Trust operation area verification method and system based on global analysis architecture

Abstract

The invention provides a trusted operation area verification method and system based on a global analysis architecture, and the method comprises the steps: setting a corresponding trust prefix for each operation area, determining a plurality of operation trust areas, and setting a corresponding real-time monitoring frequency for each operation trust area; and updating a real-time monitoring log corresponding to each operation trust area based on the real-time monitoring frequency, analyzing a real-time operation state of the corresponding operation trust area according to the real-time monitoring log, performing hierarchical verification on each real-time operation state, determining operation abnormal information of the corresponding operation trust area, and sending the operation abnormal information to the corresponding operation trust area. Tracking the operation abnormal information in a corresponding operation trust area, determining an abnormal server, obtaining historical working data of the corresponding abnormal server in a real-time monitoring log, identifying an abnormal reason of the corresponding abnormal information, and carrying out corresponding data interception and notification reminding; and whether the server is in a normal operation position or not can be found in time.

Description

Technical Field

[0001] The present invention relates to the field of abnormal supervision technology, and in particular to a trusted operation area verification method and system based on a global resolution architecture. Background Art

[0002] At present, most companies use the identity resolution system to manage data security. Whether it is a company involved in global supply chain management or a technology company with a distributed data center, the system can timely understand whether the server is in the trusted operation area at different time points through the system to ensure the security and compliance of key business data. For companies involved in sensitive information processing, such as financial institutions, healthcare companies, etc., the system can effectively prevent the non-compliant use of prefixes, provide solid protection for the company's data security, and avoid huge economic losses and reputation risks caused by data leakage or illegal access. The identity resolution system has the four functions of identification, resolution, information management, and security authentication, which meet the higher requirements of manufacturing application support and conform to the needs of intelligent manufacturing transformation and upgrading. It is an important support for solving information security, controllability, and sharing in the development and application of manufacturing industry, and is an important infrastructure for the transformation and upgrading of manufacturing industry.

[0003] However, with the development of science and technology, the amount of data of various enterprises is constantly increasing and the demand for information sharing is becoming more urgent, and the requirements for data security and compliance are gradually increasing. Handle identification resolution technology came into being, providing a unified identification and positioning method for information resources around the world. However, with the increasing complexity of the network environment and the continuous increase in security threats, simple identification resolution can no longer meet the needs of data security.

[0004] Therefore, the present invention provides a trusted operation area verification method and system based on a global resolution architecture. Summary of the invention

[0005] The present invention provides a trusted operation area verification method and system based on a global resolution architecture, which can timely detect whether the server is in a normal operation position by checking the area where the current server is running in real time. If the server is accidentally transferred to an untrusted area, measures can be taken immediately to prevent potential security risks and ensure the stable operation of the system.

[0006] The present invention provides a trusted operation area verification method based on a global resolution architecture, comprising:

[0007] Step 1: respectively set a corresponding trust prefix for each operation area, determine a number of operation trust areas, and respectively set a corresponding real-time monitoring frequency for each of the operation trust areas;

[0008] Step 2: updating the real-time monitoring log corresponding to each of the operation trust areas based on the real-time monitoring frequency, analyzing the real-time operation status of the corresponding operation trust area according to the real-time monitoring log and displaying it;

[0009] Step 3: Perform hierarchical verification on each of the real-time operation states, determine the operation abnormality information corresponding to the operation trust area, track the operation abnormality information in the corresponding operation trust area, and determine the abnormal server;

[0010] Step 4: Obtain historical working data of the corresponding abnormal server in the real-time monitoring log, identify the abnormal cause corresponding to the abnormal information, and perform corresponding data interception and notification reminders.

[0011] In one practicable manner,

[0012] The step 1 comprises:

[0013] Step 11: respectively obtaining the security development level corresponding to each operation area, setting a corresponding trust prefix for the corresponding operation area according to the security development level, determining a number of operation trust areas, grading the operation trust areas according to the trust prefixes, and determining a number of operation trust areas corresponding to each security development level;

[0014] Step 12: configuring an initial monitoring frequency for the corresponding operation trust area based on the security development level, respectively obtaining the number of servers corresponding to each of the operation trust areas, sorting the operation trust areas based on the number of servers, obtaining the last operation trust area at the end of the sorting, and considering the last initial monitoring frequency corresponding to the last operation trust area as the minimum threshold of the monitoring frequency;

[0015] Step 13: Calculate the number ratio between servers and non-servers included in each of the running trust areas respectively, add corresponding service weights to the corresponding running trust areas according to the number ratios, and use the service weights and the minimum threshold of the monitoring frequency to correct the corresponding initial monitoring frequency to obtain the real-time monitoring frequency corresponding to each of the running trust areas.

[0016] In one practicable manner,

[0017] Also includes:

[0018] Respectively obtain server addition / reduction data and non-server addition / reduction data corresponding to each of the operation trust zones;

[0019] Calculating a real-time quantity ratio corresponding to the running trust area according to the server addition / subtraction data and non-server addition / subtraction data;

[0020] The corresponding real-time monitoring frequency is synchronously corrected according to the real-time quantity ratio and the frequency monitoring minimum value.

