CN108595982B - Secure computing architecture method and device based on multi-container separation processing - Google Patents

Abstract

Translated fromChinese

本发明涉及安全计算机架构领域，尤其是一种基于多容器分离处理的安全计算架构方法及装置。本发明提出的计算架构方法中，包含了四个不同的处理容器，采取了容器安全隔离、容器协同防御、外部物理锁与内部逻辑锁安全管控、动态内存安全清洗、软件行为独立监管、敏感文件安全处理与保护、电子支付密码保护、操作系统软件与应用软件分离安装、系统软件安全升级等多种安全机制，在所提出的安全计算架构上通过执行严密的安全处理控制与操作流程，最终达到安全计算的目的。

The invention relates to the field of secure computer architecture, in particular to a secure computing architecture method and device based on multi-container separation processing. The computing architecture method proposed by the present invention includes four different processing containers, and adopts container security isolation, container collaborative defense, external physical lock and internal logical lock security management and control, dynamic memory security cleaning, independent software behavior supervision, and sensitive files. Various security mechanisms such as security processing and protection, electronic payment password protection, separate installation of operating system software and application software, system software security upgrade, etc., through the implementation of strict security processing control and operation procedures on the proposed security computing architecture, the final achievement is achieved. The purpose of secure computing.

Description

Secure computing architecture method and device based on multi-container separation processing

Technical Field

The invention relates to the field of secure computer architecture, in particular to a secure computing architecture method and device based on multi-container separation processing.

Background

The operation architecture of the existing computer system adopts a single-core or multi-core design concept, and is based on the design idea of a single physical container, a software system and a file system are located in the same physical storage space, an operating system and various application software run in the same set of memory, attack codes can use various application software as an intrusion carrier, malicious software such as viruses and trojans can attack the interior of the computer system through external interfaces such as a network card, a CD driver and a USB, and the serious security threat can be formed for mobile electronic payment by recording the trojans through a keyboard. The traditional single-container operation architecture only considers the high efficiency and the reliability of the operation function, the safety of the traditional single-container operation architecture completely depends on a terminal safety protection system or cloud safety protection realized by software, due to the inherent architecture defects, the traditional single-container operation architecture has no defense elasticity and has no defense depth, the single-container operation architecture is difficult to resist various unknown safety threats, any safety hole is utilized to possibly break through the whole defense system, the safety hidden danger of the single-container processing architecture is inherent, and the defense is almost not established at present when the network attack technology is rapidly developed.

The essence of the network attack is to tamper the system software of the target computer or insert malicious code into application software, or steal sensitive data of the target, or sneak into the dynamic memory of the target to obtain an execution opportunity, or destroy the normal operation of the target. Such a computer system is highly secure in cyberspace if the security mechanism is such that the attacking software code cannot be installed into the targeted software system at all, or has no opportunity to execute at all, nor to obtain sensitive information.

Disclosure of Invention

The technical problem to be solved by the invention is as follows: aiming at the problems in the prior art, a secure computing architecture method and device based on multi-container separation processing are provided. The invention provides a novel security computing architecture for four-container split defense, wherein each container is divided and realizes a corresponding computing function and a defense mechanism according to a security defense target. Each container performs only a given function and adopts a highly targeted security defense mechanism. Various safety protection mechanisms adopted by each container work coordinately, so that the whole computing architecture has a safe and deep defense capability, the serious consequences of network attack on the computer are avoided, and the possibility of becoming a zombie computer after being attacked is eliminated.

The technical scheme adopted by the invention is as follows:

a secure computing architecture method based on multi-container separation processing comprises the following steps:

a safety computer setting step: the safety computer is provided with four independently operated processing containers which are respectively an application-oriented elastic defense container (C1), a TCP/IP protocol stack-oriented elastic defense container (C2), a safety isolation container and a safety storage container, wherein C1 and C2 are connected with the safety isolation container through an internal first high-speed communication bus, the safety storage container is connected with the safety isolation container through an internal second high-speed communication bus, and high-speed communication is realized based on an internal communication protocol format; the C1 container of the safety computer is connected with a display card, an optical drive, a mouse, a USB and a 232 serial port, the C2 container is connected with a network interface, the safety isolation container is connected with a keyboard, the safety storage container is provided with a hard disk, a sensitive file FLASH disk, a USBKey interface and a biological authentication interface, and in addition, each container is provided with a local system software FLASH disk;

a safety isolation container isolation step: as a control core of computer cooperative defense, the method implements the safety control of the whole flow of processing of all applications, executes safety isolation control between the elastic defense container and the safety storage container, and blocks attack penetration to the safety storage container;

safety protection and control steps: the safety computer is provided with an external interface lock, an external physical lock and an internal logic lock, and is used for jointly implementing safety protection and management and control;

and (4) safe operation supervision step: each processing container of the safety computer is provided with a software behavior independent monitoring module, and the safety isolation container is provided with a safety control module independently and is connected through a safety control bus for implementing safety operation supervision control.

Further, the method further comprises the following steps:

the method comprises the following steps of joint management and control of an external physical lock and an internal logic lock: the safety computer blocks the external connection of the computer by closing the external interface lock, blocks the writing of the external physical lock of the FLASH disk by closing the external physical lock, prevents the safety omission of closing the external physical lock by a user by an internal logic lock, and jointly realizes the software tampering prevention and the data stealing prevention;

and (3) the user manages and controls the external physical lock: the software can not open/close the external physical lock and the external interface lock of the system software FLASH and the sensitive file FLASH, and only a computer user can directly open/close the external physical/interface locks in a manual mode to control the writing/reading of the FLASH in an absolute permission mode;

monitoring the state of the physical lock; the software behavior independent monitoring module of each container is responsible for monitoring the open/close states of the FLASH external physical locks and the external interface locks of the containers and reporting the open/close states to the security control module through the security control bus, and the security isolation container acquires the open/close states of all the external interface locks of the computer, the FLASH external physical locks of the system software and the FLASH external physical locks of the sensitive files through the security control module;

a logic lock management and control step; each container receives an instruction of opening/closing the internal logic lock of the FLASH sent by the security isolation container through the security control bus when the work flow needs through the software behavior independent monitoring module, and executes corresponding opening/closing control operation through the local control circuit.

Further, the method further comprises the following steps:

software behavior independent monitoring step: the software behavior independent monitoring module of each container monitors the abnormal behavior of the software, and reports to the security control module through the security control bus if the abnormal operation state (such as dead cycle) of the software is monitored, or the abnormal write operation (such as system FLASH) exists in the state that the external physical lock and the internal logic lock of the FLASH are closed;

safety protection management and control steps: the safety isolation container monitors the running states of other containers in real time based on a safety control module, and after a state instruction of abnormal running of C1 or C2 or safety storage container software is received, whether a safety control instruction of container restarting system software needs to be sent out through the safety control module is determined according to the current safety workflow; and if necessary, forcibly terminating the network attack by restarting the container, and cleaning the memory to remove the malicious codes.

Furthermore, when the safety computer is started, each processing container independently finishes the starting process, namely after the whole dynamic memory is cleaned, the system software codes in the system software FLASH disk are copied to the preset dynamic memory to execute the starting process, and then the normal working state is entered; after software of the security isolation container is started, firstly, a system software FLASH logical lock and a sensitive file FLASH logical lock of each container are immediately closed, and then states of a system software FLASH external physical lock, a sensitive file FLASH external physical lock and an external interface lock of a computer are obtained through a security control bus based on a security control module; and if the security isolation container judges that the external physical lock of the system software FLASH is not closed, the external physical lock of the sensitive file FLASH is not closed or the external interface lock is not opened, sending a prompt for closing/opening the corresponding external lock to the user on the C1 interface.

Further, when the application software is installed or upgraded, the application software is registered in the safe storage container, and the executable codes of the application software file are written into the large-capacity hard disk; after receiving the request of installing the application software, the safety isolation container sends a command message of installing the application software to the safety storage container; the safe storage container records the name information of the application software in an application software registry and records a storage space distributed for the application software execution code file in a hard disk;

the safe storage container writes the executable code file of the application software into the distributed hard disk storage space, deletes the downloaded compressed software package and the decompressed installation software file, and completes software installation.

Further, when the user needs to start the application software, the C1 container sends a request message for starting the application software, and sends the request message to the secure storage container via the secure isolation container;

the method comprises the steps that a safe storage container reads application software information recorded in a registration table in a hard disk, obtains storage space information distributed for an application software execution code file in the hard disk, then reads the application software executable code file, transmits the application software executable code file to a C1 container through the forwarding of a safe isolation container in the form of data blocks, writes the application software executable code file into a dynamically distributed memory, and then executes the application software;

during the operation of the application software, the corresponding temporary file is temporarily stored in the high-capacity DDR of C1, and when the operation is finished, the configuration parameter modification file of the application software, which is obtained by a user, is transmitted to the safe storage container and is stored in the configuration file corresponding to the application software.

Further, in the sensitive file processing mode, according to the specified flow steps, closing an external interface lock of the computer, stopping internal first high-speed communication bus communication between the computer and a C2 container, executing C1 memory cleaning, opening an external physical lock and an internal logic lock of a sensitive file FLASH, reading the sensitive file in the sensitive file FLASH, transmitting the sensitive file to C1, and temporarily storing the sensitive file in a DDR temporary file system of C1; c1 starts the corresponding application software to open the sensitive file, executes the file editing process, and after the file processing is finished, the file is saved in the sensitive file FLASH; then the operations of C1 memory cleaning, closing the internal logic lock and external physical lock of the sensitive file FLASH and opening the external interface lock of the computer are executed in turn.

Further, when the confidential document processing is performed: in the corresponding security processing mode, according to the specified flow steps, closing an external interface lock of the computer, stopping the internal first high-speed communication bus communication with a C2 container, executing C1 memory cleaning, opening an external physical lock and an internal logic lock of a sensitive file FLASH, reading a confidential file in the sensitive file FLASH, transmitting the confidential file to C1 after executing storage decryption, and temporarily storing the confidential file in a high-capacity DDR (at least 16Gbyte) temporary file system of C1; c1 starts the corresponding application software to open the confidential document, executes the editing process of the document, after the document processing, the document is stored in the sensitive document FLASH after being stored and encrypted; then sequentially executing operations of C1 memory cleaning, closing the internal logic lock and the external physical lock of the sensitive file FLASH and opening the external interface lock of the computer;

when the confidential file transmission is performed: in the corresponding security processing mode, a confidential file directory read from a hard disk is displayed on the C1, a user clicks the confidential file to be transmitted and selects a receiver of the confidential file, an internal logic lock and an external physical lock of a sensitive file FLASH are opened, and the confidential file subjected to storage decryption and communication encryption is sent to a specified destination IP address from a confidential communication special protocol port through the C2; then closing an internal logic lock and an external physical lock of the sensitive file FLASH;

when receiving the confidential document: in the non-confidential communication mode, the C2 container receives a first communication message at a confidential communication special port, transmits the first communication message to the security storage container through the security isolation container, and after decryption confirmation, opens the external physical lock and the internal logic lock of the sensitive file FLASH and then receives the confidential file; and after the file is received, firstly performing communication decryption, then performing local storage encryption, writing the encrypted file into the sensitive file FLASH, and closing the external physical lock and the internal logic lock of the sensitive file FLASH.

Furthermore, in the internet application processing mode, the browsing software can be started only in the state that the external physical lock of the system software FLASH of each container is closed; when a user browses the Internet, browsing software is opened on an operation interface of a C1 container, an Internet website to be visited is clicked through a website map, and all HTTPS protocol messages generated by the C1 container are forwarded to a C2 container through a virtual TCP/IP stack, an internal first high-speed communication bus and a security isolation container;

the C2 container transmits all TCP messages received from the network port to the security isolation container through the internal first high-speed communication bus, and the security isolation container judges that the TCP data block belongs to the communication data of the non-confidential communication port and forwards the communication data to the C1 container through the internal first high-speed communication bus.

