Software development environment security protection method and system based on data encryption

Abstract

The invention relates to the technical field of development environment protection, in particular to a software development environment security protection method and system based on data encryption. Comprising a data monitoring module, a policy execution module, a policy center module, a secure channel scheduling module, an encryption and decryption engine module, a key policy synchronization module, a data stream authentication protection module and a compliance privacy design module, and a self-adaptive and endogenous closed-loop active immune system can be successfully constructed through cooperative linkage of the modules. Traditional passive and static data encryption is converted into an active, dynamic and full-link data security base which is deeply fused with a software development process.

Description

Technical Field

[0001] This invention relates to the field of development environment protection technology, and in particular to a software development environment security protection method and system based on data encryption. Background Technology

[0002] In the field of software development, core source code, algorithm models, configuration keys, and other digital assets are the most valuable intellectual property and trade secrets of enterprises. To prevent the leakage of these assets during development, collaboration, building, and deployment, traditional security practices mainly rely on data encryption-based protection systems. These systems typically introduce encryption technology as a static and isolated tool into the development process. Their traditional functional modes are mainly manifested in: statically encrypting the code repository in the storage stage, enabling SSL / TLS channels in the network transmission stage, or encrypting configuration files in the deployment stage. These measures are like providing a basic protective coating for the "data container". Traditional encryption measures are independent of the development toolchain and are a static strategy that is "added after the fact." They cannot perceive the dynamic context in the development environment, which leads to a serious disconnect between security policies and actual development behavior and data flow. Just like the lack of an effective bonding layer between a coating and a substrate, this static protection is easily bypassed or fails when faced with complex scenarios such as internal privilege escalation, supply chain attacks, or compliance audits, and cannot form a true "immune" capability. Summary of the Invention

[0003] The purpose of this invention is to provide a software development environment security protection method and system based on data encryption. Through the coordinated linkage of various modules, an adaptive, endogenous closed-loop active immune system is successfully constructed, transforming the traditional passive and static data encryption into an active, dynamic, and end-to-end data security foundation that is deeply integrated with the software development process.

[0004] To achieve the above objectives, the present invention provides a software development environment security protection system based on data encryption, including a data monitoring module, a policy execution module, a policy hub module, a secure channel scheduling module, an encryption / decryption engine module, a key policy synchronization module, a data stream authentication and protection module, and a compliance and privacy design module; The data monitoring module, key policy synchronization module, and compliance and privacy design module are all connected to the policy central module. The policy central module is connected to the policy execution module. The secure channel scheduling module is connected to the policy central module. The encryption and decryption engine module is connected to the secure channel scheduling module. The data stream authentication and protection module is connected to both the policy central module and the encryption and decryption engine module. The key policy synchronization module is connected to the secure channel scheduling module. The compliance and privacy design module is connected to the data monitoring module.

[0005] The data monitoring module is used to perform real-time monitoring of operational behavior, data flow, and asset status throughout the entire process in the software development environment. The policy execution module is used to execute access control and operation interception policies issued by the policy hub module in the development environment; The strategy hub module is used to analyze and assess the risks of monitoring data, and generate and issue encrypted control commands. The secure channel scheduling module is used to plan secure transmission paths for sensitive data, schedule encrypted resources, and ensure the auditability of transmission. The encryption / decryption engine module is used to perform encryption / decryption operations on sensitive data; The key policy synchronization module adopts a high-availability architecture to synchronize keys and policies, ensuring global consistency. The data stream authentication and protection module is used to generate authentication tokens for control commands to achieve secondary authentication and defend against replay attacks. The compliance and privacy design module is used to embed compliance requirements into the development process, automatically identify risks, and drive policy generation.

[0006] The data monitoring module includes a behavior acquisition submodule, an asset perception submodule, and a context modeling submodule; the behavior acquisition submodule is connected to the asset perception submodule; the asset perception submodule is connected to the context modeling submodule; and the context modeling submodule is connected to the strategy hub module. The behavior collection submodule is used to collect operation and log data from the development environment; The asset awareness submodule is used to automatically discover and mark sensitive assets in the code; The context modeling submodule is used to construct a security context and attach it to the monitoring data for reporting.

[0007] The policy execution module includes an access control submodule, an operation interception submodule, and a policy cache synchronization submodule; the access control submodule is connected to the operation interception submodule; the policy cache synchronization submodule is connected to the access control submodule, the operation interception submodule, and the policy central module, respectively. The access control submodule is used to implement dynamic permission determination based on security context; The operation interception submodule is used to block and alarm unauthorized operations in real time according to control commands; The policy cache synchronization submodule is used to cache policies locally and provide degradation support to ensure policy consistency.

