Safety processing method, system and device based on system data and storage medium

Abstract

The invention discloses a security processing method, system and device based on system data and a storage medium. The method comprises the following steps: backing up data of an electric red system to obtain original backup data; if it is monitored that the high-risk operation of the internal equipment on the data occurs, the high-risk operation is stopped; and if the first data processed by the high-risk operation is abnormal, covering the first data with the original backup data. According to the method and the device, the access data of the internal equipment is monitored, and when the data is abnormal, the abnormal recovery is carried out through the backed-up original backup data, so that the abnormal access of the internal equipment can be found in time, and the security of the system data is improved. The method can be widely applied to the technical field of system security management.

Description

Technical Field

[0001] The present invention relates to the technical field of system security management, and in particular to a security processing method, system, device and storage medium based on system data. Background Art

[0002] Since the electric Hong system is connected to numerous devices and has a large amount of data, it is not easy to manage the data of the electric Hong system. The prerequisite for system data management is to ensure the security of system data. In the existing related technologies, mainly the attacks on the data of the electric Hong system by external devices are considered, while the attacks on the data of the electric Hong system by external devices controlling the internal devices of the electric Hong system are ignored, resulting in the attacks on the data of the electric Hong system by the internal devices of the electric Hong system being difficult to be discovered in time, thus making it difficult to respond in time to the security threats posed by the internal devices of the electric Hong system to the data of the electric Hong system. Summary of the Invention

[0003] The purpose of the present invention is to solve at least to some extent one of the technical problems existing in the prior art.

[0004] To this end, the purpose of the present invention is to provide a secure and efficient security processing method, system, device and storage medium based on system data.

[0005] To achieve the above technical objectives, on the one hand, an embodiment of the present invention provides a security processing method based on system data, including the following steps: backing up the data of the electric Hong system to obtain the original backup data; if a high-risk operation is detected in the operation of the internal device on the data, blocking the high-risk operation; if the first data processed by the high-risk operation is abnormal, covering the first data with the original backup data. The present application monitors the access data of the internal device and, when the data is abnormal, performs abnormal recovery through the backed-up original backup data, which can timely detect the abnormal access of the internal device and is beneficial to improving the security of system data.

[0006] In an embodiment of the present invention, the method determines whether the first data is abnormal through the following steps:

[0007] Summing the differences between several data in the first data and the corresponding original backup data to determine a first value;

[0008] Determining a second value according to the first value and the first data;

[0009] Determining a third value according to the number of times and the duration of the high-risk operation;

[0010] Determine an abnormal value according to the second value and the third value, and determine whether the first data is abnormal according to the abnormal value and a preset abnormal threshold.

[0011] In an embodiment of the present invention, the method further includes:

[0012] Obtain a device identifier of an internal device corresponding to the high-risk operation, and record the device identifier and a high-risk operation record;

[0013] If the number of high-risk operations of a first internal device is greater than or equal to a preset number, mark the first device identifier corresponding to the first internal device as denied access.

[0014] In an embodiment of the present invention, the method further includes:

[0015] Perform maintenance on the first internal device;

[0016] If the first internal device returns to normal after maintenance, mark the first device identifier as normal access.

[0017] In an embodiment of the present invention, the method further includes:

[0018] Record the abnormal situation of the first internal device and the corresponding maintenance method.

[0019] In an embodiment of the present invention, the method further includes:

[0020] Obtain a first moment of the high-risk operation corresponding to when the first data is abnormal;

[0021] Obtain the latest original backup data before the first moment, and overwrite the first data with the latest original backup data.

[0022] In an embodiment of the present invention, the method further includes:

[0023] If it is monitored that an external device accesses the data, perform a security authentication on the external device.

[0024] On the other hand, an embodiment of the present invention provides a security processing system based on system data, including:

[0025] A first module, configured to back up data of an electric Hong system to obtain original backup data;

[0026] A second module, configured to block a high-risk operation if it is monitored that an internal device has a high-risk operation on the data;

[0027] A third module, configured to overwrite the first data with the original backup data if the first data processed by the high-risk operation is abnormal.

[0028] On the other hand, an embodiment of the present invention provides a security processing device based on system data, including:

[0029] At least one processor;

[0030] At least one memory, configured to store at least one program;

[0031] When the at least one program is executed by the at least one processor, the at least one processor is caused to implement the above-mentioned security processing method based on system data.

