Software protection system and method, storage medium, equipment and program product

Abstract

The invention provides a software protection system and method, a storage medium, equipment and a program product, and the system comprises a security intermediary component which is used for carrying out the local authentication of a corresponding software component according to a preset security strategy, determining the credibility of the software component according to a local authentication result, and sending the credibility to the software component; the security intermediary component and the software component are configured in target equipment; the far-end security management center is used for acquiring operation information of the security intermediary component and performing remote authentication on the security intermediary component according to the operation information; and judging whether the security intermediary component is credible or not according to a remote authentication result, and updating the credibility of the security intermediary component based on a judgment result.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a software protection system, method, storage medium, device and program product. Background Art

[0002] The potential information security risks of software data in computer devices cannot be ignored. Due to the complexity of the network environment and the existence of unknown vulnerabilities, design flaws or improper configuration, the software components used to maintain the above software data may become the main breakthrough point for hackers to attack the device at any time and lose their security and trustworthiness. Therefore, how to effectively establish a security and trustworthiness mechanism for software components is a major problem that the industry urgently needs to solve. Summary of the invention

[0003] In view of this, the present specification provides a software protection system, method, storage medium, device and program product to solve the deficiencies in the related art.

[0004] Specifically, this specification is implemented through the following technical solutions:

[0005] According to a first aspect of an embodiment of this specification, a software protection system is provided, including:

[0006] A security intermediary component, used to perform local authentication on the corresponding software component according to a preset security policy, and determine the credibility of the software component according to the local authentication result, wherein the security intermediary component and the software component are configured in the target device;

[0007] The remote security management center is used to obtain the operation information of the security intermediary component and remotely authenticate the security intermediary component based on the operation information; determine whether the security intermediary component is trustworthy based on the remote authentication result, and update the credibility of the security intermediary component based on the determination result.

[0008] According to a second aspect of an embodiment of this specification, a software protection method is provided, which is applied to a security intermediary component configured in a target device, including:

[0009] Performing local authentication on a corresponding software component according to a preset security policy, the software component being configured in the target device;

[0010] Determining the trustworthiness of the software component based on the local authentication result;

[0011] The operation information of the security intermediary component is obtained by a remote security management center for remote authentication of the security intermediary component. The result of the remote authentication is used to determine whether the security intermediary component is trustworthy, and the credibility of the security intermediary component is updated based on the determination result.

[0012] According to a third aspect of the embodiments of this specification, a software protection method is provided, which is applied to a remote security management center, including:

[0013] Acquiring operation information of a security intermediary component, the security intermediary component being used to locally authenticate a corresponding software component according to a preset security policy and determining the credibility of the software component according to a local authentication result, the security intermediary component and the software component being configured in a target device;

[0014] The security intermediary component is remotely authenticated according to the operation information, and whether the security intermediary component is credible is determined according to the remote authentication result, and the credibility of the security intermediary component is updated based on the determination result.

[0015] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in the second aspect or the third aspect are implemented.

[0016] According to the fifth aspect of the embodiments of this specification, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method described in the second aspect or the third aspect are implemented.

[0017] According to a fifth aspect of the embodiments of this specification, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the steps of the method described in the second aspect or the third aspect.

[0018] In the technical solution provided in this specification, a security intermediary component is introduced. The security intermediary component and the software component are configured together in the target device. Even during the operation of the target device, the security intermediary component can locally authenticate the corresponding software component according to the preset security policy, and determine the trustworthiness of the software component according to the local authentication result, so as to ensure the trustworthiness of the software component in real time. The authentication process does not involve operations with huge overhead such as verifying hashes, and the performance threshold for the target device is low. At the same time, the remote security management center can obtain the operation information of the security intermediary component, and remotely authenticate the security intermediary component based on it, and can judge whether the security intermediary component is trustworthy according to the remote authentication result, and update the trustworthiness of the security intermediary component based on the judgment result. Among them, since a one-way trustworthiness determination relationship is formed between the remote security management center and the security intermediary component, and between the security intermediary component and the software component, the remote security management center can ensure the security of the security intermediary component by updating the trustworthiness, so that the software component determined by the security intermediary component is also safe and trustworthy.

[0019] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification, and for ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0021] Figure 1 is a schematic diagram of the architecture of a software protection system shown in an exemplary embodiment of this specification;

[0022] Figure 2 It is a schematic diagram of a target device building a trusted chain during the startup process, shown in an exemplary embodiment of this specification;

[0023] Figure 3 It is a flowchart of protecting software during operation of a target device, shown in an exemplary embodiment of this specification;

[0024] Figure 4 is a schematic diagram of a verification application program shown in an exemplary embodiment of this specification;

[0025] Figure 5 is a flowchart of a software protection method shown in an exemplary embodiment of this specification;

[0026] Figure 6 is a flowchart of another software protection method shown in an exemplary embodiment of this specification;

[0027] Figure 7 is a schematic diagram of the structure of an electronic device shown in an exemplary embodiment of this specification;

[0028] Figure 8 is a schematic diagram of the structure of a software protection device shown in an exemplary embodiment of this specification;

[0029] Fig. 9 It is a schematic diagram of the structure of another software protection device shown in an exemplary embodiment of this specification. DETAILED DESCRIPTION

[0030] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification.

[0031] It should be noted that in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, the single step described in this specification may be decomposed into multiple steps for description in other embodiments; and the multiple steps described in this specification may also be combined into a single step for description in other embodiments. It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0032] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0033] In the relevant technology, computer systems can be divided into three basic levels according to their structure: hardware, system software and application software. Hardware is the physical part of the computer system, including the processor (Central Processing Unit, CPU), memory, hard disk drive, graphics card, motherboard, power supply and other peripheral devices, such as keyboard, mouse and display; system software is software that manages and controls computer hardware and provides an operating environment for application software. It includes operating systems, such as Windows, Linux or macOS, device drivers, system utilities and other software that provide services for hardware; application software is software designed to meet specific user needs. They run on system software. These software include office software (such as word processing, spreadsheets), Internet browsers, media players, games and other professional software, such as graphic design, programming development tools, etc. Among them, the above-mentioned system software and the above-mentioned application software are one of the parts that are most vulnerable to malicious attacks in actual application scenarios. In order to ensure the security of their data, the trusted computing (TC) technology can be introduced. One of the core goals of this technology is to ensure the integrity of the operating system in the system software and the application in the application software, so as to ensure that the operating system or application runs in the trusted state expected by the design goal. It should be noted that so-called trust is not the same as security, but it is the basis of security, because the schemes and strategies that ensure data security can only further ensure security purposes if they are run in a trusted environment that has not been tampered with. In other words, by ensuring the integrity of the operating system and application programs, it can be ensured that the above-mentioned computer system uses the correct software stack and can promptly detect changes in the software stack after being attacked. In short, by adding trusted verification, the possibility of being attacked due to the use of unknown or tampered operating systems or applications can be effectively reduced.