[0021] In one practicable manner,

[0022] The step 2 comprises:

[0023] Step 21: sampling the operation data corresponding to the operation trust area based on the real-time monitoring frequency to obtain sampled operation data, and determining the log level of the corresponding operation trust area based on the trust prefix corresponding to each operation trust area;

[0024] Step 22: Perform dimensionality reduction processing on each of the sampled operation data to obtain the operation key information corresponding to the operation trust area, construct a corresponding timestamp according to the real-time monitoring frequency, combine the log level and the operation key information corresponding to each of the operation trust areas with the corresponding timestamp, and generate a real-time monitoring log corresponding to each of the operation trust areas;

[0025] Step 23: Analyze the real-time monitoring log in real time to determine a plurality of operation process characteristics corresponding to the operation trust area, determine the overall operation rule corresponding to the operation trust area based on the operation rule corresponding to each of the operation process characteristics, and determine the latest log data corresponding to the operation trust area according to the real-time monitoring log;

[0026] Step 24: Input the latest log data into the corresponding overall operation rule for rule matching, construct the real-time operation status of the corresponding operation trust area according to the rule matching result and input it into the corresponding terminal for display.

[0027] In one practicable manner,

[0028] The step 3 comprises:

[0029] Step 31: determining the server change information corresponding to the operation trust zone according to the real-time monitoring log, determining the server distribution information corresponding to the operation trust zone at each monitoring time, mapping the real-time operation status corresponding to each monitoring time in the server distribution information, and obtaining the server operation information corresponding to each server at different monitoring times;

[0030] Step 32: Generate an operation negotiation track of the corresponding server in the corresponding operation trust zone according to the server operation information, determine the trusted executable track corresponding to each operation trust zone according to the trust prefix corresponding to each operation trust zone, verify whether each operation negotiation track exceeds the corresponding trusted executable track, and determine the abnormal operation trust zone containing operation abnormality information;

[0031] Step 33: adjusting the real-time monitoring frequency of the abnormal operation trust area to the high-frequency monitoring frequency, collecting the high-frequency operation data of the abnormal operation trust area, searching for a plurality of associated data corresponding to the abnormal operation information in the high-frequency operation data, tracing each of the associated data, and determining the abnormal server corresponding to each of the associated data;

[0032] Step 34: respectively obtain the prescribed negotiation trajectory corresponding to each abnormal server, determine the deviant negotiation scope corresponding to the abnormal server, and determine the deviant negotiation content corresponding to the abnormal server, search for the corresponding abnormal server in the abnormal operation trust area, and mark the corresponding deviant negotiation scope and deviant negotiation content.

[0033] In one practicable manner,

[0034] Also includes:

[0035] Determining the deviant negotiation object corresponding to each abnormal server according to the deviant negotiation scope corresponding to each abnormal server;

[0036] estimating the content accepted by the deviant negotiation object according to the deviant negotiation content, and determining the degree of influence of the accepted content on the corresponding abnormal operation area;

[0037] When the impact level is higher than the safety level, interference content is constructed based on the accepted content and transmitted to the corresponding deviant negotiation object.

[0038] In one practicable manner,

[0039] The step 4 comprises:

[0040] Step 41: searching for an abnormal real-time monitoring log corresponding to an abnormal operation trust zone containing an abnormal server, extracting historical working data corresponding to the abnormal server from the abnormal real-time monitoring log, and dividing the historical working data into system sub-data, application sub-data, and access sub-data;

[0041] Step 42: identifying service function change information of the corresponding abnormal server according to the system sub-data, identifying service function management change information of the corresponding abnormal server according to the application sub-data, and identifying service negotiation change information of the corresponding abnormal server according to the access sub-data;

[0042] Step 43: Determine the abnormal cause corresponding to the abnormal server based on the service function change information, the service function management change information and the service negotiation change information corresponding to each abnormal server, generate a corresponding response strategy based on the abnormal cause, and use the response strategy to intercept data and notify reminders.

[0043] In one practicable manner,

[0044] Also includes:

[0045] The management terminal corresponding to the abnormal operation trust area is obtained, and a corresponding notification text and reminder method are generated according to the response strategy and transmitted to the management terminal for notification and reminder.

[0046] The present invention provides a trusted operation area verification system based on a global resolution architecture, comprising:

[0047] An effective supervision module is used to set a corresponding trust prefix for each operation area, determine a number of operation trust areas, and set a corresponding real-time monitoring frequency for each of the operation trust areas;

[0048] A log analysis module, used for updating the real-time monitoring log corresponding to each of the operation trust areas based on the real-time monitoring frequency, analyzing the real-time operation status of the corresponding operation trust area according to the real-time monitoring log and displaying it;

[0049] An abnormality verification module, used to perform hierarchical verification on each of the real-time operation states, determine the operation abnormality information corresponding to the operation trust area, track the operation abnormality information in the corresponding operation trust area, and determine the abnormal server;

[0050] The exception handling module is used to obtain the historical working data of the corresponding abnormal server in the real-time monitoring log, identify the abnormal cause corresponding to the abnormal information, and perform corresponding data interception and notification reminders.

[0051] In one practicable manner,

[0052] The effective supervision module comprises:

[0053] A trust configuration unit, used to respectively obtain a security development level corresponding to each operation area, set a corresponding trust prefix for the corresponding operation area according to the security development level, determine a number of operation trust areas, classify the operation trust areas according to the trust prefixes, and determine a number of operation trust areas corresponding to each security development level;

[0054] A frequency initialization unit is used to configure an initial monitoring frequency for a corresponding operation trust area based on the security development level, respectively obtain the number of servers corresponding to each of the operation trust areas, sort the operation trust areas based on the number of servers, obtain the last operation trust area at the end of the sorting, and regard the last initial monitoring frequency corresponding to the last operation trust area as the minimum threshold of the monitoring frequency;

[0055] The frequency establishment unit is used to respectively calculate the number ratio between the servers and non-servers included in each of the operation trust areas, add corresponding service weights to the corresponding operation trust areas according to the number ratios, and use the service weights and the minimum threshold of the monitoring frequency to correct the corresponding initial monitoring frequency to obtain the real-time monitoring frequency corresponding to each of the operation trust areas.

