hardware environment and the network environment are jointly evaluated by a multi-layer autoregressive analysis method to construct a dynamic risk assessment model. The hardware status information and the network status information are cross-calculated according to the dynamic risk assessment model to calculate the risk assessment value. The calculation formula of the risk assessment value is:

[0017] ,

[0018] in, , , and Represents the adjustment factor, which is used to adjust the impact of different risk dimensions on the final assessment results. i represents a single hardware status information index, j represents a single network status information, Indicates the i-th hardware status information, Indicates the initial value of the i-th hardware status information of the client. represents matrix multiplication, N represents the total parameter value of network status information, H represents the total parameter value of hardware status information, represents the detection value of the j-th network status information at the t-th moment in the detection process, represents the detection value of the j-th network status information at the t-1th moment in the detection process, Represents the security score generated by the certified microsystem.

[0019] The S2 includes installing a pure operating system on a trusted client, generating a trusted system template, and uploading the trusted system template to a server to form a trusted root system in the server.

[0020] The specific steps of S3 are as follows:

[0021] S3.1: Obtaining hardware information of the client, performing parameterization processing on the hardware information, and obtaining hardware parameters, wherein the hardware information includes a CPU architecture, memory size, hard disk type, network bandwidth, and graphics card processing capability of the client;

[0022] S3.2: constructing a system template constraint equation according to the hardware parameters and the system template, wherein the optimization goal of the system template constraint equation is to maximize the utilization of system resources and minimize energy consumption, and calculating the optimal solution of the equation by solving the system template constraint equation;

[0023] S3.3: Optimize the system template according to the optimal solution of the equation, and embed the optimized configuration parameters into the startup file of the system template to generate a trusted root system;

[0024] S3.4: The server authenticates the client through the identity authentication policy, and implants the trusted root system into the client after the authentication is passed;

[0025] S3.5: After receiving the trusted root system, the client performs a trust authentication according to the trust measurement policy. The client that is successfully authenticated initializes the sectors of the local hard disk and marks the sector data pointer. If the authentication fails, the client stops booting and uploads the illegal operation log to the server.

[0026] The specific steps of the identity authentication strategy are as follows:

[0027] S3.4.1: The server is initialized, generates a random number, calculates the private key based on the random number, generates a key pair based on the server public key, and calculates the client's signature private key based on the key pair and the client's hardware information;

[0028] S3.4.2: The server sends the signature private key and key pair to the client through a secure channel, and sends the client's identity and key pair to a trusted third party through a secure channel. The client and the trusted third party store them locally after receiving them.

[0029] S3.4.3: The client initiates an identity authentication request to the trusted third party. After receiving the instruction requesting identity authentication, the trusted third party generates verification information based on the key pair and sends the verification information to the client. After receiving the verification information, the client signs the verification information based on the signature private key and the key pair and sends the signed verification information to the trusted third party.

[0030] S3.4.4: After the trusted third party receives the signed verification information, it verifies the signature based on the client identity and compares the result with the server's private key. If they are consistent, it sends a communication approval message to the server; if they are inconsistent, it sends a communication rejection message to the server.

[0031] The step of initializing sectors of the local hard disk and marking sector data pointers includes:

[0032] Sector mapping, dividing the local hard disk into an information management area and a data area, recording the template cached to the local hard disk through the information management area, and mapping the sector data in the microsystem with the sector data on the data area;

[0033] Sector verification, which is performed after sector mapping is completed;

[0034] Update the data pointer, save the current template status in the form of a microsystem snapshot and record the data pointer, and return the sector data pointer to the server.

[0035] The specific steps of encrypting and backing up the data in the running process to the server through blockchain technology are as follows:

[0036] S4.1: The server receives the application log of the client, extracts the data return statement to be executed from the application log, and matches the target storage data identifier corresponding to the data return statement according to the preset matching rule;

[0037] S4.2: The server maps the target storage data identifier according to the hash function, obtains the consistent reading point of the target storage data, and forwards the consistent reading point of the target storage data to the backup instance;

[0038] S4.3: The backup instance receives the consistent read point of the target storage data, identifies the storage location corresponding to the consistent read point of the target storage data, sets the read point, and creates a data copy.

[0039] The target storage data identifier corresponding to the data return statement matched according to the preset matching rules includes a normal operation matching identifier and an abnormal risk matching identifier. The matching rules are used to analyze the operating rules of the client according to historical data. If the operating rules are met, the normal operation matching identifier is marked on the data. If the operating rules are not met, the abnormal risk matching identifier is marked on the data.