[0032] On the other hand, an embodiment of the present invention provides a storage medium, in which a program executable by a processor is stored, and the program executable by the processor is used to implement the above-mentioned security processing method based on system data when executed by the processor.

[0033] The embodiments of the present application at least include the following beneficial effects: The method provided by the embodiments of the present invention includes: backing up the data of the Dianhong system to obtain the original backup data; if a high-risk operation is detected in the operation of the internal device on the data, blocking the high-risk operation; if the first data processed by the high-risk operation is abnormal, overwriting the first data with the original backup data. By monitoring the access data of the internal device and performing anomaly recovery with the backed-up original backup data when the data is abnormal, the present application can timely detect the abnormal access of the internal device, which is beneficial to improving the security of system data. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following introduces the accompanying drawings related to the technical solutions in the embodiments of the present invention or the prior art. It should be understood that the accompanying drawings below only conveniently and clearly illustrate some embodiments of the technical solutions in the present invention, and those skilled in the art can obtain other drawings based on these drawings without creative efforts.

[0035] Figure 1 It is a schematic flowchart of an embodiment of the security processing method based on system data provided by the present invention;

[0036] Figure 2 It is a schematic flowchart of another embodiment of the security processing method based on system data provided by the present invention;

[0037] Figure 3 It is a schematic structural diagram of an embodiment of the security processing system based on system data provided by the present invention;

[0038] Figure 4 The structural schematic diagram of an embodiment of the security processing device based on system data provided by the present invention. Detailed implementation manners

[0039] The embodiments of the present invention will be described in detail below. The examples of the embodiments are shown in the drawings, in which the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are only used to explain the present invention and should not be construed as a limitation to the present invention. For the step numbers in the following embodiments, they are only set for the convenience of explanation and illustration, and no limitation is imposed on the order between the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0040] Since there are many devices connected to the Dianhong system and there is a large amount of data in the Dianhong system, it is not easy to manage and control the data of the Dianhong system. The prerequisite for managing and controlling system data is to ensure the security of system data. In the existing related technologies, mainly the attacks on the data of the Dianhong system by external devices of the system are considered, while the attacks on the data of the Dianhong system by external devices through controlling the internal devices of the Dianhong system are ignored, resulting in the attacks on the data of the Dianhong system by the internal devices of the Dianhong system being difficult to be discovered in time, thus making it difficult to respond in time to the security threats posed by the internal devices of the Dianhong system to the data of the Dianhong system.

[0041] The security processing method and system based on system data proposed according to the embodiments of the present invention will be described in detail below with reference to the drawings. First, the security processing method based on system data proposed according to the embodiments of the present invention will be described with reference to the drawings.

[0042] Refer to Figure 1 , an embodiment of the present invention provides a security processing method based on system data. The security processing method based on system data in the embodiment of the present invention can be applied to a terminal, can also be applied to a server, or can also be software running on a terminal or a server, etc. The terminal can be a tablet computer, a notebook computer, a desktop computer, etc., but is not limited thereto. The server can be an independent physical server, can also be a server cluster or a distributed system composed of multiple physical servers, or can also be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The security processing method based on system data in the embodiment of the present invention mainly includes the following steps:

[0043] S100: Back up the data of the Dianhong system to obtain the original backup data;

[0044] S200: If a high-risk operation is detected in the operation of the internal device on the data, block the high-risk operation;

[0045] S300: If the first data processed by the high-risk operation is abnormal, overwrite the first data with the original backup data.

[0046] In some possible implementation manners, whether the data processed by the high-risk operation in this application is abnormal is determined by the number of abnormal data and the number of high-risk operations. At the same time, this application can back up the data of the electric system periodically / multiple times. After each backup, an original backup data is formed, and the original backup data within a period of time is retained to prevent data recovery in case the data operated by the attack is abnormal.

[0047] In an embodiment of the present invention, the method determines whether the first data is abnormal through the following steps:

[0048] Sum the differences between several data in the first data and the corresponding original backup data to determine the first value;

[0049] Determine the second value according to the first value and the first data;

[0050] Determine the third value according to the number of high-risk operations and the duration;

[0051] Determine the abnormal value according to the second value and the third value, and determine whether the first data is abnormal according to the abnormal value and the preset abnormal threshold.

[0052] It can be understood that this application can determine the second value according to the quotient of the first value and the first data; determine the third value according to the product of the number of high-risk operations and the duration, and perform trigonometric function processing on this product. Of course, the above process is an exemplary example, and this application does not limit the specific calculation method.

