A comprehensive security assessment system based on trusted data space

Abstract

The present invention relates to the field of information security technology. The present invention provides a comprehensive security assessment system based on a trusted data space, which significantly improves the stability and security of the system by constructing a privacy data processing space, data encryption, blockchain storage and other technical means. The system has a flexible data processing mechanism, can maintain real-time monitoring and attack simulation capabilities in a high-traffic environment, and adopts a security assessment model based on a random forest algorithm to improve the accuracy and efficiency of security assessment. In addition, the present invention also supports data processing under multi-mode and multi-parameter conditions, meets the requirements of the trusted computing 3.0 architecture, and provides users with a comprehensive security analysis report. In summary, the present invention provides comprehensive security protection for the trusted data space, with significant beneficial effects.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a comprehensive security assessment system based on a trusted data space. Background Art

[0002] Trusted data space is built on the existing information network, and it improves the confirmation, implementation and maintenance of data circulation agreements through systematic technical arrangements. Trusted data space mainly solves the security and trust issues between data element providers, users, service providers and other entities, thereby promoting data-driven digital transformation.

[0003] The comprehensive security assessment of the trusted data space is a multi-dimensional consideration process, involving identity authentication and access control, data encryption and privacy protection, and security monitoring, etc. Through in-depth assessment of identity authentication and access control, data encryption and privacy protection, and security monitoring, the security, stability, and availability of the trusted data space can be improved, thereby providing users with a reliable and secure data processing environment.

[0004] The comprehensive security assessment based on the trusted data space has the following technical pain points in actual use. As the scale of the system expands, the amount of log data will also increase dramatically. In a high-traffic environment, real-time monitoring needs to be able to quickly and accurately identify abnormal behaviors and security threats, and it is also necessary to simulate attackers attacking the system in real time. The existing privacy computing processing mode of data available and invisible, invisible but required to be parsed by authority is difficult to support multi-mode and multi-parameter conditions, especially in large model applications. There are problems and cannot effectively support the trusted computing 3.0 architecture. The trusted computing 3.0 architecture is a network security technology architecture. Trusted computing 3.0 is guided by the ideas of "overall security" and "active immunity" and aims to build a safe and reliable computing environment and communication environment. The proposed trusted computing 3.0 architecture is to cope with increasingly complex network security threats and enhance the active, dynamic, overall and accurate defense capabilities of information systems. In order to solve the technical pain points of the existing technology, the present invention provides a comprehensive security assessment system based on a trusted data space. Summary of the invention

[0005] In view of the shortcomings of the existing technology, the present invention provides a comprehensive security assessment system based on a trusted data space to solve the shortcomings of the existing privacy computing processing mode: the existing privacy computing data processing mode is difficult to support multi-mode and multi-parameter conditions.

[0006] In order to solve the above technical problems, the specific technical solutions of the present invention are as follows:

[0007] The present invention provides a comprehensive security assessment system based on a trusted data space, comprising: a server end, a background control end and a user end, wherein the server end establishes a communication connection with the background control end and the user end, and the server end performs a comprehensive security assessment on the trusted data space according to data transmitted by the background control end and the user end, and the server end transmits the obtained comprehensive security assessment result of the trusted data space to the background control end and the user end, wherein the server end comprises:

[0008] A data acquisition unit, used to acquire system information data, wherein the system information data includes basic system information, security policy data, real-time log data, simulated attack data, system performance data, user behavior data, and user authority data;

[0009] A privacy data processing space construction unit is used to collect trusted data space configuration information, which includes access control policies, security policies, data processing capability information, storage capacity information, trusted data space log information, and network bandwidth information; perform data analysis on the trusted data space log information to obtain trusted data space user behavior data; construct a privacy data processing space based on the trusted data space user behavior data and trusted data space configuration information; set an upper limit value for the data processing volume of the trusted data space; when the data processing volume of the trusted data space reaches the upper limit value, data that exceeds the upper limit value for the data processing volume of the trusted data space is transmitted to the privacy data processing space for data processing; encrypt the data processing results of the privacy data processing space, store them in the blockchain, and then feed them back to the trusted data space;

[0010] An attack simulation unit is used to receive attack simulation basic data, the attack simulation basic data includes the type of attack, the intensity of the attack and the frequency of the attack, substitute the attack simulation basic data into a preset attack simulation data knowledge base for matching, obtain an attack simulation program set by matching, and substitute the attack simulation program in the attack simulation program set into the privacy data processing space for attack simulation;

[0011] A data security monitoring unit, used to monitor data when executing the attack simulation program in the privacy data processing space, and obtain data security monitoring data, the data security monitoring data including data security real-time monitoring data, data security anomaly identification data, data security response data and data security log records;

[0012] The security assessment unit is used to substitute the data security monitoring data into the preset security assessment model to obtain the security assessment result.

[0013] Furthermore, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the data acquisition unit comprises:

[0014] Obtain a data comparison and verification mechanism, compare and verify the obtained system information data according to the data comparison and verification mechanism, and obtain a system information comparison and verification result, which includes system information verification qualified data and system information verification unqualified data.

[0015] Furthermore, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the data acquisition unit is further used for:

[0016] Conduct internal verification of system information data, check the integrity of system information data, and analyze existing data errors or abnormal values ​​by screening, sorting and calculating system information data;

[0017] Data comparison is performed according to a predetermined data comparison and verification mechanism, which includes basic information comparison rules, key information comparison rules and business information comparison rules.

