Security protection method and device, electronic equipment and computer storage medium

Abstract

The invention discloses a safety protection method and device, electronic equipment and a computer storage medium, and the method comprises the steps that a target server receives a sensitive task request sent by a terminal; wherein the sensitive task request is sent by the terminal when the risk detection result is a security type, and the risk detection result is obtained after the terminal performs security risk detection on the sensitive task request input by the user; and the target server creates a target virtual environment based on the sensitive task request, and performs sensitive task processing in response to the sensitive task request in the target virtual environment.

Description

Technical Field

[0001] This specification relates to the field of data security, and in particular to a security protection method, device, electronic device and computer storage medium. Background Art

[0002] With the continuous development of digital technology, individuals and enterprises have begun to process more and more sensitive information through digital means. However, in the context of the current complex network security situation, sensitive information faces various data security risks. Summary of the invention

[0003] This specification provides a security protection method, device, electronic device and computer storage medium, and the technical solution is as follows:

[0004] In a first aspect, this specification provides a security protection method, which is applied to a target server, and the method includes:

[0005] Receiving a sensitive task request sent by a terminal; wherein the sensitive task request is sent by the terminal when a risk detection result is a security type, and the risk detection result is obtained after the terminal performs a security risk detection on the sensitive task request input by the user;

[0006] A target virtual environment is created based on the sensitive task request, and sensitive task processing is performed in the target virtual environment in response to the sensitive task request.

[0007] In a second aspect, this specification provides a security protection method, which is applied to a terminal, and the method includes:

[0008] Receive a sensitive task request input by a user, perform a security risk detection on the sensitive task request, and obtain a risk detection result;

[0009] When the risk detection result is a safety type, the sensitive task request is sent to a target server, so that the target server creates a target virtual environment based on the sensitive task request, and performs sensitive task processing in the target virtual environment in response to the sensitive task request.

[0010] In a third aspect, this specification provides a security protection device, which is applied to a target server, and the device includes:

[0011] A receiving module, adapted to receive a sensitive task request sent by a terminal; wherein the sensitive task request is sent by the terminal when a risk detection result is a security type, and the risk detection result is obtained after the terminal performs a security risk detection on the sensitive task request input by the user;

[0012] The processing module is adapted to create a target virtual environment based on the sensitive task request, and perform sensitive task processing in the target virtual environment in response to the sensitive task request.

[0013] In a fourth aspect, this specification provides a security protection device, applied to a terminal, the device comprising:

[0014] A detection module, adapted to receive a sensitive task request input by a user, perform security risk detection on the sensitive task request, and obtain a risk detection result;

[0015] The sending module is adapted to send the sensitive task request to the target server when the risk detection result is of a safe type, so that the target server creates a target virtual environment based on the sensitive task request and performs sensitive task processing in the target virtual environment in response to the sensitive task request.

[0016] In a fifth aspect, the present specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0017] In a sixth aspect, the present specification provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0018] In a seventh aspect, the present specification provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded by a processor to execute the above-mentioned method steps.

[0019] The beneficial effects brought about by the technical solutions provided in some embodiments of the present specification include at least: by performing security risk detection on the sensitive task requests input by the user at the terminal, so as to ensure the security of the sensitive task requests on the terminal side; then the target server receives the sensitive task request, and uses the sensitive task request to create a target virtual environment corresponding to the sensitive task request, thereby realizing the mutual correspondence between the target virtual environment and the sensitive task request; at the same time, the target virtual environment is isolated from the corresponding operating system in the target server, so as to ensure the security of operations and data in the target virtual environment on the target server side; finally, corresponding sensitive task processing is performed in response to the sensitive task request in the target virtual environment, so that the leakage of sensitive data during the sensitive task processing in the target virtual environment is avoided through the dual data protection of the physically isolated terminal and the target server. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in this specification or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A schematic diagram of a safety protection system provided in this manual;

[0022] Figure 2 A schematic diagram of a safety protection method is provided for the embodiments of this specification;

[0023] Figure 3 A schematic diagram of a process for creating a target virtual environment is provided for the embodiments of this specification;

[0024] Figure 4 A schematic diagram of a process for performing permission matching is provided for the embodiments of this specification;

[0025] Figure 5 A schematic diagram of a process for generating virtual environment configuration information for sensitive task information is provided for the embodiments of this specification;

[0026] Figure 6 A schematic diagram of a process for creating a target virtual environment is provided for the embodiments of this specification;

[0027] Figure 7 A schematic diagram of a process for deleting a target virtual environment is provided for the embodiment of this specification;

[0028] Figure 8 A flowchart of intercepting target data processing operations is provided for the embodiments of this specification;

[0029] Fig. 9 A schematic diagram of the architecture corresponding to a security protection method is provided for the embodiments of this specification;

[0030] Fig.10 A schematic diagram of a process flow of a security protection method applied to a terminal is provided for the embodiment of this specification;

[0031] Fig.11 This is a schematic diagram of the structure of the security protection device applied to the target server in this specification;

[0032] Fig.12 This is a schematic diagram of the structure of the safety protection device used in the terminal in this manual;

[0033] Fig.13 A structural block diagram of an electronic device provided in an embodiment of this specification;

[0034] Fig.14 A block diagram of the operating system and user space provided for this specification;

[0035] Fig.15 Provided for this manual Fig.14 The architecture diagram of the Android operating system;

[0036] Fig.16 Provided for this manual Fig.14 Architecture diagram of the IOS operating system. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in this specification to clearly and completely describe the technical solutions in this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0038] In the description of this specification, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In the description of this specification, it should be noted that, unless otherwise clearly specified and limited, "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. For those of ordinary skill in the art, the specific meanings of the above terms in this specification can be understood in specific circumstances. In addition, in the description of this specification, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are an "or" relationship.

[0039] With the rapid development of the digital age, enterprises are dealing with more and more sensitive information and are also facing a variety of security risks. These risks range from highly sophisticated cyber attacks to insider threats, as well as various forms of malware and social engineering attacks, making the security of sensitive data a key challenge for enterprises.

[0040] As technology develops, malware and viruses become more complex and difficult to detect, and traditional antivirus solutions often have difficulty keeping up with the pace of these threats. In addition, insiders may leak sensitive data due to misoperation, abuse of authority, or malicious intent. At the same time, the means of cyber attacks against enterprises continue to evolve, and attackers use a variety of strategies such as cross-site scripting, phishing, and advanced persistent threat (APT) attacks, requiring enterprises to have more advanced protection measures to deal with these threats. In addition, as corporate employees increasingly use mobile devices and work remotely, sensitive data is often accessed and processed in environments that are not controlled by the enterprise, increasing the complexity of data security. In addition, phishing emails and other social engineering methods are also common causes of information leakage, which may also cause employees to leak sensitive data without knowing it.

[0041] Among the related technologies, the leakage of sensitive data can be avoided through endpoint detection and response (EDR) technology, data loss prevention (DLP) technology, and multi-factor authentication (MFA) technology.

[0042] Specifically, EDR technology can monitor terminal activities in real time. EDR technology can usually provide immediate warnings of malware attacks, suspicious behaviors, and security vulnerabilities, and allow responses to security incidents. However, the effectiveness of EDR technology depends to a large extent on its behavioral analysis capabilities and the accuracy of the threat intelligence database. It may not provide effective protection when facing zero-day attacks or highly customized malware. At the same time, EDR technology usually requires complex configuration and professional security teams to effectively manage. In addition, EDR technology focuses more on detection and response rather than isolating sensitive operations, so it is not as powerful as virtualized environments in protecting sensitive operations.