[0034] The above-mentioned trusted computing technology can be implemented by technical means of measurement and verification. Among them, measurement is to collect the state of the detected application or operating system, and verification is to compare the measurement result with the preset reference value to see whether it is consistent. If it is consistent, it means that the trusted verification is passed, otherwise it means that the verification fails. In the actual implementation process, the above-mentioned technical means need to rely on the trusted root (Root of Trust) to be implemented, and the trusted root refers to a trusted foundation or starting point in a computer system, which can be used to ensure the security and reliability of the entire system. In computer equipment, a trusted hardware chip is usually used as a trusted root. According to the difference between the chip and the trusted software stack (Trusted Software Stack) running on it, the above-mentioned trusted hardware can be divided into the following multiple standards: Trusted Platform Module (Trusted Platform Module, TPM), Trusted Cryptography Module (Trusted Cryptography Module, TCM) and Trusted Platform Control Module (Trusted Platform Control Module, TPCM), considering that the relevant technology of TPM is more mature and has a higher degree of commercialization, so this specification is unified based on TPM in the following discussion to implement the above-mentioned trusted computing technology.

[0035] TPM is an independent hardware security module located outside the CPU that can resist software attacks and control access. It can be used to store tamper-proof data and provides cryptographic operations such as encryption, decryption, and signing. In trusted computing technology, TPM can usually be used to record the measurement values ​​of relevant components during the computer system startup process, such as the hash value of the corresponding component image. Specifically, before loading the next component, each component can calculate the component to be loaded, generate a hash value of a fixed length, and store it in the TPM. The TPM can compare the stored hash value with the preset hash value. If the two match, it can be considered that the corresponding component has not been tampered with and maintains its original integrity. This is repeated until the last component is loaded; or, after loading, a corresponding measurement report can be generated and handed over to a remote verification party that maintains a preset hash value to prove whether the current device is in a trusted state, thereby completely constructing the corresponding static chain of trust. In short, the essence of a static chain of trust is a continuous verification chain that is used to ensure that each link in the entire startup process can be tracked and verified for its security and integrity.

[0036] However, the above static trusted chain still has the following problems:

[0037] 1. Lack of runtime protection. The static trust chain establishes a trusted state when the system starts, but it does not involve continuous monitoring and protection when the operating system is running. Therefore, once the operating system is loaded, the role of the static trust chain has ended. When the system is running, new security threats may appear, such as malware injection, system call tampering or abuse of permissions, etc. It is difficult for the static trust chain to provide targeted protection.

[0038] 2. Limited to the operating system level. In actual scenarios, the applications running on computer systems are often numerous and diverse, and they are often updated and changed. This makes it very difficult to establish and maintain a trusted chain for each application. The process may consume a lot of computing resources and storage space, which is impractical for TPMs with generally weak performance, especially in resource-constrained environments such as mobile devices or embedded systems. As for the operating system level itself, it has provided a certain degree of abstraction and control, so it is relatively easy to manage and implement the trusted chain at this level.

[0039] Of course, in order to solve the first problem, even if we ignore the objective factors of TPM itself and try to perform dynamic measurement and verification directly at runtime to achieve runtime protection, it is not achievable. The reason is that applying the hash verification method to runtime will generate huge resource overhead, which will seriously hinder the normal operation of the computer system.

[0040] Regarding the second point, in order to protect the application level, the following security mechanisms can be used: mechanisms deployed outside the application, such as application firewalls, and mechanisms integrated into the application, such as Runtime Application Self-Protection (RASP). These mechanisms each design protection methods for different attack characteristics and attack targets. However, both are designed based on known public vulnerability risks and lack effective protection capabilities in terms of protecting against zero-day vulnerabilities and bypassing attacks. In addition, without the support of the above-mentioned trusted hardware and the above-mentioned trusted chain, the integrity of the above-mentioned mechanisms themselves may be completely compromised by attackers, and their reliability is limited.

[0041] Based on this, this specification proposes the following technical solutions to solve the above problems.

[0042] This specification provides a software protection system. Figure 1 FIG. 1 is a schematic diagram of the architecture of a software protection system shown in an exemplary embodiment of this specification. Figure 1 As shown, the system includes a target device 11, a network 12 and a remote security management center 13.

[0043] On the basis of the original software components, the target device 11 adds a security intermediary component, which can interact with the remote security management center 13 through the network 12, so that the remote security management center 13 can determine whether the security intermediary component 11 is credible. In the case that the security intermediary component is credible, the security intermediary component can perform local authentication on the corresponding software component according to the preset security policy, and then determine whether the software component is credible. Among them, the interaction between the security intermediary component and the remote security management center 13 and the software component can occur when the system is running, and the security intermediary component can be used as a credible intermediate component to verify the credible state of the software component, and the verification process does not need to involve traditional verification hashes. The target device 11 can be a physical server containing an independent host, or a virtual server carried by a host cluster. In addition, the user can also use electronic devices such as the following types as the target device 11: mobile phones, tablet devices, laptops, PDAs (Personal Digital Assistants), wearable devices (such as smart glasses, smart watches, etc.), and one or more embodiments of this specification are not limited to this.

[0044] The above-mentioned remote security management center 13 refers to a management platform that does not run on the target device 11 but is connected through the Internet. The system administrator in the platform can be the user of the target device 11 itself or a third-party cloud service provider. The platform can judge the trust status of the security intermediary component of the target device through remote authentication, and can monitor and adjust the operation of the target device in the above-mentioned software protection system by obtaining operation information, issuing security policies, etc. With the direct participation of the above-mentioned administrator, the above-mentioned security management center 13 can be defaulted as a device that is always trusted in this specification.

