Computer security policy system based on cloud platform and computer readable medium

Abstract

The invention discloses a computer security policy system based on a cloud platform. The computer security policy system comprises a micro-service module, a cloud platform module, a data storage module, a feedback module and an LTE-5G communication module, the micro-service module adopts a micro-service architecture developed based on Java; the cloud platform module comprises a plurality of micro-service processing units and a system security authentication unit; the data storage module is used for storing data of the computer security policy system; the feedback module is used for feeding back a result processed by the security policy system to the user; through the micro-service architecture based on the cloud platform and the LTE-5G communication module, potential safety hazards of the computer equipment can be monitored in real time, when the computer equipment of a user is lost, whether the computer equipment is started or not and whether the computer equipment is connected with wifi or not, sensitive data can be erased quickly, safely and accurately, the GPS position of the equipment can be acquired quickly, the bios function can be enabled quickly, meanwhile, micro-services are independent from one another, and the safety of the computer equipment is improved. And rapid construction and optimization can be realized, and the development cost and efficiency are reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a cloud platform-based computer security policy system and a computer-readable medium. Background Art

[0002] As people pay more and more attention to data security, when a user's computer device is lost, security operations such as remote positioning, locking the device, and erasing sensitive data are often required.

[0003] The current common practice is to complete relevant security operations based on BIOS and software from third-party companies. Firmware-level protection can provide good security.

[0004] But this approach has its limitations:

[0005] (1) The sensitive data deletion service can only be provided when the device is turned on.

[0006] (2) Location restrictions: places without Wi-Fi networks cannot access the Internet, resulting in the inability to delete sensitive data.

[0007] (3) Unable to accurately delete sensitive data.

[0008] (4) Remote deletion of sensitive data from computer devices without security verification may lead to accidental deletion. Summary of the invention

[0009] The purpose of the present invention is to provide a computer security policy system and a computer-readable medium based on a cloud platform to solve the above-mentioned problems existing in the prior art.

[0010] The specific application is as follows:

[0011] A computer security policy system based on a cloud platform, comprising a microservice module, a cloud platform module, a data storage module, a feedback module and an LTE-5G communication module;

[0012] The microservice module adopts a microservice architecture developed based on Java, which includes a request data receiving microservice unit, a sensitive data analysis microservice unit, a sensitive data processing microservice unit, a location positioning processing microservice unit, a BIOS lock screen processing microservice unit, a device status monitoring microservice unit and a sensitive data erasure verification microservice unit;

[0013] The cloud platform module adopts a microservice architecture developed based on Java. The cloud platform module is configured to include several microservice processing units and a system security authentication unit. Each microservice unit of the microservice module is connected to each microservice processing unit of the cloud platform module through the application processing center service in a one-to-one correspondence. Each microservice processing unit is provided with an external API interface. All connected devices are sent to each microservice processing unit of the cloud platform module for processing after being verified by the system security management unit. Each microservice processing unit provides an open API data interface for a third party.

[0014] The data storage module is used to store data of the computer security policy system; the data storage module includes a Redis database for caching temporary data and a MySQL database for storing persistent log monitoring data. The MySQL database is deployed in a master-slave mode. The master MySQL database and the backup MySQL database are divided into a sensitive data cluster for storing a lost computer, a business database cluster for storing the status of monitoring computer equipment, a business database cluster for recording the user's use of the computer equipment, a business database cluster for recording the maintenance and repair records of the computer equipment, and a business database cluster for recording the user's feedback on the use of the computer equipment. The status of the computer equipment includes the running status of the equipment and the fault status of the equipment;

[0015] The feedback module is used to feed back the result processed by the security policy system to the user;

[0016] The LTE-5G communication module is built into the computer device. If the computer device is in a shutdown state, the module is in a low-power listening state.

