Network security system, network security method and device

Abstract

The invention relates to a network security system, a network security method and a network security device, and effectively solves the technical problems that security protection is not comprehensive enough, vulnerabilities exist, the system is attacked by being easily utilized, and network security risks exist. The network security system comprises a network security service controller, a network security transponder, a network security actuator, a network security access device and an augmented security capability provider, wherein the network security service controller is used for establishing a connection in response to an access request initiated by the network security actuator; the network security repeater is used for forwarding network data between an initiator and a receiver; the network security access device is used for initiating the access request to the network security service controller and establishing connection after the network security service controller agrees; the network security executor is used for executing corresponding security measures; and the augmented security capability provider is used for providing augmented security service capability.

Description

Technical Field

[0001] The present disclosure relates to the field of network security risk technology, and in particular to a network security system and a network security method and device. Background Art

[0002] As an important guarantee for information construction, network security is to provide security protection through technical means such as firewalls, intrusion detection systems (IDS) and anti-virus software, honeypot systems, VPNs, etc. to ensure network security. However, existing technical solutions mainly focus on the deployment and application of network security equipment in various scenarios, and there is no mature solution for end-to-end network security protection, resulting in incomplete security protection, loopholes, which are easily exploited to attack the system, and network security risks. Summary of the invention

[0003] In order to solve the above technical problems, the present disclosure provides a network security system and a network security method and device, which effectively solve the technical problems that security protection is not comprehensive enough, there are loopholes, which are easy to be exploited to attack the system, and there are network security risks.

[0004] In a first aspect, an embodiment of the present disclosure provides a network security system, including a network security service controller, a network security forwarder, a network security executor, a network security access device, and an augmented security capability provider, wherein:

[0005] The network security service controller is used to establish a connection after responding to an access request initiated by the network security executor;

[0006] The network security forwarder is used to forward network data between the initiator and the receiver;

[0007] The network security access device is used to initiate an access request to the network security service controller and establish a connection after the network security service controller agrees;

[0008] The network security actuator is used to execute corresponding security measures;

[0009] The enhanced security capability provider is used to provide enhanced security service capabilities.

[0010] In a possible implementation, in the system provided by the embodiment of the present invention, the network security executor is specifically used to execute at least one of the following security measures:

[0011] Vulnerability scanning, penetration testing, intrusion detection, compliance checking, security assessment, risk detection, password detection, identity authentication, log analysis and traffic monitoring.

[0012] In a second aspect, an embodiment of the present disclosure provides a network security method, the method comprising:

[0013] Establishing a connection in response to the access request;

[0014] Real-time monitoring of external network and internal and external traffic data;

[0015] When the traffic data is abnormal, execute the safety measures corresponding to the traffic data.

[0016] In a possible implementation manner, in the method provided by the embodiment of the present invention, establishing a connection in response to an access request includes:

[0017] Set the corresponding exposure level for each device interface;

[0018] After initiating the counting request, if the exposure of the initiator is lower than the exposure of the receiver, a connection is established between the initiator and the receiver.

[0019] In a possible implementation, in the method provided by the embodiment of the present invention, the method further includes:

[0020] Set the mapping address for the initiator and receiver.

[0021] In a third aspect, an embodiment of the present disclosure provides a network security device, the device comprising:

[0022] A response unit, configured to establish a connection in response to an access request;

[0023] Monitoring unit, used to monitor the external network and internal and external traffic data in real time;

[0024] The execution unit is used to execute the safety measures corresponding to the flow data when the flow data is abnormal.

[0025] In a possible implementation manner, in the device provided by the embodiment of the present invention, the response unit is specifically used for:

[0026] Set the corresponding exposure level for each device interface;

[0027] After initiating the counting request, if the exposure of the initiator is lower than the exposure of the receiver, a connection is established between the initiator and the receiver.

[0028] In a possible implementation manner, in the device provided by the embodiment of the present invention, the response unit is further used for:

[0029] Set the mapping address for the initiator and receiver.