Further, in the non-sensitive file processing mode, when a user clicks a non-sensitive file to be opened, the C1 security application program opens corresponding document processing software according to the file type scheduling, and sends an instruction message for acquiring the specified non-sensitive file to the security storage container through the security isolation container; the secure storage container reads the designated file on the hard disk, and sends the designated file to the C1 through the secure isolation container, and the C1 temporarily stores the acquired non-sensitive file in the high-capacity DDR temporary file system; c1 processing the non-sensitive file, sending it to the safe storage container and storing it in the large-capacity hard disk.

Further, when the confidential mail writing process is performed: when a user needs to compile a confidential e-mail, firstly closing an external interface lock of a computer, executing C1 memory cleaning, then opening an external physical lock and an internal logic lock of a sensitive file FLASH, completing mail compiling, carrying out storage encryption on a mail file, storing the mail file in the sensitive file FLASH, closing the external physical lock and the internal logic lock of the sensitive file FLASH, executing C1 memory cleaning, and opening the external interface lock;

when the confidential mail sending process is performed: opening an external physical lock and an internal logic lock of a FLASH sensitive file of a secure storage container, reading a confidential mail to be sent by the secure storage container, executing storage decryption firstly, then performing transmission encryption, temporarily storing the confidential mail in a DDR temporary file system of C1, and sending out C1 through an electronic mail system; finally, C1 deletes the confidential e-mail in the DDR temporary file system, and cleans the used memory space of the confidential e-mail; closing an external physical lock and an internal logic lock of the sensitive file FLASH;

when confidential mail reception processing: when a user needs to receive a confidential email, opening a website email receiving webpage interface, downloading the email, storing the email in a DDR temporary file system of C1, transferring the email to a security storage container through a security isolator, then opening an external physical lock and an internal logic lock of a sensitive file FLASH, decrypting the email by the security storage container, and encrypting and storing the email in a sensitive file FLASH disk by using a local key; then closing an internal logic lock and an external physical lock of the sensitive file FLASH;

when the confidential mail viewing process is performed: when a user needs to check the confidential e-mail, firstly closing an external interface lock and executing C1 memory cleaning; then, the user clicks the confidential mails to be checked according to the confidential mail directory stored in the hard disk; finally, opening an external physical lock and an internal logic lock of the sensitive file FLASH, reading a specified confidential mail in the sensitive file FLASH, executing storage decryption, and transmitting the confidential mail to a DDR temporary file system of C1; after the processing is finished, C1 executes memory cleaning, closes the external physical lock and the internal logic lock of the sensitive file FLASH, and opens the external interface lock.

Further, when the user needs to submit the electronic payment password, the user clicks a payment transaction session box on a webpage, and the browser requests an SSL or SET encryption session from the electronic payment Web server; the security isolator identifies an SSL or SET message of the electronic payment request from the message data stream forwarded from the C1 to the C2, and enters an electronic payment working mode;

the security isolation container identifies SSL/SET messages responded by the electronic payment Web server from data flow forwarded from the C2 container to the C1 container, copies an encrypted public key sent by the server to the payment terminal, and forwards the messages to the C1 container; c1, the virtual keyboard driver module receives the user name and password in the payment session box;

the security isolation container finds the message of the encrypted payment password carried by the SSL or SET protocol from the data stream forwarded from the C1 to the C2, and records and forwards the message to the C2; the security isolator clears the recorded password and public key.

Further, when the user confirms the upgrade system software version, the C1 container sends a request message specifying the container operating system software upgrade to the security isolation container; after receiving a request for upgrading the software of the operating system of the designated container, the security isolation container enters a security upgrading processing mode; closing an external interface lock of the computer; cleaning the whole dynamic memories of C1 and C2; opening an external physical lock and an internal logic lock of a system software FLASH of a target container; the safe storage container reads an appointed operating system upgrading software file in the large-capacity hard disk and transmits the file to the safe isolator; the safety isolation container transfers the data block of the upgrade software file of the operating system to the elastic defense container C1 or C2 according to the designated upgrade target container, or stores the data block in a dynamic memory of the safety isolation container for upgrade operation; and after the upgrade is finished, closing the external physical lock and the internal logic lock of the system software file FLASH of the target container.

In summary, due to the adoption of the technical scheme, the invention has the beneficial effects that:

the novel safety computing architecture realizes the aim of computing environment information safety in a man-machine cooperation mode of organically combining internal logic control and external physical control, and realizes elastic defense, attack isolation, software system tampering blocking, system software upgrading safety, electronic payment password input safety, sensitive/confidential file processing safety and storage and transmission safety based on multiple safety mechanisms in a cooperation mode. The novel security computing architecture can solve the operation security problem of computers in non-secure network environments (public internet and intranet), can realize a dual-purpose security computer for military and civilian use which can be accessed to the internet, and can guarantee the security of a software system of each computer, the storage and processing security of sensitive/confidential file data and the data communication security in the internet and intranet with various known and unknown security threats.

Drawings

The invention will now be described, by way of example, with reference to the accompanying drawings, in which:

FIG. 1 is a diagram of a multi-container secure computing architecture.

Fig. 2 is the functional composition of the software system of the elastic defense container C1.

Fig. 3 is a functional component diagram of the software system of the flexible defense container C2.

FIG. 4 is a functional component diagram of a secure isolated container software system.

FIG. 5 is a functional component diagram of a secure storage container software system.

FIG. 6 is a flow chart of secure computer boot up.

Fig. 7 is an internet browsing workflow diagram.

FIG. 8 is a non-sensitive file processing workflow.

FIG. 9 is a sensitive file security process flow diagram.

Fig. 10 is a flowchart of the confidential document security process.

Fig. 11 is a flowchart of the confidential document transmission processing.

Fig. 12 is a flowchart of the confidential document receiving process.

Fig. 13 is a confidential mail transmission flowchart.

Fig. 14 is a confidential mail receiving flow chart.

Fig. 15 is an electronic payment password protection processing flow diagram.

FIG. 16 is an operating system software upgrade security control flow diagram.

Fig. 17 is an application software installation control flowchart.

Fig. 18 is an application software startup control flowchart.

Fig. 19 is a safe operation supervisory control flow chart.

Reference numerals:

representing a high-speed communication bus

Representing asafety control bus 1 representing a system software foreign objectLock with handle

2 represents external interface physical Lock 3 represents external physical Lock for sensitive File

Detailed Description

All of the features disclosed in this specification, or all of the steps in any method or process so disclosed, may be combined in any combination, except combinations of features and/or steps that are mutually exclusive.

Any feature disclosed in this specification may be replaced by alternative features serving equivalent or similar purposes, unless expressly stated otherwise. That is, unless expressly stated otherwise, each feature is only an example of a generic series of equivalent or similar features.

The computing architecture method and the device provided by the invention comprise four different processing containers (an elastic defense container C1, an elastic defense container C2, a security isolation container and a security storage container), three external physical security locks (an external interface lock of a computer, an external physical lock of a system software FLASH and an external physical lock of a sensitive file FLASH), an internal logic lock of the FLASH and a plurality of mechanisms for guaranteeing security computing processing. The flexible defense container C1 is used for defending security threats from application software, the flexible defense container C2 is used for defending security threats from a four-layer protocol below a TCP/IP protocol stack, the security isolation container is used for coordinating and implementing security control in various processing flows, and the security storage container is used for storing sensitive files with privacy, non-sensitive files without privacy and application program files. Each container has an independent monitoring module for its own software behavior. The external interface lock of the computer is used for physically blocking the communication connection between the computer and the outside, and the external physical lock and the internal logic lock of the FLASH are used for blocking the read/write operation of the FLASH. In the method and the device for the computing architecture, provided by the invention, various security mechanisms such as container security isolation, container cooperative defense, external physical lock and internal logic lock security control, dynamic memory security cleaning, software behavior independent supervision, sensitive file security processing and protection, electronic payment password protection, operating system software and application software separated installation, system software security upgrading and the like are adopted, and the purpose of security computing is finally achieved by executing strict security processing control and operation flow on the provided security computing architecture.

Multi-container secure computing architecture

A multi-container secure computing architecture is shown in fig. 1.

The multi-container novel safety computer architecture is composed of an application-oriented elastic defense container (C1), a TCP/IP protocol stack-oriented elastic defense container (C2), a safety isolation container and a safety storage container. The main design idea is to divide the functions of the traditional single-container computer architecture correspondingly according to defense targets, and each container realizes different computing functions and corresponding defense functions. Each container performs only a given function and adopts a highly targeted security defense mechanism. The containers are interconnected by an internal high speed communication bus and a security control bus.

The application-oriented elastic defense container realizes the upper layer protocol of the computer and various applications, the drive of USB, CD driver, display card, mouse and RS232 interface, and corresponding targeted security defense mechanism. The elastic defense container facing the TCP/IP protocol realizes the drive of a TCP/IP protocol stack and an internet access and a corresponding targeted security defense mechanism. The safety isolation container isolates the direct connection of the two elastic defense containers, realizes the control of the output/input flow of the computer and isolates the direct connection of the elastic defense container and the safety storage container; the security isolation container realizes the driving of the keyboard and ensures the security of the electronic payment password/password on the network. The secure storage container realizes user identity authentication, secure storage of user files and remote encryption communication protection of secret files.

Each container is provided with an independently executed software behavior monitoring hardware module, the container is subjected to targeted software behavior monitoring, unsafe software behaviors such as illegal reading/writing on a system software FLASH disk, software instruction dead cycle attack, address border crossing and the like are found in time, and an alarm instruction is sent to a safety control module. The safety management and control hardware logic can directly send a control signal to the container with abnormal behavior according to a preset safety disposal strategy to force the container to execute the operations of memory cleaning and system restarting.

The external interface lock and the FLASH external physical lock provide absolute control authority of security management for computer users, and can directly lock the external interface which can have threat, the system software FLASH disk of all containers and the sensitive file FLASH disk in the security storage container of the computer in a physical security mode. For computers with high security applications, the sensitive file FLASH disk cannot be read/written without opening an internal logical lock. The internal logic lock mechanism is used for avoiding security threats brought by management errors of the computer by users.

1. Description of the function of a resilient defensive container

The elastic defense containers C1 and C2 are specially used for dealing with various security threats, C1 is specially used for defending against the security threats faced by various applications, and C2 is specially used for defending against the security threats faced by a TCP/IP protocol stack, and the elastic defense containers C1 and C2 together realize the main functions of elastic defense. Any communication between the C1 and the C2 cannot be directly performed through the internal first high-speed communication bus, and the protocol message communication between the C1 and the C2 must be realized under the control of a security isolation container, and the security isolation container determines whether to forward or not based on the current working state of the computer.

C1 is a flexible defense subject against attacks in various application scenarios, and plays a role in greatly relieving various attack effects. C1 realizes most of the calculation functions of a common computer, but removes the network port, keyboard interface and TCP/IP protocol stack, and replaces hard disk with a large capacity DDR (16Gbyte to 32Gbyte) to store temporary files, and communicates with other containers through an internal first high-speed communication bus, mainly used for document processing, web browsing, video playing, game processing, video card driving, mouse driving, high risk interface (USB, CD-ROM, serial port) driving processing, and realizes the functions of TCP/IP protocol stack, network port and keyboard in a virtual interface mode. The C1 is installed with mainstream security protection software (e.g. 360, artificial intelligence based security defense products), and the key points of the security defense are attacks against security vulnerabilities of upper layer protocols (e.g. SMTP, FTP, HTTPS, SSL/TLS, etc.), various application layer software (IE, OFFICE, video playing, picture processing, games, etc.), and attacks against viruses and trojan injection of USB, optical drives, serial ports. Before the sensitive file is processed by the C1, all external interfaces of the computer except a video card and a mouse are directly closed by an external interface lock of the computer, memory cleaning is carried out by the C1 and the C2, the processed sensitive file is loaded, and the memory cleaning is carried out again after the processing and the storage are finished, so that the safety in the processing process of the sensitive file is ensured. The system software of C1 must be under the control of the software security upgrade mechanism and the permission control of the external physical lock and the internal logical lock of its FLASH to perform the upgrade writing. The external physical locking mechanism of the system software FLASH thoroughly eliminates the possibility of maliciously tampering the system software, ensures that the system software FLASH can not be tampered by the attack code, and ensures that the computing container has the capability of elastic defense. And C1, independently monitoring the hardware module by the software behavior in the container, monitoring the attack behavior of the software running in the container through an address bus, and reporting to the security monitoring module immediately once the application software is found to be carrying out system software FLASH disk tampering attack, CPU capacity exhaustion attack and system configuration parameter stealing attack, and taking corresponding disposal measures according to a preset security policy. The C1 container is not provided with a hard disk, and a large-capacity DDR replaces the temporary storage function of the hard disk, so that the quick cleaning is facilitated. The high-capacity DDR establishes a temporary file system during startup and is specially used for temporarily storing files processed in a file processing flow, tmp files and various log record (mainly txt type) files in the running process, and the used storage space in the file processing process can be quickly erased by executing a cleaning process.