[0043] DLP technology focuses on preventing sensitive data from being transmitted or leaked without authorization. DLP technology can classify data, monitor data flow, and prevent sensitive information from leaking out of the enterprise through channels such as email, cloud services, or mobile devices. However, DLP technology usually requires precise configuration of policies to prevent data leakage, which may require a detailed understanding of the enterprise's data flow and classification, which may be difficult to achieve in actual operations. At the same time, DLP may not be able to completely prevent internal threats because internal users usually have permission to access sensitive data. In addition, in some cases, the system corresponding to DLP technology may interfere with legitimate data sharing and affect work efficiency.

[0044] MFA technology requires users to provide two or more forms of authentication when accessing sensitive resources, such as passwords, biometrics, or authentication codes on mobile devices, which increases the difficulty for unauthorized users to gain access. However, MFA technology is mainly used to increase the security of identity authentication, but once a user is verified, malicious behavior or internal threats can still access and manipulate sensitive data without additional control measures. In addition, MFA does not prevent direct attacks on systems and data through vulnerabilities or malware.

[0045] In order to solve the existing technical problems, this specification is described in detail below in conjunction with specific embodiments.

[0046] See also Figure 1 , Figure 1 This is a scenario diagram of a safety protection system provided in this manual. Figure 1 As shown, the security protection system may include at least a client cluster and a service platform 100 .

[0047] The client cluster may include at least one client, such as Figure 1 As shown, it specifically includes client 1 corresponding to user 1, client 2 corresponding to user 2, ..., client n corresponding to user n, where n is an integer greater than 0.

[0048] Each client in the client cluster may be a terminal with communication function, including but not limited to: wearable device, handheld device, personal computer, tablet computer, vehicle-mounted device, smart phone, computing device or other processing device connected to wireless modem, etc. The terminal may be called different names in different networks, such as: user equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, cellular phone, cordless phone, personal digital assistant (PDA), electronic device in 5G network or future evolution network, etc.

[0049] The service platform 100 can be a separate target server device, such as a rack-mounted, blade, tower, or cabinet-mounted target server device, or a workstation, mainframe computer, or other hardware device with strong computing power; it can also be a target server cluster composed of multiple target servers, and the target servers in the service cluster can be composed in a symmetrical manner, wherein each target server has equivalent functions and status in the transaction link, and each target server can provide services to the outside independently, and the independent service can be understood as not requiring the assistance of other target servers.

[0050] In one or more embodiments of the present specification, the service platform 100 may establish a communication connection with at least one client in the client cluster, and complete data interaction during the security protection process based on the communication connection, such as online transaction data interaction. For example, the service platform 100 may perform security protection based on the security protection method of the present specification.

[0051] It should be noted that the service platform 100 and at least one client in the client cluster establish a communication connection through a network for interactive communication, wherein the network can be a wireless network or a wired network, the wireless network includes but is not limited to a cellular network, a wireless local area network, an infrared network or a Bluetooth network, and the wired network includes but is not limited to Ethernet, a universal serial bus (USB) or a controller local area network. In one or more embodiments of the specification, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data (such as a target compressed package) exchanged through a network. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec), etc. can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0052] The security protection system embodiments provided in this specification and the security protection methods in one or more embodiments belong to the same concept. The execution subject corresponding to the security protection method involved in one or more embodiments of the specification can be the above-mentioned service platform 100, specifically the target server; the execution subject corresponding to the security protection method involved in one or more embodiments of the specification can also be the terminal corresponding to the client, which is determined based on the actual application environment. The implementation process of the security protection system embodiment can be detailed in the following method embodiment, which will not be repeated here.

[0053] based on Figure 1 The scenario diagram is shown, and the security protection method provided by one or more embodiments of this specification is introduced in detail below.

[0054] See also Figure 2 , Figure 2A flowchart of a security protection method is provided for the embodiment of this specification. The method can be implemented by a computer program and can be run on a security protection device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application. The security protection device can be a target server.

[0055] Specifically, the security protection method is applied to the target server, and the security protection method includes:

[0056] S202: receiving a sensitive task request sent by a terminal; wherein the sensitive task request is sent by the terminal when a risk detection result is a security type, and the risk detection result is obtained after the terminal performs a security risk detection on the sensitive task request input by the user.

[0057] Among them, the user inputs a sensitive task request to the terminal, and then the terminal performs a security risk detection on the sensitive task request input by the user, and obtains a risk detection result corresponding to the sensitive task request. When the risk detection result corresponding to the sensitive task request is a security type, the terminal sends the sensitive task request to the target server. The sensitive task request can be a request for processing a sensitive task, and the sensitive task request can include sensitive task information, and the sensitive task information includes task type information and task data information corresponding to the sensitive task.

[0058] Exemplarily, when a user needs to process a task involving sensitive data, the user can create a sensitive task request on the terminal for the target task involving sensitive data. For example, the user can input the task type information and task data information corresponding to the target task into the terminal, and then the terminal creates and generates a sensitive task request for the target task based on the task type information and task data information.

[0059] After the sensitive task request is created and generated in the terminal, the sensitive task request is subjected to security risk detection, which includes but is not limited to vulnerability scanning, network traffic analysis, data verification, and permission access control detection. Among them, vulnerability scanning can use vulnerability scanning tools to scan sensitive task requests to detect security vulnerabilities in sensitive task requests; network traffic analysis can use network traffic analysis tools to analyze network data packets corresponding to sensitive task requests to determine whether there is abnormal traffic in the data traffic corresponding to network data packets; data verification is used to verify the data in the sensitive task request and the data in the sensitive task request entered by the user to ensure that the data has not been tampered with; permission access control detection is used to determine whether the user corresponding to the sensitive task request is authorized, and the authorized user can send sensitive task requests.

[0060] In addition, the security risk detection of sensitive task requests can also be performed based on the security detection model. The sensitive task requests are input into the security detection model, and the security detection model performs model processing on the sensitive task requests, thereby outputting the risk detection results corresponding to the sensitive task requests. The security detection model can be obtained based on the initial neural network model after training. First, a model training set is created. The model training set includes sample sensitive task requests. The sample sensitive task requests carry sample risk detection results. The sample sensitive task requests are input into the initial neural network model. The initial neural network model performs model processing on the sample sensitive task requests to obtain reference risk detection results. Then, a model loss function is created based on the parameters corresponding to the reference risk detection results and the sample risk detection results. The model loss value corresponding to the model loss function is determined based on the reference risk detection results and the sample risk detection results. Then, the model parameters of the initial neural network model are adjusted based on the model loss value until the model training for the initial neural network model is completed to obtain the security detection model.

[0061] After performing security risk detection on sensitive task requests, the risk detection results are obtained. When the risk detection result output by the security detection model is of a security type, it indicates that the risk detection result is of a security type; or when the vulnerability scan, network traffic analysis, data verification, and permission access control detection of sensitive task requests are all detected normally, the sensitive task request is a security request. At this time, the terminal can send a sensitive task request to the target server, and the target server receives the sensitive task request sent by the terminal. Here, the terminal can send a sensitive task request to the target server through an encrypted channel. The encrypted channel is an information transmission channel combined with encryption technology, which can ensure that even if the data is intercepted during the data transmission process, it cannot be interpreted by an unauthorized third party.

[0062] S204: Creating a target virtual environment based on the sensitive task request, and performing sensitive task processing in the target virtual environment in response to the sensitive task request.

[0063] After receiving the sensitive task request, the target server creates a target virtual environment isolated from the corresponding operating system in the target server based on the task type information and task data information in the sensitive task request. The target virtual environment is used to provide targeted software support and data support for the sensitive task corresponding to the sensitive task request. After the target virtual environment is created in the target server, the terminal corresponding to the sensitive task request is determined to have access to and operate the target virtual environment based on the sensitive task request, so that the terminal corresponding to the sensitive task request can remotely operate the target virtual environment in the target server to process the sensitive task.

[0064] The creation of the target virtual environment can be achieved through virtualization technology, which allows one or more virtual environments to be created and run on a single physical hardware system. Through virtualization technology, software can simulate hardware functions to create one or more virtual machines so that the virtual environment and the physical hardware system can each run as if on independent physical hardware. The physical hardware system and each virtual machine run their own corresponding operating system and application.