[0018] Furthermore, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the privacy data processing space construction unit is also used to:

[0019] Determine the scope of configuration information collection, which includes access control policies, security policies, data processing capability information, storage capacity information, trusted data space log information, and network bandwidth information;

[0020] The data collected according to the configuration information collection range is stored in the blockchain to generate a first hash value;

[0021] Preprocessing the data collected according to the configuration information collection range to obtain preprocessed trusted data space real-time configuration data;

[0022] The pre-processed trusted data space real-time configuration data is stored in the blockchain to generate a second hash value;

[0023] The data corresponding to the second hash value is compared with the data corresponding to the first hash value. If the first hash value includes the data corresponding to the second hash value, the data corresponding to the second hash value has not been tampered with, and the data corresponding to the second hash value is marked as usable data.

[0024] Furthermore, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the privacy data processing space construction unit is also used to:

[0025] Identify and analyze the pre-processed log data to identify users’ access patterns, operating habits, and potential security risks;

[0026] Perform cluster analysis on the preprocessed log data to obtain the frequency, time and type of user activities;

[0027] The frequency, time and type of user activities, as well as the user's access patterns, operating habits and potential security risks are analyzed through a preset user behavior analysis model to obtain user behavior data.

[0028] Furthermore, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the privacy data processing space construction unit is also used to:

[0029] Determine privacy data processing requirements, including configuration information of data processing capabilities, storage capacity, and network bandwidth;

[0030] According to the architecture of the privacy data processing space, a privacy data processing environment is configured on the architecture of the privacy data processing space, and data to be processed is migrated from the trusted data space to the privacy data processing space;

[0031] During the data migration process from the trusted data space to the privacy data processing space, the data is encrypted before being migrated within the trusted data space, and the data to be transmitted in the trusted data space is randomly selected for decryption during the data transmission process. The decrypted data to be transmitted in the trusted data space is compared with the data to be transmitted in the trusted data space before decryption. If the comparison result of the decrypted data to be transmitted in the trusted data space is consistent with the data to be transmitted in the trusted data space before decryption, the data to be transmitted in the trusted data space has not been tampered with.

[0032] Furthermore, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the attack simulation unit is also used for:

[0033] According to the attack simulation basic data, a corresponding attack simulation program set is matched in a preset attack simulation data knowledge base;

[0034] Identify access points to the privacy data processing space, where the access points include network ports, service interfaces, or predefined test environment entrances;

[0035] An isolated test environment is configured in the privacy data processing space, and the isolated test environment is used to perform attack simulation;

[0036] Set up monitoring and recording tools within an isolated test environment to capture and analyze all activities during the simulated attack;

[0037] Deploy each program in the attack simulation program set one by one into the configured isolated test environment, so that the isolated test environment executes the predetermined attack type, intensity and frequency corresponding to each simulation program;

[0038] Start the attack simulation program to launch a simulated attack on the isolated test environment configured for the privacy data processing space; monitor and record the response, performance changes, and security policy triggering of the isolated test environment configured for the privacy data processing space during the attack.

[0039] Furthermore, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the data security monitoring unit is further used for:

[0040] Configure a data security monitoring unit in the privacy data processing space and set monitoring parameters, which include monitoring indicators, thresholds, and data collection frequency;

[0041] When the attack simulation program starts to execute in the privacy data processing space, the real-time monitoring function of the data security monitoring unit is started at the same time;

[0042] Capture real-time monitoring data through monitoring tools, including CPU usage, memory usage, disk I / O, network latency, and throughput;

[0043] Use preset anomaly detection rules to detect anomalies in real-time monitoring data;

[0044] When real-time monitoring data is identified to exceed the threshold, it is classified as data security anomaly identification data;

[0045] When an abnormality is detected in real-time monitoring data, the corresponding security response mechanism is triggered, which includes automatic isolation and early warning notification.

[0046] Furthermore, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the security assessment unit is further used for:

[0047] Collect historical data security monitoring data of the trusted data space, which includes real-time monitoring data of the trusted data space, abnormal identification data of the trusted data space, security response data of the trusted data space, and log records of the trusted data space;

[0048] Preprocess the historical data security monitoring data of the trusted data space, and extract key features from the preprocessed historical data security monitoring data of the trusted data space, the key features including security status features, abnormal frequency features, response time features, and resource utilization features;

[0049] According to the random forest algorithm, the extracted features are used to train the model, and the model parameters are adjusted to obtain the security assessment model.

[0050] Furthermore, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the security assessment unit is also used for:

[0051] The security assessment results are classified into data to obtain system security status assessment results, anomaly identification and classification results, security response effect assessment results, system performance impact assessment results, user behavior security assessment results, configuration security assessment results and data integrity assessment results.

[0052] The beneficial effects of the present invention are mainly reflected in the following aspects:

[0053] The present invention constructs a privacy data processing space. When the data processing capacity of the trusted data space reaches the upper limit, the excess data will be transferred to the privacy data processing space for processing, effectively avoiding the risk of the main system being paralyzed due to excessive data processing capacity. The data will be encrypted during the migration from the trusted data space to the privacy data processing space, and random sampling decryption verification will be performed during the transmission process, which improves the security and integrity of the data during the transmission process. The data processing results of the privacy data processing space are encrypted and stored in the blockchain, and the decentralized and tamper-proof characteristics of the blockchain are used to further enhance the security and credibility of the data.

[0054] The present invention has a flexible data processing mechanism and can dynamically adjust the data processing strategy according to the actual operation situation, so as to maintain the ability of real-time monitoring and attack simulation in a high-traffic environment. An isolated test environment is configured in the privacy data processing space to perform attack simulations, so that simulated attacks will not cause direct impact on the main system, ensuring the stable operation of the system. The security assessment model based on the random forest algorithm can comprehensively evaluate the security of the system, including multiple dimensions such as system security status, anomaly identification and classification, and security response effect. By collecting historical data security monitoring data from the trusted data space, the model is trained and adjusted to make the evaluation results more accurate and reliable.