[0040] Analyzing the operation rules of the client according to historical data includes data matching network;

[0041] The data matching network includes an input layer, a hidden layer and an output layer;

[0042] The input layer is used to return a statement based on the input data, establish a feature sequence, and calculate the fitting value of the feature sequence;

[0043] The hidden layer is used to convert the fitting value of the feature sequence of the input layer into a high-dimensional space, extract features layer by layer through multiple convolutional layers and pooling layers in the high-dimensional space to obtain high-level semantic features, perform matching analysis on the high-level semantic features, and calculate the output value of the hidden layer;

[0044] The output layer is used to compare the output value of the hidden layer with the operating rules to obtain the risk matching degree;

[0045] The calculation formula of the risk matching degree is:

[0046] ,

[0047] in, represents the risk matching degree, represents the learning rate, u represents a single node in the hidden layer, U represents the total number of nodes in the hidden layer, v represents a single node in the output layer, and V represents the total number of nodes in the output layer. represents the output of the u-th node in the hidden layer, represents the connection weights between the hidden layer and the output layer nodes, A single feature that represents the law of operation, represents the node threshold of the output layer, and E represents the error of the output layer input;

[0048] An operating system security control system based on risk detection, the system comprising a risk detection module, a trusted root system generation module, a trusted root system implantation module and a trusted root system operation module;

[0049] The risk detection module is used to perform risk assessment on the client hardware and network environment to determine whether to allow the operating system to be installed;

[0050] The trusted root system generation module is used to install a clean operating system in a controlled and secure environment and generate a system template;

[0051] The trusted root system implantation module is used to obtain and configure the client hardware information, verify the client through the identity authentication policy, and implant the trusted root system into the client after the authentication is passed. The client performs the credit authentication according to the trust measurement policy and initializes the local hard disk;

[0052] The trusted root system operation module is used to collect data during the operation of the client, transmit the data back to the server for backup, apply preset matching rules to analyze the operation rules of the client, and mark the data accordingly;

[0053] The risk detection module includes:

[0054] Hardware status scanning unit: used to extract the hardware status of the client;

[0055] A network environment scanning unit, used to extract the network status of the client;

[0056] A risk assessment unit, used to calculate a risk assessment value and determine whether to allow system installation;

[0057] The trusted root system generation module includes:

[0058] Clean installation unit: responsible for executing the clean installation process of the operating system to ensure that there is no third-party software or malicious code;

[0059] Template generation unit: used to create a system image or template, which will serve as the trusted root of the client;

[0060] Upload management unit: used to upload the generated system template to the server and manage and maintain it on the server side;

[0061] The trusted root system implantation module includes:

[0062] Hardware information acquisition unit: used to collect client hardware information, such as computer name, IP address, etc.;

[0063] Authentication unit: used to perform the client's authentication process, including key generation, exchange and signature verification;

[0064] Template implantation unit: used to implant the trusted root system template into the authenticated client;

[0065] The trusted root system operation module includes:

[0066] Data collection unit: used to collect data that needs to be backed up during the operation of the client;

[0067] Data transmission unit: used to encrypt the collected data and transmit it to the server, and process the decryption reception of the server;

[0068] Backup management unit: used to receive data and back up data on the server side, and update the backup records;

[0069] Matching rule unit: applies preset matching rules, analyzes the normal operation rules and abnormal risks of client data, and marks them accordingly.

[0070] Compared with the prior art, the present invention has the following beneficial effects:

[0071] 1. Enhanced security and integrity: Through the installation of a pure operating system and the configuration of hardware information, as well as a strict trust authentication process, the system security and data integrity are greatly enhanced, effectively preventing malware infection and unauthorized access.

[0072] 2. Data protection and rapid recovery: By encrypting and backing up key data during operation, data continuity and availability are guaranteed. Even in the event of hardware failure or security attack, rapid data recovery can be achieved to minimize the impact of business interruption.