[0017] Furthermore, the request data receiving microservice unit is used to receive user data requests and adopts the WebSocket data packet format. The WebSocket data packet is composed of frames, each frame is represented by binary data, and each frame is composed of a frame header, a frame length, a frame data and a reserved field. The frame header is represented by 16 bytes, the frame length is represented by 16 bytes, the content length of the frame data is limited by the frame length, and the reserved field is represented by 32 bytes. The user data request includes at least a sensitive data erasure instruction, a location positioning instruction, a BIOS lock screen instruction and a machine status query instruction. The user data request sends an SMS message through the cloud platform module to wake up the LTE-5G communication module of the specified computer device, and the LTE-5G communication module also includes a GPS positioning function.

[0018] Furthermore, the sensitive data analysis microservice unit is used to identify whether the data in the computer device is sensitive data through a deep learning recognition model;

[0019] The specific training process of the deep learning recognition model is as follows:

[0020] L1: Collect various types of data from computer devices, including sensitive data and non-sensitive data, with a total of 100,000 items of data collected;

[0021] L2: 100,000 data items are divided into training set, test set and validation set in a ratio of 8:1:1; the data in the training set all contain sensitive data, the data in the test set contains sensitive data and non-sensitive data, and the data in the validation set contains sensitive data and non-sensitive data;

[0022] L3: Use annotation tools to annotate the data in the training set and generate an XML file;

[0023] L4: After extracting features using the convolutional neural network algorithm, the deep learning recognition model trains the data in the training set one by one;

[0024] L5: The deep learning recognition model recognizes the data in the test set one by one and obtains the accuracy and error rate;

[0025] L6: If the accuracy and error rate do not meet the requirements, proceed to step L7; if the accuracy and error rate meet the requirements, the deep learning recognition model recognizes the data in the validation set one by one. If the accuracy and error rate meet the requirements, the training ends. If the accuracy and error rate do not meet the requirements, proceed to step L7;

[0026] L7: After manually adjusting the recognition weight coefficient of the deep learning recognition model, the data in the verification set are recognized one by one. If the recognition accuracy and error rate meet the requirements, the training ends. If not, the recognition weight coefficient is adjusted again and the data in the verification set are recognized one by one again. After each recognition of the data in the verification set, the recognition record is deleted until the recognition accuracy and error rate meet the requirements and the training ends.

[0027] Furthermore, the sensitive data processing microservice unit, upon receiving the sensitive data erasure instruction, performs an operation of erasing sensitive data of a computer device;

[0028] The specific implementation process of the sensitive data erasure operation of the computer device is as follows:

[0029] S1: If the computer device is turned on, the erasing process is:

[0030] S11: Download an executable Eraser code from the remote ABT cloud server;

[0031] S12: Implanting the executable Eraser code into the BIOS of the computer device;

[0032] S13: When the computer device is in a boot state, the BIOS writes the executable Eraser code into the memory, the system of the computer device is in a boot state, and the system of the computer device reads the executable Eraser code from the memory;

[0033] S14: the executable Eraser code performs a sensitive data erasure operation, where the sensitive data is data identified by the deep learning recognition model;

[0034] S2: If the computer device is turned off, the erasing process is:

[0035] S21: When the request data receiving microservice unit receives the sensitive data erasure instruction from the user, the cloud platform module sends an SMS message to wake up the LTE-5G communication module of the designated computer device;

[0036] S22: If the LTE-5G communication module receives the SMS message, it actively accesses the ABT cloud server and downloads an executable Eraser code;

[0037] S23: the LTE-5G communication module transmits the sensitive data erasure instruction to the embedded controller EC, and the embedded controller EC restarts the computer device after receiving the instruction, and performs a sensitive data erasure operation in the bios post process, wherein the sensitive data is the data identified by the deep learning recognition model;

[0038] S24: After the processing is completed, the result is returned to the feedback module along the original path.

[0039] Furthermore, when the device status monitoring microservice unit receives the machine status query instruction, it uses a neural network prediction model for training, takes historical data as input and safety fault conditions as output, and establishes a fault prediction model; based on real-time monitoring data, it uses the trained fault prediction model to perform fault prediction, evaluate the health status of computer equipment, predict possible faults and the time when the faults will occur, and feed back to the feedback module.

