A safety control system based on FPGA

Abstract

The invention relates to the technical field of security control, and discloses a security control system based on FPGA. The security control system is configured with a trusted control module and a cryptographic algorithm module; the trusted control module is configured with a trusted computing interface, a key management unit, an algorithm selection unit, an algorithm calling unit, a security event recording unit, a security policy control unit, and a security policy interface; the cryptographic algorithm module is configured with a plurality of encryption algorithms and a random number generator; the security policy interface dynamically adjusts a plurality of security policies in the security policy control unit, thereby improving the isolation and security of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of safety control, and in particular to a safety control system based on FPGA. Background Art

[0002] In the current digital age, the importance of information security is becoming increasingly prominent. With the rapid development of computing power and the continuous advancement of cryptographic analysis technology, the security measures of traditional general-purpose computing platforms face severe challenges. In particular, in some highly sensitive fields, the limitations of traditional security solutions are becoming more and more obvious, making it difficult to fully guarantee the security and privacy of data. Some hardware trusted computing integrates security functions directly into processors, chipsets, or other hardware components, such as Intel SGX (Software Guard Extensions). This solution achieves protection of sensitive data and code through hardware isolation and encryption technology. Hardware-level isolation and encryption can effectively protect data and code from physical attacks and side-channel attacks.

[0003] However, the following technical problems often occur during the implementation of existing trusted security solutions:

[0004] First, hardware trusted computing still faces the challenge of static policy restrictions and is difficult to adapt to dynamic security requirements. In addition, hardware-implemented trusted security solutions usually solidify a set of specific cryptographic algorithms, which are difficult to adapt to different application scenarios and security requirements. This fixed algorithm selection limits the flexibility and adaptability of the system.

[0005] Second, in the operation of general computing devices, the existing technology lacks differentiation in security protection strategies for different applications and fails to select appropriate security strategies for different applications, which may lead to insufficient or excessive security protection for some applications, affecting the overall security of the system;

[0006] Third, when selecting encryption algorithms for general-purpose computing devices, the performance of the device is often not fully considered, which may cause encryption operations to have a negative impact on device performance. Summary of the invention

[0007] The summary of the invention is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The summary of the invention is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0008] The present invention proposes a safety control system based on FPGA to solve one or more of the technical problems mentioned in the above background technology part.

[0009] The present invention provides a security control system based on FPGA, comprising: a trusted control module, wherein the trusted control module is configured with a trusted computing interface, a key management unit, an algorithm selection unit, an algorithm calling unit, a security event recording unit, a security policy control unit, and a security policy interface, wherein the security policy control unit is configured with multiple security policies, each security policy corresponds to policy attribute information, and the policy attribute information includes execution complexity, protection coefficient, and update time;

[0010] The security policy interface is used to dynamically adjust multiple security policies in the security policy control unit, and the security policy adjustment record generated after each dynamic adjustment is stored in the security event recording unit;

[0011] The trusted control module is connected to the general computing device through the trusted computing interface to obtain the operation data of the general computing device during operation; the trusted control module is also used to verify the operation data, obtain the verification result and store the verification result in the security event recording unit, select and call the target encryption algorithm from the multiple encryption algorithms configured in the cryptographic algorithm module through the algorithm calling unit, and obtain the key corresponding to the target encryption algorithm from the key management unit, encrypt the verification result through the key and the target encryption algorithm, obtain the encrypted verification result, and transmit the encrypted verification result to the general computing device through the trusted computing interface;

[0012] The cryptographic algorithm module is configured with a variety of encryption algorithms and random number generators. The various encryption algorithms include symmetric encryption algorithms, asymmetric encryption algorithms, and hash algorithms. The cryptographic algorithm module is communicated with the trusted control module and uses an FPGA chip.

[0013] Optionally, the security policy control unit is used to obtain, during the startup process of the general-purpose computing device, the identification information of the general-purpose computing device, the application list of the general-purpose computing device, the baseline protection requirement level configured for the general-purpose computing device, and the application information of each application in the application list from the general-purpose computing device; query in the security event recording unit according to the identification information to determine whether there is a historical verification result corresponding to the identification information, and if there is a historical verification result corresponding to the identification information, determine the historical security policy group adopted by each historical verification result corresponding to the identification information to obtain a historical security policy group set; calculate the comprehensive protection coefficient of each historical security policy group in the historical security policy group set according to the protection coefficient corresponding to each security policy, and query the actual protection level corresponding to each historical security policy group according to the comprehensive protection coefficient, delete the historical security policy groups in the historical security policy group set whose actual protection level is less than the baseline protection requirement level, and obtain an updated historical security policy group set; select a historical security policy group from the updated historical security policy group set as the target security policy group according to the update time corresponding to each policy;

[0014] The trusted control module is also used to perform startup verification on the general computing device according to the target security policy group; if the startup verification is successful, an instruction indicating the successful verification is sent to the general computing device to put the general computing device into operation.

