Information security computing power classification method, device, equipment and storage medium

Abstract

The present invention discloses an information security computing power classification method, device, equipment and storage medium, which relates to the field of information security technology. The method includes classifying the security level of security services based on the location of keys used by applications, and creating an acquisition API for obtaining the security level of security services; loading security service drivers and security service devices for realizing each security level capability, and obtaining the security level of security services through acquisition APIs; and using corresponding security service devices based on the obtained security level of security services. The present application simplifies the understanding of security capabilities by classifying the security levels of security services, and the classification only considers the location of keys used by applications, thereby providing security computing power capabilities for different applications, which can not only simplify the work of software developers, but also make full use of each security computing power unit to achieve a balance between security and performance.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically to an information security computing power classification method, device, equipment and storage medium. Background Art

[0002] Information security computing power classification refers to the simple classification of the security level of each type of security computing power service by the location of key use, and provides a unified security computing power level acquisition API (Application Programming Interface) and security classification services through software methods to help system and software developers achieve simple and efficient security design. On the one hand, it can enable software developers to have the ability to use security computing power simply and efficiently, and on the other hand, it can integrate security design into the entire system and software development cycle to make up for the repeated investment caused by subsequent redesign.

[0003] In current computer systems, encryption and decryption services, as the basic services of security services, are implemented in different software and hardware ways in the system. Some rely on complete software algorithms, some rely on an independent encryption and decryption module, and some require an independent hardware unit. However, the security needs of applications are not exactly the same. Some applications only need to be used in the memory exclusively owned by the application, while some application keys need to be isolated from the application's memory, and some applications require independent hardware units to access the keys. Therefore, how to efficiently and optimally match the application's needs with the capabilities of security services is a problem that needs to be solved.

[0004] In the Android system, applications obtain keys through KeyStore, and the key protection method is determined by KeyMaster (an open source project for secure key management). Currently, KeyMaster supports software, TEE (Trusted execution environment) and Strongbox (an open source tool that provides public key encryption). The specific method is selected during static compilation. For example, most systems will use TEE as the default configuration. If you switch to another method, you need to manually configure the properties or recompile. In this solution, the different security requirements of application software are not taken into account, and different security level services cannot be supported at the same time, and application developers cannot distinguish between services of different security levels.

[0005] Regarding the current security computing power classification: one is that it does not support the acquisition of security levels at all. For example, openssl (an open source software library package) uses keys in user space. If an application needs to protect the keys, it needs to design a key management system, while the linux (an operating system) crypto (a cryptographic tool library) subsystem puts the keys in kernel memory for use. That is, this type of system hardly considers or gives little consideration to the overall security capabilities of the system; the other is to support static acquisition of security levels, setting the system's security level to the default capability, so that the entire system is at the highest level or at the lowest level.

[0006] Some of the above two solutions do not take into account the hardware characteristics and security characteristics of the system itself. This makes it difficult for developers to adopt appropriate solutions for their own security applications during the application development process. They need to be reinforced again together with security designers or after review by security personnel. Others cannot flexibly use different security levels, resulting in over-design, that is, all applications are run at the highest security level, wasting computing resources. Summary of the invention

[0007] The present application provides an information security computing power classification method, apparatus, device and storage medium. By classifying the security levels of security services, and the classification only considers the location where the application uses the key, the understanding of security capabilities is simplified, thereby providing security computing power capabilities for different applications, which can not only simplify the work of software developers, but also make full use of each security computing power unit to achieve a balance between security and performance.

[0008] In a first aspect, an embodiment of the present application provides an information security computing power classification method, the information security computing power classification method comprising:

[0009] Based on the location where the key is used by the application, the security level of the security service is classified, and an acquisition API for obtaining the security level of the security service is created;

[0010] Load the security service driver and security service device to realize the capabilities of each security level, and obtain the security level of the security service through the acquisition API;

[0011] Based on the security level of the acquired security service, the corresponding security service device is used.

[0012] In combination with the first aspect, in one implementation,

[0013] The security level of the security service is classified, specifically, based on the location of the key used by the application, the security level is classified in a five-level classification method;

[0014] The five-level classification method is specifically based on the non-secure memory in the chip, the virtual software environment in the chip, the virtual hardware SMC call in the chip, the independent encryption and decryption unit hardware interface outside the chip, and the encryption and decryption engine in the chip.