[0065] The embodiment of this specification provides a security protection method, wherein a target server receives a sensitive task request sent by a terminal; wherein the sensitive task request is sent by the terminal when the risk detection result is a security type, and the risk detection result is obtained after the terminal performs a security risk detection on the sensitive task request input by the user; a target virtual environment is created based on the sensitive task request, and sensitive task processing is performed in the target virtual environment in response to the sensitive task request. By performing a security risk detection on the sensitive task request input by the user at the terminal, the security of the sensitive task request is ensured on the terminal side, and then the target server receives the sensitive task request, and uses the sensitive task request to create a target virtual environment corresponding to the sensitive task request, thereby achieving mutual correspondence between the target virtual environment and the sensitive task request, and at the same time, the target virtual environment is isolated from the corresponding operating system in the target server, thereby ensuring the security of operations and data in the target virtual environment on the target server side, and finally, in the target virtual environment, corresponding sensitive task processing is performed in response to the sensitive task request, so that the leakage of sensitive data during the sensitive task processing in the target virtual environment is avoided through the dual data protection of the physically isolated terminal and the target server.

[0066] See also Figure 3 , Figure 3 The present invention provides a flow chart of creating a target virtual environment. Figure 3 As shown, in S204, creating a target virtual environment based on the sensitive task request includes:

[0067] S302: Determine that the sensitive task request corresponds to sensitive task information, and generate virtual environment configuration information for the sensitive task information.

[0068] Among them, after receiving the sensitive task request, the target server performs data parsing and processing on the sensitive task request to obtain sensitive task information corresponding to the sensitive task request, and then uses the sensitive task information to generate virtual environment configuration information corresponding to the target virtual environment.

[0069] The virtual environment configuration information includes virtual environment system configuration information, basic software configuration information and data interface configuration information corresponding to the target virtual environment. The virtual environment system configuration information may be configuration information of the virtual environment built for the sensitive task in the sensitive task information. Different sensitive tasks have different configuration requirements for the target virtual environment. Therefore, the virtual environment configuration information corresponds to the sensitive task request.

[0070] Exemplarily, the virtual environment system configuration information includes, but is not limited to, virtual resource allocation information, network configuration information, operating system configuration information, and monitoring and logging configuration information.

[0071] Virtual resource allocation information includes processor (CPU, Central Processing Unit) performance allocation information and storage configuration information. The CPU performance allocation information is the CPU core and its performance share allocated to the target virtual environment; the storage configuration information includes the memory capacity allocated to the target virtual environment and the size, type (such as solid state drive simulation or hard disk drive simulation), read and write performance, etc. of the virtual disk. Network configuration information includes network adapter setting information, Internet Protocol (IP, Internet Protocol) address and Domain Name System (DNS, Domain Name System) configuration information and firewall information. The network adapter setting information is used to configure the network adapter for the target virtual environment and determine the network connection mode corresponding to the network adapter, such as the bridge connection mode, the network address translation NAT (Network Address Translation) connection mode, etc. The operating system configuration information includes the operating system type information and the operating system version information, etc. The monitoring and logging configuration information includes the monitoring tool configuration information and the log configuration information. The monitoring tool configuration information is used to configure the monitoring tool in the target virtual environment. The monitoring tool is used to monitor the CPU, memory, disk and network usage in the target virtual environment. The log configuration information is used to configure the log.

[0072] The virtual environment system configuration information corresponds to the sensitive task request. When the sensitive task corresponding to the sensitive task request has high configuration requirements for the target virtual environment, the target server can determine the matching basic virtual environment configuration information for the sensitive task request. The basic virtual environment configuration information can be the minimum configuration that the target virtual environment can use to complete the sensitive task. The virtual environment configuration information is then flexibly configured based on the basic virtual environment configuration information. The configuration level of each configuration information in the virtual environment configuration information can be higher than or equal to the configuration level of the corresponding configuration information in the basic virtual environment configuration information.

[0073] The basic software configuration information may be the configuration information of the associated software corresponding to the sensitive task for the sensitive task request. For example, if the sensitive task is to process sensitive financial data, the basic software configuration information includes the configuration information of the financial processing software required for the sensitive financial data processing. The data interface configuration information may be the configuration information of the data interface corresponding to the data required when the sensitive task request corresponds to the sensitive task processing.

[0074] S304: Create a target virtual environment based on the virtual environment configuration information.

[0075] Among them, after obtaining the virtual environment configuration information, the target virtual environment is built in the target server using the virtual environment configuration information. The target virtual environment can be remotely controlled by the terminal so that the user corresponding to the terminal can remotely control the target virtual environment to perform sensitive task processing for sensitive task requests.

[0076] The embodiments provided in this specification determine virtual environment configuration information through sensitive task information corresponding to sensitive task requests, and then use the virtual environment configuration information to create a target virtual environment, so that the created target virtual environment can complete the sensitive task processing operations corresponding to the sensitive task requests. At the same time, the target virtual environment is isolated from the corresponding operating system in the target server, thereby ensuring the security of operations and data in the target virtual environment on the target server side.

[0077] See also Figure 4 , Figure 4 The present invention provides a flowchart of performing permission matching. Figure 4 As shown, before S302 generates virtual environment configuration information for sensitive task information, it also includes:

[0078] S402: Obtaining the user authority of the user from the terminal.

[0079] Among them, the target server sends a user permission query request of the user corresponding to the sensitive task request to the terminal corresponding to the sensitive task request. The terminal receives the user permission query request, queries the user permission of the user corresponding to the sensitive task request, and thus obtains the user permission of the user.

[0080] User permissions include data access permissions and operation permissions. Data access permissions refer to which data resources or information a user is allowed to access. For example, a user may have permissions to read files or view folders at a corresponding level. Different users may have different access levels, such as local data access permissions, specific data access permissions, global data access permissions, etc. Operation permissions refer to which operations a user performs on a system or application. For example, a user may have permissions to control functions such as adding, updating, or deleting at a corresponding level.

[0081] S404: Detect whether the sensitive task information is within the scope of the user's authority.

[0082] Among them, after obtaining the user's permissions, the target server uses the user permissions to match the sensitive task information and determines whether the sensitive task corresponding to the sensitive task information can be executed based on the user's permissions, that is, determines whether the sensitive task information is within the permission control scope of the user's permissions.

[0083] Exemplarily, when the sensitive task corresponding to the sensitive task information can be executed based on the user's user permissions, the sensitive task information is judged to be within the permission scope of the user permissions; when the sensitive task corresponding to the sensitive task information cannot be executed based on the user's user permissions, the sensitive task information is judged not to be within the permission scope of the user permissions. For example, when it is judged that the relevant technology of the sensitive task corresponding to the sensitive task information cannot be accessed based on the user permissions, it indicates that the user's user permissions cannot execute the sensitive task corresponding to the sensitive task information.

[0084] S406: When the sensitive task information is within the scope of the user's authority, a step of generating virtual environment configuration information for the sensitive task information is executed.

[0085] Among them, when the sensitive task information is within the permission control scope of the user's authority, it indicates that the sensitive task corresponding to the sensitive task information can be executed based on the user's user authority. At this time, the step of generating virtual environment configuration information for the sensitive task information in S302 is executed, and the target virtual environment is created based on the virtual environment configuration information, thereby ensuring that the target virtual environment corresponding to the sensitive task information is created on the premise that the user has the authority to execute the sensitive task corresponding to the sensitive task information; otherwise, when the user does not have the authority to execute the sensitive task corresponding to the sensitive task information, the virtual environment configuration information of the sensitive task information will not be generated, and the target virtual environment corresponding to the sensitive task information will not be created.

