A computer data security protection system

Abstract

The application discloses a computer data security protection system, and relates to the technical field of computer data security protection.The system performs a cryptography signature on system preset instructions in a trusted execution environment hardware sandbox, forms a signed instruction object, performs desemanticization hash mask dyeing on external untrusted data, realizes embedding subspace and attention mask isolation of an instruction channel and a data channel in a large model context window construction stage, records a traceable source chain of each Token in a self-recurrence generation process, performs signature traceability verification on a complete Token chain before a sensitive operation is triggered, and cuts off execution authority if there is an unsigned dyed data source.The system blocks an attack path in which external data is disguised as an instruction from an architecture level, and is suitable for data security protection of a large model and an intelligent agent system.

Description

Technical Field

[0001] This invention relates to the field of computer data security protection technology, specifically a computer data security protection system. Background Technology

[0002] The large language model is based on a neural network architecture. It uses a self-attention mechanism to uniformly encode and calculate all input symbol sequences. At the mathematical calculation level, the model treats the system's preset instructions and external input data as symbol sequences within the context window. The two share the same set of attention weight calculation rules. The model itself does not have the ability to naturally distinguish the credibility levels of the two.

[0003] The development of retrieval enhancement generation technology and artificial intelligence intelligent agent technology has enabled large models to call external tools, access databases, and execute system commands. Attackers can induce models to perform sensitive operations beyond their authority by secretly embedding malicious instructions in externally retrieved documents, web page content, or user-uploaded files, resulting in the illegal reading and leakage of core data.

[0004] Currently, the mainstream defense solutions in the industry against the above attacks include solutions based on keyword and regular expression filtering, and solutions based on secondary model review.

[0005] The former approach uses a pre-defined rule base to scan and match the content during text input and output, and intercepts the content if sensitive strings are matched.

[0006] The latter approach calls an independent review model to perform semantic-level security checks on the generated content after the main generation model outputs the results.

[0007] Both of the above-mentioned solutions perform post-event interception at the application or semantic level, without addressing the fundamental reason that the underlying instructions and data of the model are indistinguishable. The rule matching solution has the defects of lag and false negatives. The judgment of the model review solution is still based on the assumption that the semantic understanding is correct, and the additional model that needs to be introduced will bring inference delay and increased computational cost. Summary of the Invention

[0008] The technical problem to be solved by this invention is that existing large language models and artificial intelligence agent systems built on them cannot distinguish between system preset instructions and external input data at the underlying computing architecture. This allows attackers to induce the model to perform sensitive operations beyond its authority by secretly embedding malicious instructions in external data, resulting in the illegal reading and leakage of core data of the computer system.

[0009] Existing keyword filtering and secondary model review solutions are all post-hoc remedial measures at the application or semantic layer, failing to prevent the confusion between instructions and data from the underlying computational principles and system architecture of the model.

[0010] To address the aforementioned technical problems, this invention provides a computer data security protection system. The system, deployed as a secure proxy middleware between the embedded input of a large model and the application programming interface (API) caller, includes a TEE hardware-level instruction signing module, a dynamic taint coloring and dual-channel isolation module, a token chain tracing and recording module, and an API call blocking module based on signature tracing. Specifically, the TEE hardware-level instruction signing module performs cryptographic signatures on the system's preset core rules and high-privilege instructions within a trusted execution environment (TEX) hardware sandbox, generating a signed instruction object with a hardware root of trust.

[0011] The dynamic taint coloring and dual-channel isolation module divides external untrusted data into blocks and generates exclusive semantically de-semantic hash mask labels to form tainted data objects. During the large model context window construction phase, the signature instruction object and the tainted data object are mapped to mutually isolated embedding subspaces. Attention mask partitions are set to limit the cross-channel contribution of the tainted data object to the decision weight of the instruction channel.

[0012] The Token Chain Traceability Recording Module records the source set of each generated Token during the model's autoregressive generation process, forming a traceable source chain for each Token.

[0013] The application programming interface call blocking module based on signature tracing performs source trust verification on the complete token chain before sensitive operations are triggered. If any link in the chain is found to depend on an unsigned colored data object, the execution permission of that operation is forcibly cut off from the underlying architecture.

[0014] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows:

[0015] 1. Because the core instructions of the system are signed within a trusted execution environment hardware sandbox, and the signature remains immutable during subsequent processing, the present invention eliminates the possibility of instructions being forged or overwritten by external data at the hardware root of trust level.

[0016] 2. Because untrusted external data is forcibly colored before entering the model, and is physically and logically isolated from the instruction channel at both the embedding subspace and attention calculation levels, even if highly realistic instructional text is embedded in the data, the text is still marked as data channel content and does not qualify to trigger high-privilege operations.

