High-performance protection method for untrusted terminal environment feature library

Abstract

The present invention relates to the field of network security technology, and discloses a high-performance protection method for a feature library in an untrusted terminal environment, comprising: S1, generating a random salt value; S2, generating a corresponding secret feature library and a salt-containing program according to the salt value; S3, publishing the secret feature library and the salt-containing program to an untrusted terminal environment through a trusted channel, and completing the loading of the secret feature library and the running of the salt-containing program in the untrusted terminal environment; S4, after taking field values ​​of an input network data message through the salt-containing program, locating features by a hash search algorithm, and implementing control over specific network data messages according to hit rule entries, while protecting the security of rule data in a rule library without affecting the forwarding of normal network data messages, reducing the risk of rule library leakage, and implementing safe operation of the feature library in an untrusted terminal environment and high-performance matching compatibility effects.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a high-performance protection method for an untrusted terminal environment feature library. Background Art

[0002] With the development of computer networks, the number of untrusted terminal usage environments has increased. For example, Internet of Vehicles T-Box terminals, drone terminals, and Android smartphone terminals are often exposed to white box attack environments and are vulnerable to attacks from malicious attackers using reverse tracking, dynamic analysis, memory perspective, and register sniffing.

[0003] Feature libraries (such as domain name feature libraries, IP address feature libraries, and URL feature libraries) need to have high-performance processing or matching capabilities because they perform real-time matching on specified fields in incoming and outgoing messages. Currently, white-box cryptography technology is used for strong security protection. However, complex encryption calculations cause high latency, greatly reduce performance, and fail to operate normally. Traditional password protection technology publishes rules to terminals in an encrypted manner, and decrypts and loads them into memory before the terminal runs. Although this can ensure communication security, it cannot avoid being seen through the terminal's memory, which can easily lead to rule library leakage and cause irreparable losses.

[0004] To sum up, the main defects are as follows:

[0005] Existing static white-box cryptography and dynamic white-box cryptography technologies both have complex encryption and decryption calculations, and high encryption and decryption delays, which will affect the forwarding of network data packets;

[0006] Traditional cryptographic technology is mainly used for communication and storage security, and cannot effectively protect data loaded into memory after decryption. An attacker only needs to see through the running memory to obtain all decrypted plaintext features.

[0007] When the current cloud-based feature library distribution system restricts access and performs business control on feature libraries (such as domain name feature libraries, IP address feature libraries, and URL feature libraries) distributed in untrusted terminal environments, it is easy to cause a large number of feature libraries accumulated over a long period of time to be leaked. Summary of the invention

[0008] The purpose of the present invention is to provide a high-performance protection method for an untrusted terminal environment feature library to solve the following technical problems:

[0009] How to achieve the effect of secure operation and high-performance matching compatibility of the feature library in an untrusted terminal environment.

[0010] The purpose of the present invention can be achieved through the following technical solutions:

[0011] High-performance protection methods for untrusted terminal environment feature libraries, including:

[0012] S1. Generate a random salt value;

[0013] S2. Generate a corresponding dense feature library and salt-containing program according to the salt value;

[0014] S3, publishing the secret feature library and the salt-containing program to an untrusted terminal environment through a trusted channel, and completing the loading of the secret feature library and the running of the salt-containing program in the untrusted terminal environment;

[0015] S4. After taking field values ​​of the input network data message through the salt-containing program, a hash search algorithm is used to locate features to achieve high-performance dense feature matching.

[0016] As a further solution of the present invention: step S2 comprises:

[0017] S21. Convert the input feature library plaintext into an irreversible encrypted feature library according to the salt value:

[0018] S22, compiling the input feature processing program source code into a salt-containing program according to the salt value;

[0019] The feature processing program source code includes salt value macro, feature value algorithm, feature salted hash algorithm, feature search algorithm and feature corresponding behavior.

[0020] As a further solution of the present invention: the step S21 includes:

[0021] S211, cyclically read out each feature in the plain text of the feature library as an encryption object;

[0022] S212, calling the salt value as the salt value of the feature salted hash algorithm;

[0023] S213, encrypting the feature using the feature salted hash algorithm to generate an irreversible encrypted feature;

[0024] S214, re-entering each of the secret features into the database to generate the secret feature database.