[0086] This instruction manual determines whether sensitive task information is within the scope of the user's permissions based on the user's user permissions. When the sensitive task information is within the scope of the user's permissions, it indicates that the sensitive task corresponding to the sensitive task information can be executed based on the user's user permissions, thereby ensuring that the target virtual environment corresponding to the sensitive task information is created on the premise that the user has the permissions to execute the sensitive task corresponding to the sensitive task information.

[0087] See also Figure 5 , Figure 5 The present specification provides a flow chart of generating virtual environment configuration information for sensitive task information. Figure 5As shown, in S302, determining that the sensitive task request corresponds to sensitive task information and generating virtual environment configuration information for the sensitive task information includes:

[0088] S502: Extract sensitive task information from the sensitive task request, where the sensitive task information includes task type information and task data information.

[0089] Among them, the sensitive task request includes task type information and task data information. The task type information includes information such as financial data processing type, process data processing type, personnel management data processing type, planning data processing type, and test processing type. The task type information corresponding to the sensitive task request may be, for example, a financial data processing type. The task data information may include the task data required when processing the sensitive task corresponding to the sensitive task request, and the storage location information of the task data. If the task type information corresponding to the sensitive task request is a financial data processing type, the task data information may be the target financial data and the storage location information of the target financial data.

[0090] S504: Determine virtual environment system configuration information and basic software configuration information for the task type information, and generate data interface configuration information for the task data corresponding to the task data information.

[0091] Among them, for the task type information, the virtual environment system configuration information and basic software configuration information required for processing the type of task corresponding to the task type information are determined; for the task data information, the task data required for processing the sensitive task corresponding to the sensitive task request and the storage location information of the task data are determined, and then the data interface configuration information is created based on the storage location information of the task data and the task data. The data interface configuration information is used to configure the target data interface, and the task data at the storage location corresponding to the storage location information can be accessed based on the target data interface.

[0092] S506: Determine virtual environment configuration information based on the virtual environment system configuration information, basic software configuration information, and data interface configuration information.

[0093] The virtual environment system configuration information, basic software configuration information and data interface configuration information are characterized, such as vectorized or matrixed, respectively, to obtain virtual environment system configuration features, basic software configuration features and data interface configuration features corresponding to the virtual environment system configuration information, basic software configuration information and data interface configuration information. Afterwards, feature splicing is performed on the virtual environment system configuration features, basic software configuration features and data interface configuration features to obtain virtual environment configuration information.

[0094] In the present specification, the sensitive task information in the sensitive task request is determined, and then the virtual environment system configuration information and basic software configuration information corresponding to the target virtual environment are determined based on the task type information in the sensitive task information, and the data interface configuration information corresponding to the task data is generated based on the task data information in the sensitive task information. Finally, the virtual environment configuration information is determined based on the virtual environment system configuration information, the basic software configuration information and the data interface configuration information, so that the corresponding target virtual environment can be configured based on the virtual environment configuration information.

[0095] See also Figure 6 , Figure 6 The present invention provides a flow chart of creating a target virtual environment. Figure 6 As shown, in S304, creating a target virtual environment based on the virtual environment configuration information includes:

[0096] S602: configuring the target virtual environment system based on the virtual environment system configuration information, configuring the target basic software in the target virtual environment system based on the basic software configuration information, and configuring the target data interface in the target virtual environment system based on the data interface configuration information.

[0097] The virtual environment system configuration information includes but is not limited to virtual resource allocation information, network configuration information, operating system configuration information, and monitoring and log recording configuration information. After obtaining the virtual environment system configuration information, virtual resources can be allocated to the target virtual environment based on the virtual resource allocation information, the corresponding operating system can be configured for the target virtual environment based on the operating system configuration information, and the monitoring tools and logs in the target virtual environment can be configured based on the monitoring and log recording configuration information, thereby obtaining the target virtual environment system.

[0098] After the target virtual environment system is configured, the target basic software is configured in the target virtual environment system based on the basic software configuration information. Since the basic software configuration information is the configuration information of the associated software corresponding to the sensitive task for the sensitive task request, the target basic software can be configured in the target virtual environment system based on the configuration information of the associated software corresponding to the sensitive task. At the same time, the data interface configuration information is the configuration information of the data interface corresponding to the data required when the sensitive task request corresponds to the sensitive task processing, so the target data interface can be configured in the target virtual environment system based on the data interface configuration information.

[0099] S604: Obtain a target virtual environment based on the target virtual environment system, target basic software and target data interface.

[0100] Among them, after obtaining the target virtual environment system, the target basic software is installed in the target virtual environment system, and the target data interface is configured in the target virtual environment system, so that the user can execute sensitive tasks corresponding to sensitive task requests based on the target basic software, and can call the task data corresponding to the sensitive tasks based on the target data interface.

[0101] The embodiments of this specification utilize virtual environment system configuration information to configure a target virtual environment system, basic software configuration information to configure target basic software in the target virtual environment system, and data interface configuration information to configure a target data interface in the target virtual environment system, thereby obtaining a target virtual environment based on the target virtual environment system, target basic software, and target data interface.

[0102] In one embodiment provided in this specification, performing sensitive task processing in response to the sensitive task request in the target virtual environment in S204 includes:

[0103] Based on the sensitive task request, the target data interface is called to obtain the task data, and the target basic software is controlled in the target virtual environment to perform the target data processing operation corresponding to the sensitive task on the task data.

[0104] Among them, after the target virtual environment is created, the target virtual environment in the target server can call the target data interface based on the sensitive task request to obtain the task data of the sensitive task corresponding to the sensitive task request. After that, the user can remotely control the target virtual environment in the target server to operate the target basic software to perform the target data processing operation corresponding to the sensitive task on the task data.

[0105] For example, in the process of calling the target data interface to obtain task data based on sensitive task requests, the task data can be obtained through an encrypted channel to avoid data leakage in the process of obtaining task data. After calling the target data interface to obtain task data based on sensitive task requests, the obtained task data can be stored in the target virtual environment for use in target data processing operations, or the task data can be called in real time when performing target data processing operations.

[0106] In the embodiments provided in the present specification, the target virtual environment in the target server calls the target data interface based on the sensitive task request to obtain the task data of the sensitive task corresponding to the sensitive task request, and then controls the target virtual environment in the target server to operate the target basic software to perform the target data processing operation corresponding to the sensitive task on the task data, thereby effectively avoiding the leakage of the task data while completing the target data processing operation.

[0107] See also Figure 7 , Figure 7 The present invention provides a flowchart of deleting a target virtual environment. Figure 7 As shown, after performing sensitive task processing in response to the sensitive task request in the target virtual environment in S204, the method further includes:

[0108] S702: After completing the sensitive task corresponding to the sensitive task request, obtain the execution work log generated by executing the sensitive task, and save the execution work log through the target server, and / or, when the execution duration of the sensitive task is greater than or equal to a preset time threshold, save the execution work log generated by executing the sensitive task through the target server.

[0109] Among them, after completing the sensitive task processing, if the user confirms the completion of the sensitive task in the target virtual environment, the sensitive task corresponding to the sensitive task request is completed in the target virtual environment. When performing the target data processing operation, the execution work log corresponding to the target data processing operation is recorded. After the target data processing operation is completed, the execution work log generated by the target virtual environment in the target server for the sensitive task, i.e., the target data processing operation, is obtained, and the execution work log is stored in the target server, so as to facilitate the query of historical sensitive tasks through the execution work log.

[0110] Of course, the maximum execution time of the sensitive task can also be pre-set, that is, the preset time threshold. When the execution time of the sensitive task is greater than or equal to the preset time threshold, the execution work log generated by executing the sensitive task is saved through the target server, so that the execution work log is saved in time to avoid the execution work log from being accidentally deleted during the deletion of the target virtual environment.

[0111] S704: Delete the task execution temporary file corresponding to the sensitive task and the task data corresponding to the sensitive task in the target virtual environment, and perform deletion processing on the target virtual environment.

