In layman's way: the embedded development industry how to choose encryption?

Software development or embedded research and development industry, the core part is often the source code, how to do the source code management is crucial. According to the current situation of practitioners in software development or embedded research and development industry, the following characteristics are summed up:

1. Higher education, are very smart, very understanding of computers.

2. Each developer has the ability to write programs, and even write programs that can deform various data. For example: file read/write (output log), socket communication, memory mapping, resident service, etc., it is easy for web developers to distort the code of a Web server such as IIS or Tomcat.

3. The researcher's personality is stronger and more difficult to manage.

Our software development or embedded industry characteristics require the development results-source code for security management. But the reality of the work must be environmental characteristics:

1, we must have a local area network, in order to work together;

2, need to be able to access the Internet, easy to find information;

3, must through the U port serial port and other ports to connect the external equipment for debugging.

For some enterprises have the use of physical isolation, some on the virtualization, and some on the document-level encryption software, monitoring software is basically the shape of a fake. For example, the common physical isolation, that is, network and extranet disconnection, and then prohibit the use of USB stick (software or chassis), it looks good, but for computer-savvy developers, the impact of work efficiency, or can not achieve security.

for software to prohibit U disk, make a U disk PE, and then directly from the USB drive to bypass operating system control to do anything.

The cable head on the plug-in wall connects directly to your laptop for data transfer.

For not sealed u port/serial port of the embedded debugging environment is more simple, direct data can be written through the U Port serial port.

......

In addition, for virtualization, all the numbers on the server side, looks perfect, but as long as the external network is available, peripherals are available, there is basically no security.

As a software embedded research and development company's information security Manager, how should it be?

Let's look at the features of embedded development:

(1) Connecting peripherals, networked debugging

A variety of mobile phones, it is impossible to do for each device type, brand compatibility;

When the network port debugging, the debug address is constantly changing, unable to lock the specific debugging location, the data is easy to leak;

Data can not be written in ciphertext format to the device, otherwise the device is not recognized, but this is often the most likely to cause data leakage.

(2) The developer level is high, will be various crack

A code developer, can easily write a code output to the log or control program, similar to the development of the research and development of the design staff of the socket, memory, pipeline, Com,web resolver release relay, memory mapping, resident services, such as at least more than 30 kinds.

(3) The data is deformed and penetrated out of the hair

Change the file name, suffix, compression, and follow the project package, it is easy to lose.

At present, the market is more popular several anti-leak means, are from the appearance can meet the demand, but ultimately unable to do a real anti-leak.

1, internal and external network isolation

The confidential data stored in the company intranet, the intranet is not allowed to connect to the Internet, it seems that the data can only be stored in the company, but there are still a lot of other risk of exposure, such as peripheral interface copy data; When the OS is re-installed, the USB disk PE bypass operating system to copy data from WinPE; Data pair copy.

Some people say that the peripheral interface is completely sealed off, with an iron box to lock up the computer case. This is to ensure that the chassis data security, but inconvenient to connect the device needs to debug peripherals, and for developers, the Internet is an indispensable source of information, if another computer equipped with information, coupled with the cost of the former iron box, it is not a small cost.

2. Virtualization

Virtualization has become more and more hot in recent years, and the benefits are increasingly being discovered, such as reducing the number of servers, simplifying server deployment, increasing server resource utilization, and more. But it's a bit farfetched to pull virtualization together with data security (anti-disclosure). Forced where, a simple summary, is through the Internet leaks and peripheral interface data transmission. Moreover, the soft and hard cost of virtualization is about 10 times times that of a set of cryptographic software.

Virtualization for data protection against leaks

3. Transparent Document Encryption

As early as 10 years ago, people began to focus on data security this piece, the birth of the document encryption to help most manufacturers, the development of many people to the idea of encryption is: A file in the company intranet open Normal, get external open garbled, the effect is obvious and intuitive.

We also recognize that this technology has developed in the industry so far, the technology of maturity and excellence. But now the times are different, more demand is inclined to embedded development, source code data encryption, and this is the document-level transparent encryption, this process, binding the suffix encryption method will eventually stop in the source code development to prevent the need for disclosure. In front of many developers, collapsed, be utterly routed.

Let's briefly enumerate some of the shortcomings of document transparency encryption in the face of source code protection requirements.

1, u port data line with mobile phone: data through the U port to connect mobile phone leaks.

2, u port data cable connected equipment: Data through the U Port connection device leaks.

3, serial data cable connected equipment: Data through the serial connection device leaks.

4, network port data cable connected equipment: Data through the network port connection equipment leaks.

5, the control console output content protection: Developers write a console program, the relevant content output to the console and then save.