[0030] In a fourth aspect, an embodiment of the present disclosure provides an electronic device, including:

[0031] Memory;

[0032] Processor; and

[0033] Computer programs;

[0034] The computer program is stored in the memory and is configured to be executed by the processor to implement the network security method as described above.

[0035] In a fifth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the network security method as described above are implemented.

[0036] The disclosed embodiments provide a network security system, including a network security service controller, a network security forwarder, a network security executor, a network security access device, and an augmented security capability provider, which effectively solves the security service problem of ultra-large-scale networks, improves the comprehensiveness of network security services, improves the reuse efficiency of security protection and service resources, reduces the cost of network security services, realizes the intelligence, automation, and service-oriented nature of network security work, and has good economic and social benefits. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0039] Figure 1 A schematic diagram of the structure of a network security system provided by an embodiment of the present disclosure;

[0040] Figure 2 A schematic diagram of a network security method provided by an embodiment of the present disclosure;

[0041] Figure 3 A schematic diagram of a specific process of a network security method provided by an embodiment of the present disclosure;

[0042] Figure 4 A schematic diagram of the structure of a network security device provided by an embodiment of the present disclosure;

[0043] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0044] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0045] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0046] 1. In the embodiments of the present invention, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0047] As an important guarantee for information construction, network security is to provide security protection through technical means such as firewalls, intrusion detection systems (IDS) and anti-virus software, honeypot systems, VPNs, etc. to ensure network security. However, existing technical solutions mainly focus on the deployment and application of network security equipment in various scenarios, and there is no mature solution for end-to-end network security protection, resulting in incomplete security protection, loopholes, which are easily exploited to attack the system, and network security risks.

[0048] Figure 1 A schematic diagram of the structure of a network security system provided for an embodiment of the present disclosure specifically includes a network security service controller, a network security forwarder, a network security executor, a network security access device, and an augmented security capability provider, wherein the network security service controller is used to establish a connection after responding to an access request initiated by the network security executor; the network security forwarder is used to forward network data between the initiator and the receiver; the network security access device is used to initiate an access request to the network security service controller and establish a connection after the network security service controller agrees; the network security executor is used to execute corresponding security measures; and the augmented security capability provider is used to provide augmented security service capabilities. Specifically, the network security executor is specifically used to execute at least one of the following security measures: vulnerability scanning, penetration testing, intrusion detection, compliance checking, security assessment, risk detection, password detection, identity authentication, log analysis, and traffic monitoring.

[0049] Specifically, the network security service controller is responsible for managing and scheduling the customer's security service needs. The network security executor has a variety of service capabilities including vulnerability scanning, penetration testing, intrusion detection, compliance checking, security assessment, risk detection, password detection, identity authentication, log analysis and traffic monitoring. The network security forwarder realizes the forwarding of network security capabilities and basic security service capabilities. The network security access device realizes the connection of the network security executor to the network security service controller and the network security executor; enterprise security equipment provides basic security services for the enterprise and establishes a collaborative interface with the network security forwarder to realize security operations and data sharing; augmented security capability providers supplement the capabilities of the network security executor and provide enhanced network security service functions by registering with the controller.

[0050] The network security service controller set is C = {c1, ..., cm}, the total number is m, and the communication address is Out-Addrc = {oac1, ..., oacm}. If the network element has multiple internally addressable function modules, the corresponding intranet address range is In-Addrc = {iac1, ..., iacm};

[0051] The network security actuator set is E = {e1, ..., en}, the total number is n, and the communication address is Out-Addre = {oae1, ..., oaen}. If the network element has multiple internally addressable function modules, the corresponding intranet address range is In-Addre = {iae1, ..., iaen};

[0052] The network security forwarder set is F = {f1, ..., fr, the total number is r, and the communication address is Out-Addrf = {oaf1, ..., oafr}. If the network element has multiple internally addressable function modules, the corresponding intranet address range is In-Addrf = {iaf1, ..., iafr};