[0015] In combination with the first aspect, in one implementation,

[0016] The virtual hardware includes Secure Memory of TrustZone;

[0017] The independent encryption and decryption unit includes a key of an independent encryption and decryption machine, a U shield, a PCIE encryption card, and an HSM module;

[0018] The encryption and decryption engine includes an independent hardware engine.

[0019] In combination with the first aspect, in one implementation,

[0020] The security level of the security service is classified, specifically, based on the location of the key used by the application, the security level is classified in a three-level classification method;

[0021] The three-level classification method is specifically: classification of software isolation types based on the non-secure memory in the chip or based on the virtual software environment in the chip, classification of subsystem isolation types based on the virtual hardware SMC call in the chip or based on the hardware interface of the independent encryption and decryption unit outside the chip, and classification of system isolation types based on the encryption and decryption engine in the chip.

[0022] In conjunction with the first aspect, in one implementation, the creation of an acquisition API for acquiring a security level of a security service specifically includes:

[0023] Creating a driver layer for providing security level capabilities, the driver layer includes a driver for implementing security services of various hardware or software, and an acquisition API for acquiring the security level of the security service;

[0024] Create an API for accessing the driver's device nodes and obtaining the security capabilities of each device node;

[0025] A service layer is created to uniformly manage the security capabilities of the entire operating system. The security capabilities of each device node are uniformly provided through registration, subscription, and publishing.

[0026] In conjunction with the first aspect, in one implementation, the loading of the security service driver and the security service device for implementing each security level capability specifically includes:

[0027] When the operating system is initialized, the driver layer is used to load security service drivers and security service devices with security capabilities at each security level;

[0028] Start the security service manager to register, subscribe and publish security services of different security levels;

[0029] Initialize the security service device, each security service device calls the registration interface to register the security capability of the security level into the security service manager and publish it to the outside.

[0030] In combination with the first aspect, in one implementation, using a corresponding security service device based on the acquired security level of the security service specifically includes:

[0031] The application discovers the security level of all security service devices through the discovery mechanism, and matches the corresponding security service devices through the security service manager;

[0032] The application subscribes to the security service of the security service device, so that the application uses the corresponding security service device according to its own security level.

[0033] In a second aspect, an embodiment of the present application provides an information security computing power classification device, the information security computing power classification device comprising:

[0034] A classification module, which is used to classify the security level of the security service based on the location where the key is used by the application, and create an acquisition API for obtaining the security level of the security service;

[0035] A loading module, which is used to load the security service driver and security service device for implementing each security level capability, and obtain the security level of the security service through the acquisition API;

[0036] The execution module is used to use the corresponding security service device based on the security level of the acquired security service.

[0037] In a third aspect, an embodiment of the present application provides an information security computing power grading device, which includes a processor, a memory, and an information security computing power grading program stored in the memory and executable by the processor, wherein when the information security computing power grading program is executed by the processor, the steps of the above-mentioned information security computing power grading method are implemented.

[0038] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which an information security computing power grading program is stored. When the information security computing power grading program is executed by a processor, the steps of the above-mentioned information security computing power grading method are implemented.

[0039] The beneficial effects brought by the technical solution provided in the embodiments of the present application include:

[0040] By classifying the security levels of security services based on the location where applications use keys, creating an acquisition API for obtaining the security levels of security services, and then loading security service drivers and security service devices to implement capabilities at each security level, and obtaining the security level of the security service through the acquisition API, and then using the corresponding security service device based on the obtained security level of the security service, the security levels of security services are classified, and the classification only considers the location where applications use keys, which simplifies the understanding of security capabilities, thereby providing secure computing power capabilities for different applications, which can not only simplify the work of software developers, but also make full use of each secure computing power unit to achieve a balance between security and performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a flowchart of the information security computing power classification method for this application;

[0042] Figure 2 is a schematic diagram of the key location;

[0043] Figure 3 This is a functional module diagram of the information security computing power classification device of this application;

[0044] Figure 4 This is a schematic diagram of the hardware structure of the information security computing power grading device for this application. DETAILED DESCRIPTION

[0045] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0047] On the first aspect, the embodiments of the present application provide an information security computing power classification method, which simplifies the understanding of security capabilities by classifying the security levels of security computing power (security services), and the classification only considers the location where the application uses the key, thereby providing security computing power capabilities for different applications. It can not only simplify the work of software developers, but also make full use of each security computing power unit to achieve a balance between security and performance, so that application developers have a basic understanding of the overall security capabilities, and only minimal improvements are required during product security reviews.