[0008] The strategy central module includes a dynamic risk analysis submodule, an intelligent strategy orchestration submodule, and an instruction signature issuance submodule. The dynamic risk analysis submodule is connected to the data monitoring module and the intelligent strategy orchestration submodule. The instruction signature issuance submodule is connected to the intelligent strategy orchestration submodule, the strategy execution module, and the security channel scheduling module. The dynamic risk analysis submodule is used to identify specific security risk scenarios; The intelligent strategy orchestration submodule is used to map risks into a sequence of actions and generate strategy identifiers; The instruction signature issuance submodule is used to digitally sign control instructions to ensure their integrity and non-repudiation.

[0009] The secure channel scheduling module includes a key scheduling submodule, an adaptive secure routing submodule, and a channel auditing submodule; the key scheduling submodule is connected to the policy hub module and the encryption / decryption engine module; the adaptive secure routing submodule is connected to the policy hub module; and the channel auditing submodule is connected to the adaptive secure routing submodule. The key scheduling submodule is used to schedule and manage encryption keys on demand; The adaptive security routing submodule is used to dynamically plan the transmission path of sensitive data; The channel audit submodule is used to establish audit logs and form a chain of evidence for data flow.

[0010] The encryption / decryption engine module includes a multi-algorithm engine submodule, a secure key injection submodule, and a trusted execution environment submodule; the multi-algorithm engine submodule is connected to the secure key injection submodule; and the trusted execution environment submodule is connected to both the multi-algorithm engine submodule and the secure key injection submodule. The multi-algorithm engine submodule is used to support multiple encryption algorithms and execute them automatically according to instructions; The secure key injection submodule is used to securely receive, store, and clear key materials; The Trusted Execution Environment submodule provides a hardware-isolated execution environment for high-security operations.

[0011] The adaptive secure routing submodule includes a path decision unit and a tunnel management unit, wherein the path decision unit is connected to the tunnel management unit. The path decision unit is used to calculate the optimal secure path for each sensitive data transmission request and send the path information to the tunnel management unit. The tunnel management unit is used to dynamically establish and maintain an end-to-end encrypted tunnel based on the decisions received from the path decision unit.

[0012] The trusted execution environment submodule includes a remote proof unit and a sealed storage unit, wherein the remote proof unit is connected to the sealed storage unit; The remote verification unit is used to verify the integrity and trustworthiness of the current execution environment to the policy central module before the encryption and decryption operation is executed, and to generate an unlocking command after the verification is successful. The sealed storage unit is used to encrypt and store the highest security level key in use within a trusted execution environment, and only provides key access access after receiving an unlocking command from the remote verification unit.

[0013] The key policy synchronization module is also specifically connected to an internal key storage cluster. The internal key storage cluster adopts a highly available architecture based on multi-replica synchronization and automatic fault switching. It is used to persistently store active keys synchronized from the external key management system locally, providing low-latency key services for the encryption and decryption engine module.

[0014] One method for protecting a software development environment based on data encryption, employing the aforementioned data encryption-based software development environment security protection system, includes the following steps: The data monitoring module performs real-time monitoring of the entire development environment and reports the collected security events and asset status data to the strategy hub module. Meanwhile, the compliance and privacy design module transforms the embedded compliance requirements into policy rules, which are also input into the policy hub module. The strategy central module analyzes the data and assesses risks, generating encrypted control commands; To defend against replay attacks, the data stream authentication protection module generates authentication tokens for control commands, and the key policy synchronization module ensures that the keys and policies required to execute commands are globally consistent throughout the system. Subsequently, control commands are issued, the policy execution module receives the commands and performs access control and interception in the environment, and the secure channel scheduling module receives the commands and plans secure paths for sensitive data, schedules resources and ensures auditable transmission. The sensitive data to be transmitted is sent to the encryption / decryption engine module, which verifies the command and token and then performs encryption / decryption operations. The secure channel scheduling module ensures the auditability of transmission, forming a secure closed loop. The compliance and privacy design module continuously scans and transforms policies, driving the policy center to make a new round of decisions, enabling the system to achieve dynamic and intrinsic security protection.

[0015] The software development environment security protection method and system based on data encryption of the present invention, in actual operation, uses the data monitoring module to monitor the entire chain of developer behaviors and data assets, including coding, submission, building, and deployment, in real time, and reports the monitoring data to the policy hub module. Simultaneously, the compliance and privacy design module continuously scans development assets, converting identified compliance risks into policy rules and inputting them into the policy hub module. The policy hub module performs dynamic correlation analysis and risk assessment on the aggregated data, generating encrypted and tamper-proof control instructions. These instructions, after being appended with an authentication token by the data flow authentication protection module, are distributed to the policy execution module and the secure channel scheduling module. The policy execution module, based on the instructions, executes them on the development terminal and the server. The code repository and other nodes perform real-time access control and interception. The secure channel scheduling module dynamically plans transmission paths for sensitive data and schedules encryption resources according to instructions. Finally, the data to be processed is sent to the encryption / decryption engine module. After verifying the validity of the instructions and tokens, the module performs encryption / decryption operations in a secure environment. The key policy synchronization module ensures the consistency of key and policy states throughout the distributed system, thereby forming an endogenous security closed loop of perception, decision-making, execution, auditing, and feedback. Through the collaborative linkage of various modules, an adaptive, endogenous closed-loop proactive immune system is successfully constructed, transforming traditional passive and static data encryption into an active, dynamic, and end-to-end data security foundation that is deeply integrated with the software development process. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0017] Figure 1 This is a schematic diagram of the overall structure of the software development environment security protection system based on data encryption according to the present invention.

