Integrated information security system supporting multi-platform environment

Abstract

The invention relates to an integrated information security system supporting a multi-platform environment, and the system comprises an identity authentication and authority management module which is used for verifying the identity or authority of a logged-in user, and allowing the user to carry out the next operation when the verification is passed; the key management module is used for generating, distributing, storing, updating and cancelling keys; the data encryption and decryption module is used for carrying out encrypted storage, encrypted transmission and decryption on target data according to a request sent by a user and the key distributed by the key management module; and the auditing and log recording module is used for recording all encryption and decryption operations, and giving an abnormal alarm when the encryption or decryption operations are abnormal. According to the invention, by using the data encryption and decryption module and the key management module, different data streams can be ensured to be encrypted and protected in the storage and transmission process, and data is prevented from being stolen or tampered; in addition, a modular design thought is adopted, different service scenes can be flexibly adapted, and unified safety management is achieved.

Description

Technical Field

[0001] The present invention relates to the field of cryptographic technology, and in particular to an integrated information security system supporting a multi-platform environment. Background Art

[0002] With the rapid development of government, enterprise, finance, Internet and other industries, data interaction is becoming more and more frequent, and the transmission and processing of large amounts of sensitive data have brought severe network security challenges. Traditional network security equipment (such as firewalls and intrusion detection systems) are usually unable to provide effective protection against security threats in data transmission, especially when dealing with complex environments with high concurrency, multiple platforms, and multiple tasks. At present, many platform business systems lack effective protection for sensitive data in their designs. In the R&D process, there is insufficient understanding of encryption and decryption technology, and the comprehensive application of encryption and decryption technology, password management, and effective planning have not been achieved, resulting in the system being unable to provide adequate protection for sensitive data. Summary of the invention

[0003] To solve the above problems, the purpose of the present invention is to provide a safe and effective password management system and encryption and decryption service. The system is an information security system developed based on the commercial password security evaluation standard.

[0004] An integrated information security system supporting a multi-platform environment, including:

[0005] The identity authentication and authority management module is used to verify the identity or authority of the logged-in user. When the verification passes, the user is allowed to proceed to the next step;

[0006] Key management module, used to generate, distribute, store, update and revoke keys;

[0007] The data encryption and decryption module is used to encrypt, store, transmit and decrypt the target data according to the request sent by the user and the key distributed by the key management module;

[0008] The audit and logging module is used to record all encryption and decryption operations, and issue an exception alarm when an encryption or decryption operation is abnormal.

[0009] Preferably, the identity authentication and rights management module includes:

[0010] User identity verification unit, used to verify the user name, password and digital certificate submitted by the user;

[0011] The permission acquisition unit is used to obtain the user's role and attributes to obtain the user's permissions;

[0012] The permission verification unit is used to verify the user's request according to the user's permission, and when the verification is passed, the user is allowed to proceed to the next step;

[0013] Preferably, the identity authentication and rights management module further includes:

[0014] The operation log unit is used to record all user operations.

[0015] Preferably, the key management module includes:

[0016] A key generation unit, used for generating a key;

[0017] The key distribution unit is used to verify the identity of the recipient and send the key to the recipient when the verification is successful;

[0018] A key storage unit, used for transmitting the key to a database for encrypted storage;

[0019] The key update unit is used to regularly check the validity of the key. When the key reaches the expiration date, a new key is generated to replace the old key or the key is automatically updated according to the instructions of the platform user;

[0020] The key destruction unit is used to completely destroy the key.

[0021] Preferably, the data encryption and decryption module includes:

[0022] A symmetric encryption module, used to encrypt or decrypt data using a first encryption algorithm;

[0023] an asymmetric encryption module, for adopting a second encryption algorithm to provide data encryption and digital signature functions;

[0024] A hash function module, used to integrate a third encryption algorithm to generate a fixed-length 256-bit hash value to verify the integrity of the data;

[0025] A key negotiation module, used to complete the secure negotiation of the communication session key based on the second encryption algorithm;

[0026] The hybrid encryption module is used to use the second encryption algorithm to perform key exchange, use the first encryption algorithm to perform data encryption, and finally use the third encryption algorithm to verify data integrity to complete the encrypted transmission of data.