[0056] The achievable beneficial effects of the above technical solution are as follows: in order to verify the specific operating status of the trusted operating area, the present invention provides a strong guarantee for the security of information sharing and architecture. First, in order to demarcate the trusted operating area from other areas, a corresponding trust prefix is ​​set for each operating area, and different real-time monitoring frequencies are set for different operating trust areas, which can not only realize data monitoring, but also adjust the frequency according to the actual situation of the operating trust area to avoid the phenomenon of supervision failure. Then, the operating trust area is monitored according to the real-time monitoring frequency, and the corresponding real-time monitoring log is generated. The real-time operating status of the operating trust area is determined according to the real-time monitoring log. The operating abnormality information of the operating trust area is determined by performing layered verification on the real-time operating status, and the abnormal server is tracked. In order to avoid losses caused by data leakage, abnormal identification is performed on the abnormal server, and data is intercepted according to the cause of the abnormality and the relevant personnel are notified to handle it in time, thereby improving the effective supervision of the operating trust area and improving the security of the operating trust area.

[0057] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0058] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0060] Figure 1A schematic diagram of a workflow of a trusted operation area verification method based on a global resolution architecture in an embodiment of the present invention;

[0061] Figure 2 The figure is a schematic diagram of the composition of a trusted operation area verification system based on a global resolution architecture in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0063] Example 1

[0064] This embodiment provides a trusted operation area verification method and system based on a global resolution architecture, such as Figure 1 As shown, including:

[0065] Step 1: respectively set a corresponding trust prefix for each operation area, determine a number of operation trust areas, and respectively set a corresponding real-time monitoring frequency for each of the operation trust areas;

[0066] Step 2: updating the real-time monitoring log corresponding to each of the operation trust areas based on the real-time monitoring frequency, analyzing the real-time operation status of the corresponding operation trust area according to the real-time monitoring log and displaying it;

[0067] Step 3: Perform hierarchical verification on each of the real-time operation states, determine the operation abnormality information corresponding to the operation trust area, track the operation abnormality information in the corresponding operation trust area, and determine the abnormal server;

[0068] Step 4: Obtain historical working data of the corresponding abnormal server in the real-time monitoring log, identify the abnormal cause corresponding to the abnormal information, and perform corresponding data interception and notification reminders.

[0069] In this example, the trust prefix indicates an identifier used to distinguish between the trust zone and the non-trust zone, and also indicates different trust zones. The trust prefixes include: TEEA (used to identify all applications or modules related to the trusted execution environment), SEC_ (indicating security-related functions or modules), TEE_ (used to identify APIs or functions related to TEE), and SCT_ (representing a module for security context, usually used to describe context management in EE);

[0070] In this example, the operation area represents a specified area, for example: City A, Community B, Room C;

[0071] In this example, the operation trust zone means that legal data activities can be performed within the operation trust zone;

[0072] In this example, each operational trust region corresponds to a different real-time monitoring frequency;

[0073] In this example, the operation abnormality information refers to information presented when an abnormality occurs in an operation trust area;

[0074] In this example, the real-time monitoring log refers to the log generated when the work of an operation trust zone is supervised in a 24-hour cycle, and one operation trust zone corresponds to one real-time monitoring log, and the real-time monitoring log is in a continuous updating state;

[0075] In this example, the trusted operation area verification method and system based on the global resolution architecture of the present invention, as the basic module of the Handle identification resolution technology, has a wide and important scope of use. The trusted operation area verification method and system of the global resolution architecture can provide unified security standards and verification mechanisms for institutions in different countries and regions, ensure the security of cross-border data transmission and sharing, break down information barriers, and promote global economic cooperation and cultural exchanges;

[0076] In this example, when an abnormal situation is detected, notifying the user via email allows relevant personnel to quickly understand the severity and urgency of the problem. Users can take timely measures, such as launching emergency plans, notifying the technical team to handle the problem, etc., to prevent the problem from further expanding;

[0077] In this example, the purpose of layered authentication is: 1. Monitoring the server operation area can effectively prevent unauthorized access. If the server appears to be out of the trusted operation area, it is likely to have been attacked maliciously or illegally transferred. Timely detection of such abnormal situations can prevent attackers from further invading the system and protect the security of sensitive data and business;

[0078] 2. Based on the records of abnormal situations, potential security risk points can be analyzed, and then the security strategy can be adjusted and improved. For example, access control to specific areas can be strengthened, identity authentication mechanisms can be added, etc., to improve the overall security of the system.

[0079] The working principle and beneficial effects of the above technical solution: In order to verify the specific operating status of the trusted operating area, the present invention provides a strong guarantee for the security of information sharing and architecture. First, in order to divide the trusted operating area from other areas, a corresponding trust prefix is ​​set for each operating area, and different real-time monitoring frequencies are set for different operating trust areas, which can not only realize data monitoring, but also adjust the frequency according to the actual situation of the operating trust area to avoid the phenomenon of supervision failure. Then, the operating trust area is monitored according to the real-time monitoring frequency, and the corresponding real-time monitoring log is generated. The real-time operating status of the operating trust area is determined according to the real-time monitoring log. The operating abnormality information of the operating trust area is determined by performing layered verification on the real-time operating status, and the abnormal server is tracked. In order to avoid losses caused by data leakage, abnormal identification is performed on the abnormal server, and data is intercepted according to the abnormal cause and the relevant personnel are notified to handle it in time, thereby improving the effective supervision of the operating trust area and improving the security of the operating trust area.