[0018] Figure 2 This is a structural diagram of the data monitoring module of the present invention.

[0019] Figure 3 This is a schematic diagram of the strategy execution module of the present invention.

[0020] Figure 4 This is a schematic diagram of the strategy hub module of the present invention.

[0021] Figure 5 This is a schematic diagram of the structure of the secure channel scheduling module of the present invention.

[0022] Figure 6 This is a schematic diagram of the encryption / decryption engine module of the present invention.

[0023] Figure 7 This is a schematic diagram of the adaptive secure routing submodule of the present invention.

[0024] Figure 8 This is a schematic diagram of the trusted execution environment submodule of the present invention.

[0025] Figure 9 This is a flowchart of the software development environment security protection method based on data encryption according to the present invention.

[0026] In the diagram: 1-Data Monitoring Module, 2-Policy Execution Module, 3-Policy Central Module, 4-Secure Channel Scheduling Module, 5-Encryption / Decryption Engine Module, 6-Key Policy Synchronization Module, 7-Data Stream Authentication and Protection Module, 8-Compliance and Privacy Design Module, 11-Behavior Collection Submodule, 12-Asset Awareness Submodule, 13-Context Modeling Submodule, 21-Access Control Submodule, 22-Operation Interception Submodule, 23-Policy Cache Synchronization Submodule, 31-Dynamic Risk Analysis Submodule, 32-Intelligent Policy Orchestration Submodule, 33-Instruction Signature Issuance Submodule, 41-Key Scheduling Submodule, 42-Adaptive Secure Routing Submodule, 43-Channel Audit Submodule, 51-Multi-Algorithm Engine Submodule, 52-Secure Key Injection Submodule, 53-Trusted Execution Environment Submodule, 421-Path Decision Unit, 422-Tunnel Management Unit, 531-Remote Proof Unit, 532-Sealed Storage Unit, 9-Key Storage Cluster. Detailed Implementation

[0027] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0028] In the description of this invention, it should be understood that "a plurality of" means two or more, unless otherwise explicitly specified.

[0029] Please see Figures 1 to 8This invention provides a software development environment security protection system based on data encryption, comprising a data monitoring module 1, a policy execution module 2, a policy central module 3, a secure channel scheduling module 4, an encryption / decryption engine module 5, a key policy synchronization module 6, a data flow authentication and protection module 7, and a compliance and privacy design module 8. The data monitoring module 1, key policy synchronization module 6, and compliance and privacy design module 8 are all connected to the policy central module 3. The policy central module 3 is connected to the policy execution module 2. The secure channel scheduling module 4 is connected to the policy central module 3. The encryption / decryption engine module 5 is connected to the secure channel scheduling module 4. The data flow authentication and protection module 7 is connected to both the policy central module 3 and the encryption / decryption engine module 5. The key policy synchronization module 6 is connected to the secure channel scheduling module 4. The compliance and privacy design module 8 is connected to the data monitoring module 1.

[0030] The data monitoring module 1 is used to perform real-time monitoring of the entire chain of operational behavior, data flow and asset status in the software development environment. The policy execution module 2 is used to execute access control and operation interception policies issued by the policy hub module 3 in the development environment; The strategy central module 3 is used to analyze and assess the monitoring data, and generate and issue encrypted control commands. The secure channel scheduling module 4 is used to plan secure transmission paths for sensitive data, schedule encrypted resources, and ensure the auditability of transmission. The encryption / decryption engine module 5 is used to perform encryption / decryption operations on sensitive data; The key policy synchronization module 6 adopts a high-availability architecture to synchronize keys and policies, ensuring global consistency. The data stream authentication and protection module 7 is used to generate authentication tokens for control commands to achieve secondary authentication and defend against replay attacks. The compliance and privacy design module 8 is used to embed compliance requirements into the development process, automatically identify risks, and drive policy generation.