[0040] Furthermore, when the location positioning processing microservice unit receives the location positioning instruction, the LTE-5G communication module of the designated computer device feeds back the GPS position of the current designated computer device to the feedback module.

[0041] Furthermore, when the BIOS lock screen processing microservice unit receives the BIOS lock screen instruction, the LTE-5G communication module of the designated computer device transmits the BIOS lock screen instruction to the embedded controller EC. After receiving the instruction, the embedded controller EC invalidates the BIOS startup of the computer device, and the BIOS is in a locked screen state. A specific password is required to use the BIOS function.

[0042] Furthermore, the sensitive data erasure verification microservice unit performs identity authentication based on the sensitive data erasure instruction request, including:

[0043] Obtaining a computer device corresponding to a sensitive data erasure instruction request and verifying compliance of the computer device;

[0044] Verify the rationality of the frequency of requests for sensitive data erasure instructions;

[0045] Verify the integrity of the content of the WebSocket data packet corresponding to the sensitive data erasure instruction request;

[0046] When compliance, rationality and completeness are all verified, the verification of the sensitive data erasure instruction request is determined to be successful.

[0047] Furthermore, after the sensitive data erasure instruction request is authenticated, the data storage module organizes the sensitive data erasure instruction request to generate a verification sequence, stores the verification sequence in the data storage module, and associates the verification sequence with the corresponding data file; and sends the encrypted data file to the data storage module for storage.

[0048] A computer-readable medium stores a computer program, wherein the program, when executed by a processor, is used to implement any function of a computer security policy system based on a cloud platform.

[0049] Compared with the prior art, the embodiments of the present invention achieve the following beneficial effects:

[0050] The embodiment of the present invention provides a computer security policy system based on a cloud platform. The microservice module adopts a microservice architecture developed based on Java, which includes a request data receiving microservice unit, a sensitive data analysis microservice unit, a sensitive data processing microservice unit, a device status monitoring microservice unit and a sensitive data erasure verification microservice unit; the cloud platform module adopts a microservice architecture developed based on Java, and the cloud platform module is provided with a plurality of microservice processing units and a system security authentication unit; each microservice unit of the microservice module is connected to each microservice processing unit of the cloud platform module through an application processing center service in a one-to-one correspondence; each microservice processing unit is provided with an external API interface; all connected devices are sent to each microservice processing unit of the cloud platform module after being verified by the system security management unit. The data storage module is used to store the data of the computer security policy system; the feedback module is used to feed back the results of the security policy system processing to the user; the LTE-5G communication module is built into the computer device, and if the computer device is in a shutdown state, the module is in a low-power listening state; the present invention can monitor the potential safety hazards of computer devices in real time through a microservice architecture based on a cloud platform and an LTE-5G communication module. When the user's computer device is lost, whether it is turned on or connected to WiFi, sensitive data can be quickly, safely and accurately erased, the device GPS location can be quickly obtained, and the bios function can be quickly enabled. At the same time, each microservice is independent of each other and can be quickly built and optimized, saving development costs and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a system architecture diagram of a cloud platform-based computer security policy system provided by an embodiment of the present invention;

[0052] Figure 2 It is a schematic diagram of sensitive data erasure of a computer security policy system based on a cloud platform provided by an embodiment of the present invention;

[0053] Markings in the figure: 1-microservice module; 2-cloud platform module; 3-data storage module; 4-feedback module; 5-LTE-5G communication module. DETAILED DESCRIPTION

[0054] The present invention will be described in detail below in conjunction with the accompanying drawings.

[0055] Example 1

[0056] First, the technical terms involved in the embodiments of the present application are explained.