[0053] In an embodiment of the present invention, the method further includes:

[0054] Obtain the device identifier of the internal device corresponding to the high-risk operation, and record the device identifier and the high-risk operation record;

[0055] If the number of high-risk operations of the first internal device is greater than or equal to the preset number, mark the first device identifier corresponding to the first internal device as denied access.

[0056] Count the number of times of each internal device corresponding to a high-risk operation. If it is found that the number of high-risk operations of a certain internal device is greater than or equal to the preset number of times, mark the first internal device as denied access. The preset number of times is set according to actual needs and is the maximum allowable number of high-risk operation accesses. Through marking, prevent high-risk operation devices from damaging the data of the Dianhong system.

[0057] In an embodiment of the present invention, the method further includes:

[0058] Perform maintenance on the first internal device;

[0059] If the first internal device returns to normal after maintenance, mark the first device identifier as normal access.

[0060] In an embodiment of the present invention, the method further includes:

[0061] Record the abnormal situation of the first internal device and the corresponding maintenance method.

[0062] Recording the abnormal situation and the maintenance method is convenient for quickly performing maintenance when a similar abnormal situation occurs next time. Through maintenance and recording / storage operations, this application enables high-risk operation devices to return to normal as soon as possible, weakens the impact of external devices attacking the data of the Dianhong system by controlling internal devices of the Dianhong system; at the same time, it also reduces the workload of the staff responsible for data control of the Dianhong system and improves the work efficiency of the staff responsible for data control of the Dianhong system.

[0063] In an embodiment of the present invention, the method further includes:

[0064] Obtain the first moment of the high-risk operation corresponding to the abnormal occurrence of the first data;

[0065] Obtain the latest original backup data before the first moment and overwrite the first data with the latest original backup data.

[0066] In an embodiment of the present invention, the method further includes:

[0067] If it is monitored that an external device accesses data, perform a security authentication on the external device. Through the security authentication of the external device, pre-eliminate the security threat of external devices of the Dianhong system accessing the data of the Dianhong system.

[0068] The following takes a specific embodiment to introduce the security processing method provided by this application in detail:

[0069] Refer to Figure 2 , a control solution for the data of the Dianhong system provided by an embodiment of this application may include the following steps:

[0070] Back up at least one copy of the data of the Dianhong system as the original backup of the Dianhong system data, and store the original backup of the Dianhong system data in at least one storage device;

[0071] Monitor in real time the operations performed on the Dianhong system data by internal devices accessing the Dianhong system data. When a high-risk operation is detected on an internal device accessing the Dianhong system data, immediately prevent the internal device accessing the Dianhong system data from performing the high-risk operation. High-risk operations include operations such as data tampering operations, data stealing operations, and data destruction operations;

[0072] Detect whether the data subjected to high-risk operations is abnormal. When it is detected that the data subjected to high-risk operations is abnormal, retrieve the original backup of the Dianhong system data to overwrite the data subjected to high-risk operations, so that the data subjected to high-risk operations returns to normal;

[0073] Obtain the device identifier of the device that performs high-risk operations on the Dianhong system data, and send the device identifier of the device and the record of the high-risk operations performed by the device on the Dianhong system data to the Dianhong system, and the Dianhong system marks the device as a high-risk operation device.

[0074] In the above technical solution, by monitoring in real time the operations performed on the Dianhong system data by internal devices accessing the Dianhong system data, potential threats to the Dianhong system data by internal devices of the Dianhong system can be discovered in a timely manner. Once it is found that the internal devices of the Dianhong system pose a potential threat to the Dianhong system data, corresponding emergency measures are taken for the internal devices of the Dianhong system in a timely manner, and the data damaged by the high-risk operations of the internal devices of the Dianhong system is repaired in a timely manner by backing up the data, so as to ensure the security of the Dianhong system data, thereby being able to discover and respond to potential data security threats to the Dianhong system data by internal devices of the Dianhong system in a timely manner.