[0017] 3. Because the present invention requires signature tracing and verification of the token chain that triggers the operation before the execution of sensitive operations, even if the attack inducement model makes an incorrect decision at the semantic level, the system can still forcibly intercept it at the architectural level in the final stage before execution, forming a defense in depth.

[0018] 4. Since the verification calculations are concentrated on sensitive operation nodes with low trigger frequency, this invention provides architectural-level security while reducing the overall system inference latency and additional computational resource consumption compared to the solution of introducing a second large model for semantic review. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the overall architecture of the system in this embodiment of the invention.

[0020] Figure 2 This is a flowchart of the TEE hardware-level instruction signature generation and injection process in an embodiment of the present invention;

[0021] Figure 3 This is a flowchart of dynamic stain staining and dual-channel isolation processing in an embodiment of the present invention. Detailed Implementation

[0022] The following is in conjunction with the appendix Figure 1-3 The specific embodiments of the present invention will be further described below. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0023] The technical solution of the present invention will be further described below with reference to specific embodiments. Those skilled in the art should understand that the following embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0024] I. System Overall Architecture

[0025] The computer data security protection system provided by this invention is deployed in the form of a security proxy middleware between the embedded input end of a large model and the application programming interface (API) call end executed by the proxy. It can be non-intrusively connected to existing retrieval enhancement generation systems and intelligent agent scheduling frameworks without modifying the internal structure of the retrieval enhancement generation systems and intelligent agent scheduling frameworks. The system includes four functional modules that work in sequence: TEE hardware-level instruction signing module, dynamic taint coloring and dual-channel isolation module, Token chain traceability recording module, and API call blocking module based on signature traceability. Data generated by user input terminals, external web page retrieval sources, and third-party document upload sources in the external environment layer are processed by the dynamic taint coloring and dual-channel isolation module and then enter the dual-channel context construction layer of the large model together with the system instructions processed by the TEE hardware-level instruction signing module.

[0026] The model generation results are synchronously output to the Token Chain traceability recording module;

[0027] When a sensitive operation is detected, the application programming interface based on signature tracing calls the blocking module for final determination.

[0028] II. TEE Hardware-Level Instruction Strong Signature Isolation Mechanism

[0029] The system's pre-defined core rules and high-privilege instructions are loaded into the trusted execution environment (TEE) hardware sandbox during system initialization. Cryptographic signatures are then performed within the sandbox, forming immutable signed instruction objects. Specifically, during system initialization, a key is generated within the TEE hardware security module. This key is stored only within the encrypted memory area of ​​the TEE; the operating system, virtualization layer, and application layer programs cannot read or export it. The system's pre-defined core rules and high-privilege instruction set are loaded into the TEE hardware sandbox, where each instruction corresponds to a piece of original text content. Within the TEE hardware sandbox, the cryptographic signature of each instruction is calculated as follows:

[0030] ;

[0031] in, Represents a cryptographic hash function;

[0032] Indicates the first The original text content of the system instruction;

[0033] This refers to the key generated and managed internally by the hardware security module of the trusted execution environment;

[0034] This represents the random number generated during the signature calculation, used to prevent signature replay attacks.

[0035] This represents a string concatenation operation, which converts the calculated signature result into a string. Compared with the original instruction The instruction channel identifier is encapsulated together as an immutable signed instruction object. This signed instruction object retains its signature and channel identifier throughout the entire process of injecting prompt words into the large model, participating in key-value caching and autoregressive generation. Any tampering with the instruction content will cause the subsequent signature verification process to fail, thereby ensuring the authority of the system instructions at the hardware root of trust level.

[0036] III. Dynamic Stain Staining and Dual-Channel Isolation Mechanism

[0037] For all untrusted inputs from external sources, the security proxy middleware performs block processing at the input layer to obtain multiple minimum coloring units, and calculates a unique semantically removed hash mask label for each minimum coloring unit:

[0038] ;

[0039] in, Indicates the first The contents of the smallest coloring unit;

[0040] This indicates a random salt value generated by the system for this session, used to prevent prediction and forgery of the desemantic hash mask label;

[0041] The bit width parameter representing the mask label;

[0042] This represents the modulo operation, which will color the labels. By binding with the data channel identifier to form a colored data object, during the context window construction phase of the large model, the system maps the signed instruction object of the instruction channel and the colored data object of the data channel to physically isolated embedding subspaces according to the channel identifier of each input unit. The system also sets the corresponding attention mask partition in the self-attention calculation layer to restrict the direct cross-channel contribution of the data channel content to the decision weight of the instruction channel, thereby preventing the instruction text embedded in the external data from being misjudged by the model as a system instruction with execution authority.