The defense of C2 focuses on defending against attacks against the TCP/IP protocol stack, DDoS attacks. C2 runs a thin version of the operating system without a hard disk. The method is mainly used for realizing network interface drive and a TCP/IP protocol stack, is provided with mainstream safety protection software (such as 360), has the key points of safety protection of an MAC layer and the TCP/IP protocol stack, adopts an efficient mechanism for resisting TCP flow storm attack, and has the function of identifying encrypted/non-encrypted application flow (according to a protocol port). According to the principle that the simpler the system, the less the number of potential vulnerabilities, the C2 container does not run any other applications in order to minimize its functionality. The software implementation of the TCP/IP protocol stack adopts strict and provable security design to avoid stack overflow, heap overflow and other overflow loopholes. Software within the C2 container behaves independently of monitoring hardware modules, performing monitoring functions similar to those of C1. The system software of C2 must be under the control of the software security upgrade mechanism and the permission control of the external physical lock and the internal logical lock of its FLASH to perform the upgrade writing. The portal of C2 must be under the permission control of the external interface lock of the computer to open its physical interface.

The writing operation of the FLASH disk of the software systems of C1 and C2 is strictly controlled by an external physical lock, and the FLASH disk is generally read only, so that the tampering attack of malicious software such as viruses, trojans and the like from networks, USB (universal serial buses), optical drives and serial ports can be directly blocked. Even if malware enters the memory of the flexible defense container and gets an opportunity to execute, the software systems in the flexible defense containers C1 and C2 cannot be modified, and any sensitive information stored in the secure storage container cannot be acquired. And monitoring hardware logic in the software behavior independent monitoring module in the elastic defense container monitors abnormal behaviors of the C2 software through an address bus and gives an alarm to the safety control module in time.

The flexible defense container is composed of independent CPU, DDR, various interfaces, FALSHROM (BIOS), read-only FALSH disk (storing operating system and basic application processing software system, whose external physical lock and internal logic lock can prohibit its write attribute) and running state security independent monitoring logic. An operating system with a strong safety mechanism is installed on the elastic defense container, and in addition, anti-virus and anti-Trojan horse safety software is also installed.

2. Description of the function of a safety isolation Container

The defense of the security isolation container mainly aims at defending penetration attack aiming at the security storage container, defending electronic payment password stealing attack and strictly executing a preset security operation flow to block the attack intention aiming at various vulnerabilities.

The security isolation container is a key core of the security computer, and all security processing operations must be sequentially and orderly executed according to the flow under the control of the security isolation container. The safety isolation container implements safety control and isolation control on communication among other containers, indirect communication among other three containers is realized, and the design of a high-speed communication bus ensures that the other three containers cannot be directly communicated with each other.

The security isolation container does not execute any application software or TCP/IP protocol stack, and the communication with other containers adopts a special, concise and strictly designed and strictly security-checked communication protocol, so that various existing vulnerability attack means can be defended.

The safety isolation container is a processing container realized based on a single chip microcomputer and an embedded micro-operation system, the simplest software system design is adopted, the lowest level language is adopted as far as possible to realize the safety isolation container, the potential safety loopholes are avoided, and the software flow steps adopt strict and provable safety design. The safety isolation container is mainly responsible for forwarding and controlling communication data messages between the containers, scheduling and executing each safety flow, and isolating and shielding penetration attack of malicious software running in the elastic container to the safety storage container. In addition, the drive and the safety protection of the USB keyboard are realized. Before the keyboard can be used, the keyboard with the attack virus/Trojan horse must be prohibited from being used through strict security test check. The numeric keypad is mainly used for inputting password required by electronic payment transaction, and avoids the condition that a keyboard in the elastic container is eavesdropped by a Trojan horse to steal the password input by the keyboard. The software behavior independent monitoring module in the security isolation container is used for monitoring the execution of fixed and single-function software codes besides monitoring software tampering attacks and CPU capacity exhaustion attacks.

3. Secure storage container functional description

The defense of secure storage containers is focused on the theft of sensitive and confidential files, as well as man-in-the-middle attacks against secure communication protocols and attacks against impersonating confidential terminals. The safe storage container is a native harmless safe operation supporting environment, is specially used for storing user files and executing encryption/decryption operation, and provides safety guarantee for remote encryption transmission of confidential files based on a safe communication protocol. The safety container is composed of an independent CPU, a DDR, a FLASH system disk (storing operating system software, and the writing attribute of the FLASH system disk can be forbidden by an external physical lock and an internal logic lock of the FLASH system disk), a FLASH file disk (storing sensitive files, and the reading/writing attribute of the FLASH file disk can be forbidden by the external physical lock and the internal logic lock of the FLASH system disk), a hard disk (storing a non-sensitive file system and a safety log), an administrator identity authentication interface and a USBKey interface. The operation of the sensitive file FALSH disk must be strictly controlled by fingerprint/iris biometric or USBKey identity authentication under the condition that an external physical lock is opened. The writing operation of the false file disk needs to be strictly controlled by a password receiving authentication protocol, and also needs to receive multiple security control of an external switch and a USBKey.

On the hard disk of the secure storage container, a corresponding directory of general files, sensitive files and confidential files is established.

(II) safety computer work flow

1. Starting up safety control flow

When the safety computer is powered on, the following steps are taken:

the first step is as follows: the safety isolation container is started and enters a preparation working state at first because the software is simplest. The safety isolation container is based on a safety control hardware module, and sends an instruction for closing the internal logic lock of the system software FLASH and the sensitive file FLASH to the software behavior independent monitoring module of each container through a safety control bus. The software behavior independent monitoring module of each container acquires the state of the external interface lock and/or the FLASH external physical lock connected with the processor, and reports the state to the safety control module through the safety control bus.

The second step is that: each container independently finishes the starting process of the container, namely after the whole dynamic memory is firstly cleaned, the system software codes in the system software FLASH disk are copied to the preset dynamic memory for execution, the stack is set, the memory area is divided and initialized, the normal working state is entered, the C1 container erases the trace of the high-capacity DDR temporary file storage area, and a temporary file system is created in the high-capacity DDR. And then sending a starting-up indication message to the security isolation container.

The third step: after the secure storage container is started, if the fact that the USBKey is not inserted into the user is detected, the secure isolation container informs the C1 that the user is prompted to insert the USBKey; and if the USBKey is detected, reading the boot password stored in the USBKey, packaging the boot password in a start-up finishing indication message, and sending the boot password to the security isolation container (under the condition of common application, acquiring the boot password from a hard disk file of the security storage container).

The fourth step: after the security isolation container receives the start-up completion indication messages of other containers, the security isolation container informs the C1 to prompt the user to input a power-on password on the display interface, records each password symbol input by the user, and replaces the password symbol with the symbol and sends the symbol to the C1 for display.

The fifth step: after the safe isolation container receives the carriage return symbol input by the user, if the stored password is consistent with the currently input password through comparison, C1 displays an operation interface working normally, and the next step is carried out;

and a sixth step: the security isolation container is based on a security control hardware module, and acquires states of an external interface lock of a computer, an external physical lock of each container system software FLASH and an external physical lock of a sensitive file FLASH through a security control bus. And if the external interface lock is not opened, and the external physical lock of the sensitive file FLASH or the external physical lock of system software of a certain container is not closed, sending a prompt to a user on an interface, and displaying the current state of each physical lock in a task bar at the lowest part of the safety computer.

The seventh step: and the security isolation container does not forward the data block traffic between the C1 and the C2, and returns to a normal working state when all the external physical locks and the external interface locks are detected to be in a ready state, and the process is ended.

Thus, the computer can access and browse the internet.

Eighth step: if the user needs to perform operations related to security processing, the user needs to perform detection and identification through biological characteristics (one of fingerprints, irises and 3D faces), and the user can enter a security working mode only after the user passes the detection and identification through the biological characteristics. The security storage container detects the biological authentication data input by the user, extracts the biological characteristics of the user, decrypts the biological characteristics prototype data ciphertext and the biological characteristics prototype data ciphertext stored in the large-capacity hard disk by using a corresponding key in the USBKey, and then performs model matching. And if the matching is successful, sending a report message that the safety operation is legal to the safety isolation container.

The ninth step: the safety isolation container enters a normal working state with legal safety operation.

So far, the computer can perform all security processing related to the sensitive file FLASH disk.

2. Internet browsing processing flow

When a user browses the Internet, the following steps are taken:

the first step is as follows: and opening browsing software on an operation interface, clicking an internet website to be accessed through a sitemap, sending a connection request by an HTTPS protocol in the C1 container, and sending the connection request to the security isolation container through a virtual TCP/IP stack of the security isolation container and an internal first high-speed communication bus.

The second step is that: the secure isolation container forwards this HTTPS protocol connection request message to C2 over the internal first high speed communication bus.

The third step: after receiving the HTTPS protocol connection request from the internal first high-speed communication bus, the C2 container encapsulates the HTTPS protocol connection request into a TCP protocol header via the TCP/IP protocol stack in which the HTTPS protocol connection request is executed, and transmits the TCP protocol header to the internet through the internet interface.

The fourth step: the C2 container removes the TCP protocol header from the TCP data block received by the TCP/IP protocol stack from the internet access, and sends the TCP data block to the security isolation container through the internal first high-speed communication bus.

The fifth step: after receiving the TCP data block, the security isolation container determines that the TCP data block belongs to the communication data of the non-confidential communication port, and forwards the communication data to the C1 container through the internal first high-speed communication bus.

And a sixth step: and after the first high-speed communication bus communication protocol inside the C1 container is received, the first high-speed communication bus communication protocol is transmitted to an upper HTTPS protocol interface of the C1 container through a virtual TCP/IP stack.

The seventh step: the website content is displayed on the browser, and the user can browse the webpage content.

Eighth step: if a user wants to copy the contents of a webpage and store the contents in a non-sensitive file when browsing the webpage, the user can simultaneously open OFFICE software (such as a WORD tool), and after copying and editing are finished, the user first temporarily stores the file in a temporary file system in a high-capacity DDR. And then sending a command for saving the non-sensitive file through a security application program interface, forwarding the file to a security storage container through a security isolation container according to the record in the temporary file system directory, and saving the file to a large-capacity hard disk. And finally, deleting the files temporarily stored in the temporary file system.

Thus, a complete internet browsing processing procedure is completed.

3. Non-sensitive file processing flow

When the user needs to process the non-sensitive file, the following steps are taken:

the first step is as follows: opening the security application program, clicking the non-sensitive file processing button on the operation interface, sending a request message for acquiring the non-sensitive file directory to the security isolation container by the C1 security application program, and forwarding the request message to the security storage container by the security isolation container. The secure storage container reads the non-sensitive file directory stored in its hard disk, and sends the read non-sensitive file directory to C1 via the secure isolation container.