[0055] The existing privacy computing data processing model is difficult to support multi-mode and multi-parameter conditions, especially in large model applications. This invention optimizes the data processing process and improves processing efficiency and security by constructing a privacy data processing space and adopting a flexible data processing mechanism.

[0056] The Trusted Computing 3.0 architecture supports efficient security assessment through the collaborative work of the server, backend control and user, which meets the high requirements of the Trusted Computing 3.0 architecture for data security and processing efficiency. The security assessment model based on the random forest algorithm provides comprehensive security protection for the system under the Trusted Computing 3.0 architecture.

[0057] In summary, the present invention significantly improves the stability and security of the system by constructing a privacy data processing space, data encryption and blockchain storage, supporting multi-mode and multi-parameter conditions, supporting the Trusted Computing 3.0 architecture, and optimizing processing modes. It enhances the real-time monitoring and attack simulation capabilities in high-traffic environments, improves the accuracy and efficiency of security assessments, and provides comprehensive security protection for the trusted data space. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0059] Figure 1 A schematic diagram of a comprehensive security assessment system based on a trusted data space provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The technical solutions provided by the embodiments of the present invention are described in detail below in conjunction with the drawings.

[0061] In order to better understand the purpose of the present invention, the present invention is described in further detail below.

[0062] The present invention provides a comprehensive security assessment system based on a trusted data space, comprising: a server end, a background control end and a user end, wherein the server end establishes a communication connection with the background control end and the user end, and the server end performs a comprehensive security assessment on the trusted data space according to data transmitted by the background control end and the user end, and the server end transmits the obtained comprehensive security assessment result of the trusted data space to the background control end and the user end, wherein the server end comprises:

[0063] A data acquisition unit, used to acquire system information data, wherein the system information data includes basic system information, security policy data, real-time log data, simulated attack data, system performance data, user behavior data, and user authority data;

[0064] The main function of the data acquisition unit is to obtain system information data. The system information data collected by the data acquisition unit includes the following categories:

[0065] Basic system information: including the system's hardware configuration, software version, network configuration and other basic information, which is used as the basis for evaluating the system's basic operating environment and capabilities.

[0066] Security policy data: contains the security policies adopted by the system, such as access control policies, data encryption policies, etc., which are references for evaluating system security.

[0067] Real-time log data: records various events and activities during system operation, which is crucial for anomaly detection and behavior analysis.

[0068] Simulated attack data: includes historical simulated attack result data, which is used to analyze the system's response capabilities to potential threats.

[0069] System performance data: reflects the system's operating efficiency and load conditions, such as CPU usage, memory usage, etc.

[0070] User behavior data: records the behavior patterns of users interacting with the system, which helps to identify potential security risks.

[0071] User permission data: including user identity information and permission settings, is very important for evaluating the effectiveness of access control and permission management strategies.

[0072] Data verification and processing: The data acquisition unit is not only responsible for collecting data, but also for verifying and processing the data. The specific steps include:

[0073] Integrity check: Improve the integrity of the collected data.

[0074] Internal validation: Checking the consistency and accuracy of data, such as analyzing data errors or outliers through filtering, sorting, and calculations.

[0075] Comparison and verification: Compare data based on the predetermined data comparison and verification mechanism (including basic information comparison rules, key information comparison rules and business information comparison rules) to distinguish between qualified and unqualified data.

[0076] By collecting and verifying these system information data, the data acquisition unit provides a solid foundation for subsequent privacy data processing space construction, attack simulation, data security monitoring and security assessment, and improves the effectiveness and accuracy of the entire comprehensive security assessment system.

[0077] In summary, the data acquisition unit plays a vital role in the comprehensive security assessment system based on the trusted data space, and is the first step to ensure the security, stability and availability assessment of the system.

[0078] A privacy data processing space construction unit is used to collect trusted data space configuration information, which includes access control policies, security policies, data processing capability information, storage capacity information, trusted data space log information, and network bandwidth information; perform data analysis on the trusted data space log information to obtain trusted data space user behavior data; construct a privacy data processing space based on the trusted data space user behavior data and trusted data space configuration information; set an upper limit value for the data processing volume of the trusted data space; when the data processing volume of the trusted data space reaches the upper limit value, data that exceeds the upper limit value for the data processing volume of the trusted data space is transmitted to the privacy data processing space for data processing; encrypt the data processing results of the privacy data processing space, store them in the blockchain, and then feed them back to the trusted data space;

[0079] The privacy data processing space construction unit is responsible for collecting the configuration information of the trusted data space and building a privacy data processing space based on this information to process data that exceeds the processing capacity of the trusted data space. The privacy data processing space construction unit improves the stability of the system and the security of the data under high load conditions.

[0080] The collected trusted data space configuration information includes access control policies, security policies, data processing capability information, storage capacity information, trusted data space log information and network bandwidth information, which is used to build and maintain the privacy data processing space.

[0081] Log data analysis: Conduct in-depth data analysis on the trusted data space log information to identify user behavior patterns, operating habits, and potential security risks. Through analysis, the trusted data space user behavior data is extracted, providing an important basis for the construction of the privacy data processing space.

[0082] Build a privacy data processing space: Build a privacy data processing space based on the user behavior data and configuration information of the trusted data space. Set an upper limit for the data processing volume of the trusted data space. When this upper limit is reached, the excess data will be automatically transferred to the privacy data processing space for processing.