[0027] Preferably, it also includes:

[0028] The interface and docking module is used to provide a standard API interface, allowing third-party business systems or devices to dock with encryption and decryption services through the network.

[0029] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0030] The present invention relates to an integrated information security system that supports a multi-platform environment. Compared with the prior art, the present invention can ensure that different data streams are encrypted and protected during storage and transmission by utilizing a data encryption and decryption module and a key management module to prevent data from being stolen or tampered with. In addition, the present invention adopts a modular design concept, which can flexibly adapt to different business scenarios and realize secure and unified password lifecycle management.

[0031] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 A flow chart of an integrated information security system supporting a multi-platform environment provided by the present invention;

[0034] Figure 2 A diagram of the entire life cycle of a key provided by the present invention;

[0035] Figure 3 Functional block diagram of identity authentication and authority management provided by the present invention;

[0036] Figure 4 This is a functional block diagram of file encryption and transmission protection provided by the present invention;

[0037] Figure 5 This is a functional block diagram of the encryption and decryption services and interface docking provided by the present invention. DETAILED DESCRIPTION

[0038] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0039] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0040] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0041] See also Figure 1-5 , an integrated information security system supporting a multi-platform environment, including:

[0042] The identity authentication and authority management module is used to verify the identity or authority of the logged-in user. When the verification passes, the user is allowed to proceed to the next step;

[0043] Furthermore, the identity authentication and rights management module includes:

[0044] User identity verification unit, used to verify the user name, password and digital certificate submitted by the user;

[0045] The permission acquisition unit is used to obtain the user's role and attributes to obtain the user's permissions;

[0046] The permission verification unit is used to verify the user's request according to the user's permission, and when the verification is passed, the user is allowed to proceed to the next step;

[0047] The operation log unit is used to record all user operations.

[0048] Key management module, used to generate, distribute, store, update and revoke keys;

[0049] The key management module comprises:

[0050] A key generation unit, used for generating a key;

[0051] The key distribution unit is used to verify the identity of the recipient and send the key to the recipient when the verification is successful;

[0052] A key storage unit, used for transmitting the key to a database for encrypted storage;

[0053] The key update unit is used to regularly check the validity of the key. When the key reaches the expiration date, a new key is generated to replace the old key or the key is automatically updated according to the instructions of the platform user;

[0054] The key destruction unit is used to completely destroy the key.

[0055] The data encryption and decryption module is used to encrypt, store, transmit and decrypt the target data according to the request sent by the user and the key distributed by the key management module;

[0056] The data encryption and decryption module comprises:

[0057] A symmetric encryption module, used to encrypt or decrypt data using a first encryption algorithm; in an embodiment of the present invention, the first encryption algorithm is an SM4 algorithm;

[0058] The asymmetric encryption module is used to adopt a second encryption algorithm to provide data encryption and digital signature functions; in an embodiment of the present invention, the second encryption algorithm is an SM2 algorithm.

[0059] The hash function module is used to integrate a third encryption algorithm to generate a 256-bit hash value of a fixed length to verify the integrity of the data; in an embodiment of the present invention, the third encryption algorithm is the SM3 algorithm.

[0060] A key negotiation module, used to complete the secure negotiation of the communication session key based on the second encryption algorithm;

[0061] The hybrid encryption module is used to use the second encryption algorithm to perform key exchange, use the first encryption algorithm to perform data encryption, and finally use the third encryption algorithm to verify data integrity to complete the encrypted transmission of data.

[0062] The audit and logging module is used to record all encryption and decryption operations, and issue an exception alarm when an encryption or decryption operation is abnormal.

[0063] In the audit and logging module, there are three roles: system administrator, security officer, and auditor.

[0064] System Administrator: Responsible for the security management of the system, including authority allocation, monitoring security logs, responding to security incidents, etc.