[0025] As a further solution of the present invention: step S22 includes:

[0026] S221, after writing the salt value into each program source code in the feature processing program source code according to the salt value macro, obtaining a salt-containing program source code corresponding to each program source code;

[0027] S222, calling the GCC compiler to perform obfuscation compilation on the salt-containing program source code, and generating the salt-containing program after the compilation is completed.

[0028] As a further solution of the present invention: step S3 comprises:

[0029] Step S31: The cloud feature library issuing system and the untrusted terminal environment perform two-way identity authentication through traditional asymmetric encryption algorithms and digital certificates to determine the authenticity of the terminal identity;

[0030] Step S32: After identity authentication is completed between the cloud feature library issuing system and the untrusted terminal environment, a temporary session key is negotiated for publishing the secret feature library and the salted program;

[0031] Step S33: encrypt the secret feature library using the negotiated temporary session key to generate a secret feature library ciphertext;

[0032] Step S34, encrypting the salted program using the negotiated temporary session key to generate a salted program ciphertext;

[0033] Step S35, transmitting the generated secret feature library ciphertext and the salted program ciphertext to the untrusted terminal environment, completing the release of the secret feature library and the salted program;

[0034] Step S36: After receiving the secret feature library ciphertext and the salted program ciphertext, the untrusted terminal environment uses the temporary session key to decrypt the secret feature library ciphertext and the salted program ciphertext to restore the secret feature library and the salted program.

[0035] As a further solution of the present invention: step S36 includes:

[0036] Step S361, cyclically read out each secret state feature in the secret state feature library, load the salt-containing program into the memory, and start running;

[0037] Step S362: Use the read secret feature as a key to insert and locate the hash table, and insert each secret feature into the feature hash table;

[0038] Step S363: After the secret state feature insertion and salt-containing program operation in all secret state feature libraries are completed, the original secret state feature library and the original salt-containing program are deleted, and the secret state feature library and the salt-containing program are not stored on the disk, thereby reducing storage security risks;

[0039] Step S364, after the deletion and cleaning is completed, the loading of the secret feature library and the salt-containing program is completed.

[0040] As a further solution of the present invention: step S4 comprises:

[0041] Step S41, the salt-containing program parses and extracts values ​​from the input network data message according to the embedded feature value algorithm corresponding to the secret feature library;

[0042] Step S42: The salt-containing program uses the embedded salted hash algorithm corresponding to the secret feature library to perform salted hash calculation according to the embedded salt value macro and the value content, and obtains the corresponding and matchable secret feature of the network data message;

[0043] Step S43, the salt-containing program uses the message secret state feature as a key to query and locate the hash table to determine whether the feature is hit;

[0044] Step S441, hit, the salt-containing program processes according to the embedded hit behavior corresponding to the secret feature library, such as intercepting the message;

[0045] Step S442: If no hit occurs, the salted program processes the missed hit according to the embedded missed hit behavior corresponding to the secret feature library, such as forwarding the message.

[0046] The beneficial effects of the present invention are as follows: the present invention reduces the high delay caused by the complex encryption and decryption calculation method required to protect the feature library, the problem of affecting the forwarding of network data messages, and the risk of feature library leakage caused by memory perspective in traditional communication encryption and storage encryption, by converting the feature library into a secret feature library of salted hash, and by splitting and embedding the salt value, feature value algorithm, feature salted hash algorithm, feature search algorithm, and feature behavior into a program obfuscation compilation method. The present invention can perform high-performance matching on the feature library and manage specific network data messages according to the hit rule entries. At the same time, it protects the security of the rule data in the rule library without affecting the normal forwarding of network data messages, reduces the risk of rule library leakage, and realizes the safe operation of the feature library in an untrusted terminal environment and the high-performance matching compatibility effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The present invention will be further described below in conjunction with the accompanying drawings.

[0048] Figure 1 This is a general flow chart of the high-performance protection method for the untrusted terminal environment feature library in the present invention;

[0049] Figure 2 A detailed flowchart of the high-performance protection method for the untrusted terminal environment feature library in the present invention; DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] See also Figure 1 and Figure 2 As shown, the present invention is a high-performance protection method for an untrusted terminal environment feature library, comprising:

[0052] S1. Generate a random salt value. The cloud feature library issuance system generates a random salt value.