[0080] Example 2

[0081] On the basis of Example 1, the trusted operation area verification method based on the global resolution architecture, the step 1 comprises:

[0082] Step 11: respectively obtaining the security development level corresponding to each operation area, setting a corresponding trust prefix for the corresponding operation area according to the security development level, determining a number of operation trust areas, grading the operation trust areas according to the trust prefixes, and determining a number of operation trust areas corresponding to each security development level;

[0083] Step 12: configuring an initial monitoring frequency for the corresponding operation trust area based on the security development level, respectively obtaining the number of servers corresponding to each of the operation trust areas, sorting the operation trust areas based on the number of servers, obtaining the last operation trust area at the end of the sorting, and considering the last initial monitoring frequency corresponding to the last operation trust area as the minimum threshold of the monitoring frequency;

[0084] Step 13: Calculate the number ratio between servers and non-servers included in each of the running trust areas respectively, add corresponding service weights to the corresponding running trust areas according to the number ratios, and use the service weights and the minimum threshold of the monitoring frequency to correct the corresponding initial monitoring frequency to obtain the real-time monitoring frequency corresponding to each of the running trust areas.

[0085] In this example, the minimum threshold of monitoring frequency means that the set monitoring frequency cannot be lower than this value;

[0086] In this example, the safety development level indicates the current safety level of the operating area;

[0087] In this example, the service weight is related to the number of servers. The more servers there are, the more likely data leakage will occur, and the greater the service weight.

[0088] The working principle and beneficial effects of the above technical solution: Since different operation trust areas have different operation properties, when monitoring different operation trust areas, corresponding monitoring frequencies should be set for them according to their actual needs. First, the corresponding trust prefix is ​​set for it according to the security development level of the operation area, and then the corresponding initial monitoring frequency is configured for the operation trust area in combination with the security development level of each operation trust area. Then, the corresponding service weight is constructed in combination with the ratio of the number of servers and non-servers in each operation trust area. At the same time, the minimum threshold of the monitoring frequency is set according to the actual situation. Finally, the initial monitoring frequency is corrected according to the service weight and the minimum threshold of the monitoring frequency, and the real-time monitoring frequency of each operation trust area is obtained. By setting the monitoring frequency and the trust operation area for a specific prefix, it can be recorded and judged whether the current service is running in the trust area in the future, thereby improving the security of the system.

[0089] Example 3

[0090] On the basis of Example 2, the trusted operation area verification method based on the global resolution architecture further includes:

[0091] Respectively obtain server addition / reduction data and non-server addition / reduction data corresponding to each of the operation trust zones;

[0092] Calculating a real-time quantity ratio corresponding to the running trust area according to the server addition / subtraction data and non-server addition / subtraction data;

[0093] The corresponding real-time monitoring frequency is synchronously corrected according to the real-time quantity ratio and the frequency monitoring minimum value.

[0094] The working principle and beneficial effects of the above technical solution: Since the number of servers and non-servers in the running trust area is constantly changing, adjusting the real-time monitoring frequency according to the change can ensure the effectiveness of monitoring and achieve synchronous monitoring.

[0095] Example 4

[0096] On the basis of Example 1, the trusted operation area verification method based on the global resolution architecture, the step 2 includes:

[0097] Step 21: sampling the operation data corresponding to the operation trust area based on the real-time monitoring frequency to obtain sampled operation data, and determining the log level of the corresponding operation trust area based on the trust prefix corresponding to each operation trust area;

[0098] Step 22: Perform dimensionality reduction processing on each of the sampled operation data to obtain the operation key information corresponding to the operation trust area, construct a corresponding timestamp according to the real-time monitoring frequency, combine the log level and the operation key information corresponding to each of the operation trust areas with the corresponding timestamp, and generate a real-time monitoring log corresponding to each of the operation trust areas;

[0099] Step 23: Analyze the real-time monitoring log in real time to determine a plurality of operation process characteristics corresponding to the operation trust area, determine the overall operation rule corresponding to the operation trust area based on the operation rule corresponding to each of the operation process characteristics, and determine the latest log data corresponding to the operation trust area according to the real-time monitoring log;

[0100] Step 24: Input the latest log data into the corresponding overall operation rule for rule matching, construct the real-time operation status of the corresponding operation trust area according to the rule matching result and input it into the corresponding terminal for display.

[0101] In this example, the log level indicates the importance of the log, including: DEBUG, INFO, WARNING, ERROR, CRITICAL;

[0102] In this example, the dimensionality reduction process means eliminating redundancy in the sampled running data and reducing the dimension of the sampled running data by one degree;

[0103] In this example, the operation critical information refers to information in the operation trust region that determines the state of the operation trust region;

[0104] In this example, the real-time monitoring log is expressed as: [timestamp]-[log level]-[key operation information].