[0045] Figure 2 is a schematic diagram of an exemplary embodiment of this specification showing a target device building a trusted chain during the startup process, such as Figure 2 As shown, the target device of the software protection system of this specification includes the basic input / output system (BIOS) or similar firmware startup code, BIOS boot block (BIOS BootBlock), boot loader (Bootloader), operating system, application program and other conventional system components, wherein the operating system and application program can be collectively referred to as software components. In addition, Figure 2 It also includes an operating system layer security intermediary component corresponding to the operating system, and an application layer security intermediary component corresponding to the application program, wherein the operating system layer security intermediary component and the application layer security intermediary component can be collectively referred to as the security intermediary components corresponding to the respective software components.

[0046] In addition, according to different requirements for the trusted chain, the specific correspondence between the security intermediary component and the software component can also be changed. Assuming that the above-mentioned software component can include an operating system and / or an application, then when the software component only includes an operating system, the security intermediary component includes a system security intermediary component corresponding to the operating system. In the case where the software component only includes an application, the security intermediary component includes a program security intermediary component corresponding to the application. In the case where the software component includes an operating system and an application, the security intermediary component is a shared security intermediary component corresponding to the operating system and the application; or, the security intermediary component includes a system security intermediary component corresponding to the operating system, and a program security intermediary component corresponding to the application.

[0047] During the boot process of the target device, according to the loading order of BIOS, BIOS boot block, boot loader operating system and application components, each component can measure the subsequent components to be loaded step by step (corresponding to Figure 2 The image of the corresponding component is hashed, and its corresponding hash value can be stored in the platform configuration register (PCR) in the TPM as a metric for verification. The hash value of each component in the target device is stored in a preset memory, that is, the above register (corresponding to Figure 2 ), and all are verified, an initial trusted chain can be constructed; wherein, the security intermediary component is implemented based on the process running in the environment where the corresponding software component is located, so it can be regarded as being in the same environment as the corresponding software component and being loaded together with the software component. At this point, compared with the traditional static trusted chain, the above initial trusted chain still extends the components involved to the application level.

[0048] Among them, the process of verifying the above hash value can be executed by the remote security management center. Specifically, the above remote security management center can actively or passively obtain the hash value in the above memory through the network, and determine whether the obtained hash value is consistent with the expected hash value preset in the remote security management center; if the judgment result is yes, the credibility of the corresponding component in the above trusted chain can be initialized. If the judgment result is no, the administrator of the remote security management center can be prompted that there is an abnormality in the startup process of the target device, such as tampering with the corresponding component, so as to locate the target device in time and handle the corresponding abnormality.

[0049] In this specification, an initial credibility can be defined for each component that has passed verification. The credibility is an abstract variable that measures the trusted state of the component during operation. Since the probability of the component being hacked by an attacker will gradually increase during operation, the above credibility can gradually decrease with the increase of running time. In other words, by judging the credibility, it is possible to quickly and effectively determine whether the corresponding component is credible. For example, the credibility is a continuous value between 0 and 1, 1 is credible, 0 is untrustworthy, and 0.5 is the credibility threshold. If the credibility of the component is lower than the credibility threshold, it can be determined that the component is untrustworthy. If the credibility of the component is higher than the credibility threshold, it can be determined that the component is credible. At the same time, considering that the code volume and logic complexity of different components are different, the corresponding credibility decline rate will also be different, which makes the credibility of components that are more vulnerable to attack decline faster. In addition, each component can set a different credibility threshold, and divide the credible state and the untrustworthy state by the threshold, thereby increasing the freedom of the credibility in the setting process.

[0050] Furthermore, each component in the trusted chain can be regarded as a node. As mentioned above, during operation, the credibility will decrease over time. Therefore, the rate at which the credibility decreases over time is called the credibility decrease rate. α The credibility drop rate is λ α Indicates (λ α ≥0). Since the credibility decline rate is related to the complexity of the program, the module components used, the operating environment and other factors, it reflects the probability of the component being attacked and damaged. The initial credibility of the trusted chain node established after startup is expressed as C α , the corresponding establishment time is t α Then the real-time credibility of the component corresponding to any node can be calculated:

[0051]

[0052] For the concept division of credible and uncredible, there is the above credibility threshold, denoted as θ. α (t)≥θ, then the node N α The corresponding component is credible, otherwise node N α The corresponding component is untrusted.

[0053] It can be understood by those skilled in the art that the underlying components such as the BIOS boot block, BIOS and boot loader are components that work only in the boot phase and no longer run in the system operation phase. Even if they are attacked, they can be discovered during the next boot process. Therefore, the credibility degradation rate of the above-mentioned underlying components can be set to 0 during the system operation, that is, the components are always trusted, or the above-mentioned underlying components can be directly removed from the above-mentioned initial trusted chain to shorten the trusted chain and improve the resource utilization of TPM.

[0054] In addition, the above process can be executed during the operation process of the target device, and is not limited to the startup process. Therefore, the above initial trusted chain can also be called a dynamic trusted chain suitable for runtime.

[0055] Combine the following Figure 3 , the verification process of the trusted state between the remote security management center and the security intermediary component, and between the security intermediary component and the corresponding software component is described. Figure 3 As shown, the target device uses the remote security management center as a remote trusted source and as a trusted status monitoring platform. The verification process is as follows:

[0056] Step S302: The security broker component stores the hash value of its own operation information in the TPM.

[0057] In one embodiment, the security intermediary component can maintain corresponding operation information, wherein the operation information may include: the security intermediary component's own status information and configuration information, such as its own call stack, control flow, global variables, configuration files, and security policies for corresponding software components; interaction verification information with corresponding software components; file data and process information within the environment, etc.

[0058] Among them, the above-mentioned important files can correspond to different contents according to the differences between the system security intermediary component and the program security intermediary component: for the system security intermediary component, it is in the same environment as the operating system, and the file data in its environment refers to the binary executable files or library files required by the file system in the environment, as well as the configuration files including the system configuration; for the application security intermediary component, it is in the same environment as the application, and the file data in its environment refers to the configuration files of the application itself. As for the process information representing the scanning status of other processes, the abnormal processes or malicious processes in the corresponding environment can be determined by comparison and screening.