[0112] Among them, after completing the sensitive task corresponding to the sensitive task request, the execution work log generated by executing the sensitive task is saved to the target server to avoid deleting the execution work log corresponding to the sensitive task during the deletion of the target virtual environment and its related data.

[0113] Afterwards, the task execution temporary files corresponding to the sensitive tasks are deleted in the target virtual environment, as well as the task data corresponding to the sensitive tasks. Finally, after the data deletion is completed, the target virtual environment is uninstalled and deleted in the target server. The task execution temporary files may be temporary files created by the target virtual environment to complete the task when executing the sensitive task. Since the relevant data in the target virtual environment is deleted by uninstalling and deleting the target virtual environment, the target virtual environment is deleted again after the relevant data in the target virtual environment is deleted, thereby effectively preventing malicious third parties from recovering the task execution temporary files and task data corresponding to the sensitive tasks.

[0114] See also Figure 8 , Figure 8 The present invention provides a flowchart of intercepting target data processing operations. Figure 8 As shown, the safety protection method also includes:

[0115] S802: Monitor target data processing operations corresponding to sensitive tasks.

[0116] Among them, in the target server, the target data processing operation corresponding to the sensitive task is monitored based on the virtualization management system to determine whether the target data processing operation is a risky operation type. When the target data processing operation is a safe operation type, the virtualization management system will not intercept the target data processing operation.

[0117] S804: When the target data processing operation is a risky operation type, intercept the target data processing operation.

[0118] Among them, when the target data processing operation is a risky operation type, it indicates that the target data processing operation may cause the sensitive task processing operation of the sensitive task or the task data corresponding to the sensitive task to be leaked. At this time, the target data processing operation can be intercepted by the virtualization management system to avoid the risk of data leakage.

[0119] See also Fig. 9 , Fig. 9 The present invention provides a schematic diagram of the architecture corresponding to a security protection method. Fig. 9As shown, in the embodiments provided in this specification, a monitoring system can be set in the terminal, and the monitoring system is used to monitor the user's operation on the terminal in real time, capture sensitive task requests, and encrypt and forward sensitive task requests. At the same time, the monitoring system will perform security risk detection on sensitive task requests to send sensitive task requests when the risk detection result corresponding to the sensitive task request is a security type. A virtualization management system can be set in the target server, and the virtualization management system is responsible for receiving and processing sensitive task requests. The virtualization management system dynamically creates an isolated target virtual environment based on sensitive task requests and their user permissions, and configures the target virtual environment, including the setting of security measures such as network isolation, device access restrictions, and the deployment of security monitoring tools. In addition, after the sensitive task is completed, the virtualization management system will automatically start to save the execution work log corresponding to the sensitive task, delete the task execution temporary files corresponding to the sensitive task and the task data corresponding to the sensitive task, and destroy the entire virtual environment to prevent data leakage or unauthorized access.

[0120] For example, when a user needs to process a task involving company secrets or sensitive personal data, the user can initiate a sensitive task request through a preset interface or application on a terminal, which can be a workstation or a personal computing device.

[0121] The monitoring system built into the terminal will capture employees' sensitive task requests in real time and forward the requests to the virtualization management system of the target server through an encrypted channel. During this process, the monitoring system will ensure that the risk detection results are safe.

[0122] After receiving the sensitive task request, the virtualization management system in the target server can dynamically create a new, isolated target virtual environment based on the content of the sensitive task request and the permissions of the user corresponding to the sensitive task request. This target virtual environment can be configured with necessary security control measures, such as disabling external network connections, limiting device mapping, ensuring the security updates of the operating system and applications in the target virtual environment, and deploying specific security monitoring tools.

[0123] The user can enter the target virtual environment through a secure connection at the terminal, and perform sensitive tasks corresponding to sensitive task requests therein. All sensitive task processing activities corresponding to the sensitive tasks are restricted to this environment, ensuring that the target data processing operation is intercepted when it is a risky operation type, ensuring that sensitive information will not be leaked to the terminal or external network.

[0124] After a sensitive task is completed or the scheduled end time is reached, the virtualization management system will automatically start the cleanup process. This includes saving the necessary execution work logs, completely deleting all task execution temporary files and task data in the target virtual environment, and then securely destroying the entire target virtual environment. This process helps ensure that sensitive information is not accessed by unauthorized personnel and provides a brand new target virtual environment without historical traces before the next task execution.

[0125] Specifically, assuming that financial personnel use terminals to perform sensitive financial statistics, the process based on the above security protection method can be as follows:

[0126] Task initiation: The financial staff recognizes that a task involving sensitive financial data needs to be performed. The financial staff can initiate a sensitive task request on the workstation through a specially designed interface or application. This sensitive task request will detail the nature of the task, i.e., task type information (e.g., monthly financial report preparation), task data information (e.g., sales, profits, etc.), related documents, and estimated working time, etc.; Request monitoring and forwarding: The built-in monitoring system of the financial staff's workstation detects this sensitive task request and automatically forwards the request to the virtualization management system on the company's corresponding target server through a secure, encrypted channel;

[0127] Create an isolated environment: After receiving a sensitive task request, the virtualization management system will quickly create a secure, isolated target virtual environment based on the financial personnel's permissions and the characteristics of the sensitive task request. The target virtual environment is configured with necessary security control measures, such as shutting down unnecessary network connections, limiting access to external devices, and ensuring that all software is the latest and most secure version;

[0128] Handling sensitive information: Financial personnel can enter the newly created isolated target virtual environment through a secure remote login method. In this environment, financial personnel can access the required financial data and use pre-installed financial software to perform statistical work. Since all operations are performed in an isolated environment, the security of sensitive information is guaranteed. At the same time, the virtualization management system monitors all activities to ensure compliance with security requirements;

[0129] Environment cleanup and data destruction: After the financial statistics task is completed, the financial staff submits the completion status, or the work reaches the scheduled end time, the virtualization management system will start the cleanup program. The system will automatically save the necessary execution operation logs, completely delete all temporary files and sensitive data in the virtual environment, and safely destroy the entire virtual environment. This step is used to ensure that after the task is completed, no trace of sensitive financial information is left, preventing any potential data leakage or unauthorized access in the future.

[0130] Based on the embodiments provided in this specification, some of the problems existing in the above-mentioned EDR, DLP and MFA technologies can be solved or partially solved.

[0131] First, in response to the defects of EDR technology, the embodiments of this specification perform sensitive tasks in an isolated target virtual environment, so that even unknown threats are difficult to affect the real operating system or task data in the terminal, because these attackers cannot jump from the target virtual environment to the target server. At the same time, the virtualization management system can centrally manage, automatically create and destroy the target virtual environment, and reduce dependence on professional security teams. In addition, the configuration of the target virtual environment can be preset and standardized to further simplify management. In addition, virtualization technology provides a physically isolated environment for sensitive task processing operations. Compared with EDR, which can only detect and respond, virtualization technology provides more proactive protection measures.

[0132] Secondly, in response to the defects of DLP technology, the data in the target virtualization environment will not interact directly with external systems. Therefore, even if the configuration corresponding to the DLP technology is defective, sensitive data will not be easily leaked. At the same time, the isolated target virtual environment in the embodiments of this specification reduces the opportunity for internal users to abuse their permissions, because sensitive data can only be accessed in the target virtual environment when necessary and is destroyed immediately after use. In addition, since sensitive task processing operations are performed independently in the target virtual environment, they will not interfere with normal data sharing and matter processes.

[0133] In addition, in response to the defects of MFA, in the embodiments of this specification, even if the user passes the verification of MFA technology, the virtualization technology can still ensure that the user's operations are limited to a secure target virtual environment. In this way, even authenticated users cannot operate beyond the scope of authority. Moreover, since sensitive operations are performed in an isolated target virtual environment, even if the system corresponding to the terminal is attacked, it will not affect the data and applications in the isolated target virtual environment.