[0083] Data encryption and storage: Encrypt the data processing results of the privacy data processing space to improve the security of data during transmission and storage. Store the encrypted data in the blockchain, and use the decentralized and tamper-proof characteristics of the blockchain to further enhance the security and credibility of the data.

[0084] Data feedback: Feedback the processed and encrypted data from the privacy data processing space back to the trusted data space to improve data continuity and integrity.

[0085] Technical features:

[0086] Flexibility: Dynamically adjust the configuration of data processing space according to the actual operating status of the system to ensure stable operation of the system under high load conditions.

[0087] Security: By encrypting and storing data on the blockchain, the security and credibility of the data are improved.

[0088] Efficiency: Reasonable allocation of data processing tasks avoids overload of a single data processing space and improves overall processing efficiency.

[0089] The privacy data processing space construction unit improves the stability of the system and the security of data under high load conditions by collecting configuration information of the trusted data space, analyzing log data, building a privacy data processing space, encrypting and storing data, and providing data feedback.

[0090] An attack simulation unit is used to receive attack simulation basic data, the attack simulation basic data includes the type of attack, the intensity of the attack and the frequency of the attack, substitute the attack simulation basic data into a preset attack simulation data knowledge base for matching, obtain an attack simulation program set by matching, and substitute the attack simulation program in the attack simulation program set into the privacy data processing space for attack simulation;

[0091] The attack simulation unit is responsible for simulating various attack scenarios during the security assessment of the trusted data space to test the system's defense capabilities and stability.

[0092] The attack simulation unit needs to receive a series of basic attack simulation data, including the type of attack, the intensity of the attack, and the frequency of the attack. These data are important parameters for simulating attack scenarios and directly determine the complexity and destructiveness of the simulated attack.

[0093] The received attack simulation basic data will be substituted into the preset attack simulation data knowledge base for matching. The knowledge base contains various types of attack patterns and their corresponding simulation programs. Through the matching process, the set of attack simulation programs that best matches the current attack simulation basic data can be found.

[0094] The matched attack simulation program set will be deployed one by one into the privacy data processing space, and simulated attacks will be performed in the space. The purpose of this step is to test the performance of the privacy data processing space when facing attacks of different types, intensities and frequencies.

[0095] During the attack simulation process, the attack simulation unit monitors and records the response, performance changes, and triggering of security policies in the privacy data processing space. The data is crucial for evaluating the security and stability of the system.

[0096] The work results of the attack simulation unit, that is, the various data collected during the simulated attack process, will be input into the security assessment model as part of the data security monitoring data, thereby helping to obtain more comprehensive security assessment results.

[0097] Through this series of steps, the attack simulation unit can effectively evaluate the system's defense capabilities and stability without directly affecting the normal operation of the trusted data space, providing strong support for improving overall security.

[0098] A data security monitoring unit, used to monitor data when executing the attack simulation program in the privacy data processing space, and obtain data security monitoring data, the data security monitoring data including data security real-time monitoring data, data security anomaly identification data, data security response data and data security log records;

[0099] When executing the attack simulation program in the privacy data processing space, the data security monitoring unit is responsible for collecting and analyzing various operating data of the system in real time. By analyzing the real-time monitoring data, data security anomalies are discovered and identified in a timely manner. When anomalies are detected, the corresponding security response mechanism is triggered, such as automatic isolation or early warning notification.

[0100] Data security real-time monitoring data includes key system performance indicators such as CPU usage, memory usage, disk I / O, network latency, and throughput, which are used to evaluate the real-time operating status of the system.

[0101] When real-time monitoring data exceeds the preset threshold, the data will be classified as abnormal identification data, indicating that the system has security risks.

[0102] First of all, the monitoring indicators, thresholds, and data collection frequency parameters need to be set. When the attack simulation program is executed in the privacy data processing space, the real-time monitoring function of the data security monitoring unit is started at the same time. Real-time data is captured through the monitoring tool and analyzed using the preset anomaly detection rules. When an anomaly is detected, the security response mechanism is triggered to improve the security and stability of the system.

[0103] The present invention timely discovers and responds to potential security threats through real-time monitoring and anomaly detection, preventing data leakage and system damage. By analyzing the real-time monitoring data, the performance bottleneck of the system can be understood, providing a basis for optimizing system performance. Detailed data security log records are provided to provide comprehensive security information for management and decision makers to support them in making scientific decisions.

[0104] In summary, the data security monitoring unit plays a vital role in the comprehensive security assessment system of the present invention. Through real-time monitoring, anomaly detection and response mechanisms, the security and stability of the system in a high-traffic environment are improved.

[0105] The security assessment unit is used to substitute the data security monitoring data into the preset security assessment model to obtain the security assessment result.

[0106] The security assessment unit is responsible for substituting the data security monitoring data collected by the data security monitoring unit into the preset security assessment model for processing, so as to obtain a comprehensive security assessment result.

[0107] Data security monitoring data includes data security real-time monitoring data, data security anomaly identification data, data security response data and data security log records. The data is generated by the data security monitoring unit when executing the attack simulation program in the privacy data processing space.

[0108] The security assessment model used by the security assessment unit is trained based on the random forest algorithm. This model is formed by preprocessing, feature extraction and model training of historical data security monitoring data in the trusted data space.

[0109] Collect historical data security monitoring data from the trusted data space and perform preprocessing.

[0110] Extract key features from the preprocessed data, such as security status features, abnormal frequency features, response time features, resource utilization features, etc.

[0111] These features are used to train and adjust the model parameters through the random forest algorithm to obtain the final security assessment model.