[0059] Whenever new operation information is generated, its generated content can be appended to the end of the log file where the original operation information is located, and the hash value of the new operation information or the entire log file is stored in the TPM register. When the security intermediary component includes both the system security intermediary component and the program security intermediary component, the two components can independently maintain the log file and the TPM register value (i.e., the hash value stored in the register). When the security intermediary component is a shared security intermediary component corresponding to the above operating system and the above application, the component can jointly maintain the log file and TPM register value corresponding to the operating system and the above application, which is not limited in this specification.

[0060] Step S304: the remote security management center obtains the operation information of the security broker component.

[0061] In one embodiment, the remote security management center can obtain the operation information of the security intermediary component so that the remote security management center can subsequently perform remote authentication on it. The remote security management center can request the security intermediary component to send the operation information by sending a request, or the security intermediary component can actively send the operation information to the remote security management center when the preset conditions are met, which is not limited in this specification.

[0062] In addition, there is no absolute execution order between step S302 and step S304, and the specific situation can be determined and adjusted according to actual needs.

[0063] Step S306: The remote security management center obtains the TPM registration information.

[0064] In one embodiment, after the TPM obtains the hash value of the operation information of the security intermediary component, it can generate a target signature of the hash value based on a preset private key, and send the target signature together with the corresponding hash value as the registration information to the remote security management center. Specifically, the above registration information can use a data structure called Quote generated by a preset API, which contains the selected register value and the signature of the data by the TPM using the private key contained therein. This signature can prevent attackers from forging the TPM register value. Among them, similar to the above-mentioned operation information sending method, the generation and sending of the registration information can also be triggered by a remote authentication request sent by the remote security management center to the TPM, or triggered by the preset rules of the TPM, which is not limited in this specification.

[0065] After the remote security management center obtains the registered information, it can verify the target signature according to the public key publicly provided by the trusted platform module in the network, and match the hash value with the operation information; if the target signature verification is passed and the hash value matches the operation information, it can determine whether the security intermediary component is trustworthy based on the operation information. Among them, the verification of the target signature is used to verify the authenticity of the above-mentioned TPM register value, and the hash matching is used to verify the authenticity of the operation information to prevent the forgery or tampering of the operation information; if the verification fails, it means that the above-mentioned registered information is not generated by the real TPM, and if the match fails, it means that the operation information provided by the security intermediary component may be forged or tampered.

[0066] For real, untampered operation information, the remote security management center can identify abnormal operation status through manual review or analysis tools, and then find out whether the security intermediary component itself has been attacked, resulting in integrity damage, such as abnormal information in the configuration file of the security intermediary component itself, pre-marked abnormal processes scanned in other processes, etc. If no abnormality is found, the trustworthiness of the security intermediary component can be reset to the maximum value, that is, the time t in the above formula 1 is reset. α .

[0067] It will be understood by those skilled in the art that, as mentioned above, although the above-mentioned operation information may also include information of the software component corresponding to the security intermediary component, the remote security management center is still unable to adjust the credibility of the software component based on the operation information. The reason is that there must be an interval between the time when the security intermediary component obtains the information of the software component and the time when the remote security management center obtains the operation information of the security intermediary component. This interval will cause information lag, thereby affecting the remote security management center's judgment on the credibility of the software component. Therefore, the operation information can at most serve as one of the bases for the remote security management center to infer the credibility of the software component, but cannot serve as key evidence.

[0068] The above steps S302 to S306 are a remote authentication process between the remote security management center and the security broker component, and the purpose is to ensure that the security broker component can still be in a trusted state after running for a period of time.

[0069] Step S308: The remote security management center sends the security policy to the security broker component.

[0070] In one embodiment, when the remote security management center determines that the security intermediary component is trustworthy through remote authentication, a security policy can be issued to the security intermediary component so that the security intermediary component can perform local authentication on the corresponding software component. On the contrary, if the remote security management center determines that the security intermediary component is not trustworthy, then there is no need to issue the above security policy. After all, even if the security intermediary component performs local authentication based on a valid security policy when it is not trustworthy, its authentication result is not trustworthy. Among them, the so-called security policy can include a judgment strategy for abnormal behavior of the operating system and / or application, such as abnormal interface call parameter characteristics, abnormal file access behavior characteristics, etc., and can also include corresponding processing strategies and reporting strategies, such as only recording in the log, sending a warning to the remote security management center, terminating abnormal programs, etc.

[0071] It should be noted that the above local authentication should be performed only after the remote authentication is passed. However, there is a special case in this manual, that is, the target device is securely started for the first time and the initial trusted chain is built. In this case, any node in the initial trusted chain, including the security intermediary component, can be considered to be trusted. At this time, remote authentication can be skipped and local verification can be performed directly. Of course, after the initial trusted chain construction time exceeds the preset trusted time, remote authentication needs to be re-performed to ensure that the security intermediary component is trustworthy.

[0072] Step S310: The security broker component receives a local verification request from a corresponding software component during operation.

[0073] In one embodiment, the system security broker component may receive a local authentication request from an operating system, and the application security broker component may receive a local authentication request from an application program.

[0074] Step S312: The security intermediary component obtains software running information of the corresponding software component and performs local authentication.

[0075] In one embodiment, the security intermediary component can obtain the software running information of the corresponding software component, and determine whether the running state of the corresponding software component is abnormal based on the software running information and the above security policy. If the running state is normal, the credibility of the software component is updated to the credibility of the security intermediary component. If the running state is abnormal, the abnormal situation can be reported to the remote security management center. The above software running information is equivalent to the interactive verification information with the corresponding software component contained in the above running information. The software running information can further include context information of the running software, function call parameters, memory space data and other information. The above security policy can specify the verification method for the above software running information.

[0076] In particular, for applications in software components, different programming languages ​​can be specifically verified. Figure 4 Take this as an example to introduce the local authentication process for Java language applications.