[0057] (1) Microservices

[0058] Microservices is a software architecture style that builds applications as a series of small, independently deployed services built around business capabilities. These services are usually built around business capabilities and can be independently deployed through automated deployment mechanisms. The microservice architecture allows applications to be more flexible in continuous delivery and continuous integration, and can take advantage of the elasticity of cloud infrastructure.

[0059] (2)Eraser

[0060] Eraser is an open source file deletion tool that provides powerful secure deletion capabilities. Eraser supports multiple deletion algorithms, including standard (DoD 5220.22-M) and Peter Gutmann's Gutmann algorithm. In addition, Eraser also allows you to create custom deletion methods.

[0061] The embodiment of the present invention provides a computer security policy system based on a cloud platform, such as Figure 1 As shown, it includes a microservice module 1, a cloud platform module 2, a data storage module 3, a feedback module 4 and an LTE-5G communication module 5;

[0062] The microservice module 1 adopts a microservice architecture developed based on Java, which includes a request data receiving microservice unit, a sensitive data analysis microservice unit, a sensitive data processing microservice unit, a location positioning processing microservice unit, a BIOS lock screen processing microservice unit, a device status monitoring microservice unit and a sensitive data erasure verification microservice unit;

[0063] The cloud platform module 2 adopts a microservice architecture developed based on Java. The cloud platform module is configured to include several microservice processing units and a system security authentication unit. Each microservice unit of the microservice module is connected to each microservice processing unit of the cloud platform module through the application processing center service. Each microservice processing unit is provided with an external API interface. All connected devices are sent to each microservice processing unit of the cloud platform module 2 for processing after being verified by the system security management unit. Each microservice processing unit provides an open API data interface for a third party.

[0064] The data storage module 3 is used to store data of the computer security policy system; the data storage module includes a Redis database for caching temporary data and a MySQL database for storing persistent log monitoring data. The MySQL database is deployed in a master-slave mode. The master MySQL database and the backup MySQL database are divided into a sensitive data cluster for storing a lost computer, a business database cluster for storing the status of monitoring computer equipment, a business database cluster for recording the user's use of computer equipment, a business database cluster for recording the maintenance and repair records of computer equipment, and a business database cluster for recording the user's feedback on the use of computer equipment. The status of the computer equipment includes the running status of the equipment and the fault status of the equipment;

[0065] The feedback module 4 is used to feed back the result processed by the security policy system to the user;

[0066] The LTE-5G communication module 5 is built into the computer device. If the computer device is in a shutdown state, the module is in a low-power listening state.

[0067] Furthermore, the request data receiving microservice unit is used to receive user data requests and adopts the WebSocket data packet format. The WebSocket data packet is composed of frames, each frame is represented by binary data, and each frame is composed of a frame header, a frame length, a frame data and a reserved field. The frame header is represented by 16 bytes, the frame length is represented by 16 bytes, the content length of the frame data is limited by the frame length, and the reserved field is represented by 32 bytes. The user data request includes at least a sensitive data erasure instruction, a location positioning instruction, a BIOS lock screen instruction and a machine status query instruction. The user data request sends an SMS message through the cloud platform module to wake up the LTE-5G communication module of the specified computer device, and the LTE-5G communication module also includes a GPS positioning function.

[0068] Furthermore, the sensitive data analysis microservice unit is used to identify whether the data in the computer device is sensitive data through a deep learning recognition model;

[0069] The specific training process of the deep learning recognition model is as follows:

[0070] L1: Collect various types of data from computer devices, including sensitive data and non-sensitive data, with a total of 100,000 items of data collected;

[0071] L2: 100,000 data items are divided into training set, test set and validation set in a ratio of 8:1:1; the data in the training set all contain sensitive data, the data in the test set contains sensitive data and non-sensitive data, and the data in the validation set contains sensitive data and non-sensitive data;

[0072] L3: Use annotation tools to annotate the data in the training set and generate an XML file;

[0073] L4: After extracting features using the convolutional neural network algorithm, the deep learning recognition model trains the data in the training set one by one;