[0043] IV. Token Chain Traceability Mechanism

[0044] During the model's autoregressive generation process, for each generated token, the system records the source distribution of its attention weights, determines its source set, and allows the token to inherit the traceability identification information corresponding to its source object. The traceability identification information includes two types: signature information and coloring label information, which correspond to the source of the instruction channel and the source of the data channel, respectively. This forms a traceable source chain for each token, which can be called by the subsequent authentication process.

[0045] V. Application Programming Interface Call Blocking Mechanism Based on Signature Origin

[0046] When an agent triggers a high-risk operation during inference, such as sensitive data querying, database access, file reading / writing, or external network transmission, the system pauses the actual execution before proceeding with the operation and enters the authentication and verification process. The system extracts the complete token chain that triggered the operation. For each token in the chain, it reads its source set and determines whether the set contains colored data objects that have not passed the signature verification of the trusted execution environment. The system defines the trust value of a single token according to the following method: Indicates the first The trust determination value of each token, the range of which is: When the source set of the token When all source objects in the process possess at least one of a valid signature and authorization certificate, ;

[0047] when When there is colored data from sources that lack valid signatures and authorization credentials, The system calculates the overall trust risk value of this sensitive operation based on the following formula:

[0048] ;

[0049] in, Indicates trigger operation The complete token chain;

[0050] This represents the overall trust risk value of the sensitive operation, which is true if and only if the trust value of all tokens in the chain is 1. This indicates that the operation is trustworthy;

[0051] When there is a token in the chain with a trust value of 0 This indicates that the operation is untrusted. The system directly cuts off the execution permission of the application interface call at the underlying architecture level, preventing actual database access, file reading and writing or network transmission from occurring, and generates security audit logs simultaneously.

[0052] like If the operation is blocked, it will be allowed to be executed normally by the lower-level system. The system will also update the color data features corresponding to the blocking event to the risk feature database for rapid identification and interception of subsequent same-origin attack patterns.

[0053] VI. Other Implementation Methods

[0054] In deployment environments lacking trusted execution environment hardware support, a software-level isolation sandbox can be built using operating system kernel-level secure containers or microvirtual machine technology. Within this sandbox, key management and signature calculation for system instructions are performed, and a kernel-level integrity verification module replaces the hardware-level immutability guarantee to achieve instruction signature isolation effects similar to trusted execution environment solutions. This approach is suitable for deployment scenarios with limited hardware resources.

[0055] Without modifying the underlying large-scale model attention calculation structure, an independent lightweight verification model can be deployed to verify the source of the application interface call requests output by the main generator model and their associated original input context. The verification model maintains a coloring label and signature lookup table consistent with the main model. By comparing whether the original data fragments referenced by the call parameters hit the coloring label library, it achieves an effect similar to token-by-token backtracking, thereby reducing the depth of modification to the underlying architecture of the model inference engine. It is suitable for deployment scenarios where the cost of modifying the existing large-scale model inference service framework is high.

[0056] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope defined by the claims of the present invention.

Claims

1. A computer data security protection system, characterized in that, The system is deployed as a security proxy middleware between the embedded input end of the large model and the application programming interface (API) call end executed by the proxy. The system includes: The TEE hardware-level instruction signing module is used to perform cryptographic signing on the system's preset core rules and high-privilege instructions within a trusted execution environment hardware sandbox, generate signed instruction objects, and mark the signed instruction objects with instruction channel identifiers. The dynamic stain coloring and dual-channel isolation module is used to divide data from untrusted external input channels into blocks, calculate semantically removed hash mask labels for each data block, bind the hash mask labels to the data channel identifier, and generate stained data objects. During the context window construction phase of the large model, based on the channel identifier, the signature instruction object and the colored data object are mapped to mutually isolated embedding subspaces, and attention mask partitions are set to limit the cross-channel contribution of the colored data object to the decision weight of the channel where the signature instruction object is located. The Token chain tracing and recording module is used to record the source distribution of the attention weights for each generated Token during the autoregressive generation process of the large model, obtain the source set of the Token, and enable the Token to inherit the tracing identification information corresponding to its source object. The tracing identification information includes two types: signature information and coloring label information, forming a traceable source chain for each Token. The application interface call blocking module based on signature tracing is used to pause the execution of the sensitive operation when a proxy triggers a sensitive operation, extract the complete token chain that triggered the sensitive operation, trace back the source set of each token in the token chain one by one, and determine whether there is a colored data object in the source set that has not passed the signature verification of the TEE hardware-level instruction signature module. If it exists, then the execution permission of the sensitive operation will be cut off at the underlying architecture level; If it does not exist, then allow the sensitive operation.