The second step is that: the user clicks on the non-sensitive file to be opened, the C1 security application opens the corresponding document processing software according to the file type, and sends a request message for processing the non-sensitive file to the security isolation container. And after receiving the request, the safety isolation container sends an indication message for acquiring the specified non-sensitive file to the safety storage container, and the safety isolation container still keeps in a normal working mode, so that the process is ended.

The third step: the security storage container reads the non-sensitive files in the large-capacity hard disk, transmits the non-sensitive files to the security isolation container through the second high-speed communication bus by the internal high-speed bus communication protocol, transmits the non-sensitive files to the elastic defense container C1, C1 temporarily stores the whole files into a temporary file system in the large-capacity DDR, and finally displays the files on the interface of the security computer through OFFICE document processing software.

The fourth step: the user can browse, edit and play the non-sensitive file, after the processing, if the file needs to be saved (such as OFFICE file), a saving command is sent on the operation interface, and the C1 file processing software firstly saves the file to a temporary file system in a high-capacity DDR. And then sending a command for saving the non-sensitive file through a security application program interface, transmitting the whole processed and temporarily stored file content to a security storage container through an internal high-speed bus communication protocol via a first high-speed communication bus and a security isolation container, writing the whole processed and temporarily stored file content into a hard disk of a large-capacity security storage container, and replacing the original file with the same name or storing the file as a new file. Then, C1 deletes the file temporarily stored in the temporary file system.

Thus, a complete non-sensitive file processing process is completed.

4. Sensitive file safety processing flow

When a user needs to process a sensitive file, the following steps are taken:

the first step is as follows: the user opens the secure application, clicks on the computer sensitive file handling button on its interface, and the C1 secure application sends a request message to the secure isolation container to obtain a directory of sensitive files.

The second step is that: after the security isolation container receives the request of C1 to obtain the sensitive file directory, it enters into the security file processing mode, and informs C1 to prompt the user to close all the external interface locks of the computer on the display interface, and starts the timer T1.

The third step: and the safety isolation container judges that the external interface locks of the computer are completely closed based on the corresponding state information of the external interface locks acquired by the safety management and control hardware module, and then the safety isolation container enters the next step, otherwise, the safety isolation container continues to wait. If T1 is overtime, C1 is informed that the acquisition of the sensitive file directory fails, the security isolation container returns to the normal working mode, and the process is ended.

The fourth step: the safety isolation container is based on a safety control hardware module, the safety control bus controls the elastic defense containers C1 and C2 to start a cleaning mechanism, other dynamic memory areas except a memory area reserved for the operation of the operating system are cleaned, or the safety isolation container is quickly restarted to restart the process to clean the whole dynamic memory.

The fifth step: the security isolation container informs C1 to reopen the secure application and informs C1 to prompt the user on the display interface to open the external physical lock of the sensitive file FLASH, starting the timer T2. And then, judging that the external physical lock of the sensitive file FLASH is opened based on the corresponding state information acquired by the security control hardware module, entering the next step, and otherwise, continuing to wait. If T2 is overtime, C1 is informed that the acquisition of the sensitive file directory fails, the security isolation container returns to the normal working mode, and the process is ended.

And a sixth step: the security isolation container opens an internal logic lock of the sensitive file FLASH through a security control bus based on a security control hardware module, and allows the sensitive file FLASH to be read/operated and written. Meanwhile, the security isolation container only forwards the data block messages communicated between the C1 container and the security storage container, and does not forward any data block messages in the direction of the C2 container any more.

The seventh step: the secure isolation container forwards the request message to obtain the sensitive file directory to the secure storage container. The sensitive file directory stored in the hard disk of the secure storage container reader is sent to C1 through the secure isolation container, and C1 displays the sensitive file directory. The user clicks on the sensitive file to be opened, the security application opens the corresponding document processing software according to the file type, and the C1 document processing module sends a request message for processing the sensitive file to the security isolation container.

Eighth step: and the safety isolation container sends an instruction message for acquiring the specified sensitive file to the safety storage container.

The ninth step: the safe storage container reads the sensitive file appointed in the sensitive file FLASH disk, transmits the sensitive file to the safe isolation container through the second high-speed communication bus by the internal high-speed bus communication protocol, transmits the sensitive file to the elastic defense container C1, temporarily stores the sensitive file in a temporary file system in the high-capacity DDR of the safe isolation container, and finally displays the sensitive file on an interface of the document processing software.

The tenth step: the user can browse, edit, modify and play the sensitive file, after the processing, if the file (such as OFFICE file) needs to be saved, click a save button on an operation interface, and the C1 file processing software transmits the whole processed file content in the high-capacity DDR temporary file system to a safe storage container through an internal high-speed bus communication protocol via a first high-speed communication bus and a safe isolation container, writes the whole processed file content into a sensitive file disk, replaces the original file with the same name, or stores the whole file as a new file.

The eleventh step: the safety isolation container closes the internal logic lock of the FLASH disk of the sensitive file through the safety control bus, sends a memory cleaning command to the C1 again, cleans all traces of the sensitive file in the dynamic memory, and erases all traces of the document file and the tmp file in the temporary file system in the C1 high-capacity DDR.

The twelfth step: the security isolation container notification C1 prompts the user on the interface to close the external physical lock of the sensitive file FLASH disk;

the thirteenth step: the user closes the external physical lock of the sensitive file FLASH disk and opens the external interface lock of the computer.

The fourteenth step is that: the security isolation container acquires states of an external physical lock and an external interface lock of the FLASH disk of the sensitive file through a security control bus based on a security management and control hardware module, and C1 displays the states of the physical lock and the interface lock on a display screen interface task bar. And if the external physical lock of the FLASH disk of the sensitive file is in a closed state, returning to a normal working mode, and ending the process.

And finishing a complete sensitive file processing process.

5. Confidential document security processing flow

When the user needs to process the confidential document, the following steps are taken:

the first step is as follows: the user opens the secure application, clicks on the computer confidential document handling button at his interface, and C1 sends a request message to the secure isolated container for the process of obtaining confidential documents.

The second step is that: after the security isolation container receives the request message for processing the confidential document, the security isolation container enters a security document processing mode, and the notification C1 prompts the user to close all external interface locks of the computer on the display interface and starts the timer T3.

The third step: and the safety isolation container judges that the external interface lock is closed based on the corresponding state information acquired by the safety control hardware module, and then enters the next step, otherwise, the safety isolation container continues to wait. If T3 is overtime, the normal operation mode is returned and the process ends.

The fourth step: the safety isolation container is based on a safety control hardware module, the safety control bus controls the elastic defense containers C1 and C2 to start a cleaning mechanism, other dynamic memory areas except a memory area reserved for the operation of the operating system are cleaned, or the safety isolation container is quickly restarted to restart the process to clean the whole dynamic memory.

The fifth step: the security isolation container informs C1 to reopen the secure application and informs C1 to prompt the user on the display interface to open the external physical lock of the sensitive file FLASH, starting the timer T4. And then, judging that the external physical lock of the sensitive file FLASH is opened based on the corresponding state information acquired by the security control hardware module, entering the next step, and otherwise, continuing to wait. If T4 is overtime, C1 is informed that the confidential file directory acquisition fails, the security isolation container returns to the normal working mode, and the process is ended.

And a sixth step: the safety isolation container opens an internal logic lock of the sensitive file FLASH through a safety control bus based on a safety control hardware module, and allows the safety storage container to read/write the sensitive file FLASH disk; meanwhile, the security isolation container only forwards the data block messages between the C1 container and the security storage container, and does not forward any data block messages in the direction of the C2 container any more.

The seventh step: the secure isolation container forwards the request message for the confidential file process to the secure storage container. The confidential file directory stored in the hard disk of the secure storage container reader is sent to C1 via the secure isolation container, and the confidential file directory is displayed on the secure application interface. The user clicks on the confidential file to be opened, the security application program opens the corresponding document processing software according to the file type, and sends a request message for acquiring the confidential file to the security isolation container.

Eighth step: after receiving the request for obtaining the confidential file, the security isolation container sends an instruction message for obtaining the specified confidential file to the security storage container.

The ninth step: the security storage container reads the specified confidential file in the sensitive file FLASH disk, after the confidential file is decrypted by the file storage key, the confidential file is transmitted to the security isolation container through the second high-speed communication bus by the internal high-speed bus communication protocol, and the confidential file is transmitted to the elastic defense container C1 by the security isolation container, is temporarily stored in the high-capacity DDR temporary file system, and is finally displayed on the interface of the security computer through the document processing software.

The tenth step: the user can browse, edit, modify and play the confidential file temporarily stored in the temporary file system, after the processing is finished, if the file (such as an OFFICE document) needs to be stored, a storage command is sent out on an operation interface of a security application program, the C1 file processing software transmits the whole confidential file content temporarily stored in the temporary file system to a security storage container through a first high-speed communication bus and a security isolation container by an internal high-speed bus communication protocol, and after the confidential file content is encrypted by a file storage key, the confidential file content is written into a sensitive file FLASH disk to replace the original file with the same name or is stored as a new file. And after the storage is finished, the security isolation container is informed.

The eleventh step: the security isolation container sends a memory cleaning command to the C1 again to clean all traces of the confidential files in the dynamic memory, and erase all traces of the files and tmp files temporarily stored in the C1 temporary file system.

The twelfth step: the security isolation container closes the internal logical lock of the sensitive file FLASH disk and prompts the user on the interface to close the external physical lock of the sensitive file FLASH disk.

The thirteenth step: the user closes the external physical lock of the sensitive file FLASH disk and opens the external interface lock of the computer.

The fourteenth step is that: the security isolation container acquires the states of an external physical lock of the FLASH disk of the sensitive file and an external interface lock of the computer through a security control bus based on a security control hardware module, and reports C1 to display the states on an interface task bar. And if the external physical lock of the FLASH disk of the sensitive file is in a closed state, returning to a normal working mode, and opening the forwarding of the data block message in the direction of C2.

At this point, a complete confidential document processing process is completed.

6. Confidential file secure transmission processing flow

When the security computer transmits the confidential file, the following steps are taken:

the first step is as follows: the user opens the secure application, clicks the confidential file transfer button on its interface, and sends a confidential transfer request message to the secure isolated container.

The second step is that: after receiving the confidential file transmission request message, the security isolation container enters a confidential communication mode, the data block message between the C1 container and the security storage container is not forwarded any more, but the confidential communication data block between the security storage container and the C2 on a special TCP or UDP port is forwarded, and the Internet access communication data block between the C1 and the C2 is also forwarded.

The third step: the secure isolation container notification C1 prompts the user on its interface to open an external physical lock to the sensitive file FLASH disk, starting a timer T5.

The fourth step: and the security isolation container judges that the external physical lock of the sensitive file FLASH disk is opened based on the corresponding state information acquired by the security control hardware module, and then the security isolation container opens the internal logical lock of the sensitive file FLASH disk through the security control bus based on the security control hardware module, so that the read/write operation of the sensitive file FLASH disk is allowed, and the next step is carried out. If T5 times out, the process ends and returns to normal operation mode.

The fifth step: the secure isolation container forwards the confidential file transfer request message to the secure storage container, which sends the confidential file directory on its hard disk to C1 via the secure isolation container and displays the confidential file directory on the interface of the secure processing software.

And a sixth step: the user clicks on the confidential file to be transferred in the confidential file directory, and the security processing software prompts the user to select a receiver of the confidential file, includes the IP address of the receiver in the confidential file transfer command message, and transmits the confidential file to the secure storage container through the secure isolation container.

The seventh step: the secure storage container starts a secure and confidential communication protocol, reads a specified confidential file in a sensitive file FLASH disk, decrypts the confidential file by using a secure storage key in the USBKey, encrypts each data block of the file by using a communication key in the USBKey, and forwards the encrypted data block to C2 through a first internal high-speed communication bus via the secure isolation container. C2 is sent through its TCP/IP protocol stack to the specified IP address via a protocol port dedicated to confidential communications.

Eighth step: and after the confidential file is transmitted, the safe storage container sends an instruction that the transmission of the confidential file is finished to the safe isolation container.