[0073] 3. Management efficiency and cost optimization: A unified security control and management system simplifies the management complexity of equipment and data, reduces the workload of system administrators, improves management efficiency through centralized management and automated processes, and reduces overall operating costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0075] Figure 1 This is a flow chart of an operating system security control method based on risk detection according to Embodiment 1 of the present invention;

[0076] Figure 2 This is a flow chart of risk assessment value calculation in Example 1 of the present invention;

[0077] Figure 3 This is a data matching network structure diagram of Example 1 of the present invention;

[0078] Figure 4 This is a module diagram of an operating system security control system based on risk detection in Example 2 of the present invention. DETAILED DESCRIPTION

[0079] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0080] Example 1

[0081] See also Figure 1 , an embodiment of the present invention provides: an operating system security control method based on risk detection, comprising the following steps:

[0082] S1: Under the supervision of the authentication microsystem, a risk assessment value is calculated for the client's hardware environment and network environment, and whether to install a pure operating system is determined based on the risk assessment value;

[0083] S2: If the risk assessment value is less than or equal to the system risk threshold, install a clean operating system on the client and generate a system template;

[0084] S3: Optimizing the system template according to the client hardware information, and implanting the optimized system template into the client;

[0085] S4: After the template is implanted and run, the client will encrypt and back up the data during the operation to the server through blockchain technology.

[0086] See also Figure 2 , a flow chart of calculating a risk assessment value according to an embodiment of the present invention, wherein the risk assessment value is calculated for the hardware environment and network environment of the client, including:

[0087] S1.1: Under the supervision of the authentication microsystem, dynamically scan the hardware environment of the client and extract hardware status information, wherein the hardware status information includes CPU status information, memory integrity status information, hard disk encryption status information and peripheral device interface status information;

[0088] S1.2: Under the supervision of the authentication microsystem, dynamically detect the network environment of the client and extract network status information, wherein the network status information includes IP address stability information, network delay information, data integrity information and intrusion detection information;

[0089] S1.3: The variables in the hardware environment and the network environment are jointly evaluated by a multi-layer autoregressive analysis method to construct a dynamic risk assessment model. The hardware status information and the network status information are cross-calculated according to the dynamic risk assessment model to calculate the risk assessment value. The calculation formula of the risk assessment value is:

[0090] ,

[0091] in, , , and Represents the adjustment factor, which is used to adjust the impact of different risk dimensions on the final assessment results. i represents a single hardware status information index, j represents a single network status information, Indicates the i-th hardware status information, Indicates the initial value of the i-th hardware status information of the client. represents matrix multiplication, N represents the total parameter value of network status information, H represents the total parameter value of hardware status information, represents the detection value of the j-th network status information at the t-th moment in the detection process, represents the detection value of the j-th network status information at the t-1th moment in the detection process, represents the security score generated by the authentication microsystem;

[0092] The CPU status information specifically includes:

[0093] Monitor CPU usage by accessing the operating system kernel interface, including the percentage of user state, system state, and idle state;

[0094] Get CPU temperature by reading system sensor data;

[0095] Query the current CPU operating frequency through the instruction set and monitor whether there are abnormal frequency changes;

[0096] The memory integrity status information specifically includes:

[0097] Use the SMBIOS parsing tool to scan the system memory module to detect whether there are any new or removed memory modules;

[0098] Detect unusual patterns or unauthorized modifications in memory through memory scanning tools;

[0099] Detect whether memory encryption technology is enabled based on the API tool of the hardware platform;

[0100] The hard disk encryption status information specifically includes:

[0101] Use the manage-bde command to check whether the hard disk encryption software is installed and enabled in the system;

[0102] Verify that the storage and management of encryption keys comply with security specifications through the TPM module to ensure that the keys have not been leaked or tampered with;

[0103] The peripheral device interface status information specifically includes:

[0104] Scan all connected peripheral devices (such as USB devices, serial port devices) through the WMI interface and record their types and status;

[0105] Use the device management API to detect whether the security policy of the peripheral device interface is enabled, such as allowing only trusted devices to connect;

[0106] The IP address stability information specifically includes:

[0107] Continuously monitor the client's IP address changes through the network interface API and record the dynamic changes of the IP address;

[0108] Determine whether the IP address is assigned via DHCP or statically through the network configuration API, and monitor changes in DHCP leases;

[0109] The network delay information specifically includes:

[0110] Periodically sends ICMP echo requests (Ping) or TCP connection requests to a predefined server or gateway and measures the round-trip time (RTT);

[0111] The data integrity information specifically includes:

[0112] Verify the integrity of the transmitted data packet using a checksum or hash algorithm (such as SHA-256) through a built-in verification mechanism to detect whether the data packet has been tampered with during transmission;

[0113] Use network protocol analysis tools to check whether encryption and integrity protection (such as TLS, IPsec) are enabled for the transmission protocol;

[0114] The intrusion detection information specifically includes:

[0115] Monitor network traffic through IDS tools to detect abnormal traffic patterns or potential intrusions;