6, log Content protection: Developers write programs to save the code and other related content to the log file and then copy the log file.

7, Memory protection: Developers write programs to save the code and other related secrets to the memory, and then through another program, such as the memory content read away.

8. Web Parser Protection: Developers write programs to modify the code and other related secret content files into HTML text style, and then through the Web parser such as IIS or Tomcat published into a Web page, and then save the browser as a clear text copy walk.

9, Pipeline protection: developers to write a pipeline program to code and other related to the contents of the secret pass away.

10, network Communication protection: developers to write socket communication program to the code and other related secret content.

11. Message Protection: Developers write a message program to send out the content of the secret.

12, screen protection: Due to a lot of plug-ins, only for the QQ process is far from enough.

13, the development process tracking difficulties: the development of software in the debugging process, some plug-in process in the background flash, unable to capture the added to the binding process, the later cause the entire debugging process error.

14, bad files: Transparent file encryption development of the ditch so far, the principle is that the encryption software in the source file to write key when the sudden power outage or program crashes, resulting in the key is only half done. The last computer does not recognize this file.

From the encryption of the entire industry, the earliest is the Apihook application layer, the development to file filtering drive transparent encryption, until now, smart phones, Tablet PC penetration of the wider, more and more app developers, embedded development is more and more, file filtering drive transparent encryption has gradually failed to meet the needs of developers. Developers need an anti-leak software that can really withstand the "scrutiny" of technicians. As the demand grew stronger, the sandbox encryption began to appear in everyone's sight.

Why does sandbox encryption meet the requirements of source code level, embedded development, and leak protection?

2012, a world-renowned manufacturer of communications equipment, Shenzhen headquarters of the research and development staff to the sandbox encryption proposed such requirements. In the original encryption market, this piece is still a blank. The security expert group of the sandbox dongle discusses the research and gives a suitable solution. In the last few years implementation of the use of the more perfect, the development can now completely solve this kind of problem.

What is a sandbox?

When the sandbox takes effect, the entire operating environment is taken over, and the files themselves are handled, modified, compiled, debugged in a sandbox environment regardless of the sandbox, and the sandbox does not ask for these behaviors. However, when these files want to be taken out of the system, by the sandbox strict control, whether it is the network export, or hardware interface access, the administrator does not authorize, all files can not be taken away.

We treated the sandbox as a house and used the data as a person in and out of the house. People in the house to do what, become Andy Lau or Jay Chou, become a male or female, become an animal or plant, the House will not go to the tube him, the real control of the house is in and out of the "door"!

This is the "door" that the sandbox controls!

The advantage of sandbox encryption is not to change files, do not change the action, do not affect the development of debugging results, do not deliberately define the need to encrypt the file suffix, do not worry about the developers to bypass the sandbox to cause leaks; secure isolated internet access, encryption and non-encryption divided into two regions, without interference; sandbox while protecting the server, Also does not encrypt the server file, facilitates the system administrator to store, the backup, the Operation dimension, the sandbox also can with the ERP, OA, the PDM and so on the server, with the SVN, the VSS and so on version management tool seamlessly integrates.

Sandbox encryption is used for embedded development in the following major features:

(1) Sandbox client, server data in the sandbox under control, unauthorized can not be taken away;

(2) Debug interface is controlled, unauthorized, any debug interface is rejected;

(3) Open the external debugging interface, and the interface constraints: Only fixed IP access, only from the fixed port debugging, only access to fixed MAC address;

(4) Specify the sandbox client node that needs debugging, only open the U port debugging permission, only open the network port debugging permission, only open the serial debugging permission;

(5) Specify the sandbox client node that needs debugging, all the data from this client node interface to debug, all from the sandbox backup to the server, facilitate the late audit and retrospective;

(6) To release the Debugging interface client node for camera monitoring, as an aid, to constrain the debugging personnel, to ensure data security.

As shown in the following:

Sandbox encryption for embedded development

Summary: The surgery industry has specialized. In the case of drawings and Office document encryption requirements, the sandbox is too bulky and cumbersome, a bit of a fuss about the feeling that the user experience is also more than the experience of sandbox encryption. But for source code encryption and embedded development requirements, it is true that only the sandbox can meet the requirements. The development of the sandbox encryption has been a few years, experience, convenience rate, and give them a little development time, I believe that there will be a better improvement later.

Document Transparent encryption and sandbox encryption are essentially different, this article only for "source code, embedded development of anti-leak" topic to do the discussion, no meaning in the inside. Please do not take the appropriate personnel, the article is only a factual. We can also investigate the truth of the facts by ourselves. If there is not enough detail to write the place, you are welcome to add.

In layman's way: the embedded development industry how to choose encryption?