The ninth step: and after receiving the instruction, the security isolation container closes the internal logic lock of the FLASH disk of the sensitive file through the security control bus.

The tenth step: the security isolation container forwards an indication to C1 that the transfer of the confidential file is complete, informing C1 to prompt the user to close the external physical lock of the sensitive file FLASH disk on the display interface.

The eleventh step: and the security isolation container judges that the external physical lock of the FLASH disk of the sensitive file is closed based on the corresponding state information acquired by the security management and control hardware module, and returns to the normal communication mode.

And completing a complete confidential file transmission communication process.

7. Confidential document security receiving processing flow

When the security computer receives the confidential file, the following steps are taken:

the first step is as follows: the security isolation container is in the non-confidential communication mode, receives the first communication message (confidential communication receiving request) received by the C2 container at the port dedicated to confidential communication, and transmits the first communication message to the security storage container via the security isolation container.

The second step is that: the secure storage container starts a secure communication protocol, decrypts the first communication message by using a communication key in the USBKey, verifies the authenticity and integrity of the communication message, and reports the security isolation container if the verification is passed; otherwise, it is discarded, the secure communication protocol is closed, and no further operation is performed.

The third step: the security isolation container prompts the user on the human machine interface to open an external physical lock to the sensitive file FLASH disk, starting a timer T6. If T6 times out, it indicates that the secure storage container is not allowed to receive, and the process ends.

The fourth step: and the safety isolation container judges that the external physical lock of the sensitive file FLASH disk is opened based on the corresponding state information acquired by the safety control hardware module, and then the safety isolation container opens the internal logical lock of the sensitive file FLASH disk through a safety control bus based on the safety control hardware module, allows the read/operation write of the sensitive file FLASH disk and informs the safety storage container of preparing to receive. The security isolation container no longer forwards data block messages between the C1 container and the secure storage container.

The fifth step: the secure storage container secret communication protocol sends a confidential document receiving ready message.

And a sixth step: after the safe storage container completely receives the whole confidential file, the communication secret key in the USBKey is used for decrypting each communication secret text data block, the safe storage key in the USBKey is used for encrypting the whole file, and the whole file is stored in a sensitive file FLASH disk.

The seventh step: and after the safe storage container receives the confidential file, closing the confidential communication protocol, and sending an instruction of completing the reception of the confidential file to the safe isolation container.

Eighth step: and after receiving the instruction, the security isolation container closes the internal logic lock of the FLASH disk of the sensitive file through the security control bus.

The ninth step: the security isolation container notification C1 prompts the user at the display interface to close the external physical lock of the sensitive file FLASH disk.

The tenth step: and the security isolation container judges that the external physical lock of the FLASH disk of the sensitive file is closed based on the corresponding state information acquired by the security management and control hardware module, and the confidential file receiving and processing process is finished.

At this point, a complete secret file receiving communication process is completed.

8. Confidential e-mail safe sending process

When a user needs to securely send a confidential e-mail, the following processing steps are taken:

the first step is as follows: and under the security processing mode of the sensitive file, writing the mail and storing the mail in a FLASH disk of the sensitive file of the security storage container in an encrypted manner.

The second step is that: and the user opens the security processing software, clicks a security mail sending button on the interface and sends a security mail sending request message to the security isolation container.

The third step: upon receiving the secure mail send request message, the secure isolation container enters secure mail communication mode, notification C1 prompts the user on the human machine interface to open the external physical lock of the sensitive file FLASH disk, and starts timer T7.

The fourth step: and the security isolation container judges that the external physical lock of the sensitive file FLASH disk is opened by reading the state, opens the internal logic lock of the sensitive file FLASH disk through the security control bus, and sends a security mail sending request message to the security storage container. If T7 is overtime, the normal operation mode is returned to, and the flow is ended.

The fifth step: the secure storage container reads the confidential file directory on the hard disk, sends the confidential file directory to the C1 through the secure isolation container, and displays the confidential file directory on the interface. The user selects and clicks the confidential document mail to be sent, and sends a secure mail sending command message to the secure storage container.

And a sixth step: the security storage container reads the specified confidential file in the sensitive file FLASH disk, decrypts the confidential mail by using the security storage key in the USBKey, calls the security mail encryption function, encrypts each data block of the mail by using the mail key in the USBKey, forwards the encrypted data block to the C1 through the security isolation container by the internal first high-speed communication bus, and stores the encrypted data block in the C1 high-capacity DDR file system. And after the transmission is finished, informing the security isolation container to close the internal logic lock of the FLASH disk of the sensitive file.

The seventh step: and the security isolation container immediately closes the internal logic lock of the sensitive file FLASH disk after receiving the notification, and notifies C1 to prompt the user to close the external physical lock of the sensitive file FLASH disk and to make the security mail ready.

Eighth step: the user sends the confidential e-mail temporary file temporarily stored in the high-capacity DDR temporary file system in normal operation, and deletes the temporary file after the sending is finished.

The ninth step: and the security isolation container judges that the external physical lock of the FLASH disk of the sensitive file is closed based on the corresponding state information acquired by the security management and control hardware module, and returns to the normal communication mode.

Thus, a complete secure sending process of the confidential e-mail is completed.

9. Confidential mail safe receiving processing flow

When a user needs to securely receive confidential e-mail, the following processing steps are taken:

the first step is as follows: and opening a website mail receiving webpage interface, downloading the electronic mail, and storing the electronic mail in a high-capacity DDR temporary file system of C1.

The second step is that: clicking on the mail secure store button at the C1 secure handler interface, the secure mail process first passes the confidential mail to the secure storage container via secure quarantine container forwarding and then sends an indication message to the secure quarantine container specifying secure storage of the mail.

The third step: the security isolation container indicates that an external physical lock for opening the FLASH disk of the sensitive file is prompted by a user on a C1 human-computer interface;

the fourth step: and the security isolation container judges that the external physical lock of the sensitive file FLASH disk is opened based on the acquired corresponding state information, and then opens the internal logic lock of the sensitive file FLASH disk through the security control bus to allow the read/write operation of the sensitive file FLASH.

The fifth step: the secure isolation container issues an indication message to the secure storage container to decrypt the confidential mail.

And a sixth step: the safe storage container calls a decryption function of the received mails, the received mails in the large-capacity hard disk are decrypted by using a communication key in the USBKey, the mail plaintext is temporarily stored in the dynamic memory, and after the decryption is finished, the mail plaintext is encrypted by using the safe storage key in the USBKey and is stored in a sensitive file FLASH disk.

The seventh step: after the secure storage container stores the confidential mails, the trace of the confidential mails in the large-capacity hard disk is cleared, and an instruction of receiving the confidential mails is sent to the secure isolation container.

Eighth step: and after receiving the instruction, the security isolation container closes the internal logic lock of the FLASH disk of the sensitive file through the security control bus.

The ninth step: the secure isolation container forwards an indication to C1 that the confidential mail has been received, and C1 prompts the user at the display interface to close the external physical lock of the sensitive file FLASH disk.

The tenth step: and the security isolation container judges that the external physical lock of the FLASH disk of the sensitive file is closed based on the corresponding state information acquired by the security management and control hardware module, and returns to the normal communication mode.

At this point, a complete confidential mail receiving process is completed.

10. Electronic payment password security protection process

When the user needs to submit the electronic payment password, the following security protection processing steps are adopted:

the first step is as follows: the user clicks the payment transaction session box on the Web page and the browser sends a "client call" message to the electronic payment Web server requesting an SSL (secure socket protocol) or SET (secure electronic transaction protocol) encrypted session.

The second step is that: and the security isolation container identifies the SSL/SET message of the electronic payment request from the message data stream forwarded from the C1 container to the C2 container, and enters an electronic payment working mode.

The third step: and the security isolation container identifies the SSL/SET message responded by the electronic payment Web server from the data stream forwarded from the C2 container to the C1 container, copies out the encrypted public key sent by the server to the payment terminal, and forwards the message to the C1 container continuously.

The fourth step: in the payment session box, the username is entered with the large keypad and the password is entered with the numeric keys on the keypad, and the security isolation container forwards the username to C1 for receipt by the virtual keyboard driver of C1.

The fifth step: the security isolation container records each password number input by the user on the numeric keys of the keypad, replaces each password number input by a random number except the input number, and then sends the password number to the C1 container to be received by the virtual keyboard driver of C1.

And a sixth step: the security isolation container finds the message of the SSL/SET protocol carrying the encrypted payment password from the data stream forwarded from the C1 container to the C2 container, encrypts the recorded payment password number string by the copied public key, replaces the byte content of the corresponding domain in the protocol message with the encryption result, and forwards the protocol message to the C2 container continuously.

The seventh step: the secure isolation container clears the recorded password and public key information.

And finishing a complete electronic payment password protection processing process.

11. Safety control flow for operating system software upgrade

The operating system software upgrade includes the upgrade of the whole operating system software, the upgrade of partial system software functions, patch upgrade and the installation of new operating system functions.

When the user needs to upgrade the software of the operating system, the following steps are taken:

the first step is as follows: the user confirms that the operating system upgrading software compressed package is downloaded through a remote or USB disk, the safety of the version is verified through a digital certificate, and the version is decompressed and stored in a large-capacity hard disk of the safe storage container.

The second step is that: and opening the security processing program, clicking an operating system software upgrading button on an interface of the security processing program, selecting a container needing upgrading, and sending a request message for specifying the container operating system software upgrading to the security isolation container by the C1 container.

The third step: after the security isolation container receives the request of the specified container operating system software upgrade, the security isolation container enters a security upgrade processing mode, the notification C1 prompts the user to close all external interface locks on the display interface, and the timer T8 is started.

The fourth step: and the security isolation container judges that the external interface lock is closed based on the corresponding state information acquired by the security management and control hardware module, then the next step is carried out, otherwise, the security isolation container continues to wait, if T8 is overtime, the security isolation container returns to the normal working mode, and the process is ended.

The fifth step: the safety isolation container is based on a safety control hardware module, the safety control bus controls the elastic defense containers C1 and C2 to start a cleaning mechanism, other dynamic memory areas except a memory area reserved for the operation of the operating system are cleaned, or the safety isolation container is quickly restarted to restart the process to clean the whole dynamic memory.

And a sixth step: the security isolation container notification C1 prompts the user on the display interface to open the external physical lock of the system software FLASH for the specified container, starting the timer T9. And then, judging that the external physical lock of the system software FLASH is opened based on the corresponding state information acquired by the safety control hardware module, entering the next step, and otherwise, continuing to wait. If T9 times out, the normal operation mode is returned to, and the process ends.

The seventh step: the safety isolation container opens an internal logic lock of the FLASH of the appointed container opening system software under the control of the safety control module.

Eighth step: the safety isolation container sends an indication message for acquiring the upgrade file of the operating system to the safety storage container;

the ninth step: the safe storage container reads an appointed operating system upgrading software file in the large-capacity hard disk, and sequentially transmits each data block of the file to the safe isolation container through the second high-speed communication bus through the internal high-speed bus communication protocol.

The tenth step: the security isolation container transfers the data block of the upgrade software file of the operating system to a flexible defense container C1 (the upgrade software file may be large and temporarily stored in a high-capacity DDR temporary file system in C1) or to C2 (the upgrade software file is small and temporarily stored in a dynamic memory) according to a target container for designating upgrade, or stores the data block in the dynamic memory of the security isolation container. If the target container of the upgrade is designated as a safe storage container, the software upgrade file does not need to be transmitted to the safe isolation container.

The eleventh step: and the specified upgraded target container upgrading management software calls an operating system software installation function and executes the upgrading operation on the system software FLASH disk. And after the upgrade is finished, sending an upgrade finishing indication message to the safety isolation container.

The twelfth step: after the security isolation container receives the indication message of finishing the upgrading of the operating system, the security control module immediately controls and closes the internal logic lock of the system software FLASH, and prompts a user to close the external physical lock of the system software FLASH on an interface.

The thirteenth step: and the user closes the external physical lock of the system software FLASH and opens the external interface lock.