[0116] Monitor the client's open network ports based on the firewall log to detect any unauthorized port opening or port scanning activities;

[0117] In the above hardware scanning and network detection process, if the check result is yes, it is marked as 1, if not, it is marked as 0;

[0118] S2 includes installing a pure operating system on a trusted client, generating a trusted system template, and uploading the trusted system template to a server to form a trusted root system in the server;

[0119] The installation of a clean operating system on a trusted client includes: the trusted client is connected to the authentication microsystem, and the operating system is installed under the supervision of the authentication microsystem. This installation process is supervised and recorded by the authentication microsystem, and a clean operating system image is loaded from a verified installation media onto the client device to ensure the integrity and trustworthiness of the image. The installation process does not include any third-party software or components that affect system security;

[0120] The generation of a trusted system template and uploading the trusted system template to the server to form a trusted root system in the server includes: after the installation is complete, the authentication microsystem audits and verifies the installed operating system to confirm that it meets the security requirements. The trusted system template generated through this process contains the specific configuration and security settings of the operating system, and the generated trusted system template is encrypted and transmitted to the server. On the server side, security checks and verifications are performed on the received template file, including checking file integrity, source authentication, etc., to ensure that the uploaded system template has not been maliciously tampered with. When the server confirms that the security has passed, the trusted system template uploaded by the client is used as the basis to build the trusted root system of the server;

[0121] The specific steps of S3 are as follows:

[0122] S3.1: Obtaining hardware information of the client, performing parameterization processing on the hardware information, and obtaining hardware parameters, wherein the hardware information includes a CPU architecture, memory size, hard disk type, network bandwidth, and graphics card processing capability of the client;

[0123] S3.2: constructing a system template constraint equation according to the hardware parameters and the system template, wherein the optimization goal of the system template constraint equation is to maximize the utilization of system resources and minimize energy consumption, and calculating the optimal solution of the equation by solving the system template constraint equation;

[0124] S3.3: Optimize the system template according to the optimal solution of the equation, and embed the optimized configuration parameters into the startup file of the system template to generate a trusted root system;

[0125] S3.4: The server authenticates the client through the identity authentication policy, and implants the trusted root system into the client after the authentication is passed;

[0126] S3.5: After receiving the trusted root system, the client performs a trust authentication according to the trust measurement policy. The client that is successfully authenticated initializes the sectors of the local hard disk and marks the sector data pointer. If the authentication fails, the client stops booting and uploads the illegal operation log to the server.

[0127] The specific steps of the identity authentication strategy are as follows:

[0128] S3.4.1: The server is initialized, generates a random number, calculates the private key based on the random number, generates a key pair based on the server public key, and calculates the client's signature private key based on the key pair and the client's hardware information;

[0129] S3.4.2: The server sends the signature private key and key pair to the client through a secure channel, and sends the client's identity and key pair to a trusted third party through a secure channel. The client and the trusted third party store them locally after receiving them.

[0130] S3.4.3: The client initiates an identity authentication request to the trusted third party. After receiving the instruction requesting identity authentication, the trusted third party generates verification information based on the key pair and sends the verification information to the client. After receiving the verification information, the client signs the verification information based on the signature private key and the key pair and sends the signed verification information to the trusted third party.

[0131] S3.4.4: After receiving the signed verification information, the trusted third party verifies the signature according to the client identity and compares the result with the server's private key. If they are consistent, it sends a communication approval message to the server; if they are inconsistent, it sends a communication rejection message to the server.

[0132] After receiving the trusted root system, the client performs the following steps to authenticate the trust according to the trust measurement strategy:

[0133] S3.5.1: When the client terminal is powered on, a trusted root is generated through a trusted third party and forwarded to the client's basic input and output system;

[0134] S3.5.2: The basic input and output system receives the trusted root, decrypts the trusted root, and forwards the decrypted content to a trusted third party. The trusted third party verifies the decrypted content, and after confirming that the decrypted content is correct, performs a basic input and output system integrity measurement check. After the measurement passes, the basic input and output system is started, and the control execution right is transferred to the basic input and output system. The basic input and output system extends the trusted root and forwards the extended trusted root to the client's boot loader;

[0135] S3.5.3: The bootloader receives the extended trusted root, decrypts the extended trusted root, and forwards the decrypted content to the basic input and output system. The basic input and output system verifies the decrypted content, and after confirming that the decrypted content is correct, performs a bootloader integrity measurement check. After the measurement passes, the control execution right is transferred to the bootloader. The bootloader continues to extend the trusted root and forwards the extended trusted root to the client's system kernel.