[0074] L5: The deep learning recognition model recognizes the data in the test set one by one and obtains the accuracy and error rate;

[0075] L6: If the accuracy and error rate do not meet the requirements, proceed to step L7; if the accuracy and error rate meet the requirements, the deep learning recognition model recognizes the data in the validation set one by one. If the accuracy and error rate meet the requirements, the training ends. If the accuracy and error rate do not meet the requirements, proceed to step L7;

[0076] L7: After manually adjusting the recognition weight coefficient of the deep learning recognition model, the data in the verification set are recognized one by one. If the recognition accuracy and error rate meet the requirements, the training ends. If not, the recognition weight coefficient is adjusted again and the data in the verification set are recognized one by one again. After each recognition of the data in the verification set, the recognition record is deleted until the recognition accuracy and error rate meet the requirements and the training ends.

[0077] Specifically, the deep learning recognition model may be a convolutional neural network (CNN), a long short-term memory network (LSTM) or a gated recurrent unit (GRU). Compared with the existing technology, the deep learning recognition model can achieve accurate erasure of sensitive data.

[0078] Furthermore, the sensitive data processing microservice unit, upon receiving the sensitive data erasure instruction, performs an operation of erasing sensitive data of a computer device;

[0079] The specific implementation process of the sensitive data erasure operation of the computer device is as follows:

[0080] S1: If the computer device is turned on, the erasing process is:

[0081] S11: Download an executable Eraser code from the remote ABT cloud server;

[0082] S12: Implanting the executable Eraser code into the BIOS of the computer device;

[0083] S13: When the computer device is in a boot state, the BIOS writes the executable Eraser code into the memory, the system of the computer device is in a boot state, and the system of the computer device reads the executable Eraser code from the memory;

[0084] S14: the executable Eraser code performs a sensitive data erasure operation, where the sensitive data is data identified by the deep learning recognition model;

[0085] S2: If the computer device is turned off, the erasing process is:

[0086] S21: When the request data receiving microservice unit receives the sensitive data erasure instruction from the user, the cloud platform module sends an SMS message to wake up the LTE-5G communication module of the designated computer device;

[0087] S22: If the LTE-5G communication module 5 receives the SMS message, it actively accesses the ABT cloud server and downloads an executable Eraser code;

[0088] S23: the LTE-5G communication module 5 transmits the sensitive data erasing instruction to the embedded controller EC. After receiving the instruction, the embedded controller EC restarts the computer device and performs a sensitive data erasing operation in the bios post process. The sensitive data is the data identified by the deep learning recognition model.

[0089] S24: After the processing is completed, the result is returned to the feedback module along the original path.

[0090] Furthermore, when the device status monitoring microservice unit receives the machine status query instruction, it uses a neural network prediction model for training, takes historical data as input and safety fault conditions as output, and establishes a fault prediction model; based on real-time monitoring data, it uses the trained fault prediction model to perform fault prediction, evaluate the health status of computer equipment, predict possible faults and the time when the faults will occur, and feed back to the feedback module.

[0091] Specifically, the neural network prediction model may be a convolutional neural network (CNN), a long short-term memory network (LSTM) or a gated recurrent unit (GRU). Compared with the prior art, the neural network prediction model can monitor the safety hazards of computer equipment in real time.

[0092] Furthermore, when the location positioning processing microservice unit receives the location positioning instruction, the LTE-5G communication module of the designated computer device feeds back the GPS position of the current designated computer device to the feedback module.

[0093] Furthermore, when the BIOS lock screen processing microservice unit receives the BIOS lock screen instruction, the LTE-5G communication module of the designated computer device transmits the BIOS lock screen instruction to the embedded controller EC. After receiving the instruction, the embedded controller EC invalidates the BIOS startup of the computer device, and the BIOS is in a locked screen state. A specific password is required to use the BIOS function.