[0105] The working principle and beneficial effects of the above technical solution are as follows: data sampling is performed on the operation trust area according to the real-time monitoring frequency that has been set, the collected data is subjected to dimensionality reduction processing, the operation key information of the operation trust area is determined, and the log level of the operation trust area is determined according to the trust prefix of the operation trust area, and the corresponding timestamp is constructed according to the real-time monitoring frequency, and the log level and the operation key information are further combined with the timestamp to construct the real-time monitoring log of the operation trust area, and then the real-time monitoring log is further analyzed to generate the operation process characteristics of the operation trust area, and the overall operation law of the operation trust area is constructed according to the operation process characteristics, and the latest log data is analyzed according to the overall operation law, and the real-time operation status of the operation trust area is generated according to the law analysis results. In this way, the latest log data can be analyzed at each timestamp, so as to obtain the corresponding real-time operation status of the operation trust area at different times, effectively avoiding the interference of delay and achieving the purpose of synchronous monitoring.

[0106] Example 5

[0107] On the basis of Example 1, the trusted operation area verification method based on the global resolution architecture, the step 3 includes:

[0108] Step 31: determining the server change information corresponding to the operation trust zone according to the real-time monitoring log, determining the server distribution information corresponding to the operation trust zone at each monitoring time, mapping the real-time operation status corresponding to each monitoring time in the server distribution information, and obtaining the server operation information corresponding to each server at different monitoring times;

[0109] Step 32: Generate an operation negotiation track of the corresponding server in the corresponding operation trust zone according to the server operation information, determine the trusted executable track corresponding to each operation trust zone according to the trust prefix corresponding to each operation trust zone, verify whether each operation negotiation track exceeds the corresponding trusted executable track, and determine the abnormal operation trust zone containing operation abnormality information;

[0110] Step 33: adjusting the real-time monitoring frequency of the abnormal operation trust area to the high-frequency monitoring frequency, collecting the high-frequency operation data of the abnormal operation trust area, searching for a plurality of associated data corresponding to the abnormal operation information in the high-frequency operation data, tracing each of the associated data, and determining the abnormal server corresponding to each of the associated data;

[0111] Step 34: respectively obtain the prescribed negotiation trajectory corresponding to each abnormal server, determine the deviant negotiation scope corresponding to the abnormal server, and determine the deviant negotiation content corresponding to the abnormal server, search for the corresponding abnormal server in the abnormal operation trust area, and mark the corresponding deviant negotiation scope and deviant negotiation content.

[0112] In this example, the server change information includes: server switching mode, server switch, server increase, server decrease, server failure;

[0113] In this example, the supervision moment is related to the corresponding real-time supervision frequency;

[0114] In this example, the server operation information refers to information generated when the server is working;

[0115] In this example, the operation negotiation trace represents the footprint generated when the operation trust region negotiates with other servers or non-servers during the operation process;

[0116] In this example, high-frequency monitoring frequency refers to the process of high-frequency supervision of abnormal operation trust regions;

[0117] In this example, the associated data represents data related to the abnormal operation information in the abnormal operation trust region;

[0118] In this example, the prescribed negotiation trajectory represents the negotiation trajectory presented by the abnormal server in a normal working state;

[0119] In this example, the deviant negotiation content refers to the content of data exchange or information exchange between the abnormal server and the unsafe server or the unsafe non-server.

[0120] The working principle and beneficial effects of the above technical solution: In order to quickly identify whether a server is abnormal and quickly locate an abnormal server, the server change information in the operation trust area is determined according to the real-time monitoring log, and the server distribution information at each supervision moment is determined. The server operation information presented by a server at different supervision moments is further determined in combination with the corresponding real-time operation status. Then, the operation negotiation trajectory of the server in the operation trust area is determined based on the server operation information. The abnormal server is determined by analyzing the legality of the operation negotiation trajectory. At the same time, its deviant negotiation scope and deviant negotiation content are determined according to its prescribed negotiation trajectory and marked in the corresponding operation trust area. Multiple abnormal servers can be supervised at the same time to achieve rapid identification and rapid positioning, and effectively avoid data leakage.

[0121] Example 6

[0122] On the basis of Example 5, the trusted operation area verification method based on the global resolution architecture further includes:

[0123] Determining the deviant negotiation object corresponding to each abnormal server according to the deviant negotiation scope corresponding to each abnormal server;

[0124] estimating the content accepted by the deviant negotiation object according to the deviant negotiation content, and determining the degree of influence of the accepted content on the corresponding abnormal operation area;

[0125] When the impact level is higher than the safety level, interference content is constructed based on the accepted content and transmitted to the corresponding deviant negotiation object.

[0126] The working principle and beneficial effects of the above technical solution are as follows: when data or information has been leaked, the object of the negotiation is prevented from obtaining valid content, interference content is established based on the content it has received, and then the interference content is used to destroy the content it has received, thereby minimizing the risk of leakage.

[0127] Example 7

[0128] On the basis of Example 1, the trusted operation area verification method based on the global resolution architecture, the step 4 comprises:

[0129] Step 41: searching for an abnormal real-time monitoring log corresponding to an abnormal operation trust zone containing an abnormal server, extracting historical working data corresponding to the abnormal server from the abnormal real-time monitoring log, and dividing the historical working data into system sub-data, application sub-data, and access sub-data;

[0130] Step 42: identifying service function change information of the corresponding abnormal server according to the system sub-data, identifying service function management change information of the corresponding abnormal server according to the application sub-data, and identifying service negotiation change information of the corresponding abnormal server according to the access sub-data;

[0131] Step 43: Determine the abnormal cause corresponding to the abnormal server based on the service function change information, the service function management change information and the service negotiation change information corresponding to each abnormal server, generate a corresponding response strategy based on the abnormal cause, and use the response strategy to intercept data and notify reminders.