[0136] S3.5.4: The system kernel receives the extended trusted root, decrypts the extended trusted root, and forwards the decrypted content to the boot loader. The boot loader verifies the decrypted content and performs a system kernel integrity measurement check after confirming that the decrypted content is correct. After the measurement passes, the control execution right is transferred to the system kernel, and the system kernel executes the client's boot process.

[0137] After the terminal is turned on, it will pass the inspection of the microsystem. Only after the identity is verified to be the same as the data pointer stored on the server can it enter the system normally for use. If the data pointer cannot match, the terminal will be prohibited from starting and the operating system cannot be loaded, thus achieving safe startup of the terminal;

[0138] The step of initializing sectors of the local hard disk and marking sector data pointers includes:

[0139] Sector mapping, dividing the local hard disk into an information management area and a data area, recording the template cached to the local hard disk through the information management area, and mapping the sector data in the microsystem with the sector data on the data area;

[0140] It is planned to use sector mapping technology to organize and manage the local hard disk by sector, and divide it into two parts: information management area and data area, as the carrier of the microsystem. The microsystem cached to the local hard disk is recorded through the information management area; the sector data in the microsystem is mapped with the sector data on the local hard disk to achieve the function of caching the microsystem;

[0141] Sector verification, which is performed after sector mapping is completed;

[0142] Update the data pointer, save the current template status in the form of a microsystem snapshot and record the data pointer, and return the sector data pointer to the server;

[0143] Using snapshot technology, the current state of the microsystem is saved in the form of a microsystem snapshot and the data pointer is recorded in response to changes in the microsystem.

[0144] In order to realize the functions of microsystem combination, sector data presentation, front-end and back-end operation data linkage organization, control path format, data tag, abnormal recovery, bottom-level security, etc., it also includes defining a data pointer module for secure and trusted interactive matching and authentication with the microsystem. The data pointer is stored on the server side. After the terminal is turned on, the microsystem obtains the match from the server side. After the match is successful, it is recorded in the local disk cache and written with a tag, and the system starts normally; if the match is unsuccessful, the system cannot continue to start and outputs an abnormal information log; when the system has abnormal blue screen, crash, freeze, etc., the microsystem can quickly recover to the location recorded by the data pointer; because of the importance of the data pointer, the data pointer will be coupled and bound to the image resource pool. Only when the image and data pointer are both present, the terminal can obtain the system and use it;

[0145] The S3 includes data identification, sector positioning, data packaging, data encryption transmission, data decryption reception and update backup records;

[0146] The data identification includes: when the client generates new personalized data in the process of running the template, the system will identify the generation of these data according to the preset rules;

[0147] The sector positioning includes: the system will use the previously marked sector data pointer to accurately locate the sector to be backed up, ensuring that only the changed sectors and related data are backed up;

[0148] The data packaging includes: packaging the sector data to be backed up in a certain format, and adding corresponding metadata information to ensure the integrity and identifiability of the backup data;

[0149] The data encryption transmission includes: encrypting the packaged backup data and then transmitting it to the server through a secure channel. This process ensures that the backup data is not maliciously attacked or leaked during transmission;

[0150] The data decryption and reception includes: the server receives and decrypts the transmitted backup data to ensure the integrity and authenticity of the data;

[0151] The updating of the backup record includes: the server compares the new backup data with the existing data, and only stores the sector data that has changed, so as to achieve the effect of incremental backup. After the backup is completed, the server will update the backup record, including the backup time, content, terminal identification and other information, so as to facilitate subsequent recovery and management operations;

[0152] The specific steps of transmitting the data during operation back to the server for backup are as follows:

[0153] S4.1: The server receives the application log of the client, extracts the data return statement to be executed from the application log, and matches the target storage data identifier corresponding to the data return statement according to the preset matching rule;

[0154] S4.2: The server maps the target storage data identifier according to the hash function, obtains the consistent reading point of the target storage data, and forwards the consistent reading point of the target storage data to the backup instance;

[0155] S4.3: The backup instance receives the consistent read point of the target storage data, identifies the storage location corresponding to the consistent read point of the target storage data, sets the read point, and creates a data copy;

[0156] The target storage data identifiers corresponding to the data return statements matched according to the preset matching rules include normal operation matching identifiers and abnormal risk matching identifiers. The matching rules are used to analyze the operation rules of the client according to historical data. If the operation rules are met, the normal operation matching identifier is marked on the data. If the operation rules are not met, the abnormal risk matching identifier is marked on the data.