[0015] Optionally, the security policy control unit is further used to parse the application information of each application and obtain a parsing result during the operation of the general computing device, determine whether the parsing result includes the application protection requirement level, determine the application that includes the application protection requirement level in the parsing result as a first-level application, and determine the application that does not include the application protection requirement level in the parsing result as a second-level application; for each first-level application in the application list, select a security policy subgroup corresponding to each first-level application from the target security policy group according to the corresponding application protection requirement level;

[0016] For each secondary application in the application list, query in the pre-configured application protection reference level table according to the application identifier or application type included in the parsing result to obtain the application protection reference level corresponding to each secondary application, and select the security policy subgroup corresponding to each secondary application from the target security policy group according to the corresponding application protection reference level;

[0017] The trusted control module is also used to perform security verification on the application's running data according to the corresponding security policy subgroup.

[0018] Optionally, a security policy subgroup is determined by the following steps:

[0019] For each secondary application in the application list, query in the pre-configured application protection reference level table according to the application identifier of the secondary application to obtain a query result. If the query result indicates that there is an application protection reference level that matches the application identifier, determine the application protection reference level that matches the application identifier as the application protection reference level corresponding to the secondary application;

[0020] If the query result indicates that there is no application protection reference level matching the application identifier, query in the application protection reference level table according to the application type of the secondary application to obtain at least one application protection reference level corresponding to the application type, and the application identifiers corresponding to the at least one application protection reference level respectively form an alternative application identifier group; according to the semantic similarity between the function description information of the secondary application and the function description information corresponding to each application identifier in the alternative application identifier group, the application identifier with the highest semantic similarity in the alternative application identifier group is determined as the target application identifier, and the application protection reference level corresponding to the target application identifier is determined as the application protection reference level of the secondary application;

[0021] Sort multiple security policies in the target security policy group according to the order of execution complexity from low to high to obtain a target security policy sequence;

[0022] The actual protection coefficient of each secondary application is determined according to the corresponding application protection reference level. For each secondary application, N security policies are selected from the target security policy sequence in order of execution complexity from low to high, among which the comprehensive protection coefficient corresponding to the N security policies is greater than or equal to the actual protection coefficient, and the comprehensive protection coefficient corresponding to the N-1 security policies is less than the actual protection coefficient.

[0023] Optionally, the security policy control unit is further used to obtain multiple security policy adjustment records in the security event recording unit; the security policy adjustment records include the initial security policy, the changed security policy, the change time and the change triggering event;

[0024] According to the initial security policy and the change triggering event, the multiple security policy adjustment records are divided to obtain multiple security policy adjustment record groups; wherein each security policy adjustment record group corresponds to the same initial security policy and the same change triggering event;

[0025] Determine the number of changes to the initial security policy corresponding to the security policy adjustment record group according to the number of security policy adjustment records in each security policy adjustment record group;

[0026] Determine a matching score between the initial security policy and the change triggering event based on the number of changes to the initial security policy and the change triggering event;

[0027] If the match score between the initial security policy and the change trigger event is greater than the preset match score threshold; the initial security policy is determined as the fixed security policy of the corresponding change trigger event; if the match score between the initial security policy and the change trigger event is less than the preset match score threshold, a modification signal representing the modification of the initial security policy is generated, and the modification signal is sent to the management terminal.

[0028] The present invention has the following beneficial effects:

[0029] 1. Dynamically adjust multiple security policies through the security policy interface in the security control system, overcoming the problem of static policy limitations faced by hardware trusted computing, so that it can adapt to dynamic security needs. Secondly, the cryptographic algorithm module is equipped with a rich variety of encryption algorithms, such as symmetric encryption algorithms, asymmetric encryption algorithms, hash algorithms, etc. Through the algorithm selection unit and algorithm calling unit, it can select and call the target encryption algorithm from a variety of encryption algorithms, and is no longer limited to a fixed set of specific cryptographic algorithms, which greatly enhances the flexibility and adaptability of the system in different application scenarios and security requirements;

[0030] 2. By parsing the application information in operation of general computing devices, we can distinguish between primary and secondary applications, and use corresponding methods to determine the protection reference level for applications of different levels. For primary applications, select the corresponding security policy subgroup according to the application protection requirement level of the primary application; for secondary applications, first query the application protection reference level according to the application identifier. If there is no corresponding application protection reference level, query according to the application type, and determine the target application identifier and its corresponding protection reference level based on semantic similarity, and then select N security policies from the target security policy sequence according to the execution complexity. Accurate security protection for different applications is achieved, avoiding insufficient or excessive security protection for some applications, and improving the overall security of the system;

[0031] 3. The operating parameters of the general computing device (such as CPU operating occupancy) are collected through the operating parameter collection unit. The security policy control unit sends the various encryption algorithms in the cryptographic algorithm module to the expert terminal for complexity scoring, and sorts the various encryption algorithms to obtain an encryption algorithm sequence. According to the complexity score, the encryption algorithm is selected from small to large for the general computing device to execute, and at the same time, it is determined whether to stop the execution based on the operating parameters. If the operating occupancy rate is less than the security occupancy rate threshold, the selected encryption algorithm is eliminated and the sequence is updated to continue processing. The eliminated encryption algorithm is determined as the applicable encryption algorithm. If there is no eliminated algorithm in the sequence, the backup encryption algorithm is used as the applicable encryption algorithm, thereby effectively avoiding the adverse impact on device performance caused by improper encryption algorithm selection. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0033] Figure 1 It is an exemplary structural diagram of the FPGA-based safety control system of the present invention. DETAILED DESCRIPTION

[0034] The present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.