[0065] Security Officer: Responsible for the security management of the system, including authority allocation, monitoring all encryption and decryption operation logs, responding to security incidents, etc.

[0066] Auditor: Responsible for supervising and auditing system operations and security policies, including log analysis, compliance checks, and tracking of illegal operations.

[0067] The interface and docking module is used to provide a standard API interface, allowing third-party business systems or devices to dock with encryption and decryption services through the network.

[0068] Please refer to Figure 1-2 The integrated information security system of the present invention is further described below in conjunction with a specific business process:

[0069] (1) Data encryption and decryption:

[0070] a. Input data: The business system sends a data write request through the application interface;

[0071] b. Intercept data: The encryption module intercepts the data flow of the business system;

[0072] c. Key acquisition: obtain the corresponding encryption key from the key management module;

[0073] d. Encryption and decryption processing:

[0074] a) Encrypt the data (such as SM4 algorithm encryption)

[0075] b) Decrypt the data (if the encryption algorithm is SM4, the corresponding decryption algorithm is still SM4)

[0076] e. Integrity check: Ensure data integrity through encryption algorithms such as SM3;

[0077] f. Return data: Return the processed data to the business system to complete transparent encryption or decryption.

[0078] (2) Key life cycle management

[0079] a. Key generation: Call the key management module to generate a key and return the generated key.

[0080] b. Key distribution: Send the key to the target device through a secure channel to verify the identity of the recipient.

[0081] c. Key storage: The key is transferred to the database for encrypted storage.

[0082] d. Key update: Check the validity of the key regularly. When the key reaches the expiration date, generate a new key to replace the old key.

[0083] e. Key destruction: Call the cryptographic erase function to ensure that the key is completely cleared on the storage medium.

[0084] (3) Identity authentication and permission management

[0085] like Figure 3As shown, in identity authentication and permission management, it also includes: a strong authentication module, which is used to provide digital certificate verification and two-factor authentication functions to ensure that the user identity is authentic and reliable and prevent illegal login.

[0086] The permission management module supports RBAC (role-based access control) and ABAC (attribute-based access control) to achieve permission control accurate to the operation level.

[0087] The audit log module is used to record all login operations, permission allocations, and resource access behaviors, making it easier for administrators to conduct security audits and tracking.

[0088] The system interface module is used to provide a standard interface to connect with external systems such as LDAP / AD, synchronize user information, and achieve unified identity management.

[0089] Workflow

[0090] 1. User login

[0091] The user submits the user name, password and digital certificate, and the system verifies the user's identity.

[0092] 2. Obtaining permissions

[0093] The system obtains user roles and attributes from local or external identity management systems.

[0094] 3. Permission verification

[0095] The user requests access to a resource; the system verifies it based on the permission rules; if the permission is passed, access is allowed, otherwise the operation is denied.

[0096] 4. Record operation logs

[0097] The system records all user operations to ensure data security and traceability.

[0098] (4) File encryption storage process

[0099] like Figure 4 As shown, the purpose of encrypting and storing files is to implement encryption protection of file data during transmission.

[0100] 1. The user uploads a file to the system.

[0101] 2. The system generates a file encryption key (FEK).

[0102] 3. Use FEK to encrypt the file in blocks and save the encrypted data.

[0103] 4. Encrypt the FEK with the master key (MEK) and store it in the key management system (KMS).

[0104] (5) File transfer encryption process

[0105] 1. The user requests to download or transfer a file.

[0106] 2. The system establishes a TLS / SSL encrypted channel with the user client.

[0107] 3. The system reads the encrypted file, decrypts it block by block, and transmits it to the client through an encrypted channel.

[0108] 4. After the transfer is complete, the client verifies the file integrity.

[0109] (6) Log auditing and security monitoring

[0110] It provides full-link operation logs, including data access, encryption and decryption operations, key usage, etc., equipped with real-time security monitoring and abnormal behavior alarm functions to ensure the traceability and rapid response capabilities of security incidents.