[0031] Specifically, the data monitoring module 1 monitors the entire development process, including coding, submission, building, and deployment, as well as data assets, in real time and reports the monitoring data to the policy hub module 3. Simultaneously, the compliance and privacy design module 8 continuously scans development assets, converting identified compliance risks into policy rules that are input into the policy hub module 3. The policy hub module 3 performs dynamic correlation analysis and risk assessment on the aggregated data, generating encrypted and tamper-proof control commands. These commands, after being appended with authentication tokens by the data flow authentication and protection module 7, are distributed to the policy execution module 2 and the secure channel scheduling module 4. The policy execution module 2 then executes real-time access at nodes such as the development terminal and code repository according to the commands. Control and interception: The secure channel scheduling module 4 dynamically plans the transmission path and schedules encryption resources for sensitive data according to the instructions. The data to be processed is sent to the encryption / decryption engine module 5. After verifying the validity of the instructions and tokens, this module performs encryption / decryption operations in a secure environment. The key policy synchronization module 6 ensures the consistency of key and policy states throughout the distributed system, thereby forming an endogenous security closed loop of perception, decision-making, execution, auditing, and feedback. Through the collaborative linkage of various modules, an adaptive, endogenous closed-loop active immune system is successfully constructed, transforming traditional passive and static data encryption into an active, dynamic, and end-to-end data security foundation that is deeply integrated with the software development process.

[0032] For further details, please refer to Figure 2 The data monitoring module 1 includes a behavior acquisition submodule 11, an asset perception submodule 12, and a context modeling submodule 13; the behavior acquisition submodule 11 is connected to the asset perception submodule 12; the asset perception submodule 12 is connected to the context modeling submodule 13; and the context modeling submodule 13 is connected to the strategy hub module 3. The behavior collection submodule 11 is used to collect operation and log data of the development environment; The asset awareness submodule 12 is used to automatically discover and mark sensitive assets in the code; The context modeling submodule 13 is used to construct a security context and attach it to the monitoring data for reporting.

[0033] In this embodiment, the behavior collection submodule 11 can be implemented by embedding lightweight probes in integrated development environment plugins, version control system hooks, and continuous integration / continuous deployment server agents. This allows for the non-intrusive collection of data such as developer operation sequences, code commit graphs, build job logs, and internal microservice API call chains. The technical implementation can draw on the data collection ideas of open-source distributed tracing systems (such as Jaeger and SkyWalking). The asset awareness submodule 12 can scan the code repository based on regular expressions, semantic analysis, and pre-trained machine learning models (such as BERT-based code representation models) to accurately identify and classify sensitive assets such as hard-coded passwords, API keys, encryption algorithm implementations, privacy data processing functions, and core business logic code, and assign them predefined sensitivity labels. The context modeling submodule 13 integrates the data streams from behavior collection and asset awareness in real time, combining information such as user identity, device fingerprint, network location, and operation time to construct a structured composite security context object. This context object is encapsulated and reported together with the original monitoring data as core metadata, providing rich decision-making basis for subsequent risk analysis.

[0034] For further details, please refer to Figure 3 The policy execution module 2 includes an access control submodule 21, an operation interception submodule 22, and a policy cache synchronization submodule 23; the access control submodule 21 is connected to the operation interception submodule 22; the policy cache synchronization submodule 23 is connected to the access control submodule 21, the operation interception submodule 22, and the policy hub module 3, respectively. The access control submodule 21 is used to implement dynamic permission determination based on security context; The operation interception submodule 22 is used to block and alarm unauthorized operations in real time according to control commands. The policy cache synchronization submodule 23 is used to cache policies locally and provide degradation support to ensure policy consistency.

[0035] In this embodiment, the access control submodule 21 can be specifically implemented as a policy execution point deployed at a critical entry point. For example, it exists as a file system filter driver or security proxy on the development terminal, and is integrated as a pre-receive hook on the code repository side. It receives real-time authorization instructions from the policy hub module 3 or queries the local cached policy, and makes dynamic decisions based on attributes for each data access request. The decision factors include, but are not limited to, user role, resource sensitivity label, operation time, and terminal security status. Its decision logic can be implemented using the XACML standard model or based on the OPA policy engine. The operation interception submodule 22 and the access The control submodule 21 works collaboratively to immediately block corresponding code push, file read / write, network connection, and other operations at the operating system kernel layer, network driver layer, or application layer when a violation is detected or a clear blocking instruction is received, and generates a high-priority alarm event. The policy cache synchronization submodule 23 is responsible for maintaining a local lightweight policy cache library. This library can maintain eventual consistency with the policy hub through the key policy synchronization module 6. In the event of network interruption or communication delay with the hub, this submodule can provide degradation decision-making capability based on the last synchronized effective policy to ensure that security protection is not interrupted, thereby ensuring the availability and robustness of the system.