[0035] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other.

[0036] It should be noted that the concepts such as "first" and "second" mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0037] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0038] The names of the messages or information exchanged between multiple devices of the present invention are only for illustrative purposes, and are not used to limit the scope of these messages or information.

[0039] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0040] like Figure 1 As shown, it is an exemplary architecture diagram of a FPGA-based security control system of the present invention. Among them, the security control system includes: a trusted control module 100, which is configured with a trusted computing interface 101, a key management unit 102, an algorithm selection unit 103, an algorithm calling unit 104, a security event recording unit 105, a security policy control unit 106, and a security policy interface 107. The security policy control unit 106 is configured with multiple security policies, each security policy corresponds to policy attribute information, and the policy attribute information includes execution complexity, protection factor, and update time. Among them, multiple security policies are pre-set. The security policy control unit 106 can only select from multiple pre-set security policies.

[0041] The security policy interface 107 is used to dynamically adjust multiple security policies in the security policy control unit 106 , and the security policy adjustment record generated after each dynamic adjustment is stored in the security event recording unit 105 .

[0042] In some embodiments, the security policy interface 107 is used to dynamically adjust multiple security policies in the security policy control unit 106. As an example, when the security control system detects that the network traffic of the general computing device is abnormal, the multiple security policies in the security policy control unit 106 are dynamically adjusted. The security policy adjustment record generated after each dynamic adjustment is stored in the security event recording unit 105. Among them, the security adjustment record includes the initial security policy, the changed security policy, the change time and the change triggering event. Among them, the security adjustment record stored in the security event recording unit 105 can be used for security auditing and troubleshooting of the security control system.

[0043] The trusted control module 100 is connected to the general-purpose computing device through the trusted computing interface 101 to obtain the operating data of the general-purpose computing device during its operation; the trusted control module 100 is also used to verify the operating data, obtain the verification result and store the verification result in the security event recording unit 105, select and call the target encryption algorithm from the multiple encryption algorithms 201 configured in the cryptographic algorithm module through the algorithm calling unit 104, and obtain the key corresponding to the target encryption algorithm from the key management unit 102, encrypt the verification result through the key and the target encryption algorithm, obtain the encrypted verification result, and transmit the encrypted verification result to the general-purpose computing device through the trusted computing interface 101.

[0044] In some embodiments, the trusted control module 100 is connected to the general computing device through the trusted computing interface 101 to obtain the operation data of the general computing device during operation. Among them, the operation data includes but is not limited to the system log of the computing device, network traffic data, etc. The trusted control module 100 is also used to verify the operation data, obtain the verification result and store the verification result in the security event recording unit 105. As an example, the trusted control module 100 can use a static measurement method or a trust chain transmission method to verify the operation data. The algorithm calling unit 104 selects and calls the target encryption algorithm from the multiple encryption algorithms 201 configured in the cryptographic algorithm module 200, and obtains the key corresponding to the target encryption algorithm from the key management unit 102. As an example, the trusted control module 100 can select the target encryption algorithm according to the sensitivity of the operation data, wherein the sensitivity of the operation data is pre-set. For highly sensitive operation data, the algorithm calling unit 104 can select and call an asymmetric encryption algorithm from the multiple encryption algorithms 201 configured in the cryptographic algorithm module 200 as the target encryption algorithm. And obtain the key corresponding to the target encryption algorithm from the key management unit 102. The verification result is encrypted by using a key and a target encryption algorithm to obtain an encrypted verification result, which is then transmitted to a general computing device via a trusted computing interface 101. This ensures the confidentiality and integrity of the verification result during transmission, and prevents the verification result from being stolen or tampered with.

[0045] The cryptographic algorithm module 200 is configured with multiple encryption algorithms 201 and a random number generator 202. The multiple encryption algorithms 201 include a symmetric encryption algorithm, an asymmetric encryption algorithm, and a hash algorithm. The cryptographic algorithm module 200 is communicatively connected with the trusted control module 100, and the cryptographic algorithm module 200 adopts an FPGA chip.

[0046] In some embodiments, the cryptographic algorithm module 200 is configured with multiple encryption algorithms 201 and a random number generator 202. Among them, the multiple encryption algorithms 201 include symmetric encryption algorithms, asymmetric encryption algorithms, and hash algorithms. As an example, symmetric encryption algorithms include but are not limited to AES and SM4. Asymmetric encryption algorithms include but are not limited to RSA, DSA, SM2, and SM9. Hash algorithms include but are not limited to SM3, SHA-256, and SHA-3. The cryptographic algorithm module 200 is connected to the trusted control module 100 for communication, and the cryptographic algorithm module 200 uses an FPGA chip.

[0047] In these embodiments, multiple security policies are dynamically adjusted through the security policy interface 107 in the security control system, overcoming the problem of static policy limitations faced by hardware trusted computing, so that it can adapt to dynamic security requirements. Secondly, the cryptographic algorithm module 200 is configured with a rich variety of encryption algorithms, such as symmetric encryption algorithms, asymmetric encryption algorithms, hash algorithms, etc. Through the algorithm selection unit 103 and the algorithm calling unit 104, it can select and call the target encryption algorithm from the multiple encryption algorithms 201, and is no longer limited to a set of solidified specific cryptographic algorithms, which greatly enhances the flexibility and adaptability of the system under different application scenarios and security requirements.