[0048] In one embodiment, referring to Figure 1 , Figure 1 This is a flowchart of the information security computing power classification method for this application. Figure 1 As shown in the figure, the information security computing power classification method includes:

[0049] S1: Classify the security level of security services based on the location where the application uses the key, and create an acquisition API for obtaining the security level of security services;

[0050] Furthermore, in this application, the security level of the security service is classified. Specifically, based on the location of the key used by the application, a five-level classification method is used to classify the security level. The five-level classification method is specifically based on the non-secure memory in the chip, based on the virtual software environment in the chip, based on the virtual hardware SMC call in the chip, based on the hardware interface of the independent encryption and decryption unit outside the chip, and based on the encryption and decryption engine in the chip. That is, based on the location of the key used by the application, the security level is classified into five types. For details, see Figure 2 As shown, for the location of the key, label 1 corresponds to the non-secure memory in the chip, which includes the encryption and decryption service software / library and the kernel library; label 2 corresponds to the virtual software environment in the chip, which includes Container and virtual machine; label 3 corresponds to the call of the virtual hardware SMC (System Management Controller) in the chip, and the virtual hardware includes the Secure Memory of TrustZone (a security technology); label 4 corresponds to the hardware interface of the independent encryption and decryption unit outside the chip, and the independent encryption and decryption unit includes the key of the independent encryption and decryption machine, U shield (online banking security guard), PCIE (speed interface bus) encryption card, HSM module (hardware security module); label 5 corresponds to the encryption and decryption engine in the chip, and the encryption and decryption engine includes an independent hardware engine, such as an on-chip HSM; thereby realizing the classification of the security level of the application's security service (security computing power) according to the location where the application uses the key. It should be noted that the applications in this application include secure display (for digital rights management), secure communication (such as SSL), etc. Figure 2 In the specification, DDR stands for Double Data Rate Synchronous Dynamic Random Access Memory, SOC stands for System on Chip, ETH PHY stands for Ethernet Physical Layer, and SRAM stands for Static Random Access Memory.

[0051] Furthermore, in a possible implementation, the security level of the security service is classified. Specifically, based on the location of the key used by the application, the security level is classified in a three-level classification method; the three-level classification method is specifically based on the classification of software isolation types based on the non-secure memory in the chip or based on the virtual software environment in the chip, the classification of subsystem isolation types based on the virtual hardware SMC call in the chip or based on the hardware interface of the independent encryption and decryption unit outside the chip, and the classification of system isolation types based on the encryption and decryption engine in the chip. That is, based on the location of the key used by the application, the security level is classified into three types.

[0052] Coming Soon Figure 2 The non-secure memory in the chip and the virtual software environment in the chip are divided into software isolation types; Figure 2 The on-chip virtual hardware SMC call and the off-chip independent encryption and decryption unit hardware interface are divided into system isolation types; Figure 2 The on-chip encryption and decryption engine in is divided into system isolation types.

[0053] Further, in one embodiment, an acquisition API for acquiring the security level of a security service is created, specifically including:

[0054] S101: creating a driver layer for providing security level capability, the driver layer including a driver for implementing security services of various hardware or software, and an acquisition API for acquiring the security level of the security service; that is, a driver layer for providing security level capability;

[0055] S102: Creating an API for accessing the device nodes of the driver and acquiring the security capabilities of each device node;

[0056] S103: Create a service layer for unified management of the security capabilities of the entire operating system. The security capabilities of each device node are uniformly provided through registration, subscription, and publishing, so as to provide service capabilities within the operating system, between OS (Operating System), within the domain, and across chips.