The fourteenth step is that: the security isolation container is based on a security control hardware module, obtains states of an external physical lock and an external interface lock of the system software FLASH through a security control bus, and displays the states of a display on a display interface. And if the external physical lock of the system software FLASH is in a closed state, returning to a normal working mode.

Thus, a complete operating system software upgrading process is completed.

12. Application software installation control flow

The upgrading process of the application software mainly comprises the steps of carrying out 'registration' of the application software in a safe storage container and writing the executable codes of the application software files into a large-capacity hard disk.

When the user needs to install the application software, the following steps are taken:

the first step is as follows: the user confirms that the operating system upgrading software compressed package is downloaded through a remote or USB disk, the safety, the authenticity and the integrity of the version are verified through a digital certificate, and the version is decompressed and stored in a large-capacity hard disk of a safe storage container.

The second step is that: the security handler is opened and the application installation button is clicked on its interface, and the C1 container sends a request message for application installation to the secure isolation container.

The third step: and after receiving the application software installation request, the security isolation container sends a command message of application software installation to the security storage container.

The fourth step: the secure storage container records the application name information in an application registry (i.e., directory file) and records the storage space allocated in the hard disk for the application execution code file.

The fifth step: the safe storage container writes the executable code file of the application software into the allocated hard disk storage space, deletes the downloaded compressed software package and the decompressed installation software file.

And a sixth step: the secure storage container sends an indication message to the secure isolation container that the installation of the application software is complete, and the secure isolation container notifies C1 to display a prompt on the human machine interface indicating that the installation process is complete.

And finishing a complete application software installation processing process.

13. Control flow of application software starting process

When a user needs to launch application software that can be executed in the operating system environment of the C1 container, the following steps are taken:

the first step is as follows: the security handler is opened and the application launch button is clicked on its interface, and the C1 container sends a request message to the secure isolation container for the application to run.

The second step is that: and after receiving the request of starting the application software, the security isolation container sends a command message of starting the application software to the security storage container.

The third step: and the safe storage container reads the application software information recorded in the registration table in the hard disk and acquires the storage space information distributed for the application software execution code file in the hard disk.

The fourth step: the secure storage container reads the application software executable code file and transfers the application software executable code file in the form of data blocks to the C1 container via forwarding of the secure isolation container.

The fifth step: the C1 container writes the received application software executable code to the dynamically allocated memory and then executes the application software.

And a sixth step: during the operation of the application software, the corresponding temporary file is temporarily stored in the high-capacity DDR of C1, and when the operation is finished, the configuration parameter modification file of the application software, which is obtained by a user, is transmitted to the safe storage container and is stored in the configuration file corresponding to the application software.

And finishing a complete application software starting processing process.

14. Safety operation supervision control flow

When the safety computer works and operates, the safety operation supervision control adopts the following steps:

the first step is as follows: the software behavior independent monitoring module of each container acquires the states of the external interface lock and the FLASH external physical lock connected with the processor, and reports the states to the safety control module through the safety control bus.

The second step is that: after the security isolation container is started or in the running process, according to the requirement of flow management and control, the security management and control hardware module sends an instruction for closing the internal logic lock of the system software FLASH and the sensitive file FLASH to the software behavior independent monitoring module of each container through the security control bus.

The third step: and each independent monitoring module for software behavior of the container independently monitors the abnormal behavior of the local software, and if the monitoring finds that the software possibly has a dead cycle phenomenon due to the attack of energy exhaustion or has illegal write/read operation on the FLASH under the condition that an external physical lock and a logic lock of the FLASH disk are closed, immediately reports the abnormal behavior to the safety monitoring module through the safety control bus.

The fourth step: after the security isolation container detects an abnormal behavior indication of some container software through the security monitoring module, if the container is judged to suffer from serious network attack and needs to be managed and controlled according to the current security workflow state, the security control module sends an indication of restarting system software to the software behavior independent monitoring module of the container through the security control bus.

The fifth step: and after the software behavior independent monitoring module receives an indication signal for restarting system software sent by the safety control module, the system software of the container is restarted immediately through the local control logic circuit, and malicious codes in the memory are stopped and cleaned through the restarting process.

Five, beneficial effects and advantages

The existing secure computer technology is either based on a trusted computing mechanism, or antivirus trojan-proof security protection software, or based on a sandbox mechanism to monitor and control software behavior, or based on a mobile target defense mechanism. There are a large number of security events that indicate that all security mechanisms have been breached! At present, the security defense of a computer mainly depends on installed security protection software, a security company discovers a bug, and releases a patch based on the internet or a user actively downloads upgrade software. Often before a security hole patch is applied to a user computer, a significant security consequence may have been created.

The novel multi-container-based security computer architecture is combined with an absolute control mechanism of an external physical lock and an internal logic lock on a file system, under the control of a strict isolation mechanism of a security isolation container, an intrusion attack code cannot modify system software, cannot acquire a sensitive/confidential file protected by a computer, can defend against the attack of viruses, trojans and various malicious codes, can ensure the computing environment security of sensitive file processing, can ensure the password security of electronic payment, and can also realize the secure communication of the confidential file and the secure transmission of confidential e-mail on the Internet.

The novel security computer framework designed by the invention has the characteristics of strong elastic defense and deep defense, can defend various known and unknown security threats, and can be used as a security computer for confidential communication of parties and politics, and can also be used as a common civil computer.

The invention is not limited to the foregoing embodiments. The invention extends to any novel feature or any novel combination of features disclosed in this specification and any novel method or process steps or any novel combination of features disclosed.

Claims (12)