[0048] In some embodiments, in order to further solve the second technical problem described in the background technology section, that is, "the existing technology lacks differentiation in security protection strategies for different applications during the operation of general-purpose computing devices, and cannot select appropriate security strategies for different applications, which may lead to insufficient or excessive security protection for some applications, affecting the overall security of the system", some embodiments of the present invention also include:

[0049] Optionally, the security policy control unit 106 is used to obtain, during the startup process of the general-purpose computing device, the identification information of the general-purpose computing device, the application list of the general-purpose computing device, the baseline protection requirement level configured for the general-purpose computing device, and the application information of each application in the application list from the general-purpose computing device; query the security event recording unit 105 according to the identification information to determine whether there is a historical verification result corresponding to the identification information, and if there is a historical verification result corresponding to the identification information, determine the historical security policy group adopted by each historical verification result corresponding to the identification information to obtain a historical security policy group set; calculate the comprehensive protection coefficient of each historical security policy group in the historical security policy group set according to the protection coefficient corresponding to each security policy, and query the actual protection level corresponding to each historical security policy group according to the comprehensive protection coefficient, delete the historical security policy groups in the historical security policy group set whose actual protection level is less than the baseline protection requirement level, and obtain an updated historical security policy group set; select a historical security policy group from the updated historical security policy group set as the target security policy group according to the update time corresponding to each policy.

[0050] In some embodiments, the security policy control unit 106 is used to obtain the identification information of the general computing device, the application list of the general computing device, the baseline protection requirement level configured for the general computing device, and the application information of each application in the application list from the general computing device during the startup process of the general computing device. As an example, the identification information of the general computing device may be the serial number or MAC address of the general computing device. The application list includes various applications configured on the general computing device. As an example, the various applications in the application list may be operating systems, office software, etc. The baseline protection requirement level configured for the general computing device may be set according to the purpose of the general computing device (such as corporate office, personal entertainment). Each purpose of the general computing device corresponds to a baseline protection requirement level. According to the identification information, query in the security event recording unit 105 to determine whether there is a historical verification result corresponding to the identification information. As an example, query in the security event recording unit 105 through the identification information (MAC address) of the general computing device to query whether there is a historical verification result corresponding to the identification information (MAC address) of the general computing device in the security event recording unit 105. If there is a historical verification result corresponding to the identification information, determine the historical security policy group adopted by each historical verification result corresponding to the identification information, combine the historical security policy groups adopted by each historical verification result, and obtain a historical security policy group set. According to the protection coefficient corresponding to each security policy, calculate the comprehensive protection coefficient of each historical security policy group in the historical security policy group set. Among them, the calculation method of the comprehensive protection coefficient of the historical security policy group can be to add the protection coefficients corresponding to each security policy in the historical security policy group to obtain the comprehensive protection coefficient of the corresponding historical security policy group. As an example, the historical security policy group can be a historical security policy group P, and the historical security policy group P includes security policy Z and security policy X. Among them, the protection coefficient of security policy Z is 0.7, and the protection coefficient of security policy X is 0.5. Add the protection coefficient of security policy Z (0.7) and the protection coefficient of security policy X (0.5) to obtain the comprehensive protection coefficient of historical security policy group P as 1.2. Each security policy corresponds to a protection coefficient, and the protection coefficient corresponding to each security policy is pre-set. And according to the comprehensive protection coefficient, the actual protection level corresponding to each historical security policy group is queried, and the historical security policy groups in the historical security policy group set whose actual protection level is less than the benchmark protection requirement level are deleted to obtain an updated historical security policy group set. As an example, different ranges of comprehensive protection coefficients can be matched with the set actual protection levels. When the value range of the comprehensive protection coefficient is 0-0.3, the corresponding actual protection level is a low protection level. When the value range of the comprehensive protection coefficient is 0.3-0.7, the corresponding actual protection level is an intermediate protection level. When the value range of the comprehensive protection coefficient is 0.7-1, the corresponding actual protection level is a high protection level.As an example, when the baseline protection requirement level is the intermediate baseline protection requirement level, the historical security policy groups below the intermediate protection level in the historical security policy group set are deleted to obtain an updated historical security policy group set. According to the update time corresponding to each policy, a historical security policy group is selected from the updated historical security policy group set as the target security policy group. As an example, the historical security policy group with the most recent update time can be selected from the updated historical security policy group set as the target security policy group. Among them, the historical security policy group with the most recent update time can better adapt to the current security environment.

[0051] The trusted control module 100 is also used to perform startup verification on the general computing device according to the target security policy group; if the startup verification is successful, an instruction indicating the successful verification is sent to the general computing device to put the general computing device into operation.

[0052] In some embodiments, the trusted control module 100 is also used to perform startup verification on the general computing device according to the target security policy group. As an example, the trusted control module 100 performs startup verification on the general computing device according to the provisions of each security policy in the target security policy group. The startup verification can be to verify whether the BIOS (basic input and output system) of the general computing device has been tampered with, whether the password entered by the user is correct, etc. If the startup verification is successful, an instruction indicating the success of the verification is sent to the general computing device to enable the general computing device to enter the running state.