[0057] S2: Load the security service driver and security service device for implementing each security level capability, and obtain the security level of the security service through the acquisition API;

[0058] Furthermore, in one embodiment, loading of a security service driver and a security service device for realizing each security level capability specifically includes:

[0059] S201: When the operating system is initialized, the driver layer realizes the loading of security service drivers and security service devices of security capabilities of each security level; that is, the recording operation is performed;

[0060] S202: starting the security service manager to register, subscribe to and publish security services of different security levels; that is, starting the security service manager;

[0061] S203: Initialize the security service device, each security service device calls the registration interface to register the security capability of the security level in the security service manager and publish it to the outside, that is, perform registration and publishing operations.

[0062] S3: Based on the obtained security level of the security service, use the corresponding security service equipment.

[0063] Further, in one embodiment, based on the obtained security level of the security service, using the corresponding security service device specifically includes:

[0064] S301: The application discovers the security levels of all security service devices through a discovery mechanism, and matches the corresponding security service devices through a security service manager;

[0065] S302: The application subscribes to the security service of the security service device, so that the application uses the corresponding security service device according to its own security level.

[0066] This application classifies the security level of each security service according to the location where the key is used; provides a unified security level acquisition API for the upper-level framework or application, including a coarse-grained three-level classification and a fine-grained five-level classification method, and provides an acquisition API with the ability to obtain security levels; provides security classification services, including registration, discovery and broadcasting, to facilitate application use.

[0067] The information security computing power classification method of the embodiment of the present application classifies the security level of the security service based on the location of the key used by the application, creates an acquisition API for obtaining the security level of the security service, and then loads the security service driver and security service device for realizing the capabilities of each security level, and obtains the security level of the security service through the acquisition API, and then uses the corresponding security service device based on the obtained security level of the security service. By classifying the security level of the security service, and the classification only considers the location of the key used by the application, the understanding of security capabilities is simplified, thereby providing security computing power capabilities for different applications, which can not only simplify the work of software developers, but also make full use of each security computing power unit to achieve a balance between security and performance.

[0068] In a second aspect, an embodiment of the present application also provides an information security computing power grading device.

[0069] In one embodiment, referring to Figure 3 , Figure 3This is a functional module diagram of the information security computing power classification device of this application. Figure 3 As shown, the information security computing power classification device includes: a classification module, a loading module, and an execution module.

[0070] The classification module is used to classify the security level of the security service based on the location of the key used by the application, and to create an acquisition API for obtaining the security level of the security service; the loading module is used to load the security service driver and security service device for implementing the capabilities of each security level, and to obtain the security level of the security service through the acquisition API; the execution module is used to use the corresponding security service device based on the obtained security level of the security service.

[0071] Among them, the functional implementation of each module in the above-mentioned information security computing power grading device corresponds to the various steps in the above-mentioned information security computing power grading method embodiment, and its functions and implementation processes will not be repeated here one by one.

[0072] On the third aspect, an embodiment of the present application provides an information security computing power grading device, which may be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0073] Reference Figure 4 , Figure 4 The hardware structure diagram of the information security computing power grading device involved in the embodiment of the present application is shown in FIG. In the embodiment of the present application, the information security computing power grading device may include a processor, a memory, a communication interface, and a communication bus.

[0074] The communication bus may be of any type and is used to interconnect the processor, the memory, and the communication interface.

[0075] Communication interfaces include input / output (I / O) interfaces, physical interfaces, and logical interfaces, which are used to interconnect devices within the information security computing power grading device, as well as interfaces used to interconnect the information security computing power grading device with other devices (such as other computing devices or user devices). Physical interfaces can be Ethernet interfaces, optical fiber interfaces, ATM interfaces, etc.; user devices can be display screens (Display), keyboards (Keyboard), etc.

[0076] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0077] The processor may be a general-purpose processor, and the general-purpose processor may call the information security computing power classification program stored in the memory and execute the information security computing power classification method provided in the embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the information security computing power classification program is called may refer to the various embodiments of the information security computing power classification method of the present application, and will not be repeated here.

[0078] Those skilled in the art will understand that Figure 4 The hardware structure shown in the figure does not constitute a limitation on the present application, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0079] In a fourth aspect, an embodiment of the present application also provides a computer-readable storage medium.

[0080] An information security computing power grading program is stored on the computer-readable storage medium of the present application, wherein when the information security computing power grading program is executed by a processor, the steps of the information security computing power grading method as described above are implemented.