[0112] The security assessment unit substitutes the collected real-time data security monitoring data into the trained security assessment model to conduct a fast and effective security assessment and generate comprehensive security assessment results.

[0113] The evaluation results include multiple dimensions such as system security status assessment, anomaly identification and classification, security response effectiveness assessment, system performance impact assessment, user behavior security assessment, configuration security assessment, and data integrity assessment, providing users with a comprehensive security analysis report.

[0114] The application of the security assessment unit is not limited to real-time security monitoring, but also provides system administrators with important security decision-making basis, helping to timely discover potential security threats and take corresponding security measures.

[0115] Specifically, the comprehensive security assessment system based on the trusted data space provided by the present invention, the data acquisition unit includes:

[0116] Obtain a data comparison and verification mechanism, compare and verify the obtained system information data according to the data comparison and verification mechanism, and obtain a system information comparison and verification result, which includes system information verification qualified data and system information verification unqualified data.

[0117] Specifically, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the data acquisition unit is further used for:

[0118] Conduct internal verification of system information data, check the integrity of system information data, and analyze existing data errors or abnormal values ​​by screening, sorting and calculating system information data;

[0119] Data comparison is performed according to a predetermined data comparison and verification mechanism, which includes basic information comparison rules, key information comparison rules and business information comparison rules.

[0120] Specifically, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the privacy data processing space construction unit is further used to:

[0121] Determine the scope of configuration information collection, which includes access control policies, security policies, data processing capability information, storage capacity information, trusted data space log information, and network bandwidth information;

[0122] The data collected according to the configuration information collection range is stored in the blockchain to generate a first hash value;

[0123] Preprocessing the data collected according to the configuration information collection range to obtain preprocessed trusted data space real-time configuration data;

[0124] The pre-processed trusted data space real-time configuration data is stored in the blockchain to generate a second hash value;

[0125] The data corresponding to the second hash value is compared with the data corresponding to the first hash value. If the first hash value includes the data corresponding to the second hash value, the data corresponding to the second hash value has not been tampered with, and the data corresponding to the second hash value is marked as usable data.

[0126] Determine the scope of configuration information collection: First, we define a configuration information collection scope, including key information such as access control policies and security policies.

[0127] Data collection and storage: Data is collected according to this range and stored on the blockchain. At the same time, a hash value (first_hash) is generated for this data, which can be regarded as the "fingerprint" of the data and used to verify the integrity of the data later.

[0128] Data preprocessing: Preprocess the collected data to meet the needs of subsequent analysis or use.

[0129] Re-storage and hash value generation: The preprocessed data is stored in the blockchain again and a new hash value (second_hash) is generated.

[0130] Hash value comparison and data verification: Finally, the integrity of the data is verified by comparing the two hash values. It should be noted here that hash value comparison does not directly compare whether the two hash values ​​are exactly the same, but verifies whether they are consistent (that is, whether the data has been tampered with during the preprocessing process). In practical applications, this is usually done by checking the records on the blockchain, such as using timestamps, on-chain records and other mechanisms to improve data consistency.

[0131] This process can be converted into the following code when implemented in programming:

[0132] / / Determine the scope of configuration information collection

[0133] config_fields = [access control policy, security policy, data processing capability information, storage capacity information, trusted data space log information, network bandwidth information]

[0134] / / Collect and store data to the blockchain for the first time and generate the first hash value

[0135] data_initial = collect_data(config_fields)

[0136] blockchain_store(data_initial)

[0137] first_hash = generate_hash(data_initial)

[0138] / / Preprocess the data

[0139] processed_data = preprocess_data(data_initial)

[0140] / / Store the preprocessed data into the blockchain and generate the second hash value

[0141] blockchain_store(processed_data)

[0142] second_hash = generate_hash(processed_data)

[0143] / / Compare the two hash values ​​to verify data integrity

[0144] if first_hash is consistent with second_hash:

[0145] mark_data_as_usable(processed_data)

[0146] else:

[0147] raise DataIntegrityError("Data may have been tampered with").

[0148] Specifically, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the privacy data processing space construction unit is further used to:

[0149] Identify and analyze the pre-processed log data to identify users’ access patterns, operating habits, and potential security risks;

[0150] Perform cluster analysis on the preprocessed log data to obtain the frequency, time and type of user activities;

[0151] The frequency, time and type of user activities, as well as the user's access patterns, operating habits and potential security risks are analyzed through a preset user behavior analysis model to obtain user behavior data.

[0152] Specifically, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the privacy data processing space construction unit is further used to:

[0153] Determine privacy data processing requirements, including configuration information of data processing capabilities, storage capacity, and network bandwidth;

[0154] According to the architecture of the privacy data processing space, a privacy data processing environment is configured on the architecture of the privacy data processing space, and data to be processed is migrated from the trusted data space to the privacy data processing space;

[0155] During the data migration process from the trusted data space to the privacy data processing space, the data is encrypted before being migrated within the trusted data space, and the data to be transmitted in the trusted data space is randomly selected for decryption during the data transmission process. The decrypted data to be transmitted in the trusted data space is compared with the data to be transmitted in the trusted data space before decryption. If the comparison result of the decrypted data to be transmitted in the trusted data space is consistent with the data to be transmitted in the trusted data space before decryption, the data to be transmitted in the trusted data space has not been tampered with.