[0053] Optionally, the security policy control unit 106 is also used to parse the application information of each application and obtain a parsing result during the operation of the general computing device, determine whether the parsing result includes an application protection requirement level, determine the application whose application protection requirement level is included in the parsing result as a first-level application, and determine the application whose application protection requirement level is not included in the parsing result as a second-level application; for each first-level application in the application list, select a security policy subgroup corresponding to each first-level application from the target security policy group according to the corresponding application protection requirement level.

[0054] In some embodiments, the security policy control unit 106 is also used to parse the application information of each application and obtain the parsing result during the operation of the general computing device. The application information may be a configuration file, permission setting, etc. Determine whether the parsing result includes the application protection requirement level. The application containing the application protection requirement level in the parsing result is determined as a first-level application, and the application not containing the application protection requirement level in the parsing result is determined as a second-level application. For each first-level application in the application list, according to the corresponding application protection requirement level, the security policy subgroup corresponding to each first-level application is selected from the target security policy group. As an example, each first-level application corresponds to an application protection requirement level, wherein the application protection requirement level may be a high-level application protection requirement level, a medium-level application protection requirement level, or a low-level application protection requirement level. The security policy subgroup corresponding to each first-level application can be selected from the target security policy group according to the application protection requirement level corresponding to each first-level application. Among them, the actual protection level of the security policy subgroup is the same as the application protection requirement level of the corresponding first-level application. That is, when the application protection requirement level corresponding to the first-level application is a high-level application protection requirement level, the actual protection level of the security policy subgroup is also a high-level protection level. The protection coefficients of each security policy in the security policy subgroup are added together to obtain the comprehensive protection coefficient of the security policy subgroup. When the value range of the comprehensive protection coefficient is 0.7-1, the actual protection level corresponding to the security policy subgroup is the advanced protection level.

[0055] Optionally, a security policy subgroup is determined by the following steps:

[0056] Step 1: For each secondary application in the application list, query in the pre-configured application protection reference level table according to the application identifier of the secondary application to obtain the query result. If the query result indicates that there is an application protection reference level that matches the application identifier, the application protection reference level that matches the application identifier is determined as the application protection reference level corresponding to the secondary application.

[0057] In some embodiments, for each secondary application in the application list, the application identifier of the secondary application is queried in a pre-configured application protection reference level table to obtain a query result. The application identifier may be an application name, an application version number, etc. The application protection reference level table includes an application identifier, an application protection reference level that matches the application identifier, an application type, and an application protection reference level that matches the application type. The application protection reference level that matches the application identifier is determined as the application protection reference level corresponding to the secondary application.

[0058] Step 2. If the query result indicates that there is no application protection reference level that matches the application identifier, query in the application protection reference level table according to the application type of the secondary application to obtain at least one application protection reference level corresponding to the application type, and the application identifiers corresponding to at least one application protection reference level constitute an alternative application identifier group; based on the semantic similarity between the functional description information of the secondary application and the functional description information corresponding to each application identifier in the alternative application identifier group, the application identifier with the highest semantic similarity in the alternative application identifier group is determined as the target application identifier, and the application protection reference level corresponding to the target application identifier is determined as the application protection reference level of the secondary application.

[0059] In some embodiments, if the query result indicates that there is no application protection reference level that matches the application identifier, the application type of the secondary application is queried in the application protection reference level table to obtain at least one application protection reference level corresponding to the application type. The application type may be office software, multimedia tools, and the like. Each secondary application corresponds to an application type. Each application type corresponds to at least one application protection reference level. The application identifiers corresponding to at least one application protection reference level constitute an alternative application identifier group. The function description information of the secondary application is semantically analyzed with the function description information corresponding to each application identifier in the alternative application identifier group to obtain the semantic similarity corresponding to each application identifier. Each application identifier in the alternative application identifier group is sorted in order of semantic similarity from high to low to obtain an application identifier sequence. The application identifier with the highest semantic similarity in the application identifier sequence is determined as the target application identifier. The application protection reference level corresponding to the target application identifier is determined as the application protection reference level of the secondary application.

[0060] In practice, the functional description information of the secondary application and the functional description information corresponding to each application identifier in the candidate application identifier group can be input into the semantic similarity model to obtain the semantic similarity corresponding to each application identifier. Among them, the semantic similarity model can be a bidirectional encoder representation from transformers model. Before use, the semantic similarity model can be trained using a training sample set so that the accuracy of the semantic similarity output by the semantic similarity model meets the actual use requirements.

[0061] The training samples in the training sample set include the functional description information of the sample secondary application, the functional description information corresponding to the sample application identifier, and the semantic similarity corresponding to the sample application identifier. Thus, the functional description information of the sample secondary application and the functional description information corresponding to the sample application identifier are used as input, and the semantic similarity corresponding to the sample application identifier is used as the expected output, and the semantic similarity model is trained using the deep learning training method.

[0062] Step three: sort multiple security policies in the target security policy group according to the order of execution complexity from low to high to obtain a target security policy sequence.