2. The system according to claim 1, characterized in that, The TEE hardware-level instruction signing module is also used to: generate a key inside the trusted execution environment hardware security module during the system initialization phase, and the key is stored only in the encrypted memory area of ​​the trusted execution environment; For each instruction in the system's preset instruction set, the cryptographic signature corresponding to the instruction is calculated based on the cryptographic hash function, the original text content of the instruction, the key, and the random number generated for this signature calculation. The cryptographic signature, the original text content of the instruction, and the instruction channel identifier are encapsulated together into a signature instruction object.

3. The system according to claim 1, characterized in that, The dynamic taint coloring and dual-channel isolation module is also used to: calculate the semantic-free hash mask label based on the cryptographic hash function, the content of each data block, and the random salt value generated for this session; The random salt value is used to prevent the prediction and forgery of the semantically removed hash mask label.

4. The system according to claim 1, characterized in that, The application programming interface call blocking module based on signature tracing is also used to: for each Token in the Token chain, determine whether all source objects in its source set have at least one of a valid signature and an authorization certificate; If both conditions are met, the trust value of the token is set to the first value; otherwise, it is set to the second value. When there is a token in the token chain with a trust judgment value of the second value, the sensitive operation is determined to be untrusted, and the execution permission of the sensitive operation is cut off at the underlying architecture level; When the trust value of all tokens in the token chain is the first value, the sensitive operation is determined to be trustworthy, and the sensitive operation is allowed.

5. The system according to claim 1, characterized in that, The system interfaces with the retrieval enhancement generation system and the agent scheduling framework in a non-intrusive manner, without requiring any modification to the internal structure of the retrieval enhancement generation system and the agent scheduling framework.

6. The system according to claim 1, characterized in that, The key generated in the TEE hardware-level instruction signing module is stored only in the encrypted memory area of ​​the Trusted Execution Environment (TEE), and cannot be read or exported by the operating system, virtualization layer, or application layer programs.

7. The system according to claim 1, characterized in that, The application programming interface call blocking module based on signature tracing is also used to: after cutting off the execution permission of the sensitive operation, generate a security audit log and update the coloring data features corresponding to this blocking event to the risk feature library for the identification of subsequent same-origin attack patterns.

8. A method for protecting computer data security, characterized in that, The method is applied to a secure proxy middleware deployed between the embedded input of a large model and the application programming interface (API) caller of the proxy execution. The method includes: Within the trusted execution environment hardware sandbox, the system's preset core rules and high-privilege instructions are cryptographically signed to generate signed instruction objects, and the signed instruction objects are marked with instruction channel identifiers. Data from untrusted external input channels is segmented into blocks. For each data block, a semantically de-semantic hash mask label is calculated. The hash mask label is then bound to the data channel identifier to generate a colored data object. During the context window construction phase of the large model, based on the channel identifier, the signature instruction object and the colored data object are mapped to mutually isolated embedding subspaces, and attention mask partitions are set to limit the cross-channel contribution of the colored data object to the decision weight of the channel where the signature instruction object is located. During the large model autoregressive generation process, for each generated token, the source distribution of its attention weight is recorded to obtain the source set of the token, and the token inherits the traceability identification information corresponding to its source object. The traceability identification information includes two types: signature information and coloring label information, forming a traceable source chain for each token. When a proxy triggers a sensitive operation, the execution of the sensitive operation is paused, the complete token chain that triggered the sensitive operation is extracted, and the source set of each token in the token chain is traced back one by one to determine whether there are any colored data objects that have failed the signature verification in the source set. If it exists, then the execution permission of the sensitive operation will be cut off at the underlying architecture level; If it does not exist, then allow the sensitive operation.

9. The method according to claim 8, characterized in that, The steps for cryptographically signing the system's preset core rules and high-privilege instructions include: during the system initialization phase, generating a key within the trusted execution environment's hardware security module, and storing the key only within the encrypted memory area of ​​the trusted execution environment; For each instruction in the system's preset instruction set, the cryptographic signature corresponding to the instruction is calculated based on the cryptographic hash function, the original text content of the instruction, the key, and the random number generated for this signature calculation. The cryptographic signature, the original text content of the instruction, and the instruction channel identifier are encapsulated together into a signature instruction object.

10. The method according to claim 8, characterized in that, The step of determining whether there are colored data objects that have failed signature verification in the source set includes: for each Token in the Token chain, determining whether all source objects in its source set have at least one of a valid signature and an authorization certificate; If both conditions are met, the trust value of the token is set to the first value; otherwise, it is set to the second value. When there is a token in the token chain with a trust judgment value of the second value, the sensitive operation is determined to be untrustworthy; When the trust value of all tokens in the token chain is the first value, the sensitive operation is determined to be trustworthy.

Images