[0132] In this example, the service function change information indicates information generated when the abnormal server increases or decreases service functions, the service function management change information indicates information generated when the management terminal manages the abnormal server differently, and the service negotiation change information indicates information generated when the abnormal server negotiates with other servers or non-servers;

[0133] In this example, the response strategy includes two parts: data interception and notification reminder.

[0134] The working principle and beneficial effects of the above technical solution are as follows: when an abnormal server has appeared in the running trust area, the historical working data of the abnormal server is extracted from its abnormal real-time monitoring log, and then the various change information of the abnormal server is identified, thereby determining the abnormal cause of the abnormal server, and finally generating a corresponding response strategy to intercept data and notify reminders, and further intercept and process the leaked data or information, thereby minimizing the risk of data leakage through multiple insurances.

[0135] Example 8

[0136] Based on Example 7, the trusted operation area verification method based on the global resolution architecture further includes:

[0137] The management terminal corresponding to the abnormal operation trust area is obtained, and a corresponding notification text and reminder method are generated according to the response strategy and transmitted to the management terminal for notification and reminder.

[0138] The working principle and beneficial effects of the above technical solution are as follows: different abnormal operation trust areas are managed and reminded differently, so that managers can make decisions as quickly as possible.

[0139] Example 9

[0140] This embodiment provides a trusted operation area verification system based on a global resolution architecture, such as Figure 2 As shown, including:

[0141] An effective supervision module is used to set a corresponding trust prefix for each operation area, determine a number of operation trust areas, and set a corresponding real-time monitoring frequency for each of the operation trust areas;

[0142] A log analysis module, used for updating the real-time monitoring log corresponding to each of the operation trust areas based on the real-time monitoring frequency, analyzing the real-time operation status of the corresponding operation trust area according to the real-time monitoring log and displaying it;

[0143] An abnormality verification module, used to perform hierarchical verification on each of the real-time operation states, determine the operation abnormality information corresponding to the operation trust area, track the operation abnormality information in the corresponding operation trust area, and determine the abnormal server;

[0144] The exception handling module is used to obtain the historical working data of the corresponding abnormal server in the real-time monitoring log, identify the abnormal cause corresponding to the abnormal information, and perform corresponding data interception and notification reminders.

[0145] In this example, the trust prefix indicates an identifier used to distinguish between the trust zone and the non-trust zone, and also indicates different trust zones. The trust prefixes include: TEEA (used to identify all applications or modules related to the trusted execution environment), SEC_ (indicating security-related functions or modules), TEE_ (used to identify APIs or functions related to TEE), and SCT_ (representing a module for security context, usually used to describe context management in EE);

[0146] In this example, the operation area represents a specified area, for example: City A, Community B, Room C;

[0147] In this example, the operation trust zone means that legal data activities can be performed within the operation trust zone;

[0148] In this example, each operational trust region corresponds to a different real-time monitoring frequency;

[0149] In this example, the operation abnormality information refers to information presented when an abnormality occurs in an operation trust area;

[0150] In this example, the real-time monitoring log refers to the log generated when the work of an operation trust zone is supervised in a 24-hour cycle, and one operation trust zone corresponds to one real-time monitoring log, and the real-time monitoring log is in a continuous updating state;

[0151] In this example, the trusted operation area verification method and system based on the global resolution architecture of the present invention, as the basic module of the Handle identification resolution technology, has a wide and important scope of use. The trusted operation area verification method and system of the global resolution architecture can provide unified security standards and verification mechanisms for institutions in different countries and regions, ensure the security of cross-border data transmission and sharing, break down information barriers, and promote global economic cooperation and cultural exchanges;

[0152] In this example, when an abnormal situation is detected, notifying the user via email allows relevant personnel to quickly understand the severity and urgency of the problem. Users can take timely measures, such as launching emergency plans, notifying the technical team to handle the problem, etc., to prevent the problem from further expanding;

[0153] In this example, the purpose of layered authentication is: 1. Monitoring the server operation area can effectively prevent unauthorized access. If the server appears to be out of the trusted operation area, it is likely to have been attacked maliciously or illegally transferred. Timely detection of such abnormal situations can prevent attackers from further invading the system and protect the security of sensitive data and business;

[0154] 2. Based on the records of abnormal situations, potential security risk points can be analyzed, and then the security strategy can be adjusted and improved. For example, access control to specific areas can be strengthened, identity authentication mechanisms can be added, etc., to improve the overall security of the system.

[0155] The working principle and beneficial effects of the above technical solution: In order to verify the specific operating status of the trusted operating area, the present invention provides a strong guarantee for the security of information sharing and architecture. First, in order to divide the trusted operating area from other areas, a corresponding trust prefix is ​​set for each operating area, and different real-time monitoring frequencies are set for different operating trust areas, which can not only realize data monitoring, but also adjust the frequency according to the actual situation of the operating trust area to avoid the phenomenon of supervision failure. Then, the operating trust area is monitored according to the real-time monitoring frequency, and the corresponding real-time monitoring log is generated. The real-time operating status of the operating trust area is determined according to the real-time monitoring log. The operating abnormality information of the operating trust area is determined by performing layered verification on the real-time operating status, and the abnormal server is tracked. In order to avoid losses caused by data leakage, abnormal identification is performed on the abnormal server, and data is intercepted according to the abnormal cause and the relevant personnel are notified to handle it in time, thereby improving the effective supervision of the operating trust area and improving the security of the operating trust area.