[0063] Step 4: Determine the actual protection factor of each secondary application based on the corresponding application protection reference level. For each secondary application, select N security policies from the target security policy sequence in order of execution complexity from low to high. Among them, the comprehensive protection factor corresponding to the N security policies is greater than or equal to the actual protection factor, and the comprehensive protection factor corresponding to the N-1 security policies is less than the actual protection factor.

[0064] In some embodiments, the actual protection coefficient of each secondary application is determined according to the corresponding application protection reference level, wherein each application protection reference level corresponds to an actual protection coefficient. As an example, when the application protection reference level is low, the corresponding actual protection coefficient is 0.25, when the application protection reference level is medium, the corresponding actual protection coefficient is 0.5, and when the application protection reference level is high, the corresponding actual protection coefficient is 0.7. For each secondary application, N security policies are selected from the target security policy sequence in order of execution complexity from low to high. Among them, the comprehensive protection coefficient corresponding to the N security policies is greater than or equal to the actual protection coefficient, and the comprehensive protection coefficient corresponding to the N-1 security policies is less than the actual protection coefficient. As an example, when the number of security policies in the target security policy sequence is 7, the value range of N can be 1-7. That is, the minimum value of N is 1, and the maximum value of N is 7.

[0065] The trusted control module 100 is also used to perform security verification on the running data of the application according to the corresponding security policy subgroup.

[0066] In some embodiments, the trusted control module 100 monitors the running data of the application in real time and performs security verification on the running data according to the provisions corresponding to each security policy in the security policy subgroup.

[0067] In these embodiments, by parsing the application information in operation of the general computing device, the primary and secondary applications are distinguished, and the protection reference levels of applications of different levels are determined in corresponding ways. For primary applications, the corresponding security policy subgroup is selected according to the application protection requirement level of the primary application; for secondary applications, the application protection reference level is first queried according to the application identifier. If there is no corresponding application protection reference level, it is then queried according to the application type, and the target application identifier and its corresponding protection reference level are determined based on semantic similarity, and then N security policies are selected from the target security policy sequence according to the execution complexity. Accurate security protection for different applications is achieved, avoiding the situation where some applications have insufficient or excessive security protection, and improving the overall security of the system.

[0068] Optionally, the security policy control unit 106 is further used to obtain multiple security policy adjustment records in the security event recording unit 105 through the security policy interface 107; the security policy adjustment record includes the initial security policy, the changed security policy, the change time and the change triggering event. Among them, multiple security policy adjustment records in the security event recording unit 105 within the target time period can be obtained. When the target time period is seven days, multiple security policy adjustment records of the security event recording unit 105 within seven days are obtained.

[0069] According to the initial security policy and the change triggering event, multiple security policy adjustment records are divided to obtain multiple security policy adjustment record groups; wherein each security policy adjustment record group corresponds to the same initial security policy and the same change triggering event.

[0070] In some embodiments, security policy adjustment records with the same initial security policy and change triggering event are divided into corresponding security policy adjustment record groups to obtain multiple security policy adjustment record groups. Each security policy adjustment record group corresponds to the same initial security policy and the same change triggering event. As an example, multiple security policy adjustment records may be security policy adjustment record Y, security policy adjustment record K, security policy adjustment record U, and security policy adjustment record G. The initial security policy in security policy adjustment record Y is initial security policy H, the initial security policy in security policy adjustment record K is initial security policy E, the initial security policy in security policy adjustment record U is initial security policy H, and the initial security policy in security policy adjustment record Y is initial security policy E. The change triggering event in security policy adjustment record Y is change triggering event T, the change triggering event in security policy adjustment record K is change triggering event M, the change triggering event in security policy adjustment record U is change triggering event T, and the change triggering event in security policy adjustment record G is change triggering event M. Security policy adjustment records with the same initial security policy and the same change triggering event are divided into corresponding security policy adjustment record groups to obtain multiple security policy adjustment record groups.

[0071] The number of changes to the initial security policy corresponding to the security policy adjustment record group is determined according to the number of security policy adjustment records in each security policy adjustment record group.

[0072] In some embodiments, as an example, the number of security policy adjustment records in the security policy adjustment record group (Z) is 7. Therefore, it is determined that the number of changes to the initial security policy in the security policy adjustment record group (Z) is 7.

[0073] According to the number of changes to the initial security policy and the change triggering event, a matching score between the initial security policy and the corresponding change triggering event is determined.

[0074] In some embodiments, as an example, the change trigger event corresponding to the initial security policy (Q) is the network traffic anomaly of the general computing device. The number of changes of the initial security policy is input into the preset matching score table to obtain the matching score between the initial security policy and the corresponding change trigger event. Among them, the matching score table includes the number of changes and the matching score corresponding to the number of changes. In practice, the matching score corresponding to the number of changes can be used as the matching score between the initial security policy and the corresponding change trigger event. As an example, when the number of changes of the initial security policy is 7, the matching score between the initial security policy and the corresponding change trigger event can be 30 points. Among them, the lower the matching score, the lower the effectiveness of the initial security policy (Q) in responding to the change trigger event (network traffic anomaly of the general computing device), that is, the weaker the ability of the initial security policy (Q) to solve the problem of network traffic anomaly, and frequent dynamic adjustment is required. The higher the matching score, the higher the effectiveness of the initial security policy (Q) in responding to the change trigger event (network traffic anomaly of the general computing device), that is, the initial security policy (Q) can solve the network traffic anomaly problem well without frequent dynamic adjustment.