[0077] In one embodiment, when the software component includes the application, the security intermediary component can insert verification logic for the calling method of the method interface corresponding to the application according to the security policy; wherein the verification logic can be used to: when it is determined that there is an exception during the execution of the calling method, terminate the execution process.

[0078] Specifically, Figure 4 The application is written in Java, so the actual execution file is a binary file in a specific format with the suffix "class". The verification trigger logic is inserted into the important position of the method in the application class when the Java Instrumentation mechanism is used. The verification trigger logic obtains important context information of the application during operation, such as the call stack, important global variables, call parameters, etc., and sends it to the security intermediary component of the same layer for verification. Through the above logic injection method, the verification logic in the security policy can be triggered based on the code inserted in the scheduled task or specific execution position, thereby deeply and comprehensively ensuring the credibility of the application.

[0079] like Figure 4 As shown, the program security intermediary component can maintain the environment image of the environment and the log report for the log file that records the operation information. When the program security intermediary component receives the security policy issued by the remote security management center, it provides three methods: class loading check (Class Loading Check), logic injection (Logic Injection), and boundary check (Boundary Cheak).

[0080] Method 1: Class loading detection, in the verification step of the linking process of the above binary file, ensure that the class definition is valid and does not violate the Java Virtual Machine (JVM) specification, such as checking whether the class has the correct class file format, the correct magic number, the correct version number, the correct constant pool, etc. If the class passes the verification, it can be safely loaded and executed by the JVM.

[0081] Method 2: Bounds detection usually refers to the process in which the JVM execution engine obtains data from the JVM's runtime data area (RuntimeData Area) and performs array operations, string operations, or other operations that require checking index or parameter ranges provided by the native library through native method calls to ensure that the index or parameter value does not exceed the predefined boundary or range. This is a way to prevent cross-bounds errors (Index Out Of Bounds Exception) and other types of errors, with the aim of ensuring the robustness and stability of the program.

[0082] Mode 3: Logic injection, generally refers to a security vulnerability that allows an attacker to change the logic flow of a program by manipulating the application's input data, thereby performing unintended operations. This attack is usually malicious and aims to bypass security controls or perform unauthorized actions. However, in this specification, the concept of logic injection can also be used for legitimate and secure purposes, namely injecting security logic. In this case, the injection of security logic refers to the deliberate addition of additional logic to an application to enhance the security and robustness of the system. Figure 4 The security policy can inject security logic into the JVM's class loader, so that the operation behavior indicated by the security logic can also be executed during the application's class loading process.

[0083] The above embodiments are implemented based on Java applications, but their designs can also be applied to other languages. The difference is that the implementation of other languages ​​is different based on the characteristics of different languages. For interpreted languages ​​that also have built-in virtual machines, such as Python, the boundaries of the application can be found by imitating the method of the Java program, and the security check logic can be added to the application interpreter or runtime library. For languages ​​such as C / C++ that are compiled into bare machine code, the boundaries of the application are difficult to determine, and the use of common instructions is also vulnerable to attacks. In this scenario, hardware-supported isolation mechanisms, such as Software Guard Extensions (SGX), can solve this problem. SGX establishes mutually isolated enclaves to prevent direct interaction between applications and the external environment, and its communication interface can be protected as the boundary of the application, and combined with the security verification mechanism of the trusted chain in this specification to achieve trusted verification for the application.

[0084] Back to the above software running information, of course, no matter what detection method is used, if it is determined that there is an exception in the execution process of the corresponding calling method, then the execution of the application can be terminated, thereby minimizing the damage that the application may suffer. If the verification passes, the credibility of the application component can be updated to the current credibility of the corresponding security intermediary component. It can be understood that the above method of collecting the context information of the application and verifying the credibility of the application based on the insertion of verification logic can save a lot of resource overhead compared to the method of verifying the hash, and the above insertion of verification logic can more flexibly determine the detection point and detection behavior of the application, so that the solution of this specification has a certain ability to identify zero-day vulnerabilities and bypass attacks.

[0085] Of course, the above method of updating the current trustworthiness of the corresponding security intermediary component is usually only applicable to a node with only one security intermediary component to perform local authentication on the software component. Assuming that there are multiple nodes, for example, the same software component corresponds to different security intermediary components (N1, N2, ..., N k ), then the updated trustworthiness of the node corresponding to the above software component in the trusted chain should be set to the minimum trustworthiness of the nodes corresponding to multiple security intermediary components, that is,

[0086] C α =max(min 1≤i≤k (Cred i (t)), Cred α (t)), t α =t (Formula 2)

[0087] The above steps S308 to S312 are a local authentication process between the security intermediary component and the software component, which aims to enable the trusted detection to cover software components including the application program and support the process during the system operation.

[0088] It is worth mentioning that this manual connects the complete remote authentication and local verification processes by introducing a security intermediary component and its credibility. The running processes do not interfere with each other and can be configured to run in parallel or alternately, or with different running frequencies.

[0089] It can be seen from the above embodiments that this specification extends the trusted chain from the traditional operating system to the application program based on the security intermediary component, thereby establishing a trusted relationship between the hardware trusted root at the bottom of the system and the application program at the top of the system, and realizing runtime protection; in addition, based on the application insertion verification logic to collect the context information of the application program and perform verification, an efficient application runtime measurement mechanism is realized, which can ensure the low overhead and real-time measurement during the application program running process, and further, by improving the anomaly detection points and detection behaviors, the anomaly detection mechanism corresponding to the application program has high effectiveness and versatility, and has a certain ability to defend against zero-day vulnerabilities and bypass attacks.

[0090] Figure 5 is a flowchart of a software protection method shown in an exemplary embodiment of this specification, such as Figure 5 As shown, the method is applied to a security intermediary component configured in a target device, including:

[0091] Step S502, locally authenticating a corresponding software component according to a preset security policy, the software component being configured in the target device;

[0092] Step S504, determining the credibility of the software component according to the local authentication result;

[0093] The operation information of the security intermediary component is obtained by a remote security management center for remote authentication of the security intermediary component. The result of the remote authentication is used to determine whether the security intermediary component is trustworthy, and the credibility of the security intermediary component is updated based on the determination result.