[0157] The matching rules include:

[0158] Completeness check: Ensure that the data return statement contains all necessary fields and information without omissions or errors;

[0159] Format validation: Check whether the data conforms to the predetermined format, such as date and time format, value range, and string length;

[0160] Permission verification: confirm that the client has the required permission level to execute the data return statement;

[0161] Contextual consistency: The information in the data return statement needs to match the context of the current operation, such as user session and transaction status;

[0162] Business logic consistency: Data return statements must comply with business logic constraints. For example, existing records cannot be created, and non-existent data cannot be deleted.

[0163] The operating rules include:

[0164] Abnormal pattern recognition: By analyzing historical data, a pattern library of abnormal behaviors is established, such as frequent login failures and unusually large amounts of data requests.

[0165] Rate limiting: Detects whether the frequency of data echo statements exceeds the normal range, which may indicate automated attacks or system abuse;

[0166] Illegal input detection: Identify security threats such as illegal characters, encoding errors, or SQL injections in data return statements;

[0167] Abnormal access time: If the request occurs outside normal working hours or inactive time periods, it may indicate unauthorized access or system intrusion;

[0168] Abnormal data changes: Monitor whether the data changes involved in the data return statement are reasonable. For example, sudden large-scale fund transfers may indicate internal fraud or account theft.

[0169] The matching rules can be implemented by machine learning models, see Figure 3 , a data matching network structure diagram of an embodiment of the present invention, wherein the data matching network comprises:

[0170] The input layer builds a feature sequence based on the input data return statement and calculates the fitting value of the feature sequence;

[0171] A hidden layer converts the fitting value of the feature sequence of the input layer to a high-dimensional space, extracts features layer by layer in the high-dimensional space through multiple convolutional layers and pooling layers, obtains high-level semantic features, performs matching analysis on the high-level semantic features, and calculates the output value of the hidden layer;

[0172] The output layer is used to compare the output value of the hidden layer with the operating rules to obtain the risk matching degree;

[0173] The calculation formula of the risk matching degree is:

[0174] ,

[0175] in, represents the risk matching degree, represents the learning rate, u represents a single node in the hidden layer, U represents the total number of nodes in the hidden layer, v represents a single node in the output layer, and V represents the total number of nodes in the output layer. represents the output of the u-th node in the hidden layer, represents the connection weights between the hidden layer and the output layer nodes, A single feature that represents the law of operation, represents the node threshold of the output layer, and E represents the error of the output layer input;

[0176] Specifically, the data matching network is provided with an input layer, a hidden layer and an output layer. The input layer is used to establish a feature sequence according to the input parameters of the data matching network, accumulate the feature sequence, establish a grey differential equation, calculate the least squares parameter of the grey differential equation, and calculate the fitting value of the feature sequence by discretizing the least squares parameter solution. The hidden layer is used to transform the feature sequence fitting value of the input layer into a high-dimensional space by mapping according to the connection weights between the input layer and the hidden layer, sum the feature sequence fitting value in the high-dimensional space after convolution and pooling, and calculate the output value of the hidden layer by bias. The output layer is used to obtain the input of the output layer, calculate the average error of the input value of the output layer, and determine whether the average error meets the convergence condition. If it does not meet the convergence requirement, the connection weight and node threshold are updated. If it meets the convergence requirement, the risk matching degree is output.

[0177] Example 2

[0178] See also Figure 4 , the present invention provides an embodiment: an operating system security control system based on risk detection, the system comprising a risk detection module, a trusted root system generation module, a trusted root system implantation module and a trusted root system operation module;

[0179] The risk detection module is used to perform risk assessment on the client hardware and network environment to determine whether to allow the operating system to be installed;

[0180] The trusted root system generation module is used to install a clean operating system in a controlled and secure environment and generate a system template;

[0181] The trusted root system implantation module is used to obtain and configure the client hardware information, verify the client through the identity authentication policy, and implant the trusted root system into the client after the authentication is passed. The client performs the credit authentication according to the trust measurement policy and initializes the local hard disk;

[0182] The trusted root system operation module is used to collect data during the operation of the client, transmit the data back to the server for backup, apply preset matching rules to analyze the operation rules of the client, and mark the data accordingly;

[0183] The risk detection module includes:

[0184] Hardware status scanning unit: used to extract the hardware status of the client;

[0185] A network environment scanning unit, used to extract the network status of the client;