[0053] S2, the cloud feature library issuing system generates the corresponding secret feature library and salt-containing program according to the salt value;

[0054] Step S2 includes:

[0055] S21. Convert the input feature library plaintext into an irreversible encrypted feature library according to the salt value:

[0056] Step S21 includes:

[0057] S211, cyclically read out each feature in the plain text of the feature library as an encryption object;

[0058] S212, calling the salt value as the salt value of the characteristic salted hash algorithm (such as MD5);

[0059] S213, encrypting the feature using a feature salted hash algorithm to generate an irreversible secret feature, so that even if the feature library is leaked, it cannot be reversed into a plaintext feature library;

[0060] S214, re-enter each secret feature into the database to generate a secret feature database.

[0061] S22, compiling the input feature processing program source code into a salt-containing program according to the salt value;

[0062] Among them, the feature processing program source code includes salt value macro, feature value algorithm, feature salt hash algorithm, feature search algorithm and feature corresponding behavior.

[0063] Step S22 includes:

[0064] S221, after writing the salt value into each program source code in the feature processing program source code according to the salt value macro, obtaining the salt-containing program source code corresponding to each program source code;

[0065] S222, calling the GCC compiler to confuse and compile the salt-containing program source code, reducing the probability of obtaining the signature library salt value and algorithm through decompilation, and generating the salt-containing program after the compilation is completed.

[0066] S3, publishing the secret feature library and the salt-containing program to the untrusted terminal environment through the trusted channel, and completing the loading of the secret feature library and the running of the salt-containing program in the untrusted terminal environment;

[0067] Step S3 includes:

[0068] Step S31: The cloud feature library issuing system and the untrusted terminal environment perform two-way identity authentication through traditional asymmetric encryption algorithms and digital certificates to determine the authenticity of the terminal identity;

[0069] Step S32: After completing identity authentication between the cloud feature library issuing system and the untrusted terminal environment, a temporary session key is negotiated for publishing the secret feature library and the salted program;

[0070] Step S33: encrypt the secret feature database using the negotiated temporary session key to generate a secret feature database ciphertext;

[0071] Step S34, encrypting the salted program using the negotiated temporary session key to generate a salted program ciphertext;

[0072] Step S35, transmitting the generated secret feature library ciphertext and salted program ciphertext to the untrusted terminal environment, completing the release of the secret feature library and the salted program;

[0073] Step S36: After receiving the secret feature library ciphertext and the salted program ciphertext, the untrusted terminal environment uses the temporary session key to decrypt the secret feature library ciphertext and the salted program ciphertext to restore the secret feature library and the salted program.

[0074] Step S36 includes:

[0075] Step S361, cyclically read out each secret feature in the secret feature library, load the salt-containing program into the memory, and start running;

[0076] Step S362: Use the read secret feature as a key to insert and locate the hash table, and insert each secret feature into the feature hash table;

[0077] Step S363: After the secret state feature insertion and salt-containing program operation in all secret state feature libraries are completed, the original secret state feature library and the original salt-containing program are deleted, and the secret state feature library and the salt-containing program are not stored on the disk, thereby reducing storage security risks;

[0078] Step S364, after the deletion and cleaning is completed, the loading of the secret feature library and the salt-containing program is completed.

[0079] S4. After taking field values ​​of the input network data message through the salt-containing program, the hash search algorithm is used to locate the features to achieve high-performance dense feature matching.

[0080] Step S4 includes:

[0081] Step S41, the salt-containing program parses and extracts values ​​(such as URL content extraction) from the input network data message according to the embedded feature value algorithm corresponding to the secret feature library;

[0082] Step S42: The salt-containing program uses the embedded salted hash algorithm corresponding to the secret feature library to perform salted hash calculation according to the embedded salt value macro and the value content, and obtains the corresponding and matchable secret feature of the network data message;

[0083] Step S43, the salt-containing program uses the message secret state feature as the key to query and locate the feature hash table to determine whether the feature hits; the query and location adopts the hash modulus search method, which is not affected by the number of feature library entries, and the entire match is only queried once, and the matching performance is efficient;

[0084] Step S441, hit, the salt-containing program processes according to the embedded hit behavior corresponding to the secret feature library, such as intercepting the message;

[0085] Step S442: If no hit occurs, the salted program processes the missed hit according to the embedded missed hit behavior corresponding to the secret feature library, such as forwarding the message.