[0094] As mentioned above, the target device is also configured with a trusted platform module; the remote security management center is also used to:

[0095] Acquire the registered information maintained in the trusted platform module, wherein the registered information records a hash value of the operation information and a target signature generated by the trusted platform module for the hash value based on a preset private key;

[0096] Verifying the target signature according to the public key provided by the trusted platform module, and matching the hash value with the operation information;

[0097] When the target signature verification passes and the hash value matches the operation information, it is determined whether the security broker component is credible according to the operation information.

[0098] As mentioned above, the trusted platform module is used to:

[0099] Based on the preset trusted root, the security intermediary component and the software component are measured step by step to store the hash value of each component in the target device to a preset memory, and build a corresponding trusted chain;

[0100] The remote security management center is also used for:

[0101] Obtaining a hash value in the memory, and determining whether the obtained hash value is consistent with a preset expected hash value;

[0102] If the judgment result is yes, the credibility of the corresponding component in the trusted chain is initialized.

[0103] As mentioned above, the software components include operating systems and / or applications;

[0104] In the case where the software components include the operating system and the application program,

[0105] The security intermediary component is a shared security intermediary component corresponding to the operating system and the application; or,

[0106] The security intermediary component includes a system security intermediary component corresponding to the operating system and a program security intermediary component corresponding to the application program.

[0107] As mentioned above, the method further comprises:

[0108] In the case where the software component includes the application, verification logic is inserted into the calling method of the method interface corresponding to the application according to the security policy; wherein the verification logic is used to: terminate the execution process when it is determined that there is an exception during the execution of the calling method.

[0109] As mentioned above, the remote security management center is also used to:

[0110] When the judgment result is yes, the security policy is sent to the security intermediary component so that the security intermediary component performs the local authentication.

[0111] As mentioned above, the operation information of the security intermediary component includes at least any of the following:

[0112] The component's own status information and configuration information, interaction verification information with the corresponding software components, and file data and process information in the environment.

[0113] As mentioned above, the local authentication of the corresponding software components according to the preset security policy includes:

[0114] The software running information of the corresponding software component is obtained, and whether the running state of the software component is abnormal is determined according to the software running information and the security policy; if the running state is normal, the credibility of the software component is updated to the credibility of the security intermediary component.

[0115] Figure 6 is a flowchart of another software protection method shown in an exemplary embodiment of this specification, such as Figure 6 As shown, the method is applied to a remote security management center configured in a target device, including:

[0116] Step S602, obtaining operation information of a security intermediary component, wherein the security intermediary component is used to locally authenticate the corresponding software component according to a preset security policy and determine the credibility of the software component according to the local authentication result, and the security intermediary component and the software component are configured in the target device;

[0117] Step S604: remotely authenticate the security intermediary component according to the operation information, determine whether the security intermediary component is trustworthy according to the remote authentication result, and update the trustworthiness of the security intermediary component based on the determination result.

[0118] As mentioned above, the target device is also configured with a trusted platform module; the method further includes:

[0119] Acquire the registered information maintained in the trusted platform module, wherein the registered information records a hash value of the operation information and a target signature generated by the trusted platform module for the hash value based on a preset private key;

[0120] Verifying the target signature according to the public key provided by the trusted platform module, and matching the hash value with the operation information;

[0121] When the target signature verification passes and the hash value matches the operation information, it is determined whether the security broker component is credible according to the operation information.

[0122] As mentioned above, the trusted platform module is used to:

[0123] Based on the preset trusted root, the security intermediary component and the software component are measured step by step to store the hash value of each component in the target device to a preset memory, and build a corresponding trusted chain;

[0124] The method further comprises:

[0125] Obtaining a hash value in the memory, and determining whether the obtained hash value is consistent with a preset expected hash value;

[0126] If the judgment result is yes, the credibility of the corresponding component in the trusted chain is initialized.

[0127] As mentioned above, the software components include operating systems and / or applications;

[0128] In the case where the software components include the operating system and the application program,

[0129] The security intermediary component is a shared security intermediary component corresponding to the operating system and the application; or,

[0130] The security intermediary component includes a system security intermediary component corresponding to the operating system and a program security intermediary component corresponding to the application program.

[0131] As mentioned above, the security mediator component is also used to:

[0132] In the case where the software component includes the application, verification logic is inserted into the calling method of the method interface corresponding to the application according to the security policy; wherein the verification logic is used to: terminate the execution process when it is determined that there is an exception during the execution of the calling method.

[0133] As mentioned above, the method further comprises:

[0134] When the judgment result is yes, the security policy is sent to the security intermediary component so that the security intermediary component performs the local authentication.

[0135] As mentioned above, the operation information of the security intermediary component includes at least any of the following:

[0136] The component's own status information and configuration information, interaction verification information with the corresponding software components, and file data and process information in the environment.

[0137] As mentioned above, the process of the local authentication of the security intermediary component includes:

[0138] The software running information of the corresponding software component is obtained, and whether the running state of the software component is abnormal is determined according to the software running information and the security policy; if the running state is normal, the credibility of the software component is updated to the credibility of the security intermediary component.

[0139] Figure 7 This is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment. Figure 7At the hardware level, the device includes a processor 702, an internal bus 704, a network interface 706, a memory 708, and a non-volatile memory 710, and may also include hardware required for other functions. One or more embodiments of this specification can be implemented based on software, such as the processor 702 reading the corresponding computer program from the non-volatile memory 710 into the memory 708 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices. Corresponding to the embodiments of the aforementioned software protection method, this specification also provides embodiments of a software protection device.

[0140] Corresponding to the aforementioned embodiment of a software protection method, this specification also provides an embodiment of a software protection device.

[0141] Please refer to Figure 8 , Figure 8 FIG. 1 is a schematic diagram showing the structure of a software protection device according to an exemplary embodiment. Figure 8 As shown, in a software implementation, the apparatus is applied to a security intermediary component configured in a target device, which may include:

[0142] A local authentication unit 81, configured to perform local authentication on a corresponding software component according to a preset security policy, the software component being configured in the target device;

[0143] A software component credibility determination unit 82, configured to determine the credibility of the software component according to the local authentication result;

[0144] The operation information of the security intermediary component is obtained by a remote security management center for remote authentication of the security intermediary component. The result of the remote authentication is used to determine whether the security intermediary component is trustworthy, and the credibility of the security intermediary component is updated based on the determination result.