[0081] Among them, the method implemented when the information security computing power classification program is executed can refer to the various embodiments of the information security computing power classification method of this application, and will not be repeated here.

[0082] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0083] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0084] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0085] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0086] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0087] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0088] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for grading information security computing power, characterized in that: The information security computing power classification method includes: Based on the location where the key is used by the application, the security level of the security service is classified, and an acquisition API for obtaining the security level of the security service is created; Load the security service driver and security service device to realize the capabilities of each security level, and obtain the security level of the security service through the acquisition API; Based on the security level of the obtained security service, use the corresponding security service equipment; in, The security level of the security service is classified, specifically, based on the location of the key used by the application, the security level is classified in a five-level classification method; The five-level classification method is specifically based on the non-secure memory in the chip, the virtual software environment in the chip, the virtual hardware SMC call in the chip, the independent encryption and decryption unit hardware interface outside the chip, and the encryption and decryption engine in the chip.

2. The information security computing power classification method according to claim 1, characterized in that: The virtual hardware includes Secure Memory of TrustZone; The independent encryption and decryption unit includes a key of an independent encryption and decryption machine, a U shield, a PCIE encryption card, and an HSM module; The encryption and decryption engine includes an independent hardware engine.

3. The information security computing power classification method according to claim 1, characterized in that: The security level of the security service is classified, specifically, based on the location of the key used by the application, the security level is classified in a three-level classification method; The three-level classification method is specifically: classification of software isolation types based on the non-secure memory in the chip or based on the virtual software environment in the chip, classification of subsystem isolation types based on the virtual hardware SMC call in the chip or based on the hardware interface of the independent encryption and decryption unit outside the chip, and classification of system isolation types based on the encryption and decryption engine in the chip.

4. The information security computing power classification method according to claim 1, characterized in that: The creation of an acquisition API for acquiring the security level of a security service specifically includes: Creating a driver layer for providing security level capabilities, the driver layer includes a driver for implementing security services of various hardware or software, and an acquisition API for acquiring the security level of the security service; Create an API for accessing the driver's device nodes and obtaining the security capabilities of each device node; A service layer is created to uniformly manage the security capabilities of the entire operating system. The security capabilities of each device node are uniformly provided through registration, subscription, and publishing.

5. The information security computing power classification method according to claim 4, characterized in that: The loading of the security service driver and security service device for realizing each security level capability specifically includes: When the operating system is initialized, the driver layer is used to load security service drivers and security service devices with security capabilities at each security level; Start the security service manager to register, subscribe and publish security services of different security levels; Initialize the security service device, each security service device calls the registration interface to register the security capability of the security level into the security service manager and publish it to the outside.

6. The information security computing power classification method according to claim 5, characterized in that: The use of the corresponding security service device based on the obtained security level of the security service specifically includes: The application discovers the security level of all security service devices through the discovery mechanism, and matches the corresponding security service devices through the security service manager; The application subscribes to the security service of the security service device, so that the application uses the corresponding security service device according to its own security level.

7. An information security computing power classification device, characterized in that: The information security computing power classification device comprises: A classification module, which is used to classify the security level of the security service based on the location where the key is used by the application, and create an acquisition API for obtaining the security level of the security service; A loading module, which is used to load the security service driver and security service device for implementing each security level capability, and obtain the security level of the security service through the acquisition API; An execution module, which is used to use a corresponding security service device based on the security level of the acquired security service; in, The security level of the security service is classified, specifically, based on the location of the key used by the application, the security level is classified in a five-level classification method; The five-level classification method is specifically based on the non-secure memory in the chip, the virtual software environment in the chip, the virtual hardware SMC call in the chip, the independent encryption and decryption unit hardware interface outside the chip, and the encryption and decryption engine in the chip.

8. An information security computing power classification device, characterized in that: The information security computing power grading device includes a processor, a memory, and an information security computing power grading program stored in the memory and executable by the processor. When the information security computing power grading program is executed by the processor, the steps of the information security computing power grading method as described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an information security computing power classification program, wherein when the information security computing power classification program is executed by the processor, the steps of the information security computing power classification method according to any one of claims 1 to 6 are implemented.

Images