[0094] Furthermore, the sensitive data erasure verification microservice unit performs identity authentication based on the sensitive data erasure instruction request, including:

[0095] Obtaining a computer device corresponding to a sensitive data erasure instruction request and verifying compliance of the computer device;

[0096] Verify the rationality of the frequency of requests for sensitive data erasure instructions;

[0097] Verify the integrity of the content of the WebSocket data packet corresponding to the sensitive data erasure instruction request;

[0098] When compliance, rationality and completeness are all verified, the verification of the sensitive data erasure instruction request is determined to be successful.

[0099] Specifically, identity authentication can use different encryption algorithms. Ring signature is an emerging digital signature scheme. Compared with conventional digital signatures, it has high security and can conceal the identity of the signer. Therefore, it is widely used in identity authentication scenarios that require anonymization. Its basic principle is: when the signer performs a digital signature, he can use the public key of the user on the ring and his own private key to calculate the signature at will without seeking the consent of other ring members. After receiving the signature sent by the ring, the verifier cannot determine which signer in the ring the signature comes from. Therefore, only the private key holder, that is, the signer, has the right to view the signature, and other members of the ring cannot view it, ensuring the security of data transmission. At the same time, the use of the ring signature encryption algorithm can well protect the privacy of users.

[0100] Elliptic Curve Cryptography Cryptographty (ECC) is a commonly used asymmetric cryptographic algorithm. Compared with conventional asymmetric algorithms, ECC has a shorter key length and higher security. This feature also determines that it is suitable for situations where the amount of encrypted data is large. Its basic principle is: define an ellipse curve equation on a plane coordinate system, define a base point P, and generate the final point G after k points are made, where k is the ECC private key and G is the ECC public key. The public key G is calculated using the base point, G = k*P, so it is easy to calculate the public key G. However, it is difficult to calculate the private key k when P and G are known, because division is more complicated for computers. This ensures the security of identity authentication.

[0101] Furthermore, after the sensitive data erasure instruction request is authenticated, the data storage module 3 organizes the sensitive data erasure instruction request to generate a verification sequence, stores the verification sequence in the data storage module 3, and associates the verification sequence with the corresponding data file; and sends the encrypted data file to the data storage module 3 for storage.

[0102] Specifically, compared with the prior art, identity authentication based on sensitive data erasure instruction requests can safely and accurately erase sensitive data without accidentally deleting data from computer devices that are not the target of loss.

[0103] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, any function of the computer security policy system described above is implemented.

[0104] Embodiment 2, as Figure 2 As shown:

[0105] When the cloud platform module 2 receives a user service request, it first determines whether the computer equipment is turned on or off:

[0106] (1) When the user's device is turned on, the original Eraser software is used to erase the device.

[0107] A1. First, a piece of Eraser code provided by Eraser software is implanted into the BIOS;

[0108] B1. When booting, the BIOS will spit out this code to the memory, and when the system OS starts, the system OS will read this code from the memory;

[0109] C1. The actual function of this code is to download an executable exe file from the remote ABT cloud server and execute it locally on the user. The exe file is generated by Eraser.

[0110] D1. When the user sends a service request, the cloud platform module 2 interacts with the user's local program to complete the entire service, including tracking, locking, erasing and recovery.

[0111] (2) When the user device is turned off, the erasure process is implemented through the following path

[0112] A2. When the cloud platform module 2 receives the user service instruction, the cloud platform module 2 sends an SMS message to wake up the LTE-5G communication module 5 of the specified device;

[0113] B2. LTE-5G communication module 5 is in a low-power listening state in S5 state. After receiving the SMS message, it actively accesses the ABT cloud server and processes the instructions issued by the server;

[0114] C2. After the LTE-5G communication module 5 is awakened, it checks that the instruction given by the cloud platform module 2 is an erase command, and then transmits the instruction to the EC. After receiving the instruction, the EC restarts the machine and executes the erase action in the bios post process;

[0115] D2. After processing, the results will be fed back to the user.

[0116] Specifically, when a user's computer device is lost, sensitive data can be erased quickly, securely and accurately regardless of whether it is turned on or connected to Wi-Fi.