[0036] For further details, please refer to Figure 4 The strategy central module 3 includes a dynamic risk analysis submodule 31, an intelligent strategy orchestration submodule 32, and an instruction signature issuance submodule 33; the dynamic risk analysis submodule 31 is connected to the data monitoring module 1 and to the intelligent strategy orchestration submodule 32; the instruction signature issuance submodule 33 is connected to the intelligent strategy orchestration submodule 32, and to the strategy execution module 2 and the security channel scheduling module 4. The dynamic risk analysis submodule 31 is used to identify specific security risk scenarios; The intelligent strategy orchestration submodule 32 is used to map risks into a sequence of handling actions and generate strategy identifiers; The instruction signature issuing submodule 33 is used to digitally sign the control instructions to ensure their integrity and non-repudiation.

[0037] In this embodiment, the dynamic risk analysis submodule 31 serves as the brain of the system. Its core is a real-time correlation analysis engine. This engine can integrate open-source stream processing platforms (such as Apache Flink) and load predefined threat model rules to perform pattern matching and correlation analysis on continuously input composite security context data streams. For example, it can identify combined risk scenarios such as "accessing the core algorithm library from an unfamiliar IP address outside of working hours and attempting batch downloads." Its analytical capabilities surpass simple threshold alarms. The intelligent policy orchestration submodule 32 embeds an extensible policy rule library and response script library. When the risk analysis submodule identifies a threat, the orchestration submodule, based on the threat type, severity, and affected assets, retrieves and instantiates a preset response process from the script library, generating a response containing specific actions. The system generates an ordered sequence of actions (such as immediately blocking access, triggering data encryption, raising the audit level, and isolating related resources), and assigns a globally unique policy identifier to each response. The instruction signing and issuing submodule 33 then uses the system root private key pre-installed in the hardware security module to digitally sign the arranged instruction sequence and its policy identifier, generating an authentication instruction package with cryptographic integrity and non-repudiation. This signing process follows the standard PKI system to ensure that the instruction is not tampered with during transmission to the policy execution module 2 or the secure channel scheduling module 4, and that the receiver can verify the authenticity of the instruction source by verifying the signature.

[0038] For further details, please refer to Figure 5 The secure channel scheduling module 4 includes a key scheduling submodule 41, an adaptive secure routing submodule 42, and a channel auditing submodule 43; the key scheduling submodule 41 is connected to the policy hub module 3 and the encryption / decryption engine module 5; the adaptive secure routing submodule 42 is connected to the policy hub module 3; and the channel auditing submodule 43 is connected to the adaptive secure routing submodule 42. The key scheduling submodule 41 is used to schedule and manage encryption keys on demand; The adaptive security routing submodule 42 is used to dynamically plan the transmission path of sensitive data; The channel audit submodule 43 is used to establish audit logs and form a data flow evidence chain.

[0039] In this embodiment, the key scheduling submodule 41 acts as the scheduling center for encryption resources. It integrates with external enterprise-level key management systems or cloud service providers' KMS via standardized APIs (such as PKCS#11 and KMIP). Based on the data asset sensitivity tags and compliance requirements contained in the instructions issued by the policy center, it dynamically requests or obtains corresponding data encryption keys from the KMS. To support higher security requirements, this submodule can also be designed with an interface to access a quantum-secure key source based on a quantum key distribution network, providing key materials resistant to quantum computing attacks for assets with the highest security level. The adaptive secure routing submodule 42 is responsible for planning the optimal path for each transmission task of sensitive data. It continuously collects and evaluates the real-time status (such as latency and packet loss rate) and security reputation scores of each node in the network. In addition to policy constraints (such as data not being allowed to cross borders), the system dynamically calculates and selects the most secure and reliable transmission path using an improved Dijkstra algorithm or intent-based networking technology. Path options may include encrypted tunnels within the enterprise intranet, software-defined boundary channels based on a zero-trust architecture, or encrypted data calculations performed through a trusted execution environment. The channel audit submodule 43 generates and maintains an immutable audit log for each established secure data channel. The log records in detail the source and destination of the data flow, transmission timestamps, data hash values, security policy identifiers used, and path information. After being organized using hash chain or Merkle tree technology, these logs can be periodically anchored to a blockchain or timestamp service, thereby forming a complete, verifiable, and legally valid chain of evidence for data flow, meeting the stringent requirements of compliance auditing and post-event traceability.

[0040] For further information, please refer to [link / reference]. Figure 6 The encryption / decryption engine module 5 includes a multi-algorithm engine submodule 51, a secure key injection submodule 52, and a trusted execution environment submodule 53; the multi-algorithm engine submodule 51 is connected to the secure key injection submodule 52; the trusted execution environment submodule 53 is connected to both the multi-algorithm engine submodule 51 and the secure key injection submodule 52. The multi-algorithm engine submodule 51 is used to support multiple encryption algorithms and execute them automatically according to instructions; The secure key injection submodule 52 is used to securely receive, store, and clear key materials; The Trusted Execution Environment submodule 53 provides a hardware-isolated execution environment for high-security operations.