[0186] A risk assessment unit, used to calculate a risk assessment value and determine whether to allow system installation;

[0187] The trusted root system generation module includes:

[0188] Clean installation unit: responsible for executing the clean installation process of the operating system to ensure that there is no third-party software or malicious code;

[0189] Template generation unit: used to create a system image or template, which will serve as the trusted root of the client;

[0190] Upload management unit: used to upload the generated system template to the server and manage and maintain it on the server side;

[0191] The trusted root system implantation module includes:

[0192] Hardware information acquisition unit: used to collect client hardware information, such as computer name, IP address, etc.;

[0193] Identity authentication unit: used to perform the client's identity authentication process, including key generation, exchange and signature verification;

[0194] Template implantation unit: used to implant the trusted root system template into the authenticated client;

[0195] The trusted root system operation module includes:

[0196] Data collection unit: used to collect data that needs to be backed up during the operation of the client;

[0197] Data transmission unit: used to encrypt the collected data and transmit it to the server, and process the decryption reception of the server;

[0198] Backup management unit: used to receive data and back up data on the server side, and update the backup records;

[0199] Matching rule unit: applies preset matching rules, analyzes the normal operation rules and abnormal risks of client data, and marks them accordingly.

[0200] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. An operating system security control method based on risk detection, characterized in that: The following steps are involved: S1: Under the supervision of the authentication microsystem, a risk assessment value is calculated for the client's hardware environment and network environment, and whether to install a pure operating system is determined based on the risk assessment value; S2: If the risk assessment value is less than or equal to the system risk threshold, install a clean operating system on the client and generate a system template; S3: Optimizing the system template according to the client hardware information, and implanting the optimized system template into the client; S4: After the client implants the template and runs it, the data during the operation is encrypted and backed up to the server through blockchain technology; The step of calculating the risk assessment value for the client's hardware environment and network environment includes: S1.1: Under the supervision of the authentication microsystem, dynamically scan the hardware environment of the client and extract hardware status information, wherein the hardware status information includes CPU status information, memory integrity status information, hard disk encryption status information and peripheral device interface status information; S1.2: Under the supervision of the authentication microsystem, dynamically detect the network environment of the client and extract network status information, wherein the network status information includes IP address stability information, network delay information, data integrity information and intrusion detection information; S1.3: By using a multi-layer autoregressive analysis method, jointly evaluate the variables in the hardware environment and the network environment, build a dynamic risk assessment model, perform cross operations on the hardware status information and the network status information according to the dynamic risk assessment model, and calculate the risk assessment value. The calculation formula of the risk assessment value is: ， in, , , and Represents the adjustment factor, which is used to adjust the impact of different risk dimensions on the final assessment results. i represents a single hardware status information index, j represents a single network status information, Indicates the i-th hardware status information, Indicates the initial value of the i-th hardware status information of the client. represents matrix multiplication, N represents the total parameter value of network status information, H represents the total parameter value of hardware status information, represents the detection value of the j-th network status information at the t-th moment in the detection process, represents the detection value of the j-th network status information at the t-1th moment in the detection process, Represents the security score generated by the certified microsystem.

2. The operating system security control method based on risk detection according to claim 1 is characterized in that: The S2 includes installing a pure operating system on a trusted client, generating a trusted system template, and uploading the trusted system template to a server to form a trusted root system in the server.

3. The operating system security control method based on risk detection according to claim 1 is characterized in that: The specific steps of S3 are as follows: S3.1: Obtaining hardware information of the client, performing parameterization processing on the hardware information, and obtaining hardware parameters, wherein the hardware information includes a CPU architecture, memory size, hard disk type, network bandwidth, and graphics card processing capability of the client; S3.2: constructing a system template constraint equation according to the hardware parameters and the system template, wherein the optimization goal of the system template constraint equation is to maximize the utilization of system resources and minimize energy consumption, and calculating the optimal solution of the equation by solving the system template constraint equation; S3.3: Optimize the system template according to the optimal solution of the equation, and embed the optimized configuration parameters into the startup file of the system template to generate a trusted root system; S3.4: The server authenticates the client through the identity authentication policy, and implants the trusted root system into the client after the authentication is passed; S3.5: After receiving the trusted root system, the client performs a trust authentication according to the trust measurement policy. The client that is successfully authenticated initializes the sectors of the local hard disk and marks the sector data pointer. If the authentication fails, the client stops booting and uploads the illegal operation log to the server.