[0156] Specifically, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the attack simulation unit is further used for:

[0157] According to the attack simulation basic data, a corresponding attack simulation program set is matched in a preset attack simulation data knowledge base;

[0158] Identify access points to the privacy data processing space, where the access points include network ports, service interfaces, or predefined test environment entrances;

[0159] An isolated test environment is configured in the privacy data processing space, and the isolated test environment is used to perform attack simulation;

[0160] Set up monitoring and recording tools within an isolated test environment to capture and analyze all activities during the simulated attack;

[0161] Deploy each program in the attack simulation program set one by one into the configured isolated test environment, so that the isolated test environment executes the predetermined attack type, intensity and frequency corresponding to each simulation program;

[0162] Start the attack simulation program to launch a simulated attack on the isolated test environment configured for the privacy data processing space; monitor and record the response, performance changes, and security policy triggering of the isolated test environment configured for the privacy data processing space during the attack.

[0163] Specifically, in the comprehensive security assessment system based on the trusted data space provided by the present invention, the data security monitoring unit is further used for:

[0164] Configure a data security monitoring unit in the privacy data processing space and set monitoring parameters, which include monitoring indicators, thresholds, and data collection frequency;

[0165] When the attack simulation program starts to execute in the privacy data processing space, the real-time monitoring function of the data security monitoring unit is started at the same time;

[0166] Capture real-time monitoring data through monitoring tools, including CPU usage, memory usage, disk I / O, network latency, and throughput;

[0167] Use preset anomaly detection rules to detect anomalies in real-time monitoring data;

[0168] When real-time monitoring data is identified to exceed the threshold, it is classified as data security anomaly identification data;

[0169] When an abnormality is detected in real-time monitoring data, the corresponding security response mechanism is triggered, which includes automatic isolation and early warning notification.

[0170] Specifically, the comprehensive security assessment system based on the trusted data space provided by the present invention, the security assessment unit is also used for:

[0171] Collect historical data security monitoring data of the trusted data space, which includes real-time monitoring data of the trusted data space, abnormal identification data of the trusted data space, security response data of the trusted data space, and log records of the trusted data space;

[0172] Preprocess the historical data security monitoring data of the trusted data space, and extract key features from the preprocessed historical data security monitoring data of the trusted data space, the key features including security status features, abnormal frequency features, response time features, and resource utilization features;

[0173] According to the random forest algorithm, the extracted features are used to train the model, and the model parameters are adjusted to obtain the security assessment model.

[0174] Specifically, the comprehensive security assessment system based on the trusted data space provided by the present invention, the security assessment unit is also used for:

[0175] The security assessment results are classified into data to obtain system security status assessment results, anomaly identification and classification results, security response effect assessment results, system performance impact assessment results, user behavior security assessment results, configuration security assessment results and data integrity assessment results.

[0176] Collect historical data security monitoring data from the trusted data space, which is the basis for subsequent analysis and evaluation.

[0177] Clean and transform the collected raw data to improve the quality and consistency of the data and prepare for subsequent feature extraction and model training.

[0178] Extracting key features from the preprocessed data will serve as input for model training and is crucial to the performance and accuracy of the model.

[0179] Use the random forest algorithm to train a security assessment model based on the extracted features. This model will be used to evaluate new security monitoring data. Use the trained model to evaluate new data to determine the security status of the system. Further data classification is performed on the security assessment results to gain a more detailed understanding of the system's security performance in all aspects.

[0180] This process can be converted into the following code when implemented in programming:

[0181] function performSecurityAssessment():

[0182] data = collectHistoricalMonitoringData()# Collect historical data

[0183] preprocessed_data = preprocessData(data)# Data preprocessing

[0184] features = extractFeatures(preprocessed_data)# Feature extraction

[0185] model = trainModel(features, RandomForestAlgorithm)# Model training

[0186] results = model.assess(newData)# Security Assessment

[0187] classified_results = classifyResults(results)# Result classification

[0188] return classified_results# Returns the classified evaluation results.

[0189] The present invention solves the problem that when the simulated attack exceeds the system operation load range, the system is paralyzed, thereby failing to continuously perform real-time monitoring in a high-traffic environment by the following methods:

[0190] First, the present invention constructs a privacy data processing space. When the data processing volume of the trusted data space reaches the upper limit, the system transfers the excess data to the privacy data processing space for processing, thereby avoiding the risk of the main system being paralyzed due to excessive data processing volume.

[0191] Secondly, the data will be encrypted during the migration from the trusted data space to the privacy data processing space, and random sampling decryption verification will be performed during the transmission process to improve the security and integrity of the data.

[0192] In addition, the system configures an isolated test environment within the privacy data processing space to perform attack simulations so that simulated attacks will not have a direct impact on the main system.

[0193] At the same time, by configuring the data security monitoring unit, the system can monitor the status of the privacy data processing space in real time and trigger the security response mechanism in time when an anomaly is detected.

[0194] In addition, the security assessment model trained using the random forest algorithm can continuously optimize the accuracy and efficiency of the assessment.

[0195] Finally, the system has a flexible data processing mechanism that can dynamically adjust data processing strategies according to actual operating conditions, thereby maintaining real-time monitoring and attack simulation capabilities in a high-traffic environment.

[0196] The present invention improves the stability and security of the system and enhances the feasibility of the comprehensive security assessment system of the trusted data space to continuously perform real-time monitoring and attack simulation in a high-traffic environment.

[0197] The innovative features of the present invention include the following aspects:

[0198] Construction of privacy data processing space: When the existing privacy computing processing modes of data are available but invisible, or invisible but requires permission resolution, it is difficult to support multi-mode and multi-parameter conditions, especially there are huge problems in large model applications. The present invention achieves the effect of supporting multi-mode and multi-parameter conditions, especially in large model applications.