[0086] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. High-performance protection method for untrusted terminal environment feature library, characterized in that: include: S1. Generate a random salt value; S2. Generate a corresponding dense feature library and salt-containing program according to the salt value; S3, publishing the secret feature library and the salt-containing program to an untrusted terminal environment through a trusted channel, and completing the loading of the secret feature library and the running of the salt-containing program in the untrusted terminal environment; S4, after taking field values ​​of the input network data message through the salt-containing program, a hash search algorithm is used to locate features to achieve high-performance dense feature matching; The step S2 comprises: S21. Convert the input feature library plaintext into an irreversible encrypted feature library according to the salt value: S22, compiling the input feature processing program source code into a salt-containing program according to the salt value; The feature processing program source code includes salt value macro, feature value algorithm, feature salting hash algorithm, feature search algorithm and feature corresponding behavior; The step S21 comprises: S211, cyclically read out each feature in the plain text of the feature library as an encryption object; S212, calling the salt value as the salt value of the feature salted hash algorithm; S213, encrypting the feature using the feature salted hash algorithm to generate an irreversible encrypted feature; S214, re-storing each of the secret features to generate the secret feature library; The step S22 comprises: S221, after writing the salt value into each program source code in the feature processing program source code according to the salt value macro, obtaining a salt-containing program source code corresponding to each program source code; S222, calling the GCC compiler to perform obfuscation compilation on the salt-containing program source code, and generating a salt-containing program after the compilation is completed; The step S4 comprises: Step S41, the salt-containing program parses and extracts values ​​from the input network data message according to the embedded feature value algorithm corresponding to the secret feature library; Step S42: The salt-containing program uses the embedded salted hash algorithm corresponding to the secret feature library to perform salted hash calculation according to the embedded salt value macro and the value content, and obtains the corresponding and matchable secret feature of the network data message; Step S43, the salt-containing program uses the message secret state feature as a key to query and locate the feature hash table to determine whether the feature is hit; Step S441: hit, the salt-containing program processes according to the embedded hit behavior corresponding to the secret feature library and intercepts the message; Step S442: If no hit occurs, the salted program processes the message according to the embedded miss behavior corresponding to the secret feature library and forwards the message.

2. The high-performance protection method for untrusted terminal environment feature library according to claim 1 is characterized in that: The step S3 comprises: Step S31: The cloud feature library issuing system and the untrusted terminal environment perform two-way identity authentication through traditional asymmetric encryption algorithms and digital certificates to determine the authenticity of the terminal identity; Step S32: After identity authentication is completed between the cloud feature library issuing system and the untrusted terminal environment, a temporary session key is negotiated for publishing the secret feature library and the salted program; Step S33: encrypt the secret feature library using the negotiated temporary session key to generate a secret feature library ciphertext; Step S34, encrypting the salted program using the negotiated temporary session key to generate a salted program ciphertext; Step S35, transmitting the generated secret feature library ciphertext and the salted program ciphertext to the untrusted terminal environment, completing the release of the secret feature library and the salted program; Step S36: After receiving the secret feature library ciphertext and the salted program ciphertext, the untrusted terminal environment uses the temporary session key to decrypt the secret feature library ciphertext and the salted program ciphertext to restore the secret feature library and the salted program.

3. The high-performance protection method for untrusted terminal environment feature library according to claim 2 is characterized in that: The step S36 comprises: Step S361, cyclically read out each secret state feature in the secret state feature library, load the salt-containing program into the memory, and start running; Step S362: Use the read secret feature as a key to insert and locate the hash table, and insert each secret feature into the feature hash table; Step S363: After the secret state feature insertion and salt-containing program operation in all secret state feature libraries are completed, the original secret state feature library and the original salt-containing program are deleted, and the secret state feature library and the salt-containing program are not stored on the disk, thereby reducing storage security risks; Step S364, after the deletion and cleaning is completed, the loading of the secret feature library and the salt-containing program is completed.

Images