[0075] This application can be further configured as:

[0076] In the step of detecting whether the data subjected to high-risk operations is abnormal, when the data subjected to high-risk operations is abnormal, retrieving the original backup of the Dianhong system data to overwrite the data subjected to high-risk operations, so that the data subjected to high-risk operations returns to normal, the detection method for whether the data subjected to high-risk operations is abnormal includes the following expression:

[0077]

[0078] where δ is a preset abnormal threshold, W n represents the nth data subjected to high-risk operations, C n represents the original backup of the Dianhong system data of the nth data subjected to high-risk operations, n is a positive integer, 1 ≤ n ≤ N, N represents the total number of Dianhong system data, t represents the duration of the high-risk operations on the Dianhong system data, and m represents the number of times the Dianhong system data has been subjected to high-risk operations.

[0079] This calculation formula calculates whether the data subjected to high-risk operations is abnormal through the original backup power system data, the data subjected to high-risk operations, the duration of the high-risk operations, the number of high-risk operations and the preset abnormal threshold. The trigonometric functions in the formula can also be replaced by other functions, and this application does not make specific restrictions. The calculation formula can be used to indicate whether the data after the high-risk operation in the previous period of time is abnormal. If the calculation result satisfies the calculation formula, the data subjected to high-risk operations in the previous period of time will be overwritten with the original backup power system data. That is, if the calculated abnormal value is greater than the preset abnormal threshold, it indicates that the data is abnormal.

[0080] Through the above technical solution, it is very easy to detect whether the data subjected to high-risk operations is abnormal. When the above formula is satisfied, it means that it is detected that the data subjected to high-risk operations is abnormal.

[0081] The application may be further configured to include the following steps:

[0082] The Dianhong system continuously counts and records the number of times high-risk operating devices perform high-risk operations. When the number of high-risk operating devices performs high-risk operations exceeds the preset number, the Dianhong system will reject all access requests from high-risk operating devices to Dianhong system data based on the device identifier of the high-risk operating device, and send the device identifier of the high-risk operating device to the Dianhong system data management and control staff.

[0083] In the above technical solution, it is possible to effectively prevent high-risk operating equipment from damaging the data of the telecom system.

[0084] The application may be further configured to include the following steps:

[0085] The data control staff of the Dianhong system will inspect and repair the high-risk operating equipment. When the high-risk operating equipment returns to normal after inspection, the data control staff of the Dianhong system will issue an instruction to the Dianhong system to lift the rejection of the access application for the high-risk equipment. The Dianhong system will delete the mark of the high-risk operating equipment based on the instruction to lift the rejection of the access application for the high-risk equipment.

[0086] In the above technical solution, the data control staff of the Dianhong system promptly repairs the high-risk operating equipment so that the high-risk operating equipment can return to normal as soon as possible, thereby weakening the impact of external equipment attacking the Dianhong system data by controlling the internal equipment of the Dianhong system.

[0087] The application may be further configured to include the following steps:

[0088] The staff in charge of data control in the Dianhong system send the abnormal conditions of high-risk operation equipment and the corresponding maintenance methods for maintaining the abnormal conditions of high-risk equipment to the Dianhong system. Subsequently, if equipment in the Dianhong system presents the same abnormal conditions as those of the high-risk operation equipment, the Dianhong system automatically repairs the equipment through the corresponding maintenance methods for maintaining the abnormal conditions of high-risk equipment.

[0089] Through the above technical solution, the internal equipment of the Dianhong system with abnormal conditions can be automatically repaired, thus reducing the workload of the staff in charge of data control in the Dianhong system and improving their work efficiency.

[0090] This application can be further configured as follows: The following steps can also be included:

[0091] When equipment outside the Dianhong system sends a request to access the data of the Dianhong system, the Dianhong system conducts a security authentication on the external equipment.

[0092] In the above technical solution, before accessing the data of the Dianhong system, the equipment outside the Dianhong system must first pass the security authentication of the Dianhong system. Only after passing the security authentication of the Dianhong system can the external equipment of the Dianhong system access the data of the Dianhong system, thereby eliminating in advance the security threats posed by the external equipment of the Dianhong system to the data of the Dianhong system.