[0117] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0118] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0119] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0120] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0121] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0122] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the apparatus according to an embodiment of the present invention. The present invention may also be implemented as a device or device program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may have the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

Claims

1. A computer security policy system based on a cloud platform, characterized in that: Including microservice module, cloud platform module, data storage module, feedback module and LTE-5G communication module; The microservice module adopts a microservice architecture developed based on Java, which includes a request data receiving microservice unit, a sensitive data analysis microservice unit, a sensitive data processing microservice unit, a location positioning processing microservice unit, a BIOS lock screen processing microservice unit, a device status monitoring microservice unit and a sensitive data erasure verification microservice unit; The cloud platform module adopts a microservice architecture developed based on Java. The cloud platform module is configured to include several microservice processing units and a system security authentication unit. Each microservice unit of the microservice module is connected to each microservice processing unit of the cloud platform module through the application processing center service in a one-to-one correspondence. Each microservice processing unit is provided with an external API interface. All connected devices are sent to each microservice processing unit of the cloud platform module for processing after being verified by the system security management unit. Each microservice processing unit provides an open API data interface for a third party. The data storage module is used to store data of the computer security policy system; the data storage module includes a Redis database for caching temporary data and a MySQL database for storing persistent log monitoring data. The MySQL database is deployed in a master-slave mode. The master MySQL database and the backup MySQL database are divided into a sensitive data cluster for storing a lost computer, a business database cluster for storing the status of monitoring computer equipment, a business database cluster for recording the user's use of the computer equipment, a business database cluster for recording the maintenance and repair records of the computer equipment, and a business database cluster for recording the user's feedback on the use of the computer equipment. The status of the computer equipment includes the running status of the equipment and the fault status of the equipment; The feedback module is used to feed back the result processed by the security policy system to the user; The LTE-5G communication module is built into the computer device. If the computer device is in a shutdown state, the module is in a low-power listening state.

2. A computer security policy system based on a cloud platform according to claim 1, characterized in that: The request data receiving microservice unit is used to receive the user's data request and adopts the WebSocket data packet format. The WebSocket data packet is composed of frames, each frame is represented by binary data, and each frame is composed of a frame header, a frame length, a frame data and a reserved field. The frame header is represented by 16 bytes, the frame length is represented by 16 bytes, the content length of the frame data is limited by the frame length, and the reserved field is represented by 32 bytes. The user data request includes at least a sensitive data erasure instruction, a location positioning instruction, a BIOS lock screen instruction and a machine status query instruction. The user data request sends an SMS message through the cloud platform module to wake up the LTE-5G communication module of the specified computer device, and the LTE-5G communication module also includes a GPS positioning function.

3. A computer security policy system based on a cloud platform according to claim 2, characterized in that: The sensitive data analysis microservice unit is used to identify whether the data in the computer device is sensitive data through a deep learning recognition model; The specific training process of the deep learning recognition model is as follows: L1: Collect various types of data from computer devices, including sensitive data and non-sensitive data, with a total of 100,000 items of data collected; L2: 100,000 data items are divided into training set, test set and validation set in a ratio of 8:1:1; the data in the training set all contain sensitive data, the data in the test set contains sensitive data and non-sensitive data, and the data in the validation set contains sensitive data and non-sensitive data; L3: Use annotation tools to annotate the data in the training set and generate an XML file; L4: After extracting features using the convolutional neural network algorithm, the deep learning recognition model trains the data in the training set one by one; L5: The deep learning recognition model recognizes the data in the test set one by one and obtains the accuracy and error rate; L6: If the accuracy and error rate do not meet the requirements, proceed to step L7; if the accuracy and error rate meet the requirements, the deep learning recognition model recognizes the data in the validation set one by one. If the accuracy and error rate meet the requirements, the training ends. If the accuracy and error rate do not meet the requirements, proceed to step L7; L7: After manually adjusting the recognition weight coefficient of the deep learning recognition model, the data in the verification set are recognized one by one. If the recognition accuracy and error rate meet the requirements, the training ends. If not, the recognition weight coefficient is adjusted again and the data in the verification set are recognized one by one again. After each recognition of the data in the verification set, the recognition record is deleted until the recognition accuracy and error rate meet the requirements and the training ends.