[0134] See also Fig.10 , Fig.10 The present invention provides a flowchart of a security protection method applied to a terminal. The method can be implemented by a computer program and can be run on a device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application. Fig.10 As shown, the method is applied to a terminal, comprising:

[0135] S1002: Receive a sensitive task request input by a user, perform a security risk detection on the sensitive task request, and obtain a risk detection result.

[0136] S1004: When the risk detection result is a security type, the sensitive task request is sent to the target server, so that the target server creates a target virtual environment based on the sensitive task request, and performs sensitive task processing in the target virtual environment in response to the sensitive task request.

[0137] Among them, the relevant descriptions in S1002 and S1004 can refer to the relevant descriptions in S202 and S204, which will not be repeated here.

[0138] In the embodiments provided in this specification, the security protection method applied to the terminal may also include: sending user permissions corresponding to the user to the target server, so that when the target server determines that the sensitive task information corresponding to the sensitive task request is within the permission scope of the user permissions, it generates virtual environment configuration information for the sensitive task information.

[0139] For the relevant description of this embodiment, reference may be made to the relevant description of S402 to S406 , which will not be repeated here.

[0140] The following will be combined Fig.11 , the security protection device applied to the target server provided in this specification is introduced in detail. It should be noted that, Fig.11 The security devices shown are applied to the target server to implement this instruction Figures 1 to 9 For the convenience of explanation, only the parts related to this specification are shown. For the specific technical details not disclosed, please refer to this specification. Figures 1 to 9 The embodiment shown.

[0141] See also Fig.11 , Fig.11 1 is a schematic diagram of the structure of the security protection device applied to the target server in this specification. The security protection device 1 applied to the target server can be implemented as all or part of the target server through software, hardware or a combination of both. According to some embodiments, the security protection device 1 applied to the target server includes a receiving module 11 and a processing module 12, which are specifically used to:

[0142] The receiving module 11 is adapted to receive a sensitive task request sent by a terminal; wherein the sensitive task request is sent by the terminal when the risk detection result is a security type, and the risk detection result is obtained after the terminal performs a security risk detection on the sensitive task request input by the user;

[0143] The processing module 12 is adapted to create a target virtual environment based on the sensitive task request, and perform sensitive task processing in the target virtual environment in response to the sensitive task request.

[0144] Optionally, the processing module 12 includes:

[0145] A determination unit, adapted to determine that a sensitive task request corresponds to sensitive task information, and generate virtual environment configuration information for the sensitive task information;

[0146] The creation unit is adapted to create a target virtual environment based on the virtual environment configuration information.

[0147] Optionally, the determining unit further includes:

[0148] An acquisition subunit, adapted to acquire user rights of a user from a terminal;

[0149] A detection subunit, adapted to detect whether sensitive task information is within the scope of authority controlled by the user authority;

[0150] The execution subunit is adapted to execute the step of generating virtual environment configuration information for sensitive task information when the sensitive task information is within the scope of authority controlled by the user authority.

[0151] Optionally, the determining unit further includes:

[0152] An extraction subunit, adapted to extract sensitive task information in a sensitive task request, wherein the sensitive task information includes task type information and task data information;

[0153] A determination subunit adapted to determine virtual environment system configuration information and basic software configuration information for task type information, and to generate data interface configuration information for task data corresponding to task data information;

[0154] The virtual environment configuration information determining subunit is adapted to determine the virtual environment configuration information based on the virtual environment system configuration information, the basic software configuration information and the data interface configuration information.

[0155] Optionally, the creation unit includes:

[0156] A configuration subunit adapted to configure a target virtual environment system based on the virtual environment system configuration information, configure target basic software in the target virtual environment system based on the basic software configuration information, and configure a target data interface in the target virtual environment system based on the data interface configuration information;

[0157] The target virtual environment determination subunit is adapted to obtain the target virtual environment based on the target virtual environment system, the target basic software and the target data interface.

[0158] Optionally, the processing module 12 is further adapted to call a target data interface to obtain task data based on a sensitive task request, and control the target basic software in the target virtual environment to perform a target data processing operation corresponding to the sensitive task on the task data.

[0159] Optionally, the processing module 12 further includes:

[0160] a storage unit adapted to obtain an execution work log generated by executing the sensitive task after completing the sensitive task corresponding to the sensitive task request, and save the execution work log through a target server, and / or, when the execution time of the sensitive task is greater than or equal to a preset time threshold, save the execution work log generated by executing the sensitive task through the target server;

[0161] The deletion unit is adapted to delete the task execution temporary files corresponding to the sensitive tasks and the task data corresponding to the sensitive tasks in the target virtual environment, and perform deletion processing on the target virtual environment.

[0162] Optionally, the security protection device 1 applied to the target server further includes:

[0163] A monitoring module, suitable for monitoring target data processing operations corresponding to sensitive tasks;

[0164] The interception module is adapted to intercept the target data processing operation when the target data processing operation is a risky operation type.

[0165] It should be noted that the security protection device applied to the target server provided in the above embodiment only uses the division of the above functional modules as an example when executing the security protection method applied to the target server. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the security protection device provided in the above embodiment belongs to the same concept as the security protection method embodiment. The implementation process is detailed in the method embodiment and will not be repeated here.

[0166] The following will be combined Fig.12 , the security protection device applied to the target server provided in this specification is introduced in detail. It should be noted that, Fig.12 The security devices shown are applied to the target server to implement this instruction Fig.10 For the convenience of explanation, only the parts related to this specification are shown. For the specific technical details not disclosed, please refer to this specification. Fig.10 The embodiment shown.

[0167] See also Fig.12 , Fig.12 2 is a schematic diagram of the structure of the security protection device applied to the terminal in this specification. The security protection device 2 applied to the terminal can be implemented as all or part of the target server through software, hardware or a combination of both. According to some embodiments, the security protection device 2 applied to the terminal includes a detection module 21 and a sending module 22, which are specifically used to:

[0168] The detection module 21 is adapted to receive a sensitive task request input by a user, perform security risk detection on the sensitive task request, and obtain a risk detection result;

[0169] The sending module 22 is adapted to send the sensitive task request to the target server when the risk detection result is of a safe type, so that the target server creates a target virtual environment based on the sensitive task request and performs sensitive task processing in the target virtual environment in response to the sensitive task request.

[0170] Optionally, the security protection device 2 applied to the terminal also includes a permission sending module, which is suitable for sending user permissions corresponding to the user to the target server, so that when the target server determines that the sensitive task information corresponding to the sensitive task request is within the permission control scope of the user permissions, it generates virtual environment configuration information for the sensitive task information.

[0171] It should be noted that the security protection device applied to the terminal provided in the above embodiment only uses the division of the above functional modules as an example when executing the security protection method applied to the terminal. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the security protection device provided in the above embodiment belongs to the same concept as the security protection method embodiment. The implementation process is detailed in the method embodiment and will not be repeated here.

[0172] The above serial numbers in this specification are for description only and do not represent the advantages or disadvantages of the embodiments.

[0173] The present specification also provides a computer storage medium, which can store multiple instructions, which are suitable for being loaded and executed by a processor as described above. Figures 1 to 9 The security protection method applied to the target server in the embodiment shown in the figure can be specifically executed by referring to Figures 1 to 9 The specific description of the illustrated embodiment will not be repeated here.

[0174] The present specification also provides a computer storage medium, which can store multiple instructions, which are suitable for being loaded and executed by a processor as described above. Fig.10 The security protection method applied to the terminal in the embodiment shown in the figure can be specifically executed by referring to Fig.10 The specific description of the illustrated embodiment will not be repeated here.

[0175] The present specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figures 1 to 9The security protection method applied to the target server in the embodiment shown in the figure can be specifically executed by referring to Figures 1 to 9 The specific description of the illustrated embodiment will not be repeated here.