[0053] The network security access point set is A = {a1, ..., as}, the total number is s, and the communication address is Out-Addra = {oaa1, ..., oaas}. If the network element has multiple internally addressable function modules, the corresponding intranet address range is In-Addra = {iaa1, ..., iaas};

[0054] The set of augmented security capability providers is P = {p1, ..., pt}, the total number is t, and the communication address is Out-Addrp = {oap1, ..., oapt}. If the network element has multiple internally addressable function modules, the corresponding intranet address range is In-Addrp = {iap1, ..., iapt};

[0055] The enterprise security asset set is U = {u1,...,uv}, the total number is v, and the communication address is Out-Addrp = {oau1,...,oauv}. If the network element has multiple internally addressable function modules, the corresponding intranet address range is In-Addrp = {iau1,...,iauv};

[0056] When any two network function units (X, Y) communicate with each other, they are based on the corresponding intelligent service interface specification Ixy. For example, the intelligent service interface between the network security forwarder F and the network security access device A is Ifa.

[0057] Figure 2 A schematic diagram of a network security method provided by an embodiment of the present disclosure, specifically including the following steps: Figure 2 The following steps S201 to S203 are shown:

[0058] S201. Establish a connection in response to an access request.

[0059] S202. Monitor the external network and internal and external traffic data in real time.

[0060] S203: When the flow data is abnormal, execute the safety measures corresponding to the flow data.

[0061] In this method, the functions and implementation processes implemented by each communication intelligent service interface are as follows: Figure 3 As shown, including:

[0062] Connection direction control. Different exposure scores are assigned to each unit according to its deployment position in the network. For example, the exposure of an intranet element is 0, and the exposure of an extranet element is 100. A connection can only be initiated from a low-exposure unit to a high-exposure unit.

[0063] Authentication, authorization and billing. The intelligent service interface needs to establish a connection before starting communication. During the process of establishing the connection, both parties need to be authenticated, authorized and billed.

[0064] Data encryption: The data transmitted in the intelligent service interface should support encrypted transmission;

[0065] Address mapping. Each network element uses the communication address when establishing a connection, but its corresponding intranet address may have overlapping or unreachable address ranges. In order to achieve interoperability of the intranet addresses of each network element, the corresponding intelligent service interface needs to perform global interoperability mapping of the address to ensure the uniqueness of each address information when transmitting data packets in the interface.

[0066] In one example, the network security actuator intranet address set ia e1 Each address in the euThe interface accesses the intranet address set of the enterprise security asset set ia uv The network security service controller will record the address information of all intranet network elements that join the global service network and assign a unique global temporary IP address G to each network element.

[0067] When a new network element joins the global service network, it first establishes a connection through the corresponding interface using the communication address. After the connection is successfully established, the network security service controller will assign a unique global temporary IP address to the devices at both ends of the interface. Later, when the interface sends and receives intranet data packets from both parties, the intelligent service interface will perform bidirectional IP address mapping and translation on the intranet data packets.

[0068] In another example, when the network security enforcer is within the network ia e1 The mth device in the eu Access enterprise security assets uv When the nth device in the network is connected, its target address will be assigned by the network security service controller as G un , and enterprise security assets ia uv The source address of the data packet received by the device in the network is the address assigned to the ia by the network security service controller. e1 The global temporary address G of the device em , so that the existing local applications of both parties can continue to be used without being affected by the address mapping translation. The above operations are only implemented on the intelligent service interface and are transparent to the network elements of both communicating parties;

[0069] Protocol conversion. Depending on the connected devices, the communication protocol stacks that each network element can provide are also different. Therefore, the intelligent service interface needs to adapt the protocol stacks for the network elements of both parties of the communication, such as adapting the IPv4 and IPv6 protocols.

[0070] The information transmitted between intelligent service interfaces includes control information and data information. The interfaces should support the transmission of corresponding data through corresponding network security control channels and network security data channels.

[0071] The intelligent service interface supports periodically sending active test information to the peer to verify the validity of the connection. If no active test information is received within a certain period of time, the interface connection needs to be reestablished.