[0041] In this embodiment, the multi-algorithm engine submodule 51 is the core of encryption and decryption calculations. It integrates multiple algorithm libraries, including Chinese national cryptographic algorithms SM2 / SM4, internationally used algorithms AES-GCM, RSA-OAEP, ECC, and post-quantum cryptography candidate algorithms (such as CRYSTALS-Kyber). The engine can automatically call the corresponding algorithm program to perform encryption or decryption operations on data according to the algorithm identifier specified in the policy instruction, ensuring the system's algorithmic agility. The secure key injection submodule 52 is a protected memory area with physical or logical isolation capabilities. It receives key materials from the key scheduling submodule 41 through a secure channel. The key exists only in plaintext form in volatile memory within it, and after each encryption / decryption calculation, this unit immediately performs an explicit memory zeroing operation to prevent key residue from causing side-channel attacks. The trusted execution environment submodule 53 is implemented based on hardware security extension technologies provided by modern CPUs, such as Intel SGX, AMD SEV, or ARM. TrustZone provides an "enclave" that is completely isolated from the host operating system and all other applications for encryption and decryption operations involving master keys or top-secret code segments. Code and data executed inside the enclave, including the keys being used, are completely encrypted and invisible to the outside, thus providing the highest level of runtime confidentiality and integrity protection.

[0042] For further details, please refer to Figure 7 The adaptive secure routing submodule 42 includes a path decision unit 421 and a tunnel management unit 422, wherein the path decision unit 421 is connected to the tunnel management unit 422. The path decision unit 421 is used to calculate the optimal secure path for each sensitive data transmission request and send the path information to the tunnel management unit 422. The tunnel management unit 422 is used to dynamically establish and maintain an end-to-end encrypted tunnel based on the decisions received from the path decision unit 421.

[0043] In this embodiment, the path decision unit 421 can be specifically implemented as a lightweight path calculation engine. It maintains a dynamic network topology and security status graph. When a data transmission request is received, the unit comprehensively considers real-time network performance indicators (such as latency and bandwidth), predefined node security reputation scores (calculated based on historical behavior and security events), and hard constraints issued by the policy center (such as "only domestic nodes allowed"), and calculates the optimal or satisfactory secure path under the current conditions through a weighted multi-objective optimization algorithm. The tunnel management unit 422 is responsible for the establishment and lifecycle management of the secure channel based on the received path decision results. It utilizes a mature network protocol stack, such as establishing a network layer tunnel through the IPsec protocol family, or establishing a transport layer / application layer encrypted channel using WireGuard, TLS, etc. The unit can dynamically migrate or rebuild tunnel connections according to changes in network conditions or policy updates to ensure the continuity and security of data transmission.

[0044] For further details, please refer to Figure 8 The trusted execution environment submodule 53 includes a remote verification unit 531 and a sealed storage unit 532, wherein the remote verification unit 531 is connected to the sealed storage unit 532. The remote verification unit 531 is used to verify the integrity and trustworthiness of the current execution environment to the strategy central module 3 before the encryption and decryption operation is executed, and to generate an unlocking command after the verification is successful. The sealed storage unit 532 is used to encrypt and store the highest security level key in use within a trusted execution environment, and only provides key access access after receiving the unlocking command from the remote verification unit 531.

[0045] In this embodiment, the remote proof unit 531 is key to achieving trusted computing. Before each high-security operation, this subunit calls instructions provided by the TEE hardware to generate a cryptographic proof report about the current enclave memory content, code hash value, and hardware status. This report is verified by the CPU manufacturer's proof service or a trusted third-party proof service. The verification result and report are sent to the policy central module 3. Only after the central module confirms that the environment is trustworthy will subsequent operations be authorized. This is the foundation for ensuring the reliability of the "trust chain". The sealed storage unit 532 utilizes the "sealed storage" feature provided by the TEE hardware. It encrypts the highest security level key that needs protection using an encryption key bound to the current enclave identity and status and stores it. This encryption operation binds the key to a specific trusted environment. Only when the remote proof is successful and proves that the current enclave is consistent with the enclave state when the sealed data was created can the sealed storage unit 532 successfully decrypt the plaintext key for use by the multi-algorithm engine submodule 51. Otherwise, the key will remain encrypted and cannot be illegally obtained.

[0046] For further information, please refer to [link / reference]. Figure 1 The key policy synchronization module 6 is also specifically connected to an internal key storage cluster 9; The internal key storage cluster 9 adopts a high-availability architecture based on multi-replica synchronization and automatic fault switching. It is used to persistently store active keys synchronized from the external key management system locally, providing low-latency key services for the encryption / decryption engine module 5.