[0111] (7) Encryption and decryption services and interface connection

[0112] like Figure 5 As shown, the integrated information security system provides encryption and decryption services for the target business system or equipment through authorization, and supports data docking of three-party encryption devices. The specific operation process is as follows:

[0113] 1. File / data transmission: The business system or device uses the interface to call the "integrated information security system" file encryption interface to encrypt the files or sensitive information that need to be encrypted. The encrypted files cannot be opened normally and can only be decrypted by calling the decryption interface again. This can ensure that the files are not intercepted and the data content is not stolen during transmission over the Internet or untrusted networks.

[0114] 2. Encryption operations: The secure dock performs encryption operations based on user permissions and key management policies. Common encryption algorithms such as SM4 (symmetric encryption) and SM2 (asymmetric encryption) are used to ensure data security.

[0115] 3. Storing encrypted files: Encrypted files or data are returned to the business system or device and stored in the local system. The storage path of encrypted data is strictly controlled to avoid leakage.

[0116] 4. Data access and decryption: When a business system or device needs to access encrypted data, it requests the "integrated information security system" to perform decryption operations through authorization. The decrypted data is only valid in the authorized user's system.

[0117] The present invention can ensure that different data streams are encrypted and protected during storage and transmission by utilizing a data encryption and decryption module and a key management module to prevent data from being stolen or tampered with. In addition, the present invention adopts a modular design concept, which can flexibly adapt to different business scenarios and achieve unified security management.

[0118] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technical solution that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. An integrated information security system supporting a multi-platform environment, characterized in that: include: The identity authentication and authority management module is used to verify the identity or authority of the logged-in user. When the verification passes, the user is allowed to proceed to the next step; Key management module, used to generate, distribute, store, update and revoke keys; The data encryption and decryption module is used to encrypt, store, transmit and decrypt the target data according to the request sent by the user and the key distributed by the key management module; The audit and logging module is used to record all encryption and decryption operations, and issue an exception alarm when an encryption or decryption operation is abnormal.

2. The integrated information security system supporting a multi-platform environment according to claim 1, characterized in that: The identity authentication and authority management module includes: User identity verification unit, used to verify the user name, password and digital certificate submitted by the user; The permission acquisition unit is used to obtain the user's role and attributes to obtain the user's permissions; The permission verification unit is used to verify the user's request according to the user's permissions. When the verification is passed, the user is allowed to proceed to the next step.

3. The integrated information security system supporting a multi-platform environment according to claim 2, characterized in that: The identity authentication and rights management module also includes: The operation log unit is used to record all user operations.

4. The integrated information security system supporting a multi-platform environment according to claim 3, characterized in that: The key management module comprises: A key generation unit, used for generating a key; The key distribution unit is used to verify the identity of the recipient and send the key to the recipient when the verification is successful; A key storage unit, used for transmitting the key to a database for encrypted storage; The key update unit is used to regularly check the validity of the key. When the key reaches the expiration date, a new key is generated to replace the old key or the key is automatically updated according to the instructions of the platform user; The key destruction unit is used to completely destroy the key.

5. The integrated information security system supporting a multi-platform environment according to claim 4, characterized in that: The data encryption and decryption module comprises: A symmetric encryption module, used to encrypt or decrypt data using a first encryption algorithm; an asymmetric encryption module, for adopting a second encryption algorithm to provide data encryption and digital signature functions; A hash function module, used to integrate a third encryption algorithm to generate a fixed-length 256-bit hash value to verify the integrity of the data; A key negotiation module, used to complete the secure negotiation of the communication session key based on the second encryption algorithm; The hybrid encryption module is used to use the second encryption algorithm to perform key exchange, use the first encryption algorithm to perform data encryption, and finally use the third encryption algorithm to verify data integrity to complete the encrypted transmission of data.

6. The integrated information security system supporting a multi-platform environment according to claim 1, characterized in that: Also includes: The interface and docking module is used to provide a standard API interface, allowing third-party business systems or devices to dock with encryption and decryption services through the network.

Images