4. A cloud platform-based computer security policy system according to claim 3, characterized in that: The sensitive data processing microservice unit, upon receiving the sensitive data erasure instruction, performs an operation of erasing sensitive data of the computer device; The specific implementation process of the sensitive data erasure operation of the computer device is as follows: S1: If the computer device is turned on, the erasing process is: S11: Download an executable Eraser code from the remote ABT cloud server; S12: Implanting the executable Eraser code into the BIOS of the computer device; S13: When the computer device is in a boot state, the BIOS writes the executable Eraser code into the memory, the system of the computer device is in a boot state, and the system of the computer device reads the executable Eraser code from the memory; S14: the executable Eraser code performs a sensitive data erasure operation, where the sensitive data is data identified by the deep learning recognition model; S2: If the computer device is turned off, the erasing process is: S21: When the request data receiving microservice unit receives the sensitive data erasure instruction from the user, the cloud platform module sends an SMS message to wake up the LTE-5G communication module of the designated computer device; S22: If the LTE-5G communication module receives the SMS message, it actively accesses the ABT cloud server and downloads an executable Eraser code; S23: the LTE-5G communication module transmits the sensitive data erasure instruction to the embedded controller EC, and the embedded controller EC restarts the computer device after receiving the instruction, and performs a sensitive data erasure operation in the bios post process, wherein the sensitive data is the data identified by the deep learning recognition model; S24: After the processing is completed, the result is returned to the feedback module along the original path.

5. A cloud platform-based computer security policy system according to claim 4, characterized in that: When the device status monitoring microservice unit receives the machine status query instruction, it uses a neural network prediction model for training, takes historical data as input and safety fault conditions as output, and establishes a fault prediction model; based on real-time monitoring data, it uses the trained fault prediction model to perform fault prediction, evaluate the health status of computer equipment, predict possible faults and the time when the faults will occur, and feed back to the feedback module.

6. A cloud platform-based computer security policy system according to claim 5, characterized in that: When the location positioning processing microservice unit receives the location positioning instruction, the LTE-5G communication module of the designated computer device feeds back the GPS position of the current designated computer device to the feedback module.

7. A cloud platform-based computer security policy system according to claim 6, characterized in that: When the BIOS lock screen processing microservice unit receives the BIOS lock screen instruction, the LTE-5G communication module of the designated computer device transmits the BIOS lock screen instruction to the embedded controller EC. After receiving the instruction, the embedded controller EC invalidates the BIOS startup of the computer device, and the BIOS is in a lock screen state. A specific password is required to use the BIOS function.

8. A cloud platform-based computer security policy system according to claim 7, characterized in that: The sensitive data erasure verification microservice unit performs identity authentication based on the sensitive data erasure instruction request, including: Obtaining a computer device corresponding to a sensitive data erasure instruction request and verifying compliance of the computer device; Verify the rationality of the frequency of requests for sensitive data erasure instructions; Verify the integrity of the content of the WebSocket data packet corresponding to the sensitive data erasure instruction request; When compliance, rationality and completeness are all verified, the verification of the sensitive data erasure instruction request is determined to be successful.

9. A cloud platform-based computer security policy system according to claim 8, characterized in that: After the sensitive data erasure instruction request is authenticated, the data storage module organizes the sensitive data erasure instruction request to generate a verification sequence, stores the verification sequence in the data storage module, and associates the verification sequence with the corresponding data file; And the encrypted data file is sent to the data storage module for storage.

10. A computer readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, it is used to implement the functions of a cloud platform-based computer security policy system as described in any one of claims 1 to 7.

Images