[0072] In this method, the enhanced capability may also be extended, and the enhanced security capability provider registers with the controller through the network security control channel to provide the enhanced security service capability.

[0073]

[0074]

[0075] In response to a successful registration, the controller returns relevant information and registration credentials of the network security access device to the provider through the network security control channel.

[0076]

[0077] The enhanced security capability provider makes an access request to the access device

[0078] The enhanced security capability provider submits an access request to the access device through the network security control channel.

[0079]

[0080] Since the provider provides registration credentials, the accessor will accept the provider's access request and invoke its capabilities when appropriate.

[0081] Network security forwarders collaborate with enterprise security devices to integrate enterprise security capabilities

[0082] The network security forwarder cooperates with the enterprise security equipment to realize the integration of enterprise security capabilities. The enterprise security equipment provides basic security services for the enterprise and establishes a collaborative interface with the network security forwarder to realize the sharing of security operations and data.

[0083] For example, the firewall in the enterprise security equipment can provide external intrusion IP interception and interception log data for the network security forwarder; the intrusion detection system can provide security risk information for the network security forwarder; the WAF system can provide a configuration interface for the network security forwarder to detect and intercept Web attacks.

[0084] Due to the wide variety of enterprise security equipment, in order to achieve functional integration, network security repeaters are needed to realize the communication and control interfaces, data processing and configuration functions of various security equipment.

[0085] The network security forwarder makes an access request to the network security access device

[0086] Network security forwarders can be deployed in multiple enterprises and are responsible for providing security services for their respective networks and devices. Since network security forwarders need to communicate and coordinate with network security service controllers, network security actuators, network security forwarders, network security access devices, etc., it is necessary to access the system proposed in this proposal through network security control channels to network security access devices. The establishment methods of network security control channels and data channels can be found in the description of the above-mentioned "Functions and implementation methods of each communication intelligent service interface".

[0087] When accessing the system, you need to provide the network security forwarder configuration information and network information and service requirements. The following is an example.

[0088]

[0089] The network security access device forwards the access request to the service controller

[0090] Several network security access points will be deployed in the system, each responsible for accessing a network security forwarder in a certain area. The network security access point needs to be deployed in a location that can be accessed by the network security forwarder, such as the public Internet or the DMZ area of ​​the enterprise. When receiving the above access request, the network security access point needs to submit the access information to the service controller for centralized management and control.

[0091]

[0092]

[0093] The service controller agrees to the access request

[0094] If the information, account number, and password provided by the network security forwarder are all legal, the service controller will approve the access application of the network security forwarder and provide the verified access credentials Auth; otherwise, the access application will be rejected, and the network security forwarder will not be able to use the network security service.

[0095]

[0096]

[0097] The network security access device notifies the network security forwarder that it has successfully connected to the network.

[0098] The network security access device informs the network security forwarder that it has successfully connected to the network, and the network security forwarder will use various security services in subsequent steps.

[0099] After successful access, the network security forwarder needs to periodically send the information in step (1) to the network security access device to maintain the activity of the connection. If the network and service information have not changed, there is no need to change the message sequence number. If there is a network change or service information change, the network security forwarder needs to periodically send information to the network security access device through the network security control channel and update the message sequence number.

[0100]

[0101] Intranet devices submit service requests to network security forwarders

[0102] Security services can be initiated proactively within the enterprise, or the controller can proactively issue instructions to the network security forwarder to execute security services.

[0103] Taking the model of internally initiated service application as an example, the enterprise can interactively access the network security forwarder based on the intranet device and submit service requirements to the network security forwarder through the intranet device.

[0104]

[0105]

[0106] The network security forwarder submits an external service request to the access device

[0107] The network security forwarder submits an external service request to the access device through the network security control channel based on the external network information contained in the "IP range requiring service" data in the message.