[0047] In this embodiment, the internal key storage cluster 9 is a key component designed to address the performance bottlenecks and single-point-of-failure risks that may arise from complete reliance on an external KMS. This cluster can adopt a highly available architecture based on Raft or Paxos distributed consensus algorithms, consisting of multiple nodes, each of which persistently stores a copy of the active key. The key policy synchronization module 6, acting as the cluster's client and management interface, is responsible for pulling keys from the external KMS and writing them into the cluster, while ensuring strong data consistency among the copies within the cluster. When the encryption / decryption engine module 5 needs a key, it can directly initiate a low-latency query request to a node in the local cluster, instead of accessing the remote KMS every time. This greatly improves system performance. The cluster has an automatic fault detection and leader election mechanism. When a node fails, the service can automatically switch to a healthy node, thereby ensuring the continuity and high availability of the key service. This design achieves a balance between security and efficiency in its architecture.

[0048] Please see Figure 9 A software development environment security protection method based on data encryption, employing the aforementioned data encryption-based software development environment security protection system, includes the following steps: S1: Data monitoring module 1 performs real-time monitoring of the entire development environment and reports the collected security events and asset status data to strategy hub module 3; S2: At the same time, the compliance and privacy design module 8 transforms the embedded compliance requirements into policy rules and inputs them into the policy hub module 3. S3: The strategy central module 3 analyzes the data and assesses the risks, generating encrypted control commands; S4: To defend against replay attacks, the data stream authentication protection module 7 generates authentication tokens for control commands, and the key policy synchronization module 6 ensures that the keys and policies required to execute commands are globally consistent throughout the system. S5: Subsequently, control instructions are issued, policy execution module 2 receives the instructions, performs access control and interception in the environment, and secure channel scheduling module 4 receives the instructions, plans secure paths for sensitive data, schedules resources and ensures auditable transmission. S6: The sensitive data to be transmitted is sent to the encryption / decryption engine module 5. After verifying the command and token, the module performs encryption / decryption operations. S7: The secure channel scheduling module 4 ensures the auditability of transmission, forming a secure closed loop. The compliance and privacy design module 8 continuously scans and transforms policies, driving the policy center to make a new round of decisions, enabling the system to achieve dynamic and intrinsic security protection.

[0049] The above-disclosed embodiments are merely one or more preferred embodiments of this application and should not be construed as limiting the scope of this application. Those skilled in the art can understand that all or part of the processes for implementing the above embodiments and equivalent changes made in accordance with the claims of this application still fall within the scope of this application.

Claims

1. A software development environment security protection system based on data encryption, characterized in that, It includes a data monitoring module, a policy execution module, a policy hub module, a secure channel scheduling module, an encryption / decryption engine module, a key policy synchronization module, a data stream authentication and protection module, and a compliance and privacy design module; The data monitoring module, key policy synchronization module, and compliance and privacy design module are all connected to the policy central module. The policy central module is connected to the policy execution module. The secure channel scheduling module is connected to the policy central module. The encryption / decryption engine module is connected to the secure channel scheduling module. The data flow authentication and protection module is connected to both the policy central module and the encryption / decryption engine module. The key policy synchronization module is connected to the secure channel scheduling module. The compliance and privacy design module is connected to the data monitoring module. The data monitoring module is used for real-time monitoring of operational behavior, data flow, and asset status throughout the entire software development environment. The policy execution module is used to execute access control and operation interception policies issued by the policy hub module in the development environment; The strategy hub module is used to analyze and assess the risks of monitoring data, and generate and issue encrypted control commands. The secure channel scheduling module is used to plan secure transmission paths for sensitive data, schedule encrypted resources, and ensure the auditability of transmission. The encryption / decryption engine module is used to perform encryption / decryption operations on sensitive data; The key policy synchronization module adopts a high-availability architecture to synchronize keys and policies, ensuring global consistency. The data stream authentication and protection module is used to generate authentication tokens for control commands to achieve secondary authentication and defend against replay attacks. The compliance and privacy design module is used to embed compliance requirements into the development process, automatically identify risks, and drive policy generation.

2. The software development environment security protection system based on data encryption as described in claim 1, characterized in that, The data monitoring module includes a behavior acquisition submodule, an asset perception submodule, and a context modeling submodule; the behavior acquisition submodule is connected to the asset perception submodule; the asset perception submodule is connected to the context modeling submodule. The context modeling submodule is connected to the strategy hub module; The behavior collection submodule is used to collect operation and log data from the development environment; The asset awareness submodule is used to automatically discover and mark sensitive assets in the code; The context modeling submodule is used to construct a security context and attach it to the monitoring data for reporting.

3. The software development environment security protection system based on data encryption as described in claim 2, characterized in that, The policy execution module includes an access control submodule, an operation interception submodule, and a policy cache synchronization submodule; the access control submodule is connected to the operation interception submodule; the policy cache synchronization submodule is connected to the access control submodule, the operation interception submodule, and the policy central module, respectively. The access control submodule is used to implement dynamic permission determination based on security context; The operation interception submodule is used to block and alarm unauthorized operations in real time according to control commands; The policy cache synchronization submodule is used to cache policies locally and provide degradation support to ensure policy consistency.