[0093] In addition, this application provides a control device for the data of the Dianhong system, which may include:

[0094] A data backup module, which is used to back up at least one original backup of the Dianhong system data for the Dianhong system data and store the original backup of the Dianhong system data in at least one storage device;

[0095] A high-risk operation prevention module, which is used to monitor in real time the operations performed on the Dianhong system data by the internal equipment accessing the Dianhong system data. When it is detected that the internal equipment accessing the Dianhong system data performs high-risk operations, the high-risk operations performed by the internal equipment accessing the Dianhong system data on the Dianhong system data are prevented in real time. High-risk operations include operations such as data tampering operations, data theft operations, and data destruction operations;

[0096] A data recovery module, which is used to detect whether the data affected by high-risk operations is abnormal. When it is detected that the data affected by high-risk operations is abnormal, the original backup of the Dianhong system data is retrieved to overwrite the data affected by high-risk operations, so that the data affected by high-risk operations returns to normal;

[0097] A high-risk operation equipment marking module, which is used to obtain the device identifier of the equipment that performs high-risk operations on the Dianhong system data and send the device identifier of the equipment and the record of the high-risk operations performed by the equipment on the Dianhong system data to the Dianhong system, and the Dianhong system marks the equipment as high-risk operation equipment.

[0098] This application can be further configured as:

[0099] A control device for telecom system data may also include:

[0100] The module for denying access to high-risk operation devices is used for the Dianhong system to continuously count and record the number of high-risk operation devices that perform high-risk operations. When the number of high-risk operation devices that perform high-risk operations exceeds the preset number, the Dianhong system will deny all access requests from the high-risk operation devices to the Dianhong system data based on the device identifier of the high-risk operation device, and send the device identifier of the high-risk operation device to the Dianhong system data management and control staff.

[0101] This application can be further configured as:

[0102] A control device for telecom system data may also include:

[0103] The high-risk operation equipment mark deletion module is used by the data control staff of the Dianhong system to repair the equipment marked as high-risk operation equipment. When the high-risk operation equipment returns to normal after maintenance, the data control staff of the Dianhong system sends an instruction to the Dianhong system to lift the rejection of the high-risk equipment access application. The Dianhong system deletes the high-risk operation equipment mark of the equipment based on the instruction to lift the rejection of the high-risk equipment access application.

[0104] This application can be further configured as:

[0105] A control device for telecom system data may also include:

[0106] The external device security authentication module is used for the Dianhong system to perform security authentication on the external device when the device outside the Dianhong system issues a request to access the Dianhong system data.

[0107] The present application provides a method for controlling data in a telecom system, which can promptly detect whether internal equipment in the telecom system poses a potential threat to the data in the telecom system, and promptly repair data damaged by high-risk operations of internal equipment in the telecom system through backup data, thereby ensuring the security of the data in the telecom system, thereby being able to promptly respond to potential data security threats to the data in the telecom system from internal equipment in the telecom system.

[0108] In summary, the method provided by the embodiments of the present application includes: backing up the data of the DH system to obtain the original backup data; if a high-risk operation is detected in the operation of the internal device on the data, blocking the high-risk operation; if the first data processed by the high-risk operation appears abnormal, covering the first data with the original backup data. By monitoring the access data of the internal device and performing anomaly recovery with the backed-up original backup data when the data appears abnormal, the present application can timely detect abnormal access of the internal device, which is beneficial to improving the security of system data.

[0109] Secondly, referring to the attached Figure 3 A security processing system based on system data proposed according to an embodiment of the present invention is described, specifically including:

[0110] The first module 310 is used to back up the data of the DH system to obtain the original backup data;

[0111] The second module 320 is used to block a high-risk operation if a high-risk operation is detected in the operation of the internal device on the data;

[0112] The third module 330 is used to cover the first data with the original backup data if the first data processed by the high-risk operation appears abnormal.

[0113] It can be seen that the content in the above method embodiments is applicable to the system embodiments of the present invention. The functions specifically implemented by the system embodiments of the present invention are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above method embodiments.

[0114] Referring to Figure 4 , an embodiment of the present invention provides a security processing device based on system data, including:

[0115] At least one processor 410;

[0116] At least one memory 420 for storing at least one program;

[0117] When the at least one program is executed by the at least one processor 410, the at least one processor 410 implements the security processing method based on system data.

[0118] Similarly, the content in the above method embodiments is applicable to the device embodiments of the present invention. The functions specifically implemented by the device embodiments of the present invention are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above method embodiments.

[0119] An embodiment of the present invention also provides a computer-readable storage medium, which stores a program executable by a processor. The program executable by the processor is used to execute the above-mentioned security processing method based on system data when executed by the processor.

[0120] Similarly, the content in the above method embodiments is applicable to this storage medium embodiment. The functions specifically implemented by this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those in the above method embodiments.