[0075] If the match score between the initial security policy and the change trigger event is greater than the preset match score threshold; the initial security policy is determined as the fixed security policy of the corresponding change trigger event; wherein the fixed security policy can mean that when the corresponding change trigger event occurs, the initial security policy corresponding to the corresponding change trigger event is determined as the fixed application security policy of the change trigger event. That is, whenever the above-mentioned change trigger event occurs, the corresponding fixed security policy of the change trigger event can be adopted. If the match score between the initial security policy and the change trigger event is less than the preset match score threshold, a modification signal representing the modification of the initial security policy is generated, and the modification signal is sent to the management terminal.

[0076] In some embodiments, in order to further solve the technical problem 3 described in the background technology section, that is, "in the process of selecting encryption algorithms for general computing devices, the performance of the device is often not fully considered, which may cause the encryption operation to have a negative impact on the performance of the device", in some embodiments of the present invention, the FPGA-based security control system also includes:

[0077] An operation parameter collection unit is used to collect operation parameters of a general-purpose computing device, including an operation occupancy rate; and send the operation parameters to a security policy control unit. As an example, the operation occupancy rate can be expressed as the operation occupancy rate of a CPU in a general-purpose computing device. In practice, the hardware carrier that carries the security control system can be pluggable hardware. The pluggable hardware can be a hard disk.

[0078] The security policy control unit is also used to send the multiple encryption algorithms configured in the cryptographic algorithm module to the expert terminal. Using the expert experience information, the complexity of the operation complexity of each encryption algorithm in the multiple encryption algorithms is scored to obtain the complexity score of each encryption algorithm; the expert terminal sends the complexity score of each encryption algorithm to the security policy control unit.

[0079] The security policy control unit is further used to sort each encryption algorithm in the plurality of encryption algorithms in ascending order of the complexity score of each encryption algorithm to obtain an encryption algorithm sequence.

[0080] For the encryption algorithm sequence, the value of the target number is set to 1, and the security policy control unit performs the following processing steps: select the target number of encryption algorithms from the encryption algorithm sequence in the order of the complexity score of each encryption algorithm from small to large, and the security policy control unit sends the selected target number of encryption algorithms to the general computing device, so that the general computing device executes the selected encryption algorithm; the operation parameter acquisition unit obtains the operation parameters of the general computing device when executing the selected encryption algorithm. If the operation occupancy rate of the general computing device is greater than the preset security occupancy rate threshold, the security policy control unit generates a stop execution signal indicating that the execution of the encryption algorithm is stopped, and sends the stop execution signal to the general computing device; so that the general computing device stops the operation of the selected encryption algorithm and ends the processing steps for the encryption algorithm sequence.

[0081] If the operation occupancy rate of the general computing device is less than the preset safety occupancy rate threshold, the selected target number of encryption algorithms are removed from the encryption algorithm sequence to obtain an updated encryption algorithm sequence, and the updated encryption algorithm sequence is used as the encryption algorithm sequence to continue to execute the above processing steps.

[0082] After the above processing steps are completed, the encryption algorithm eliminated in the encryption algorithm sequence is determined as the applicable encryption algorithm corresponding to the general computing device, and the applicable encryption algorithm group corresponding to the general computing device is obtained. Each applicable encryption algorithm in the applicable encryption algorithm group represents an encryption algorithm that can be used by the general computing device. If the eliminated encryption algorithm does not exist in the encryption algorithm sequence, the backup encryption algorithm in the security control system is used as the applicable encryption algorithm for the general computing device.

[0083] In these embodiments, the operating parameters of the general computing device (such as CPU operating occupancy) are collected by the operating parameter collection unit, and the security policy control unit sends the multiple encryption algorithms in the cryptographic algorithm module to the expert terminal for complexity scoring, and sorts the multiple encryption algorithms to obtain an encryption algorithm sequence. According to the complexity score, the encryption algorithm is selected from small to large for the general computing device to execute, and at the same time, it is determined whether to stop the execution according to the operating parameters. If the operating occupancy is less than the security occupancy threshold, the selected encryption algorithm is eliminated and the sequence is updated to continue processing. The eliminated encryption algorithm is determined as an applicable encryption algorithm. If there is no eliminated algorithm in the sequence, the backup encryption algorithm is used as the applicable encryption algorithm, thereby effectively avoiding the adverse impact on the device performance caused by improper selection of the encryption algorithm.

[0084] The above descriptions are only some preferred embodiments of the present invention and the explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present invention is not limited to the technical solutions formed by the specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) to form a technical solution.