4. The software development environment security protection system based on data encryption as described in claim 3, characterized in that, The strategy central module includes a dynamic risk analysis submodule, an intelligent strategy orchestration submodule, and an instruction signature issuance submodule; the dynamic risk analysis submodule is connected to the data monitoring module and also to the intelligent strategy orchestration submodule. The instruction signature issuance submodule is connected to the intelligent policy orchestration submodule, and is also connected to the policy execution module and the secure channel scheduling module. The dynamic risk analysis submodule is used to identify specific security risk scenarios; The intelligent strategy orchestration submodule is used to map risks into a sequence of actions and generate strategy identifiers; The instruction signature issuance submodule is used to digitally sign control instructions to ensure their integrity and non-repudiation.

5. The software development environment security protection system based on data encryption as described in claim 4, characterized in that, The secure channel scheduling module includes a key scheduling submodule, an adaptive secure routing submodule, and a channel auditing submodule; the key scheduling submodule is connected to the policy hub module and the encryption / decryption engine module; the adaptive secure routing submodule is connected to the policy hub module; and the channel auditing submodule is connected to the adaptive secure routing submodule. The key scheduling submodule is used to schedule and manage encryption keys on demand; The adaptive security routing submodule is used to dynamically plan the transmission path of sensitive data; The channel audit submodule is used to establish audit logs and form a chain of evidence for data flow.

6. The software development environment security protection system based on data encryption as described in claim 5, characterized in that, The encryption / decryption engine module includes a multi-algorithm engine submodule, a secure key injection submodule, and a trusted execution environment submodule; The multi-algorithm engine submodule is connected to the secure key injection submodule; the trusted execution environment submodule is connected to both the multi-algorithm engine submodule and the secure key injection submodule. The multi-algorithm engine submodule is used to support multiple encryption algorithms and execute them automatically according to instructions; The secure key injection submodule is used to securely receive, store, and clear key materials; The Trusted Execution Environment submodule provides a hardware-isolated execution environment for high-security operations.

7. The software development environment security protection system based on data encryption as described in claim 5, characterized in that, The adaptive secure routing submodule includes a path decision unit and a tunnel management unit, and the path decision unit is connected to the tunnel management unit. The path decision unit is used to calculate the optimal secure path for each sensitive data transmission request and send the path information to the tunnel management unit. The tunnel management unit is used to dynamically establish and maintain an end-to-end encrypted tunnel based on the decisions received from the path decision unit.

8. The software development environment security protection system based on data encryption as described in claim 6, characterized in that, The trusted execution environment submodule includes a remote proof unit and a sealed storage unit, wherein the remote proof unit is connected to the sealed storage unit. The remote verification unit is used to verify the integrity and trustworthiness of the current execution environment to the policy central module before the encryption and decryption operation is executed, and to generate an unlocking command after the verification is successful. The sealed storage unit is used to encrypt and store the highest security level key in use within a trusted execution environment, and only provides key access access after receiving an unlocking command from the remote verification unit.

9. The software development environment security protection system based on data encryption as described in claim 1, characterized in that, The key policy synchronization module is also specifically connected to an internal key storage cluster. The internal key storage cluster adopts a highly available architecture based on multi-replica synchronization and automatic fault switching. It is used to persistently store active keys synchronized from the external key management system locally, providing low-latency key services for the encryption and decryption engine module.

10. A method for protecting the security of a software development environment based on data encryption, employing the software development environment security protection system based on data encryption as described in claim 1, characterized in that, Includes the following steps, The data monitoring module performs real-time monitoring of the entire development environment and reports the collected security events and asset status data to the strategy hub module. Meanwhile, the compliance and privacy design module transforms the embedded compliance requirements into policy rules, which are also input into the policy hub module. The strategy central module analyzes the data and assesses risks, generating encrypted control commands; To defend against replay attacks, the data stream authentication protection module generates authentication tokens for control commands, and the key policy synchronization module ensures that the keys and policies required to execute commands are globally consistent throughout the system. Subsequently, control commands are issued, the policy execution module receives the commands and performs access control and interception in the environment, and the secure channel scheduling module receives the commands and plans secure paths for sensitive data, schedules resources and ensures auditable transmission. The sensitive data to be transmitted is sent to the encryption / decryption engine module, which verifies the command and token and then performs encryption / decryption operations. The secure channel scheduling module ensures the auditability of transmission, forming a secure closed loop. The compliance and privacy design module continuously scans and transforms policies, driving the policy center to make a new round of decisions, enabling the system to achieve dynamic and intrinsic security protection.

Images