[0176] The present specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Fig.10 The security protection method applied to the terminal in the embodiment shown in the figure can be specifically executed by referring to Fig.10 The specific description of the illustrated embodiment will not be repeated here.

[0177] Please refer to Fig.13 , Fig.13 The electronic device in this specification may include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 may be connected via the bus 150.

[0178] The processor 110 may include one or more processing cores. The processor 110 uses various interfaces and lines to connect various parts of the entire electronic device, and executes various functions and processes data of the electronic device 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Optionally, the processor 110 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented separately through a communication chip.

[0179] The memory 120 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable storage medium. The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The operating system may be an Android system, including a system deeply developed based on the Android system, an IOS system developed by Apple, including a system deeply developed based on the IOS system or other systems. The data storage area may also store data created by the electronic device during use, such as a phone book, audio and video data, chat record data, etc.

[0180] See also Fig.14 As shown, Fig.14 This is a structural block diagram of the operating system and user space provided in this specification. The memory 120 can be divided into an operating system space and a user space, the operating system runs in the operating system space, and the native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve good operating results, the operating system allocates corresponding system resources to different third-party applications. However, different application scenarios in the same third-party application also have different requirements for system resources. For example, in the local resource loading scenario, the third-party application has higher requirements for disk reading speed; in the animation rendering scenario, the third-party application has higher requirements for GPU performance. The operating system and the third-party application are independent of each other, and the operating system often cannot perceive the current application scenario of the third-party application in a timely manner, resulting in the operating system being unable to perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0181] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to open up data communication between third-party applications and the operating system so that the operating system can obtain the current scenario information of third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.

[0182] Fig.15 Provided for this manual Fig.14 The architecture diagram of the Android operating system in FIG. 1 is a diagram showing an operating system as the Android system. The programs and data stored in the memory 120 are as follows: Fig.15 As shown, the memory 120 may store a Linux kernel layer 320, a system runtime library layer 340, an application framework layer 360 and an application layer 380, wherein the Linux kernel layer 320, the system runtime library layer 340 and the application framework layer 360 belong to the operating system space, and the application layer 380 belongs to the user space. The Linux kernel layer 320 provides underlying drivers for various hardware of electronic devices, such as display drivers, audio drivers, camera drivers, Bluetooth drivers, Wi-Fi drivers, power management, etc. The system runtime library layer 340 provides the main feature support for the Android system through some C / C++ libraries. For example, the SQLite library provides database support, the OpenGL / ES library provides 3D drawing support, and the Webkit library provides browser kernel support, etc. The Android runtime library (Androidruntime) is also provided in the system runtime library layer 340, which mainly provides some core libraries that allow developers to use the Java language to write Android applications. The application framework layer 360 provides various APIs that may be used when building applications. Developers can also use these APIs to build their own applications, such as activity management, window management, view management, notification management, content provider, package management, call management, resource management, and location management. At least one application runs in the application layer 380. These applications can be native applications that come with the operating system, such as contact applications, text messaging applications, clock applications, camera applications, etc.; they can also be third-party applications developed by third-party developers, such as game applications, instant messaging applications, photo beautification applications, etc.

[0183] Fig.16 Provided for this manual Fig.14 FIG. 1 is an architecture diagram of the IOS operating system, taking the operating system as the IOS system as an example, the programs and data stored in the memory 120 are as follows: Fig.16As shown, the IOS system includes: a core operating system layer 420 (CoreOS layer), a core service layer 440 (Core Services layer), a media layer 460 (Media layer), and a touchable layer 480 (Cocoa Touch Layer). The core operating system layer 420 includes the operating system kernel, drivers, and underlying program frameworks, which provide functions closer to the hardware for use by the program framework located in the core service layer 440. The core service layer 440 provides system services and / or program frameworks required by the application, such as the foundation framework, account framework, advertising framework, data storage framework, network connection framework, geographic location framework, motion framework, etc. The media layer 460 provides audio-visual interfaces for the application, such as graphics and image related interfaces, audio technology related interfaces, video technology related interfaces, and wireless playback (AirPlay) interfaces for audio and video transmission technologies. The touchable layer 480 provides various commonly used interface-related frameworks for application development, and the touchable layer 480 is responsible for the user's touch interaction operations on the electronic device. For example, local notification service, remote push service, advertising framework, game tool framework, message user interface (UI) framework, user interface UIKit framework, map framework, etc.

[0184] exist Fig.16 Among the frameworks shown, the frameworks related to most applications include but are not limited to: the basic framework in the core service layer 440 and the UIKit framework in the touchable layer 480. The basic framework provides many basic object classes and data types, provides the most basic system services for all applications, and has nothing to do with UI. The classes provided by the UIKit framework are basic UI class libraries for creating touch-based user interfaces. iOS applications can provide UIs based on the UIKit framework, so it provides the basic architecture of applications for building user interfaces, drawing, processing and user interaction events, responding to gestures, etc.

[0185] Among them, the method and principle of implementing data communication between third-party applications and the operating system in the IOS system can be referred to the Android system, and this manual will not go into details here.

[0186] Among them, the input device 130 is used to receive input instructions or data, and the input device 130 includes but is not limited to a keyboard, a mouse, a camera, a microphone or a touch device. The output device 140 is used to output instructions or data, and the output device 140 includes but is not limited to a display device and a speaker. In one example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are touch screens, which are used to receive touch operations on or near them by users using any suitable objects such as fingers and touch pens, and to display the user interfaces of various applications. The touch screen is usually set on the front panel of the electronic device. The touch screen can be designed as a full screen, a curved screen or a special-shaped screen. The touch screen can also be designed as a combination of a full screen and a curved screen, or a combination of a special-shaped screen and a curved screen, which is not limited in this specification.

[0187] In addition, those skilled in the art will appreciate that the structure of the electronic device shown in the above drawings does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, the electronic device also includes a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (WiFi) module, a power supply, a Bluetooth module and other components, which will not be described in detail here.

[0188] In this specification, the execution subject of each step may be the electronic device described above. Optionally, the execution subject of each step is the operating system of the electronic device. The operating system may be an Android system, an IOS system, or other operating systems, which is not limited in this specification.

[0189] The electronic device of this specification may also be equipped with a display device, which may be any device capable of realizing a display function, such as a cathode ray tube display (CR), a light-emitting diode display (LED), an electronic ink screen, a liquid crystal display (LCD), a plasma display panel (PDP), etc. The user may use the display device on the electronic device 101 to view displayed text, images, videos and other information. The electronic device may be a smart phone, a tablet computer, a gaming device, an AR (Augmented Reality) device, a car, a data storage device, an audio playback device, a video playback device, a notebook, a desktop computing device, a wearable device such as an electronic watch, an electronic glasses, an electronic helmet, an electronic bracelet, an electronic necklace, electronic clothing and other devices.

[0190] exist Fig.13 In the electronic device shown, the electronic device may be a target server, and the processor 110 may be used to call the security protection program applied to the target server stored in the memory 120, and specifically perform the following operations:

[0191] Receive sensitive task requests sent by the terminal; wherein the sensitive task request is sent by the terminal when the risk detection result is a security type, and the risk detection result is obtained after the terminal performs a security risk detection on the sensitive task request input by the user;

[0192] A target virtual environment is created based on the sensitive task request, and sensitive task processing is performed in the target virtual environment in response to the sensitive task request.

[0193] Optionally, when the processor 110 executes the creation of a target virtual environment based on a sensitive task request, the processor 110 specifically executes:

[0194] Determine that the sensitive task request corresponds to the sensitive task information, and generate virtual environment configuration information for the sensitive task information;

[0195] Create a target virtual environment based on the virtual environment configuration information.

[0196] Optionally, before executing generating virtual environment configuration information for sensitive task information, the processor 110 further specifically executes:

[0197] Obtain the user's user rights from the terminal;

[0198] Check whether sensitive task information is within the scope of user permissions;

[0199] When the sensitive task information is within the scope of the user's authority, a step of generating virtual environment configuration information for the sensitive task information is performed.