[0156] Example 10

[0157] On the basis of Example 9, the trust operation area verification system based on the global resolution architecture, the effective supervision module includes:

[0158] A trust configuration unit, used to respectively obtain a security development level corresponding to each operation area, set a corresponding trust prefix for the corresponding operation area according to the security development level, determine a number of operation trust areas, classify the operation trust areas according to the trust prefixes, and determine a number of operation trust areas corresponding to each security development level;

[0159] A frequency initialization unit is used to configure an initial monitoring frequency for a corresponding operation trust area based on the security development level, respectively obtain the number of servers corresponding to each of the operation trust areas, sort the operation trust areas based on the number of servers, obtain the last operation trust area at the end of the sorting, and regard the last initial monitoring frequency corresponding to the last operation trust area as the minimum threshold of the monitoring frequency;

[0160] The frequency establishment unit is used to respectively calculate the number ratio between the servers and non-servers included in each of the operation trust areas, add corresponding service weights to the corresponding operation trust areas according to the number ratios, and use the service weights and the minimum threshold of the monitoring frequency to correct the corresponding initial monitoring frequency to obtain the real-time monitoring frequency corresponding to each of the operation trust areas.

[0161] In this example, the minimum threshold of monitoring frequency means that the set monitoring frequency cannot be lower than this value;

[0162] In this example, the safety development level indicates the current safety level of the operating area;

[0163] In this example, the service weight is related to the number of servers. The more servers there are, the more likely data leakage will occur, and the greater the service weight.

[0164] The working principle and beneficial effects of the above technical solution: Since different operation trust areas have different operation properties, when monitoring different operation trust areas, corresponding monitoring frequencies should be set for them according to their actual needs. First, the corresponding trust prefix is ​​set for it according to the security development level of the operation area, and then the corresponding initial monitoring frequency is configured for the operation trust area in combination with the security development level of each operation trust area. Then, the corresponding service weight is constructed in combination with the ratio of the number of servers and non-servers in each operation trust area. At the same time, the minimum threshold of the monitoring frequency is set according to the actual situation. Finally, the initial monitoring frequency is corrected according to the service weight and the minimum threshold of the monitoring frequency, and the real-time monitoring frequency of each operation trust area is obtained. By setting the monitoring frequency and the trust operation area for a specific prefix, it can be recorded and judged whether the current service is running in the trust area in the future, thereby improving the security of the system.

[0165] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A trusted operation area verification method based on a global resolution architecture, characterized in that: include: Step 1: respectively set a corresponding trust prefix for each operation area, determine a number of operation trust areas, and respectively set a corresponding real-time monitoring frequency for each of the operation trust areas; Step 2: updating the real-time monitoring log corresponding to each of the operation trust areas based on the real-time monitoring frequency, analyzing the real-time operation status of the corresponding operation trust area according to the real-time monitoring log and displaying it; Step 3: Perform hierarchical verification on each of the real-time operation states, determine the operation abnormality information corresponding to the operation trust area, track the operation abnormality information in the corresponding operation trust area, and determine the abnormal server; Step 4: Obtain historical working data of the corresponding abnormal server in the real-time monitoring log, identify the abnormal cause corresponding to the abnormal information, and perform corresponding data interception and notification reminders.

2. A method for verifying a trusted operation area based on a global resolution architecture as claimed in claim 1, characterized in that: The step 1 comprises: Step 11: respectively obtaining the security development level corresponding to each operation area, setting a corresponding trust prefix for the corresponding operation area according to the security development level, determining a number of operation trust areas, grading the operation trust areas according to the trust prefixes, and determining a number of operation trust areas corresponding to each security development level; Step 12: configuring an initial monitoring frequency for the corresponding operation trust area based on the security development level, respectively obtaining the number of servers corresponding to each of the operation trust areas, sorting the operation trust areas based on the number of servers, obtaining the last operation trust area at the end of the sorting, and considering the last initial monitoring frequency corresponding to the last operation trust area as the minimum threshold of the monitoring frequency; Step 13: Calculate the number ratio between servers and non-servers included in each of the running trust areas respectively, add corresponding service weights to the corresponding running trust areas according to the number ratios, and use the service weights and the minimum threshold of the monitoring frequency to correct the corresponding initial monitoring frequency to obtain the real-time monitoring frequency corresponding to each of the running trust areas.

3. A method for verifying a trusted operation area based on a global resolution architecture as claimed in claim 2, characterized in that: Also includes: Respectively obtain server addition / reduction data and non-server addition / reduction data corresponding to each of the operation trust zones; Calculating a real-time quantity ratio corresponding to the running trust area according to the server addition / subtraction data and non-server addition / subtraction data; The corresponding real-time monitoring frequency is synchronously corrected according to the real-time quantity ratio and the frequency monitoring minimum value.

4. A method for verifying a trusted operation area based on a global resolution architecture as claimed in claim 1, characterized in that: The step 2 comprises: Step 21: sampling the operation data corresponding to the operation trust area based on the real-time monitoring frequency to obtain sampled operation data, and determining the log level of the corresponding operation trust area based on the trust prefix corresponding to each operation trust area; Step 22: Perform dimensionality reduction processing on each of the sampled operation data to obtain the operation key information corresponding to the operation trust area, construct a corresponding timestamp according to the real-time monitoring frequency, combine the log level and the operation key information corresponding to each of the operation trust areas with the corresponding timestamp, and generate a real-time monitoring log corresponding to each of the operation trust areas; Step 23: Analyze the real-time monitoring log in real time to determine a plurality of operation process characteristics corresponding to the operation trust area, determine the overall operation rule corresponding to the operation trust area based on the operation rule corresponding to each of the operation process characteristics, and determine the latest log data corresponding to the operation trust area according to the real-time monitoring log; Step 24: Input the latest log data into the corresponding overall operation rule for rule matching, construct the real-time operation status of the corresponding operation trust area according to the rule matching result and input it into the corresponding terminal for display.