[0108]

[0109] The network security access device submits an external service request to the actuator

[0110] If the network security executor can provide the required service application, the network security access device submits an external service application to the executor, including (external network address information;

[0111] Otherwise, if the enhanced security capability provider can provide the required service application, the network security access device submits an external service application to the enhanced security capability provider through the network security control channel, including the external network address information;

[0112] Otherwise, manual service can be arranged depending on the situation.

[0113]

[0114]

[0115] Network security enforcers provide external services to Internet-exposed devices

[0116] The network security actuator provides external services to Internet-exposed devices through the network security data channel, including the services required in the message: risk identification, security vulnerability scanning, and security penetration.

[0117] According to the above steps, the role of the network security executor here may also be an augmented security capability provider or a manual service.

[0118] The network security forwarder submits an intranet service application to the access device. The network security forwarder submits an internal service application to the access device based on the "IP range requiring service" data in the message, which includes the intranet address information.

[0119]

[0120] The network security access device makes an intranet service request to the controller

[0121]

[0122]

[0123] The network security service controller formulates the intranet service policy and notifies the security executor

[0124] Specifically, first of all, since the network security forwarder has certain basic network security service capabilities, the network security service controller will analyze whether the application service content includes services that can be executed locally by the network security forwarder. If so, the network security service controller will be informed to execute the service locally. In another case, some services can be composed of multiple steps, and the network security service controller can execute some of the steps. Then for network security services that the network security forwarder cannot support, the network security service controller will formulate policies according to the following steps. First, refer to the software and hardware configuration of the network security forwarder to see whether the program corresponding to the corresponding security service can be downloaded to the network security forwarder for execution. If it can, send the program and related parameters to the network security forwarder and then execute it locally; if the corresponding service cannot be executed on the network security forwarder, the controller can notify the actuator to run the relevant program, but the target address of the data packet sent and received by the program needs to be forwarded by the network security access device to the network security forwarder through a tunnel (the endpoints of the tunnel are the network security actuator and the network security forwarder respectively) and finally forwarded to the intranet address, and receive the response data packet in the opposite direction of the path, thereby realizing a complete remote security service process; finally, for some security service tasks that cannot be executed by the actuator, if the augmented security capability provider can provide the required service application, notify the augmented security capability provider to carry out the service; otherwise, manual service can be arranged as appropriate. The target address of the data packet sent and received by the service needs to be forwarded by the network security access device to the network security forwarder through a tunnel and finally forwarded to the intranet address, and receive the response data packet in the opposite direction of the path, thereby realizing a complete remote manual security service process.

[0125] The network security executor provides security services to the network security access device

[0126] The network security executor establishes a network security data channel with the network security forwarder, and the network security access device performs intermediate forwarding.

[0127] Note that according to the above steps, the role of the network security executor here may also be an augmented security capability provider or a manual service.

[0128] The network security access device forwards the service data to the network security forwarder

[0129] The network security access device forwards the service data of the network security data channel to the network security forwarder. Since the endpoints of the tunnel are the network security executor and the network security forwarder, the network security access device only forwards the data packets here and does not need to execute additional programs.

[0130] Network security forwarders forward and perform security services on intranet devices

[0131] The network security forwarder acts as the endpoint of the network security data channel. After unpacking the data packet from the channel, it forwards the data packet to the intranet device and returns the corresponding data of the intranet device to the executor through the network security data channel, thereby realizing security services for the intranet device.

[0132] When all security services are executed, the network security service controller will prepare a corresponding service report and submit it to the customer.

[0133] It should be pointed out that since different networks have different available resources and different protection requirements, the controller needs to plan application lists for each network. Even for the same network, its protection requirements and resource conditions change at different time points, so the controller needs to continuously plan and update applications for the network and publish them to the corresponding security forwarders and access devices.

[0134] Figure 4 The network security device 400 provided in the embodiment of the present disclosure can execute the processing flow provided in the above network security method embodiment, such as Figure 4 As shown, the network security device 400 includes a response unit 401, a monitoring unit 402 and an execution unit 403, wherein:

[0135] A response unit, configured to establish a connection in response to an access request;

[0136] Monitoring unit, used to monitor the external network and internal and external traffic data in real time;

[0137] The execution unit is used to execute the safety measures corresponding to the flow data when the flow data is abnormal.