[0200] Optionally, when the processor 110 determines that the sensitive task request corresponds to the sensitive task information and generates the virtual environment configuration information for the sensitive task information, specifically executes:

[0201] Extract sensitive task information from sensitive task requests, where the sensitive task information includes task type information and task data information;

[0202] Determine virtual environment system configuration information and basic software configuration information for task type information, and generate data interface configuration information for task data corresponding to task data information;

[0203] The virtual environment configuration information is determined based on the virtual environment system configuration information, the basic software configuration information and the data interface configuration information.

[0204] Optionally, when the processor 110 creates a target virtual environment based on the virtual environment configuration information, specifically:

[0205] Configure the target virtual environment system based on the virtual environment system configuration information, configure the target basic software in the target virtual environment system based on the basic software configuration information, and configure the target data interface in the target virtual environment system based on the data interface configuration information;

[0206] A target virtual environment is obtained based on a target virtual environment system, target basic software and a target data interface.

[0207] Optionally, when the processor 110 performs sensitive task processing in response to a sensitive task request in the target virtual environment, specifically performs:

[0208] Based on the sensitive task request, the target data interface is called to obtain the task data, and the target basic software is controlled in the target virtual environment to perform the target data processing operation corresponding to the sensitive task on the task data.

[0209] Optionally, after executing the sensitive task processing in the target virtual environment in response to the sensitive task request, the processor 110 further specifically executes:

[0210] After completing the sensitive task corresponding to the sensitive task request, obtaining the execution work log generated by executing the sensitive task, and saving the execution work log through the target server, and / or, when the execution time of the sensitive task is greater than or equal to a preset time threshold, saving the execution work log generated by executing the sensitive task through the target server;

[0211] The task execution temporary files corresponding to the sensitive tasks and the task data corresponding to the sensitive tasks are deleted in the target virtual environment, and the target virtual environment is deleted.

[0212] Optionally, the processor 110 is further adapted to execute:

[0213] Monitor target data processing operations corresponding to sensitive tasks;

[0214] When the target data processing operation is a risky operation type, the target data processing operation is intercepted.

[0215] exist Fig.13 In the electronic device shown, the electronic device may be a terminal, and the processor 110 may be used to call the security protection program applied to the terminal stored in the memory 120, and specifically perform the following operations:

[0216] Receive sensitive task requests input by users, perform security risk detection on the sensitive task requests, and obtain risk detection results;

[0217] When the risk detection result is a security type, the sensitive task request is sent to the target server, so that the target server creates a target virtual environment based on the sensitive task request, and performs sensitive task processing in the target virtual environment in response to the sensitive task request.

[0218] Optionally, the processor 110 is also suitable for executing: sending user permissions corresponding to the user to the target server, so that when the target server determines that the sensitive task information corresponding to the sensitive task request is within the permission control scope of the user permissions, it generates virtual environment configuration information for the sensitive task information.

[0219] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0220] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the object features, interactive behavior features and user information involved in this specification are all obtained with full authorization.

[0221] The above disclosure is only the preferred embodiment of this specification, which certainly cannot be used to limit the scope of rights of this specification. Therefore, equivalent changes made according to the claims of this specification are still within the scope covered by this specification.

Claims

1. A security protection method, applied to a target server, comprising: Receiving a sensitive task request sent by a terminal; wherein the sensitive task request is sent by the terminal when a risk detection result is a security type, and the risk detection result is obtained after the terminal performs a security risk detection on the sensitive task request input by the user; A target virtual environment is created based on the sensitive task request, and sensitive task processing is performed in the target virtual environment in response to the sensitive task request.

2. The security protection method according to claim 1, wherein creating a target virtual environment based on the sensitive task request comprises: Determining that the sensitive task request corresponds to sensitive task information, and generating virtual environment configuration information for the sensitive task information; A target virtual environment is created based on the virtual environment configuration information.

3. The security protection method according to claim 2, before generating the virtual environment configuration information for the sensitive task information, further comprising: Obtaining user authority of the user from the terminal; Detecting whether the sensitive task information is within the scope of the user's authority; When the sensitive task information is within the scope of the user's authority, the step of generating virtual environment configuration information for the sensitive task information is performed.

4. The security protection method according to claim 2, wherein determining that the sensitive task request corresponds to sensitive task information and generating virtual environment configuration information for the sensitive task information comprises: Extracting sensitive task information from the sensitive task request, wherein the sensitive task information includes task type information and task data information; Determine virtual environment system configuration information and basic software configuration information for the task type information, and generate data interface configuration information for task data corresponding to the task data information; The virtual environment configuration information is determined based on the virtual environment system configuration information, the basic software configuration information and the data interface configuration information.

5. The security protection method according to claim 4, wherein the step of creating a target virtual environment based on the virtual environment configuration information comprises: Configure the target virtual environment system based on the virtual environment system configuration information, configure the target basic software in the target virtual environment system based on the basic software configuration information, and configure the target data interface in the target virtual environment system based on the data interface configuration information; The target virtual environment is obtained based on the target virtual environment system, the target basic software and the target data interface.

6. The security protection method according to claim 5, wherein the step of performing sensitive task processing in response to the sensitive task request in the target virtual environment comprises: Based on the sensitive task request, the target data interface is called to obtain task data, and in the target virtual environment, the target basic software is controlled to perform a target data processing operation corresponding to the sensitive task on the task data.

7. The security protection method according to claim 1, after performing sensitive task processing in response to the sensitive task request in the target virtual environment, further comprising: After completing the sensitive task corresponding to the sensitive task request, obtaining an execution work log generated by executing the sensitive task, and saving the execution work log through the target server, and / or, when the execution duration of the sensitive task is greater than or equal to a preset time threshold, saving the execution work log generated by executing the sensitive task through the target server; The task execution temporary file corresponding to the sensitive task and the task data corresponding to the sensitive task are deleted in the target virtual environment, and the target virtual environment is deleted.

8. The security protection method according to claim 1, further comprising: Monitoring target data processing operations corresponding to the sensitive tasks; When the target data processing operation is a risky operation type, the target data processing operation is intercepted.

9. A security protection method, applied to a terminal, comprising: Receive a sensitive task request input by a user, perform a security risk detection on the sensitive task request, and obtain a risk detection result; When the risk detection result is a safety type, the sensitive task request is sent to a target server, so that the target server creates a target virtual environment based on the sensitive task request, and performs sensitive task processing in the target virtual environment in response to the sensitive task request.

10. The method according to claim 9, further comprising: The user rights corresponding to the user are sent to the target server, so that when the target server determines that the sensitive task information corresponding to the sensitive task request is within the permission control scope of the user rights, virtual environment configuration information for the sensitive task information is generated.

11. A security protection device, applied to a target server, comprising: A receiving module, adapted to receive a sensitive task request sent by a terminal; wherein the sensitive task request is sent by the terminal when a risk detection result is a security type, and the risk detection result is obtained after the terminal performs a security risk detection on the sensitive task request input by the user; The processing module is adapted to create a target virtual environment based on the sensitive task request, and perform sensitive task processing in the target virtual environment in response to the sensitive task request.

12. A security protection device, applied to a terminal, comprising: A detection module, adapted to receive a sensitive task request input by a user, perform security risk detection on the sensitive task request, and obtain a risk detection result; The sending module is adapted to send the sensitive task request to the target server when the risk detection result is of a safe type, so that the target server creates a target virtual environment based on the sensitive task request and performs sensitive task processing in the target virtual environment in response to the sensitive task request.

13. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps of any one of claims 1 to 8 or 9 to 10.

14. A computer program product, the computer program product storing at least one instruction, wherein the at least one instruction is loaded by a processor and executes the method steps according to any one of claims 1 to 8 or 9 to 10.

15. An electronic device, comprising: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 8 or 9 to 10.

Images