Translated fromChinese

1.一种基于多容器分离处理的安全计算架构方法，其特征在于包括：1. a security computing architecture method based on multi-container separation processing is characterized in that comprising:安全计算机设置步骤：安全计算机设置有四个独立运行的处理容器，分别为面向应用的弹性防御容器C1、面向TCP/IP协议栈的弹性防御容器C2、安全隔离容器以及安全存储容器，C1和C2通过内部的第一高速通信总线与安全隔离容器连接，安全存储容器通过内部的第二高速通信总线与安全隔离容器连接，基于内部通信协议格式实现高速通信；安全计算机的C1容器连接显卡、光驱、鼠标、USB以及232串口，C2容器连接网络接口，安全隔离容器连接键盘，安全存储容器设置有硬盘和敏感文件FLASH盘、USBKey接口以及生物认证接口，此外每个容器都设置有本地系统软件FLASH盘；Security computer setup steps: The security computer is provided with four independently running processing containers, namely the application-oriented elastic defense container C1, the TCP/IP protocol stack-oriented elastic defense container C2, the security isolation container and the security storage container, C1 and C2 The first internal high-speed communication bus is connected to the safety isolation container, the safety storage container is connected to the safety isolation container through the internal second high-speed communication bus, and high-speed communication is realized based on the internal communication protocol format; the C1 container of the safety computer is connected to the graphics card, optical drive, Mouse, USB and 232 serial ports, the C2 container is connected to the network interface, the safety isolation container is connected to the keyboard, the safety storage container is provided with hard disk and sensitive file FLASH disk, USBKey interface and biometric authentication interface, in addition, each container is equipped with local system software FLASH disk ;安全隔离容器隔离步骤：安全隔离容器作为计算机协同防御的管控核心，实施对所有应用的处理实施全流程的安全管控，在弹性防御容器与安全存储容器之间执行安全隔离控制，阻断对安全存储容器的攻击渗透；Security isolation container isolation steps: The security isolation container acts as the control core of computer collaborative defense, implements full-process security control over the processing of all applications, performs security isolation control between elastic defense containers and secure storage containers, and blocks access to secure storage. Container attack penetration;安全防护与管控步骤：安全计算机设置有外部接口锁、外部物理锁以及内部逻辑锁，用于联合实施安全防护与管控；Security protection and control steps: The security computer is provided with external interface locks, external physical locks and internal logical locks for joint implementation of security protection and control;安全监管步骤：安全计算机各处理容器都设置有一个软件行为独立监控模块，安全隔离容器单独设置有一个安全管控模块，它们通过安全控制总线连接，用于实施安全运行监管控制；Safety supervision steps: each processing container of the safety computer is provided with an independent monitoring module for software behavior, and the safety isolation container is provided with a separate safety management and control module, which are connected through a safety control bus to implement safety operation supervision and control;外部物理锁和内部逻辑锁的联合管控步骤：安全计算机通过关闭外部接口锁阻断计算机的外部连接，通过关闭FLASH盘的外部物理锁阻断对其写入，通过内部逻辑锁防止用户关闭外部物理锁的安全疏漏，共同实现防软件篡改、防数据窃取；The joint management and control steps of the external physical lock and the internal logical lock: the security computer blocks the external connection of the computer by closing the external interface lock, blocks the writing to the FLASH disk by closing the external physical lock, and prevents the user from closing the external physical lock through the internal logical lock. The security omission of locks can jointly achieve anti-software tampering and data theft;用户对外部物理锁的管控步骤：软件不能开/关系统软件FLASH和敏感文件FLASH的外部物理锁、外部接口锁，只有计算机用户才能直接以手动方式开/关这些外部物理/接口锁，对FLASH的写/读实施绝对权限的控制；User's control steps for external physical locks: software cannot open/close the external physical locks and external interface locks of system software FLASH and sensitive file FLASH, only computer users can manually open/close these external physical/interface locks. The write/read implementation of absolute permission control;物理锁状态监测步骤：各容器的软件行为独立监控模块负责监测其FLASH外部物理锁、外部接口锁的开/关状态，并通过安全控制总线向安全管控模块报告，安全隔离容器通过安全管控模块获取计算机的所有外部接口锁、系统软件FLASH外部物理锁和敏感文件FLASH外部物理锁的开/关状态；Physical lock status monitoring steps: The software behavior independent monitoring module of each container is responsible for monitoring the on/off status of its FLASH external physical lock and external interface lock, and reports to the security control module through the security control bus, and the security isolation container is obtained through the security control module. The on/off status of all external interface locks of the computer, system software FLASH external physical locks and sensitive file FLASH external physical locks;逻辑锁管控步骤：各容器通过软件行为独立监控模块接受安全隔离容器在工作流程需要时通过安全控制总线发出的开/关FLASH内部逻辑锁的指令，并通过本地控制电路执行相应的开/关控制操作；Logic lock management and control steps: Each container accepts the instruction to open/close the FLASH internal logic lock through the safety control bus when the safety isolation container is required by the work flow through the software behavior independent monitoring module, and execute the corresponding on/off control through the local control circuit operate;软件行为独立监视步骤：各容器的软件行为独立监控模块对本容器实施软件异常行为监视，若监测到软件出现异常的运行状态，或监测到在FLASH外部物理锁与内部逻辑锁都关闭的状态下存在不正常的写操作，则通过安全控制总线向安全管控模块报告；Steps for independent software behavior monitoring: The software behavior independent monitoring module of each container monitors the abnormal software behavior of the container. If the software detects an abnormal running state, or detects that the external physical lock and internal logical lock of FLASH are both closed. Abnormal write operations are reported to the security control module through the security control bus;安全防护管控步骤：安全隔离容器基于安全管控模块实时监测其它容器的运行状态，在接收到C1或C2或安全存储容器软件运行异常的状态指示后，根据当前的安全工作流程，确定是否需要通过安全管控模块发出容器重启系统软件的安全管控指令；必要时，以容器重启来强制终止网络攻击，通过清洗内存清除掉恶意代码。Security protection management and control steps: The security isolation container monitors the running status of other containers in real time based on the security control module. After receiving the status indication that the C1 or C2 or security storage container software is running abnormally, it is determined whether it needs to pass the security according to the current security workflow. The management and control module issues security management and control instructions for the container to restart the system software; if necessary, the container restarts to forcibly terminate the network attack, and the malicious code is removed by cleaning the memory.2.根据权利要求1所述的安全计算架构方法，其特征在于：2. secure computing architecture method according to claim 1, is characterized in that:当安全计算机开机时，各处理容器独自完成自己的启动过程，即首先清洗整个动态内存后，再将系统软件FLASH盘中的系统软件代码拷贝到其预置的动态内存中去执行启动过程，然后进入正常工作状态；安全隔离容器的软件启动后，首先立即关闭各个容器的系统软件FLASH逻辑锁和敏感文件FLASH逻辑锁，再基于安全管控模块通过安全控制总线获取计算机的系统软件FLASH外部物理锁、敏感文件FLASH外部物理锁、外部接口锁的状态；若安全隔离容器判断出系统软件FLASH外部物理锁未关闭、敏感文件FLASH外部物理锁未关闭或者外部接口锁未打开，则在C1界面上向用户发出关闭/打开相应外部锁的提示。When the security computer is powered on, each processing container completes its own startup process, that is, after cleaning the entire dynamic memory, the system software code in the system software FLASH disk is copied to its preset dynamic memory to execute the startup process, and then Enter the normal working state; after the software of the safety isolation container is started, first immediately close the system software FLASH logical lock and sensitive file FLASH logical lock of each container, and then obtain the computer's system software FLASH external physical lock through the security control bus based on the security control module, Status of the FLASH external physical lock and external interface lock for sensitive files; if the security isolation container determines that the system software FLASH external physical lock is not closed, the sensitive file FLASH external physical lock is not closed, or the external interface lock is not open, it will notify the user on the C1 interface. Issue a prompt to close/open the corresponding external lock.3.根据权利要求1所述的安全计算架构方法，其特征在于：3. secure computing architecture method according to claim 1, is characterized in that:当安装或升级应用软件时，在安全存储容器中进行应用软件“注册”、将应用软件文件可执行代码写入大容量硬盘；即安全隔离容器接收到应用软件安装的请求后，向安全存储容器发出应用软件安装的命令消息；安全存储容器在应用软件注册表中记录该应用软件名称信息，并记录在硬盘中为该应用软件执行代码文件分配的存储空间；When the application software is installed or upgraded, the application software is "registered" in the secure storage container, and the executable code of the application software file is written into the large-capacity hard disk; that is, after the secure isolation container receives the application software installation request, it sends the application software to the secure storage container. Send a command message for application software installation; the secure storage container records the application software name information in the application software registry, and records the storage space allocated for the application software execution code file in the hard disk;安全存储容器将该应用软件可执行代码文件写入分配的硬盘存储空间，删除下载的压缩软件包和解压缩的安装软件文件，完成软件安装。The secure storage container writes the application software executable code file into the allocated hard disk storage space, deletes the downloaded compressed software package and the decompressed installation software file, and completes the software installation.4.根据权利要求1所述的安全计算架构方法，其特征在于：4. secure computing architecture method according to claim 1, is characterized in that:当用户需要启动应用软件时，C1容器发出应用软件启动的请求消息，经由安全隔离容器发送给安全存储容器；When the user needs to start the application software, the C1 container sends a request message to start the application software, and sends it to the security storage container via the security isolation container;安全存储容器读取硬盘中注册表记录的应用软件信息，获取在硬盘中为该应用软件执行代码文件分配的存储空间信息，然后读取该应用软件可执行代码文件，并以数据块的形式经由安全隔离容器的转发传送到C1容器，写入到动态分配的内存中，然后执行该应用软件；The secure storage container reads the application software information recorded in the registry in the hard disk, obtains the storage space information allocated for the application software executable code file in the hard disk, and then reads the application software executable code file, and uses the data block in the form of via The forwarding of the security isolation container is transmitted to the C1 container, written into the dynamically allocated memory, and then the application software is executed;在应用软件的运行过程中，其相应的临时文件暂存在C1的大容量DDR中，运行结束时，将用户对该应用软件的配置参数修改文件传送给安全存储容器，保存到应用软件相应的配置文件中。During the running process of the application software, its corresponding temporary files are temporarily stored in the large-capacity DDR of C1. At the end of the operation, the user's configuration parameter modification file for the application software is transferred to the secure storage container, and saved to the corresponding configuration of the application software. in the file.5.根据权利要求1或4所述的方法，其特征在于：5. The method according to claim 1 or 4, wherein:在敏感文件处理模式中，按规定流程步骤，依次执行关闭计算机的外部接口锁、停止与C2容器之间的内部第一高速通信总线通信、执行C1内存清洗、打开敏感文件FLASH的外部物理锁和内部逻辑锁，读取敏感文件FLASH中的敏感文件，传送到C1，暂存在C1的DDR临时文件系统中；C1启动相应的应用软件来打开该敏感文件，执行文件编辑处理，文件处理完毕后，保存到的敏感文件FLASH中；然后再依次执行C1内存清洗、关闭敏感文件FLASH的内部逻辑锁和外部物理锁、打开计算机的外部接口锁的操作。In the sensitive file processing mode, according to the prescribed process steps, the external interface lock of the computer is closed, the internal first high-speed communication bus communication with the C2 container is stopped, the C1 memory cleaning is performed, and the external physical lock of the sensitive file FLASH is opened. Internal logical lock, read the sensitive file in the sensitive file FLASH, transfer it to C1, and temporarily store it in the DDR temporary file system of C1; C1 starts the corresponding application software to open the sensitive file, executes the file editing process, after the file processing is completed, Save the sensitive file FLASH; then perform the operations of C1 memory cleaning, closing the internal logical lock and external physical lock of the sensitive file FLASH, and opening the computer's external interface lock.6.根据权利要求5所述的方法，其特征在于：6. The method according to claim 5, wherein:当进行机密文件处理时：在对应的安全处理模式中，按规定流程步骤，依次执行关闭计算机的外部接口锁、停止与C2容器之间的内部的第一高速通信总线通信、执行C1内存清洗、打开敏感文件FLASH的外部物理锁和内部逻辑锁，读取敏感文件FLASH中的机密文件，执行存储解密后，传送到C1，暂存在C1的大容量DDR临时文件系统中；C1启动相应的应用软件来打开该机密文件，执行文件的编辑处理，文件处理完毕后，经过存储加密后，保存到的敏感文件FLASH中；然后再依次执行C1内存清洗、关闭敏感文件FLASH的内部逻辑锁和外部物理锁、打开计算机的外部接口锁的操作，DDR容量至少为16Gbyte；When processing confidential files: in the corresponding security processing mode, according to the prescribed process steps, sequentially execute closing the external interface lock of the computer, stop the internal first high-speed communication bus communication with the C2 container, execute C1 memory cleaning, Open the external physical lock and internal logical lock of the sensitive file FLASH, read the confidential file in the sensitive file FLASH, perform storage and decryption, transfer it to C1, and temporarily store it in the large-capacity DDR temporary file system of C1; C1 starts the corresponding application software To open the confidential file, execute the editing process of the file, after the file is processed, after storage encryption, save it to the sensitive file FLASH; then perform C1 memory cleaning in turn, and close the internal logical lock and external physical lock of the sensitive file FLASH. , Open the computer's external interface lock operation, the DDR capacity is at least 16Gbyte;当进行机密文件传输时：在对应的安全处理模式中，在C1上显示从硬盘上读取的机密文件目录，用户点击要传输的机密文件并选择其接收方，打开敏感文件FLASH的内部逻辑锁和外部物理锁，将进行了存储解密和通信加密后的机密文件由C2从机密通信专用协议端口，向指定的目的IP地址发送；然后关闭敏感文件FLASH的内部逻辑锁和外部物理锁；When transmitting confidential files: In the corresponding security processing mode, the directory of confidential files read from the hard disk is displayed on C1, the user clicks the confidential file to be transmitted and selects its recipient, and opens the internal logical lock of the sensitive file FLASH With the external physical lock, the confidential files after storage decryption and communication encryption are sent by C2 from the special protocol port for confidential communication to the specified destination IP address; then close the internal logical lock and external physical lock of the sensitive file FLASH;当进行机密文件接收时：在非机密通信模式中，C2容器在机密通信专用端口接收到第一个通信报文，经由安全隔离容器传送到安全存储容器，对其进行解密确认后，打开敏感文件FLASH的外部物理锁和内部逻辑锁，然后进行机密文件的接收；文件接收完毕，先进行通信解密，再进行本地存储加密，写入敏感文件FLASH中，关闭敏感文件FLASH的外部物理锁和内部逻辑锁。