[0138] In a possible implementation manner, in the device provided by the embodiment of the present invention, the response unit 401 is specifically used for:

[0139] Set the corresponding exposure level for each device interface;

[0140] After initiating the counting request, if the exposure of the initiator is lower than the exposure of the receiver, a connection is established between the initiator and the receiver.

[0141] In a possible implementation manner, in the device provided by the embodiment of the present invention, the response unit 401 is further configured to:

[0142] Set the mapping address for the initiator and receiver.

[0143] Figure 4 The network security device of the illustrated embodiment can be used to execute the technical solution of the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0144] In addition, combined Figure 1-Figure 4 The network security method and apparatus described in the embodiments of the present application may be implemented by an electronic device. Figure 5 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0145] like Figure 5 As shown, the electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 to a random access memory (RAM) 503 to implement the network security method of the embodiment described in the present disclosure. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0146] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 The electronic device 500 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0147] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart, thereby implementing the voice control method as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0148] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0149] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0150] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0151] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:

[0152] Establishing a connection in response to the access request;

[0153] Real-time monitoring of external network and internal and external traffic data;

[0154] When the traffic data is abnormal, execute the safety measures corresponding to the traffic data.

[0155] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.

[0156] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0157] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0158] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0159] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0160] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0161] The disclosed embodiment provides a network security system, including a network security service controller, a network security forwarder, a network security executor, a network security access device and an augmented security capability provider, which effectively solves the security service problem of ultra-large-scale networks, improves the comprehensiveness of network security services, improves the reuse efficiency of security protection and service resources, reduces the cost of network security services, realizes the intelligence, automation and service of network security work, and has good economic and social benefits. It should be understood by those skilled in the art that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0162] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0163] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0164] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0165] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0166] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network security system, characterized in that: The system includes a network security service controller, a network security forwarder, a network security executor, a network security access device and an augmented security capability provider, wherein: The network security service controller is used to establish a connection in response to an access request initiated by the network security executor; The network security forwarder is used to forward network data between the initiator and the receiver; The network security access device is used to initiate the access request to the network security service controller and establish a connection after the network security service controller agrees; The network security executor is used to execute corresponding security measures; The enhanced security capability provider is used to provide enhanced security service capabilities.

2. The system according to claim 1, characterized in that The network security executor is specifically used to execute at least one of the following security measures: Vulnerability scanning, penetration testing, intrusion detection, compliance checking, security assessment, risk detection, password detection, identity authentication, log analysis and traffic monitoring.

3. A network security method, characterized in that: The method comprises: Establishing a connection in response to the access request; Real-time monitoring of the external network and internal and external traffic data; When the flow data is abnormal, a safety measure corresponding to the flow data is executed.

4. The method according to claim 3, characterized in that The establishing a connection in response to the access request comprises: Set the corresponding exposure level for each device interface; After initiating the counting request, if the exposure of the initiator is lower than the exposure of the receiver, a connection is established between the initiator and the receiver.

5. The method according to claim 4, characterized in that The method further comprises: Mapping addresses are set for the initiator and the receiver.

6. A network security device, characterized in that: The device comprises: A response unit, configured to establish a connection in response to an access request; A monitoring unit, used for monitoring the external network and internal and external traffic data in real time; The execution unit is used to execute the safety measures corresponding to the flow data when the flow data is abnormal.

7. The device according to claim 6, characterized in that The response unit is specifically used for: Set the corresponding exposure level for each device interface; After initiating the counting request, if the exposure of the initiator is lower than the exposure of the receiver, a connection is established between the initiator and the receiver.

8. The device according to claim 7, characterized in that The response unit is also used for: Mapping addresses are set for the initiator and the receiver.

9. An electronic device, characterized in that: include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and is configured to be executed by the processor to implement the network security method as claimed in any one of claims 3 to 5.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the network security method according to any one of claims 3 to 5 is implemented.

Images