5. A method for verifying a trusted operation area based on a global resolution architecture as claimed in claim 1, characterized in that: The step 3 comprises: Step 31: determining the server change information corresponding to the operation trust zone according to the real-time monitoring log, determining the server distribution information corresponding to the operation trust zone at each monitoring time, mapping the real-time operation status corresponding to each monitoring time in the server distribution information, and obtaining the server operation information corresponding to each server at different monitoring times; Step 32: Generate an operation negotiation track of the corresponding server in the corresponding operation trust zone according to the server operation information, determine the trusted executable track corresponding to each operation trust zone according to the trust prefix corresponding to each operation trust zone, verify whether each operation negotiation track exceeds the corresponding trusted executable track, and determine the abnormal operation trust zone containing operation abnormality information; Step 33: adjusting the real-time monitoring frequency of the abnormal operation trust area to the high-frequency monitoring frequency, collecting the high-frequency operation data of the abnormal operation trust area, searching for a plurality of associated data corresponding to the abnormal operation information in the high-frequency operation data, tracing each of the associated data, and determining the abnormal server corresponding to each of the associated data; Step 34: respectively obtain the prescribed negotiation trajectory corresponding to each abnormal server, determine the deviant negotiation scope corresponding to the abnormal server, and determine the deviant negotiation content corresponding to the abnormal server, search for the corresponding abnormal server in the abnormal operation trust area, and mark the corresponding deviant negotiation scope and deviant negotiation content.

6. A method for verifying a trusted operation area based on a global resolution architecture as claimed in claim 5, characterized in that: Also includes: Determining the deviant negotiation object corresponding to each abnormal server according to the deviant negotiation scope corresponding to each abnormal server; estimating the content accepted by the deviant negotiation object according to the deviant negotiation content, and determining the degree of influence of the accepted content on the corresponding abnormal operation area; When the impact level is higher than the safety level, interference content is constructed based on the accepted content and transmitted to the corresponding deviant negotiation object.

7. A method for verifying a trusted operation area based on a global resolution architecture as claimed in claim 1, characterized in that: The step 4 comprises: Step 41: searching for an abnormal real-time monitoring log corresponding to an abnormal operation trust zone containing an abnormal server, extracting historical working data corresponding to the abnormal server from the abnormal real-time monitoring log, and dividing the historical working data into system sub-data, application sub-data, and access sub-data; Step 42: identifying service function change information of the corresponding abnormal server according to the system sub-data, identifying service function management change information of the corresponding abnormal server according to the application sub-data, and identifying service negotiation change information of the corresponding abnormal server according to the access sub-data; Step 43: Determine the abnormal cause corresponding to the abnormal server based on the service function change information, the service function management change information and the service negotiation change information corresponding to each abnormal server, generate a corresponding response strategy based on the abnormal cause, and use the response strategy to intercept data and notify reminders.

8. A method for verifying a trusted operation area based on a global resolution architecture as claimed in claim 7, characterized in that: Also includes: The management terminal corresponding to the abnormal operation trust area is obtained, and a corresponding notification text and reminder method are generated according to the response strategy and transmitted to the management terminal for notification and reminder.

9. A trusted operation area verification system based on a global resolution architecture, characterized in that: include: An effective supervision module is used to set a corresponding trust prefix for each operation area, determine a number of operation trust areas, and set a corresponding real-time monitoring frequency for each of the operation trust areas; A log analysis module, used for updating the real-time monitoring log corresponding to each of the operation trust areas based on the real-time monitoring frequency, analyzing the real-time operation status of the corresponding operation trust area according to the real-time monitoring log and displaying it; An abnormality verification module, used to perform hierarchical verification on each of the real-time operation states, determine the operation abnormality information corresponding to the operation trust area, track the operation abnormality information in the corresponding operation trust area, and determine the abnormal server; The exception handling module is used to obtain the historical working data of the corresponding abnormal server in the real-time monitoring log, identify the abnormal cause corresponding to the abnormal information, and perform corresponding data interception and notification reminders.

10. A trusted operation area verification system based on a global resolution architecture as claimed in claim 9, characterized in that: The effective supervision module comprises: A trust configuration unit, used to respectively obtain a security development level corresponding to each operation area, set a corresponding trust prefix for the corresponding operation area according to the security development level, determine a number of operation trust areas, classify the operation trust areas according to the trust prefixes, and determine a number of operation trust areas corresponding to each security development level; A frequency initialization unit is used to configure an initial monitoring frequency for a corresponding operation trust area based on the security development level, respectively obtain the number of servers corresponding to each of the operation trust areas, sort the operation trust areas based on the number of servers, obtain the last operation trust area at the end of the sorting, and regard the last initial monitoring frequency corresponding to the last operation trust area as the minimum threshold of the monitoring frequency; The frequency establishment unit is used to respectively calculate the number ratio between the servers and non-servers included in each of the operation trust areas, add corresponding service weights to the corresponding operation trust areas according to the number ratios, and use the service weights and the minimum threshold of the monitoring frequency to correct the corresponding initial monitoring frequency to obtain the real-time monitoring frequency corresponding to each of the operation trust areas.

Images