[0121] In some alternative embodiments, the functions / operations mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the functions / operations involved, two consecutive blocks shown may actually be executed substantially simultaneously or the blocks can sometimes be executed in the reverse order. In addition, the embodiments presented and described in the flowcharts of the present invention are provided by way of example for the purpose of providing a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logical flows presented herein. Alternative embodiments are contemplated, in which the order of various operations is changed and the sub-operations described as part of a larger operation are executed independently.

[0122] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise stated to the contrary, one or more of the functions and / or features may be integrated in a single physical device and / or software module, or one or more functions and / or features may be implemented in separate physical devices or software modules. It can also be understood that a detailed discussion of the actual implementation of each module is not necessary for understanding the present invention. Rather, considering the attributes, functions, and internal relationships of the various functional modules in the devices disclosed herein, the actual implementation of the modules will be understood within the ordinary skills of an engineer. Therefore, those skilled in the art can implement the present invention as set forth in the claims without undue experimentation. It can also be understood that the specific concepts disclosed are illustrative only and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0123] When the above-mentioned functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several programs for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs.

[0124] The logic and / or steps represented in the flowchart or described in other ways herein, for example, can be considered as an ordered list of executable programs for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by a program execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other systems that can fetch and execute programs from the program execution system, apparatus, or device), or in combination with these program execution systems, apparatuses, or devices. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in combination with a program execution system, apparatus, or device.

[0125] More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or other suitable processing as necessary, and then stored in a computer memory.

[0126] It should be understood that various parts of the present invention can be implemented by hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable program execution system. For example, if implemented in hardware, as in another embodiment, any one of the following techniques known in the art or a combination thereof can be used: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application specific integrated circuits having appropriate combinational logic gate circuits, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

[0127] In the above description of this specification, the descriptions referring to the terms "one embodiment / example", "another embodiment / example", or "certain embodiments / examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0128] Although the embodiments of the present invention have been shown and described, those of ordinary skill in the art can understand that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the claims and their equivalents.

[0129] The above has specifically described the preferred embodiments of the present invention, but the present invention is not limited to the described embodiments. Those skilled in the art can also make various equivalent deformations or substitutions without departing from the spirit of the present invention, and these equivalent deformations or substitutions are all included within the scope defined by the claims of the present invention.

Claims

1. A security processing method based on system data, characterized in that It includes the following steps: Back up the data of the electric Hong system to obtain the original backup data; If a high-risk operation is detected in the operation of the internal device on the data, block the high-risk operation; If the first data processed by the high-risk operation is abnormal, overwrite the first data with the original backup data.

2. The security processing method based on system data according to claim 1, characterized in that The method determines whether the first data is abnormal through the following steps: Sum the differences between several data in the first data and the corresponding original backup data to determine the first value; Determine the second value according to the first value and the first data; Determine the third value according to the number of times and duration of the high-risk operation; Determine the abnormal value according to the second value and the third value, and determine whether the first data is abnormal according to the abnormal value and the preset abnormal threshold.

3. The security processing method based on system data according to claim 1, wherein The method further includes: Obtain the device identifier of the internal device corresponding to the high-risk operation, and record the device identifier and the high-risk operation record; If the number of high-risk operations of the first internal device is greater than or equal to the preset number, mark the first device identifier corresponding to the first internal device as denied access.

4. The security processing method based on system data according to claim 3, wherein, The method further includes: Repair the first internal device; If the first internal device returns to normal after being repaired, mark the first device identifier as normal access.

5. The security processing method based on system data according to claim 4, wherein The method further includes: Record the abnormal situation of the first internal device and the corresponding repair method.

6. The security processing method based on system data according to claim 1, wherein, The method further includes: Obtain the first moment of the high-risk operation corresponding to the abnormal first data; Obtain the latest original backup data before the first moment, and overwrite the first data with the latest original backup data.

7. The security processing method based on system data according to claim 1, wherein The method further includes: If it is detected that an external device accesses the data, perform a security authentication on the external device.

8. A security processing system based on system data, characterized in that, It includes: A first module for backing up the data of the electric Hong system to obtain the original backup data; A second module for blocking the high-risk operation if a high-risk operation is detected in the operation of the internal device on the data; A third module for overwriting the first data with the original backup data if the first data processed by the high-risk operation is abnormal.

9. A security processing device based on system data, characterized in that, It includes: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the security processing method based on system data according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a program executable by a processor, characterized in that, The program executable by the processor is used to implement the security processing method based on system data according to any one of claims 1 to 7 when executed by the processor.

Images