[0199] Data encryption blockchain storage: Data will be encrypted during the migration from the trusted data space to the private data processing space, and random sampling decryption verification will be performed during the transmission process, which improves the security and integrity of the data during transmission. The data processing results of the private data processing space are encrypted and stored in the blockchain, using the decentralized and tamper-proof characteristics of the blockchain to further enhance the security and credibility of the data.

[0200] The various innovative features of the technical solution of the present invention jointly improve the stability and security of the system, enhance the real-time monitoring and attack simulation capabilities in high-traffic environments, and improve the accuracy and efficiency of security assessments.

[0201] The main purpose of building a privacy data processing space is to deal with the inability of the trusted data space to process a large amount of data that requires privacy computing in a timely manner under high load. The existing privacy computing processing mode of data that is available but invisible, or invisible but needs to be parsed according to permissions, is difficult to support multi-mode and multi-parameter conditions, especially in large model applications. In addition, how to effectively support the trusted computing 3.0 architecture, the construction process is proposed to include the following key steps:

[0202] The technical solution of the present invention aims to solve the problem that the trusted data space cannot process a large amount of data requiring privacy computing in a timely manner under high load by constructing a privacy data processing space, while addressing the shortcomings of the existing privacy computing processing mode and effectively supporting the trusted computing 3.0 architecture. The specific solutions are as follows:

[0203] The privacy data processing space construction unit of the present invention is used to collect configuration information of the trusted data space, including access control strategy, security strategy, data processing capability, storage capacity, log information and network bandwidth, etc.

[0204] When the data processing capacity of the trusted data space reaches the upper limit, the excess data will be transferred to the privacy data processing space for processing, effectively avoiding the risk of the main system being paralyzed due to excessive data processing capacity.

[0205] During the migration from the trusted data space to the privacy data processing space, the data will be encrypted to improve the security of the data during transmission.

[0206] The data processing results of the privacy data processing space are encrypted and stored in the blockchain, utilizing the decentralized and tamper-proof characteristics of the blockchain to further enhance the security and credibility of the data.

[0207] The present invention supports multi-mode, multi-parameter conditions, and a flexible data processing mechanism. The system has the ability to dynamically adjust data processing strategies according to actual operating conditions to adapt to different security assessment requirements and environmental changes.

[0208] The construction of the privacy data processing space improves the system's stability and data processing capabilities under high load conditions, and helps support multi-mode and multi-parameter conditions, especially the needs of large model applications.

[0209] The technical solution of the present invention supports the trusted computing 3.0 architecture, and the collaborative work of the trusted data space and the privacy data processing space: through the collaborative work of the server side, the background control side and the user side, efficient security assessment is achieved, which meets the high requirements of the trusted computing 3.0 architecture for data security and processing efficiency.

[0210] The security assessment model based on the random forest algorithm can comprehensively evaluate the security of the system, including multiple dimensions such as system security status, anomaly identification and classification, and security response effect, providing comprehensive security protection for the system under the Trusted Computing 3.0 architecture.

[0211] To address the shortcomings of existing privacy computing processing modes and the problem that existing privacy computing data processing modes are difficult to support multi-mode and multi-parameter conditions, the present invention optimizes the data processing process and improves processing efficiency and security by constructing a privacy data processing space and adopting a flexible data processing mechanism.

[0212] To summarize, the technical solution of the present invention effectively solves the problem that the trusted data space cannot process a large amount of data requiring privacy computing in a timely manner under high load conditions by constructing a privacy data processing space, data encryption and blockchain storage, supporting multi-mode and multi-parameter conditions, supporting the Trusted Computing 3.0 architecture, and optimizing the processing mode. It also addresses the shortcomings of the existing privacy computing processing mode and provides comprehensive security protection for the system under the Trusted Computing 3.0 architecture.

[0213] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations, and the above-described embodiments of the present invention do not constitute a limitation on the scope of protection of the present invention.

Claims

1. A comprehensive security assessment system based on a trusted data space, characterized in that: include: The server side, the backend control side and the user side, the server side establishes a communication connection with the backend control side and the user side, the server side performs a comprehensive security assessment on the trusted data space according to the data transmitted by the backend control side and the user side, and the server side transmits the comprehensive security assessment result of the trusted data space to the backend control side and the user side, the server side includes: A data acquisition unit, used to acquire system information data, wherein the system information data includes basic system information, security policy data, real-time log data, simulated attack data, system performance data, user behavior data, and user authority data; A privacy data processing space construction unit is used to collect trusted data space configuration information, which includes access control policies, security policies, data processing capability information, storage capacity information, trusted data space log information, and network bandwidth information; perform data analysis on the trusted data space log information to obtain trusted data space user behavior data; construct a privacy data processing space based on the trusted data space user behavior data and trusted data space configuration information; set an upper limit value for the data processing volume of the trusted data space; when the data processing volume of the trusted data space reaches the upper limit value, data that exceeds the upper limit value for the data processing volume of the trusted data space is transmitted to the privacy data processing space for data processing; encrypt the data processing results of the privacy data processing space, store them in the blockchain, and then feed them back to the trusted data space; An attack simulation unit is used to receive attack simulation basic data, the attack simulation basic data includes the type of attack, the intensity of the attack and the frequency of the attack, substitute the attack simulation basic data into a preset attack simulation data knowledge base for matching, obtain an attack simulation program set by matching, and substitute the attack simulation program in the attack simulation program set into the privacy data processing space for attack simulation; A data security monitoring unit, used to monitor data when executing the attack simulation program in the privacy data processing space, and obtain data security monitoring data, the data security monitoring data including data security real-time monitoring data, data security anomaly identification data, data security response data and data security log records; A security assessment unit is used to substitute data security monitoring data into a preset security assessment model to obtain a security assessment result; The privacy data processing space construction unit is further used to: Determine privacy data processing requirements, including configuration information of data processing capabilities, storage capacity, and network bandwidth; According to the architecture of the privacy data processing space, a privacy data processing environment is configured on the architecture of the privacy data processing space, and data to be processed is migrated from the trusted data space to the privacy data processing space; During the data migration process from the trusted data space to the privacy data processing space, the data is encrypted before being migrated within the trusted data space, and the data to be transmitted in the trusted data space is randomly selected for decryption during the data transmission process. The decrypted data to be transmitted in the trusted data space is compared with the data to be transmitted in the trusted data space before decryption. If the comparison result of the decrypted data to be transmitted in the trusted data space is consistent with the data to be transmitted in the trusted data space before decryption, the data to be transmitted in the trusted data space has not been tampered with.