4. The operating system security control method based on risk detection according to claim 3 is characterized in that: The specific steps of the identity authentication strategy are as follows: S3.4.1: The server is initialized, generates a random number, calculates the private key based on the random number, generates a key pair based on the server public key, and calculates the client's signature private key based on the key pair and the client's hardware information; S3.4.2: The server sends the signature private key and key pair to the client through a secure channel, and sends the client's identity and key pair to a trusted third party through a secure channel. The client and the trusted third party store them locally after receiving them. S3.4.3: The client initiates an identity authentication request to the trusted third party. After receiving the instruction requesting identity authentication, the trusted third party generates verification information based on the key pair and sends the verification information to the client. After receiving the verification information, the client signs the verification information based on the signature private key and the key pair and sends the signed verification information to the trusted third party. S3.4.4: After the trusted third party receives the signed verification information, it verifies the signature based on the client identity and compares the result with the server's private key. If they are consistent, it sends a communication approval message to the server; if they are inconsistent, it sends a communication rejection message to the server.

5. The operating system security control method based on risk detection according to claim 3 is characterized in that: The step of initializing sectors of the local hard disk and marking sector data pointers includes: Sector mapping, dividing the local hard disk into an information management area and a data area, recording the template cached to the local hard disk through the information management area, and mapping the sector data in the microsystem with the sector data on the data area; Sector verification, which is performed after sector mapping is completed; Update the data pointer, save the current template status in the form of a microsystem snapshot and record the data pointer, and return the sector data pointer to the server.

6. The operating system security control method based on risk detection according to claim 1 is characterized in that: The specific steps of encrypting and backing up the data in the running process to the server through blockchain technology are as follows: S4.1: The server receives the application log of the client, extracts the data return statement to be executed from the application log, and matches the target storage data identifier corresponding to the data return statement according to the preset matching rule; S4.2: The server maps the target storage data identifier according to the hash function, obtains the consistent reading point of the target storage data, and forwards the consistent reading point of the target storage data to the backup instance; S4.3: The backup instance receives the consistent read point of the target storage data, identifies the storage location corresponding to the consistent read point of the target storage data, sets the read point, and creates a data copy.

7. The operating system security control method based on risk detection according to claim 6 is characterized in that: The target storage data identifier corresponding to the data return statement matched according to the preset matching rules includes a normal operation matching identifier and an abnormal risk matching identifier. The matching rules are used to analyze the operating rules of the client according to historical data. If the operating rules are met, the normal operation matching identifier is marked on the data. If the operating rules are not met, the abnormal risk matching identifier is marked on the data.

8. The operating system security control method based on risk detection according to claim 7 is characterized in that: Analyzing the operation rules of the client according to historical data includes data matching network; The data matching network includes an input layer, a hidden layer and an output layer; The input layer is used to return a statement based on the input data, establish a feature sequence, and calculate the fitting value of the feature sequence; The hidden layer is used to convert the fitting value of the feature sequence of the input layer into a high-dimensional space, extract features layer by layer through multiple convolutional layers and pooling layers in the high-dimensional space to obtain high-level semantic features, perform matching analysis on the high-level semantic features, and calculate the output value of the hidden layer; The output layer is used to compare the output value of the hidden layer with the operating rules to obtain the risk matching degree; The calculation formula of the risk matching degree is: ， in, represents the risk matching degree, represents the learning rate, u represents a single node in the hidden layer, U represents the total number of nodes in the hidden layer, v represents a single node in the output layer, and V represents the total number of nodes in the output layer. represents the output of the u-th node in the hidden layer, represents the connection weights between the hidden layer and the output layer nodes, A single feature that represents the law of operation, represents the node threshold of the output layer, and E represents the error of the output layer input.

9. An operating system security control system based on risk detection, implemented based on the operating system security control method based on risk detection as claimed in any one of claims 1 to 8, characterized in that: The system includes a risk detection module, a trusted root system generation module, a trusted root system implantation module and a trusted root system operation module; The risk detection module is used to perform risk assessment on the client hardware and network environment to determine whether to allow the operating system to be installed; The trusted root system generation module is used to install a clean operating system in a controlled and secure environment and generate a system template; The trusted root system implantation module is used to obtain and configure the client hardware information, verify the client through the identity authentication policy, and implant the trusted root system into the client after the authentication is passed. The client performs the credit authentication according to the trust measurement policy and initializes the local hard disk; The trusted root system operation module is used to collect data during the operation of the client, and transmit the data back to the server for backup, apply preset matching rules to analyze the operation rules of the client, and mark the data accordingly.

Images