[0145] Optionally, the target device is further configured with a trusted platform module; and the remote security management center is further used for:

[0146] Acquire the registered information maintained in the trusted platform module, wherein the registered information records a hash value of the operation information and a target signature generated by the trusted platform module for the hash value based on a preset private key;

[0147] Verifying the target signature according to the public key provided by the trusted platform module, and matching the hash value with the operation information;

[0148] When the target signature verification passes and the hash value matches the operation information, it is determined whether the security broker component is credible according to the operation information.

[0149] Optionally, the trusted platform module is used to:

[0150] Based on the preset trusted root, the security intermediary component and the software component are measured step by step to store the hash value of each component in the target device to a preset memory, and build a corresponding trusted chain;

[0151] The remote security management center is also used for:

[0152] Obtaining a hash value in the memory, and determining whether the obtained hash value is consistent with a preset expected hash value;

[0153] If the judgment result is yes, the credibility of the corresponding component in the trusted chain is initialized.

[0154] Optionally, the software component includes an operating system and / or an application program;

[0155] In the case where the software components include the operating system and the application program,

[0156] The security intermediary component is a shared security intermediary component corresponding to the operating system and the application; or,

[0157] The security intermediary component includes a system security intermediary component corresponding to the operating system and a program security intermediary component corresponding to the application program.

[0158] Optionally, the device further comprises:

[0159] The verification logic insertion unit 83 is used to insert verification logic into the calling method of the method interface corresponding to the application according to the security policy when the software component includes the application; wherein the verification logic is used to terminate the execution process when it is determined that there is an exception during the execution of the calling method.

[0160] Optionally, the remote security management center is further used for:

[0161] When the judgment result is yes, the security policy is sent to the security intermediary component so that the security intermediary component performs the local authentication.

[0162] Optionally, the operation information of the security intermediary component includes at least any one of the following:

[0163] The component's own status information and configuration information, interaction verification information with the corresponding software components, and file data and process information in the environment.

[0164] Optionally, the local authentication unit 81 is specifically configured to:

[0165] The software running information of the corresponding software component is obtained, and whether the running state of the software component is abnormal is determined according to the software running information and the security policy; if the running state is normal, the credibility of the software component is updated to the credibility of the security intermediary component.

[0166] Corresponding to the aforementioned another embodiment of the software protection method, this specification also provides another embodiment of the software protection device.

[0167] Please refer to Fig. 9 , Fig. 9 FIG. 1 is a schematic diagram showing the structure of a software protection device according to an exemplary embodiment. Fig. 9 As shown, in a software implementation, the device is applied to a remote security management center and may include:

[0168] An operation information acquisition unit 91 is used to acquire operation information of a security intermediary component, the security intermediary component is used to perform local authentication on a corresponding software component according to a preset security policy, and determine the credibility of the software component according to the local authentication result, the security intermediary component and the software component are configured in a target device;

[0169] The security intermediary component credibility updating unit 92 is used to remotely authenticate the security intermediary component according to the operation information, determine whether the security intermediary component is credible according to the remote authentication result, and update the credibility of the security intermediary component based on the determination result.

[0170] Optionally, the target device is further configured with a trusted platform module; the apparatus further comprises:

[0171] A trusted judgment unit 93, configured to obtain the registered information maintained in the trusted platform module, wherein the registered information records a hash value of the operation information and a target signature generated by the trusted platform module for the hash value based on a preset private key;

[0172] Verifying the target signature according to the public key provided by the trusted platform module, and matching the hash value with the operation information;

[0173] When the target signature verification passes and the hash value matches the operation information, it is determined whether the security broker component is credible according to the operation information.

[0174] Optionally, the trusted platform module is used to:

[0175] Based on the preset trusted root, the security intermediary component and the software component are measured step by step to store the hash value of each component in the target device to a preset memory, and build a corresponding trusted chain;

[0176] The device also includes:

[0177] A credibility initialization unit 94, used to obtain the hash value in the memory and determine whether the obtained hash value is consistent with a preset expected hash value;

[0178] If the judgment result is yes, the credibility of the corresponding component in the trusted chain is initialized.

[0179] Optionally, the software component includes an operating system and / or an application program;

[0180] In the case where the software components include the operating system and the application program,

[0181] The security intermediary component is a shared security intermediary component corresponding to the operating system and the application; or,

[0182] The security intermediary component includes a system security intermediary component corresponding to the operating system and a program security intermediary component corresponding to the application program.

[0183] Optionally, the security intermediary component is further used to:

[0184] In the case where the software component includes the application, verification logic is inserted into the calling method of the method interface corresponding to the application according to the security policy; wherein the verification logic is used to: terminate the execution process when it is determined that there is an exception during the execution of the calling method.

[0185] Optionally, the device further comprises:

[0186] The security policy issuing unit 95 is used to issue the security policy to the security intermediary component if the judgment result is yes, so that the security intermediary component performs the local authentication.

[0187] Optionally, the operation information of the security intermediary component includes at least any one of the following:

[0188] The component's own status information and configuration information, interaction verification information with the corresponding software components, and file data and process information in the environment.

[0189] Optionally, the process of the security intermediary component performing local authentication includes:

[0190] The software running information of the corresponding software component is obtained, and whether the running state of the software component is abnormal is determined according to the software running information and the security policy; if the running state is normal, the credibility of the software component is updated to the credibility of the security intermediary component.

[0191] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0192] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. Ordinary technicians in this field can understand and implement it without paying creative work.

[0193] In addition, the present specification also provides a computer program product, including a computer program / instruction, which implements the implementation process of the corresponding steps in the above method when executed by a processor.

[0194] The present specification also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the implementation process of the corresponding steps in the above method is implemented.

[0195] The embodiments of the subject matter and functional operations described in this specification may be implemented in the following: digital electronic circuits, tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or a combination of one or more of them. The embodiments of the subject matter described in this specification may be implemented as one or more computer programs, i.e., one or more modules in computer program instructions encoded on a tangible non-temporary program carrier to be executed by a data processing device or to control the operation of the data processing device. Alternatively or additionally, the program instructions may be encoded on an artificially generated propagation signal, such as a machine-generated electrical, optical or electromagnetic signal, which is generated to encode information and transmit it to a suitable receiver device for execution by a data processing device. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them.