When receiving confidential files: In the non-confidential communication mode, the C2 container receives the first communication message on the dedicated port for confidential communication, transmits it to the secure storage container via the security isolation container, decrypts and confirms it, and opens the sensitive file FLASH's external physical lock and internal logical lock, and then receive confidential files; after the file is received, first perform communication decryption, and then perform local storage encryption, write sensitive files to FLASH, and close the external physical lock and internal logic of sensitive files FLASH. Lock.7.根据权利要求1或4所述的方法，其特征在于：7. The method according to claim 1 or 4, wherein:在互联网应用处理模式中，在各容器的系统软件FLASH外部物理锁关闭的状态下，才能启动浏览软件；当用户浏览互联网时，在C1容器操作界面打开浏览软件，通过网站地图点击要访问的互联网站，C1容器将其产生的所有HTTPS协议报文，通过其虚拟的TCP/IP栈，经内部的第一高速通信总线、由安全隔离容器转发给C2容器；In the Internet application processing mode, the browsing software can be started only when the external physical lock of the system software FLASH of each container is closed; when the user browses the Internet, open the browsing software on the C1 container operation interface, and click the Internet to be accessed through the site map. station, the C1 container forwards all the HTTPS protocol messages generated by it to the C2 container through its virtual TCP/IP stack, through the internal first high-speed communication bus, and from the security isolation container;C2容器将从网口上接收到的TCP报文全部通过内部的第一高速通信总线发送到安全隔离容器，安全隔离容器判断出该TCP数据块属于非机密通信端口的通信数据，则通过内部的第一高速通信总线向C1容器转发。The C2 container sends all the TCP packets received from the network port to the security isolation container through the internal first high-speed communication bus. A high-speed communication bus forwards to the C1 container.8.根据权利要求1或4所述的方法，其特征在于：8. The method according to claim 1 or 4, wherein:在非敏感文件处理模式中，当用户点击要打开的非敏感文件，C1安全应用程序根据文件类型调度打开相应的文档处理软件，经由安全隔离容器向安全存储容器发出获取指定的非敏感文件的指示消息；安全存储容器读取硬盘上的指定文件，经由安全隔离容器发送到C1，C1将获取的非敏感文件暂存在大容量DDR临时文件系统中；C1处理完毕非敏感文件后，再发送到安全存储容器保存到大容量硬盘上。In the non-sensitive file processing mode, when the user clicks on the non-sensitive file to be opened, the C1 security application schedules to open the corresponding document processing software according to the file type, and sends an instruction to obtain the specified non-sensitive file to the security storage container via the security isolation container message; the secure storage container reads the specified file on the hard disk and sends it to C1 via the secure isolation container, and C1 temporarily stores the acquired non-sensitive file in the large-capacity DDR temporary file system; after C1 processes the non-sensitive file, it will be sent to the security Storage containers are saved to large capacity hard disks.9.根据权利要求1或4所述的方法，其特征在于：9. The method according to claim 1 or 4, wherein:当进行机密邮件编写处理时：当用户需要编写机密电子邮件时，首先关闭计算机的外部接口锁，并执行C1内存清洗，然后打开敏感文件FLASH的外部物理锁和内部逻辑锁，完成邮件编写并进行邮件文件的存储加密，保存在敏感文件FLASH中，关闭敏感文件FLASH的外部物理锁和内部逻辑锁，并执行C1内存清洗，打开外部接口锁；When writing confidential emails: When the user needs to write confidential emails, first close the external interface lock of the computer and perform C1 memory cleaning, then open the external physical lock and internal logical lock of the sensitive file FLASH, complete the email writing and proceed The storage of mail files is encrypted and stored in the sensitive file FLASH, close the external physical lock and internal logical lock of the sensitive file FLASH, perform C1 memory cleaning, and open the external interface lock;当进行机密邮件发送处理时：打开安全存储容器敏感文件FLASH的外部物理锁和内部逻辑锁，安全存储容器读取需要发送的机密邮件，先执行存储解密，再进行传输加密，暂存在C1的DDR临时文件系统中，C1通过电子邮件系统发送出去；最后C1删除DDR临时文件系统中的机密电子邮件，清洗机密邮件使用过的内存空间；关闭敏感文件FLASH的外部物理锁和内部逻辑锁；When sending confidential emails: open the external physical lock and internal logical lock of the sensitive file FLASH in the secure storage container, read the confidential email to be sent in the secure storage container, perform storage decryption first, then perform transmission encryption, and temporarily store it in the DDR of C1 In the temporary file system, C1 sends it out through the e-mail system; finally, C1 deletes the confidential e-mail in the DDR temporary file system, cleans the memory space used by the confidential e-mail; closes the external physical lock and internal logical lock of the sensitive file FLASH;当进行机密邮件接收处理时：当用户需要接收机密电子邮件时，打开网站邮件接收网页界面，下载电子邮件，保存到C1的DDR临时文件系统中，并将电子邮件经由安全隔离器转给传递给安全存储容器，然后打开敏感文件FLASH的外部物理锁和内部逻辑锁，安全存储容器对电子邮件解密，并将其以本地密钥加密保存在敏感文件FLASH盘中；然后关闭敏感文件FLASH的内部逻辑锁和外部物理锁；When receiving confidential emails: when the user needs to receive confidential emails, open the web interface for receiving emails from the website, download the emails, save them in the DDR temporary file system of C1, and transfer the emails to the The secure storage container, then open the external physical lock and internal logical lock of the sensitive file FLASH, the secure storage container decrypts the email, and encrypts it with the local key and saves it in the sensitive file FLASH disk; then close the internal logic of the sensitive file FLASH locks and external physical locks;当机密邮件查看处理时：当用户需要查看机密电子邮件时，首先关闭外部接口锁和执行C1内存清洗；然后用户根据硬盘中保存的机密邮件目录，点击需要查看的机密邮件；最后，打开敏感文件FLASH的外部物理锁和内部逻辑锁，读取敏感文件FLASH中的指定机密邮件，执行存储解密，传送到C1的DDR临时文件系统中；处理完毕，C1执行内存清洗，关闭敏感文件FLASH的外部物理锁和内部逻辑锁，打开外部接口锁。When viewing confidential emails: when the user needs to view confidential emails, first close the external interface lock and perform C1 memory cleaning; then the user clicks the confidential emails to be viewed according to the confidential email directory saved in the hard disk; finally, open the sensitive files The external physical lock and internal logical lock of FLASH, read the designated confidential mail in the sensitive file FLASH, perform storage decryption, and transfer it to the DDR temporary file system of C1; after processing, C1 performs memory cleaning and closes the external physical file of the sensitive file FLASH. Lock and internal logic lock, open external interface lock.10.根据权利要求5所述的方法，其特征在于：10. The method according to claim 5, wherein:当用户需要提交电子支付密码时，用户在网页上点击支付交易会话框，浏览器向电子支付Web服务器请求SSL或SET加密会话；安全隔离器从C1向C2转发的报文数据流中，识别出电子支付请求的SSL或SET报文，进入电子支付工作模式；When the user needs to submit the electronic payment password, the user clicks the payment transaction dialog box on the web page, and the browser requests the electronic payment web server for an SSL or SET encrypted session; the security isolator identifies the message data stream forwarded from C1 to C2 The SSL or SET message of the electronic payment request enters the electronic payment working mode;安全隔离容器从C2容器向C1容器转发的数据流中，识别出电子支付Web服务器应答的SSL/SET报文，拷贝出服务器发送给支付终端的加密公钥，并将该报文继续转发给C1容器；C1的虚拟键盘驱动模块接收支付会话框中的用户名以及密码；In the data stream forwarded from the C2 container to the C1 container, the security isolation container identifies the SSL/SET message responded by the electronic payment web server, copies the encrypted public key sent by the server to the payment terminal, and forwards the message to C1. Container; the virtual keyboard driver module of C1 receives the user name and password in the payment dialog box;安全隔离容器从C1向C2转发的数据流中找到SSL或SET协议承载的加密支付密码的报文，并记录将其转发给C2；安全隔离器清除记录的口令密码和公钥。The security isolation container finds the encrypted payment password message carried by the SSL or SET protocol from the data stream forwarded from C1 to C2, records and forwards it to C2; the security isolator clears the recorded password, password and public key.11.根据权利要求5所述的方法，其特征在于：11. The method of claim 5, wherein:当用户确认升级系统软件版本时，C1容器向安全隔离容器发送指定容器操作系统软件升级的请求消息；安全隔离容器接收到指定容器操作系统软件升级的请求后，进入安全升级处理模式；关闭计算机的外部接口锁；清洗C1以及C2整个动态内存；打开目标容器的系统软件FLASH的外部物理锁和内部逻辑锁；安全存储容器读取大容量硬盘内指定的操作系统升级软件文件并传递给安全隔离器；安全隔离容器根据指定升级的目标容器，将操作系统升级软件文件数据块转交给弹性防御容器C1或C2，或者保存在安全隔离容器的动态内存中进行升级操作；升级完毕，关闭目标容器的系统软件文件FLASH的外部物理锁和内部逻辑锁。When the user confirms to upgrade the system software version, the C1 container sends a request message for the specified container operating system software upgrade to the security isolation container; after the security isolation container receives the specified container operating system software upgrade request, it enters the security upgrade processing mode; External interface lock; clean the entire dynamic memory of C1 and C2; open the external physical lock and internal logical lock of the system software FLASH of the target container; the security storage container reads the specified operating system upgrade software file in the large-capacity hard disk and transmits it to the security isolator ;The security isolation container transfers the operating system upgrade software file data blocks to the elastic defense container C1 or C2 according to the specified upgrade target container, or saves it in the dynamic memory of the security isolation container for the upgrade operation; after the upgrade, shut down the system of the target container External physical lock and internal logical lock of software file FLASH.12.一种基于多容器分离处理的安全计算架构装置，其特征在于包括：12. A secure computing architecture device based on multi-container separation processing, characterized by comprising:安全计算机：安全计算机设置有四个独立运行的处理容器，分别为面向应用的弹性防御容器C1、面向TCP/IP协议栈的弹性防御容器C2、安全隔离容器以及安全存储容器，C1和C2通过内部的第一高速通信总线与安全隔离容器连接，安全存储容器通过内部的第二高速通信总线与安全隔离容器连接，基于内部通信协议格式实现高速通信；安全计算机的C1容器连接显卡、光驱、鼠标、USB以及232串口，C2容器连接网络接口，安全隔离容器连接键盘，安全存储容器设置有硬盘和敏感文件FLASH盘、USBKey接口以及生物认证接口，此外每个容器都设置有本地系统软件FLASH盘；Security computer: The security computer is provided with four independently running processing containers, which are the application-oriented elastic defense container C1, the TCP/IP protocol stack-oriented elastic defense container C2, the security isolation container and the security storage container. C1 and C2 pass through the internal The first high-speed communication bus is connected to the safety isolation container, the safety storage container is connected to the safety isolation container through the internal second high-speed communication bus, and high-speed communication is realized based on the internal communication protocol format; the C1 container of the safety computer is connected to the graphics card, optical drive, mouse, USB and 232 serial ports, the C2 container is connected to the network interface, the security isolation container is connected to the keyboard, the security storage container is provided with a hard disk and a FLASH disk for sensitive files, a USBKey interface and a biometric authentication interface, and each container is provided with a local system software FLASH disk;安全隔离容器：作为计算机协同防御的管控核心，实施对所有应用的处理实施全流程的安全管控，在弹性防御容器与安全存储容器之间执行安全隔离控制，阻断对安全存储容器的攻击渗透；Security isolation container: As the control core of computer collaborative defense, it implements full-process security control over the processing of all applications, implements security isolation control between elastic defense containers and secure storage containers, and blocks the penetration of attacks on secure storage containers;安全计算机设置有外部接口锁、外部物理锁以及内部逻辑锁，用于联合实施安全防护与管控；外部物理锁和内部逻辑锁的联合管控步骤：安全计算机通过关闭外部接口锁阻断计算机的外部连接，通过关闭FLASH盘的外部物理锁阻断对其写入，通过内部逻辑锁防止用户关闭外部物理锁的安全疏漏，共同实现防软件篡改、防数据窃取；用户对外部物理锁的管控步骤：软件不能开/关系统软件FLASH和敏感文件FLASH的外部物理锁、外部接口锁，只有计算机用户才能直接以手动方式开/关这些外部物理/接口锁，对FLASH的写/读实施绝对权限的控制；物理锁状态监测步骤：各容器的软件行为独立监控模块负责监测其FLASH外部物理锁、外部接口锁的开/关状态，并通过安全控制总线向安全管控模块报告，安全隔离容器通过安全管控模块获取计算机的所有外部接口锁、系统软件FLASH外部物理锁和敏感文件FLASH外部物理锁的开/关状态；逻辑锁管控步骤：各容器通过软件行为独立监控模块接受安全隔离容器在工作流程需要时通过安全控制总线发出的开/关FLASH内部逻辑锁的指令，并通过本地控制电路执行相应的开/关控制操作；The security computer is provided with an external interface lock, an external physical lock and an internal logical lock, which are used to jointly implement security protection and control; the joint control steps of the external physical lock and the internal logical lock: the security computer blocks the external connection of the computer by closing the external interface lock , by closing the external physical lock of the FLASH disk to block writing to it, and using the internal logical lock to prevent the user from closing the external physical lock to prevent the safety omission of the user, so as to jointly realize anti-software tampering and data theft; the user's control steps for the external physical lock: software The external physical lock and external interface lock of system software FLASH and sensitive file FLASH cannot be turned on/off. Only computer users can manually turn on/off these external physical/interface locks and implement absolute authority control over FLASH writing/reading; Physical lock status monitoring steps: The software behavior independent monitoring module of each container is responsible for monitoring the on/off status of its FLASH external physical lock and external interface lock, and reports to the security control module through the security control bus, and the security isolation container is obtained through the security control module. All external interface locks of the computer, system software FLASH external physical locks and sensitive file FLASH external physical locks on/off status; logical lock control steps: each container accepts the safety isolation through the software behavior independent monitoring module. Control the command of on/off the internal logic lock of FLASH issued by the control bus, and execute the corresponding on/off control operation through the local control circuit;其中，安全计算机各处理容器都设置有一个软件行为独立监控模块，安全隔离容器单独设置有一个安全管控模块，它们通过安全控制总线连接，用于实施安全运行监管控制；软件行为独立监视步骤：各容器的软件行为独立监控模块对本容器实施软件异常行为监视，若监测到软件出现异常的运行状态，或监测到在FLASH外部物理锁与内部逻辑锁都关闭的状态下存在不正常的写操作，则通过安全控制总线向安全管控模块报告；安全防护管控步骤：安全隔离容器基于安全管控模块实时监测其它容器的运行状态，在接收到C1或C2或安全存储容器软件运行异常的状态指示后，根据当前的安全工作流程，确定是否需要通过安全管控模块发出容器重启系统软件的安全管控指令；必要时，以容器重启来强制终止网络攻击，通过清洗内存清除掉恶意代码。Among them, each processing container of the security computer is provided with an independent software behavior monitoring module, and the security isolation container is provided with a separate security control module. The independent monitoring module of the software behavior of the container monitors the abnormal software behavior of the container. If an abnormal running state of the software is detected, or an abnormal write operation is detected when both the external physical lock and the internal logical lock of the FLASH are closed, the Report to the security control module through the security control bus; security protection control steps: the security isolation container monitors the running status of other containers in real time based on the security control module. It determines whether it is necessary to issue a security control command to restart the system software of the container through the security control module; if necessary, restart the container to forcibly terminate the network attack, and remove the malicious code by cleaning the memory.

Images