2. The comprehensive security assessment system based on the trusted data space as claimed in claim 1, characterized in that: The data acquisition unit comprises: Obtain a data comparison and verification mechanism, compare and verify the obtained system information data according to the data comparison and verification mechanism, and obtain a system information comparison and verification result, which includes system information verification qualified data and system information verification unqualified data.

3. The comprehensive security assessment system based on the trusted data space as claimed in claim 2, characterized in that: The data acquisition unit is further used for: Conduct internal verification of system information data, check the integrity of system information data, and analyze existing data errors or abnormal values ​​by screening, sorting and calculating system information data; Data comparison is performed according to a predetermined data comparison and verification mechanism, which includes basic information comparison rules, key information comparison rules and business information comparison rules.

4. The comprehensive security assessment system based on the trusted data space as claimed in claim 1, characterized in that: The privacy data processing space construction unit is further used to: Determine the scope of configuration information collection, which includes access control policies, security policies, data processing capability information, storage capacity information, trusted data space log information, and network bandwidth information; The data collected according to the configuration information collection range is stored in the blockchain to generate a first hash value; Preprocessing the data collected according to the configuration information collection range to obtain preprocessed trusted data space real-time configuration data; The pre-processed trusted data space real-time configuration data is stored in the blockchain to generate a second hash value; The data corresponding to the second hash value is compared with the data corresponding to the first hash value. If the first hash value includes the data corresponding to the second hash value, the data corresponding to the second hash value has not been tampered with, and the data corresponding to the second hash value is marked as usable data.

5. The comprehensive security assessment system based on the trusted data space as claimed in claim 4, characterized in that: The privacy data processing space construction unit is further used to: Identify and analyze the pre-processed log data to identify users’ access patterns, operating habits, and potential security risks; Perform cluster analysis on the preprocessed log data to obtain the frequency, time and type of user activities; The frequency, time and type of user activities, as well as the user's access patterns, operating habits and potential security risks are analyzed through a preset user behavior analysis model to obtain user behavior data.

6. The comprehensive security assessment system based on the trusted data space as claimed in claim 1, characterized in that: The attack simulation unit is further used for: According to the attack simulation basic data, a corresponding attack simulation program set is matched in a preset attack simulation data knowledge base; Identify access points to the privacy data processing space, where the access points include network ports, service interfaces, or predefined test environment entrances; An isolated test environment is configured in the privacy data processing space, and the isolated test environment is used to perform attack simulation; Set up monitoring and recording tools within an isolated test environment to capture and analyze all activities during the simulated attack; Deploy each program in the attack simulation program set one by one into the configured isolated test environment, so that the isolated test environment executes the predetermined attack type, intensity and frequency corresponding to each simulation program; Start the attack simulation program to launch a simulated attack on the isolated test environment configured for the privacy data processing space; monitor and record the response, performance changes, and security policy triggering of the isolated test environment configured for the privacy data processing space during the attack.

7. The comprehensive security assessment system based on the trusted data space as claimed in claim 1, characterized in that: The data security monitoring unit is further used for: Configure a data security monitoring unit in the privacy data processing space and set monitoring parameters, which include monitoring indicators, thresholds, and data collection frequency; When the attack simulation program starts to execute in the privacy data processing space, the real-time monitoring function of the data security monitoring unit is started at the same time; Capture real-time monitoring data through monitoring tools, including CPU usage, memory usage, disk I / O, network latency, and throughput; Use preset anomaly detection rules to detect anomalies in real-time monitoring data; When real-time monitoring data is identified to exceed the threshold, it is classified as data security anomaly identification data; When an abnormality is detected in real-time monitoring data, the corresponding security response mechanism is triggered, which includes automatic isolation and early warning notification.

8. The comprehensive security assessment system based on the trusted data space as claimed in claim 1, characterized in that: The safety assessment unit is further used for: Collect historical data security monitoring data of the trusted data space, which includes real-time monitoring data of the trusted data space, abnormal identification data of the trusted data space, security response data of the trusted data space, and log records of the trusted data space; Preprocess the historical data security monitoring data of the trusted data space, and extract key features from the preprocessed historical data security monitoring data of the trusted data space, the key features including security status features, abnormal frequency features, response time features, and resource utilization features; According to the random forest algorithm, the extracted features are used to train the model, and the model parameters are adjusted to obtain the security assessment model.

9. The comprehensive security assessment system based on the trusted data space as claimed in claim 8, characterized in that: The safety assessment unit is also used for: The security assessment results are classified into data to obtain system security status assessment results, anomaly identification and classification results, security response effect assessment results, system performance impact assessment results, user behavior security assessment results, configuration security assessment results and data integrity assessment results.

Images