[0196] The processes and logic flows described in this specification can be performed by one or more programmable computers executing one or more computer programs to perform corresponding functions by operating on input data and generating output. The processes and logic flows can also be performed by special purpose logic circuits, such as FPGAs (field programmable gate arrays) or ASICs (application-specific integrated circuits), and the apparatus can also be implemented as special purpose logic circuits.

[0197] Computers suitable for executing computer programs include, for example, general and / or special microprocessors, or any other type of processing unit. Typically, the processing unit will receive instructions and data from a read-only memory and / or a random access memory. The basic components of a computer include a processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data. Typically, the computer will also include one or more large-capacity storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or the computer will be operably coupled to this large-capacity storage device to receive data from it or to transmit data to it, or both. However, the computer does not necessarily have such a device. In addition, the computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device such as a universal serial bus (USB) flash drive, just to name a few.

[0198] Computer readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including, for example, semiconductor memory devices (e.g., EPROM, EEPROM and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD ROM and DVD-ROM disks. The processor and memory may be supplemented by, or incorporated in, special purpose logic circuitry.

[0199] Although this specification includes many specific implementation details, these should not be interpreted as limiting the scope of any invention or the scope of protection claimed, but are mainly used to describe the features of the specific embodiments of specific inventions. Certain features described in multiple embodiments in this specification may also be implemented in combination in a single embodiment. On the other hand, the various features described in a single embodiment may also be implemented separately in multiple embodiments or in any suitable sub-combination. In addition, although features may work in certain combinations as described above and even initially claim protection, one or more features from the claimed combination may be removed from the combination in some cases, and the claimed combination may point to a sub-combination or a variation of a sub-combination.

[0200] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that these operations be performed in the particular order shown or performed sequentially, or requiring that all illustrated operations be performed to achieve the desired results. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system modules and components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product, or packaged into multiple software products.

[0201] Thus, specific embodiments of the subject matter have been described. Furthermore, the processes depicted in the figures do not necessarily require the particular order shown or sequential order to achieve desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0202] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A software protection system, comprising: A security intermediary component, used to perform local authentication on the corresponding software component according to a preset security policy, and determine the credibility of the software component according to the local authentication result, wherein the security intermediary component and the software component are configured in the target device; A remote security management center, used to obtain the operation information of the security intermediary component and remotely authenticate the security intermediary component according to the operation information; Whether the security intermediary component is credible is determined according to the remote authentication result, and the credibility of the security intermediary component is updated based on the determination result. 2 . The system according to claim 1 , wherein the target device is further configured with a trusted platform module different from the security intermediary component.

3. The system according to claim 2, wherein the remote security management center is further used for: Acquire the registered information maintained in the trusted platform module, wherein the registered information records a hash value of the operation information and a target signature generated by the trusted platform module for the hash value based on a preset private key; Verifying the target signature according to the public key provided by the trusted platform module, and matching the hash value with the operation information; When the target signature verification passes and the hash value matches the operation information, it is determined whether the security broker component is credible according to the operation information.

4. The system according to claim 3, wherein the trusted platform module is used for: Based on the preset trusted root, the security intermediary component and the software component are measured step by step to store the hash value of each component in the target device to a preset memory, and build a corresponding trusted chain; The remote security management center is also used for: Obtaining a hash value in the memory, and determining whether the obtained hash value is consistent with a preset expected hash value; If the judgment result is yes, the credibility of the corresponding component in the trusted chain is initialized.

5. The system according to claim 1, wherein the software component comprises an operating system and / or an application program; In the case where the software components include the operating system and the application program, The security intermediary component is a shared security intermediary component corresponding to the operating system and the application; or, The security intermediary component includes a system security intermediary component corresponding to the operating system and a program security intermediary component corresponding to the application program.

6. The system according to claim 5, wherein the security broker component is further configured to: In the case where the software component includes the application, inserting verification logic into the calling method of the method interface corresponding to the application according to the security policy; wherein, The verification logic is used to terminate the execution process when it is determined that an exception exists during the execution of the calling method.

7. The system according to claim 1, wherein the remote security management center is further used for: When the judgment result is yes, the security policy is sent to the security intermediary component so that the security intermediary component performs the local authentication.

8. The system according to claim 1, wherein the operation information of the security intermediary component includes at least any of the following: The component's own status information and configuration information, interaction verification information with the corresponding software components, and file data and process information in the environment.

9. The system according to claim 1, wherein the process of the security intermediary component performing local authentication comprises: The software running information of the corresponding software component is obtained, and whether the running state of the software component is abnormal is determined according to the software running information and the security policy; if the running state is normal, the credibility of the software component is updated to the credibility of the security intermediary component.

10. A software protection method, applied to a security intermediary component configured in a target device, comprising: Performing local authentication on a corresponding software component according to a preset security policy, the software component being configured in the target device; Determining the trustworthiness of the software component based on the local authentication result; The operation information of the security intermediary component is obtained by a remote security management center for remote authentication of the security intermediary component. The result of the remote authentication is used to determine whether the security intermediary component is trustworthy, and the credibility of the security intermediary component is updated based on the determination result.

11. A software protection method, applied to a remote security management center, comprising: Acquiring operation information of a security intermediary component, the security intermediary component being used to locally authenticate a corresponding software component according to a preset security policy and determining the credibility of the software component according to a local authentication result, the security intermediary component and the software component being configured in a target device; The security intermediary component is remotely authenticated according to the operation information, and whether the security intermediary component is credible is determined according to the remote authentication result, and the credibility of the security intermediary component is updated based on the determination result.

12. A computer-readable storage medium having a computer program or instruction stored thereon, wherein the program or instruction, when executed by a processor, implements the steps of the method according to any one of claims 10 to 11.

13. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 10 to 11 when executing the program.

14. A computer program product, comprising a computer program or instructions, which, when executed by a processor, implements the steps of the method according to any one of claims 10 to 11.

Images