Claims

1. A safety control system based on FPGA, characterized in that: include: A trusted control module, wherein the trusted control module is configured with a trusted computing interface, a key management unit, an algorithm selection unit, an algorithm calling unit, a security event recording unit, a security policy control unit, and a security policy interface. The security policy control unit is configured with multiple security policies, each of which corresponds to policy attribute information, and the policy attribute information includes execution complexity, protection factor, and update time; The security policy interface is used to dynamically adjust multiple security policies in the security policy control unit, and the security policy adjustment record generated after each dynamic adjustment is stored in the security event recording unit; The trusted control module is connected to the general-purpose computing device through the trusted computing interface to obtain the operation data of the general-purpose computing device during operation; the trusted control module is also used to verify the operation data, obtain the verification result and store the verification result in the security event recording unit, select and call the target encryption algorithm from the multiple encryption algorithms configured in the cryptographic algorithm module through the algorithm calling unit, and obtain the key corresponding to the target encryption algorithm from the key management unit, encrypt the verification result through the key and the target encryption algorithm to obtain the encrypted verification result, and transmit the encrypted verification result to the general-purpose computing device through the trusted computing interface; A cryptographic algorithm module, wherein a plurality of encryption algorithms and random number generators are configured in the cryptographic algorithm module, wherein the plurality of encryption algorithms include a symmetric encryption algorithm, an asymmetric encryption algorithm and a hash algorithm, the cryptographic algorithm module is communicatively connected with the trusted control module, and the cryptographic algorithm module adopts an FPGA chip; The security policy control unit is used to obtain, during the startup process of the general-purpose computing device, from the general-purpose computing device the identification information of the general-purpose computing device, the application list of the general-purpose computing device, the baseline protection requirement level configured for the general-purpose computing device, and the application information of each application in the application list; According to the identification information, query the security event recording unit to determine whether there is a historical verification result corresponding to the identification information; if there is a historical verification result corresponding to the identification information, determine the historical security policy group adopted by each historical verification result corresponding to the identification information to obtain a historical security policy group set; according to the protection coefficient corresponding to each security policy, respectively calculate the comprehensive protection coefficient of each historical security policy group in the historical security policy group set, and query the actual protection level corresponding to each historical security policy group according to the comprehensive protection coefficient, delete the historical security policy group in the historical security policy group set whose actual protection level is lower than the benchmark protection requirement level, and obtain an updated historical security policy group set; according to the update time corresponding to each policy, select a historical security policy group from the updated historical security policy group set as the target security policy group; The trusted control module is further used to perform startup verification on the general computing device according to the target security policy group; if the startup verification is successful, send an instruction indicating the success of the verification to the general computing device, so that the general computing device enters a running state; The security policy control unit is further used to parse the application information of each application and obtain a parsing result during the operation of the general computing device, determine whether the parsing result includes an application protection requirement level, determine the application that includes the application protection requirement level in the parsing result as a first-level application, and determine the application that does not include the application protection requirement level in the parsing result as a second-level application; for each first-level application in the application list, select a security policy subgroup corresponding to each first-level application from the target security policy group according to the corresponding application protection requirement level; For each secondary application in the application list, query in a pre-configured application protection reference level table according to the application identifier or application type included in the parsing result to obtain the application protection reference level corresponding to each secondary application, and select the security policy subgroup corresponding to each secondary application from the target security policy group according to the corresponding application protection reference level; The trusted control module is also used to perform security verification on the running data of the application according to the corresponding security policy subgroup; The security policy subgroup is determined by the following steps: For each secondary application in the application list, query in a pre-configured application protection reference level table according to the application identifier of the secondary application to obtain a query result, and if the query result indicates that there is an application protection reference level matching the application identifier, determine the application protection reference level matching the application identifier as the application protection reference level corresponding to the secondary application; If the query result indicates that there is no application protection reference level matching the application identifier, query in the application protection reference level table according to the application type of the secondary application to obtain at least one application protection reference level corresponding to the application type, and the application identifiers corresponding to the at least one application protection reference level respectively form a candidate application identifier group; According to the semantic similarity between the function description information of the secondary application and the function description information corresponding to each application identifier in the candidate application identifier group, the application identifier with the highest semantic similarity in the candidate application identifier group is determined as the target application identifier, and the application protection reference level corresponding to the target application identifier is determined as the application protection reference level of the secondary application; Sort multiple security policies in the target security policy group according to the order of execution complexity from low to high to obtain a target security policy sequence; The actual protection coefficient of each secondary application is determined according to the corresponding application protection reference level. For each secondary application, N security policies are selected from the target security policy sequence in order of execution complexity from low to high, where the comprehensive protection coefficient corresponding to the N security policies is greater than or equal to the actual protection coefficient, and the comprehensive protection coefficient corresponding to the N-1 security policies is less than the actual protection coefficient.

2. The FPGA-based safety control system according to claim 1, characterized in that: The security policy control unit is also used to obtain multiple security policy adjustment records in the security event recording unit; the security policy adjustment records include the initial security policy, the changed security policy, the change time and the change triggering event; According to the initial security policy and the change triggering event, the multiple security policy adjustment records are divided to obtain multiple security policy adjustment record groups; wherein each security policy adjustment record group corresponds to the same initial security policy and the same change triggering event; Determining the number of changes to the initial security policy corresponding to each security policy adjustment record group according to the number of security policy adjustment records in the security policy adjustment record group; Determining a matching score between the initial security policy and the change triggering event according to the number of changes to the initial security policy and the change triggering event; If the matching score between the initial security policy and the change triggering event is greater than a preset matching score threshold; the initial security policy is determined as the fixed security policy of the corresponding change triggering event; if the matching score between the initial security policy and the change triggering event is less than the preset matching score threshold, a modification signal representing the modification of the initial security policy is generated, and the modification signal is sent to the management terminal.

Images