Implementation method of universal network security interoperation interface, storage medium and equipment
By designing a general network security interoperability interface, using standardized language layer, control layer and customized script call interface, the problem of poor interoperability of existing network defense systems is solved, seamless docking and interoperability of network security products is achieved, and overall defense efficiency is improved.
Patent Information
- Application Number
- CN202411698609.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-26
- Publication Date
- 2025-03-18
AI Technical Summary
The poor interoperability of existing network defense systems leads to cumbersome and inefficient processing when handling large-scale and complex network security events, and the integration of different defense components and technologies is high and difficult to achieve.
A general network security interoperability interface is designed to achieve seamless docking and interoperability of network security products through standardized language layer, standardized control layer and customized script call interface.
By introducing standardized command and control interfaces, clarifying the syntax and data format of the communication protocol, unified access management and interoperability of network security products is achieved, overall defense efficiency is improved, and out-of-the-box effect is achieved.
Smart Images
Figure CN119645359A_ABST
Abstract
Description
Technical Field
[0001] The present application belongs to the field of network security technology, and in particular, relates to a method, storage medium and device for implementing a universal network security interoperability interface. Background Art
[0002] The core of network attack and defense is the battle of attack and defense speed between the attacker and the defender, but most of the current network defense systems operate in isolation and are often statically configured, which makes network security operations inconvenient. Therefore, when investigating and responding to network security incidents, especially large-scale and complex network security incidents, the entire processing process is cumbersome and inefficient, and attackers will have more free attack time. Remediation and mitigation measures for such network attacks usually use multiple technologies / products to work together, but the integration of different defense components and technologies can be costly and require customized communication interfaces (proprietary APIs). In addition, functional modules in the product may be tightly coupled with other functions, which may make it impossible to directly access them through the API, thereby reducing the flexibility of dynamic integration of the product with other tools.
[0003] The diversity of security product interfaces has brought great difficulties to interoperability, and it is difficult to standardize the use of products, which hinders the value of the entire security ecosystem. Therefore, there is an urgent need for a universal technology system that can be compatible with security products in various scenarios, achieve seamless docking and plug-and-play of security capabilities, and thus improve the overall defense effectiveness.
[0004] Existing interoperability interfaces can be divided into data collection, data transmission, instruction, and interaction categories. Different categories of interfaces have different fields and functions. Different products use different interfaces with different field format designs, which completely lack reusability and universality. Summary of the invention
[0005] In response to the above-mentioned technical problems existing in the prior art, the present application provides a method, storage medium and device for implementing a universal network security interoperability interface. By analyzing the universal capabilities of various scenario-based applications, the universal functions of network security product interoperability are extracted, and a set of universal interface technology architecture is designed. The interface method is called with a standardized language layer, a standardized control layer and a customized script, thereby completing the implementation of the universal network security interoperability interface.
[0006] In order to achieve the above-mentioned purpose, the first technical solution adopted in this application is: to provide a method for implementing a universal network security interoperability interface, including: extracting the universal functions of network security product interoperability, designing the technical architecture of the universal network security interoperability interface, the technical architecture including a standardized language layer, a standardized control layer and a customized script calling interface; defining a standardized language layer, using the network security interoperability language to uniformly access and manage network security products; defining a standardized control layer, using the network security interoperability language to achieve interoperability between network security products; and defining a customized script calling interface to achieve flexible calling at the application layer.
[0007] The second technical solution adopted in the present application is: providing a computer-readable storage medium storing computer instructions, wherein the computer instructions are operated to execute the implementation method of the universal network security interoperability interface in solution one.
[0008] The third technical solution adopted in the present application is: to provide a computer device, which includes a processor and a memory, the memory stores computer instructions, wherein the processor operates the computer instructions to execute the implementation method of the universal network security interoperability interface in solution one.
[0009] The beneficial effects that can be achieved by the technical solution of the present application are as follows: the present application introduces a standardized, function-centric command and control interface, clarifies the syntax and data format of information transmitted by the communication protocol through information exchange and memory between multiple heterogeneous systems or components, defines the CSIL language and framework, implements the definition of a standardized language layer, and standardizes the basic data structure of the language layer; defines a standardized control layer, based on the CSIL language, standardizes the control layer data structure; defines a customized script calling interface to achieve flexible calling of the application layer; encapsulates the interface using the CSIL language to achieve a general network security product interoperability interface, which can identify commands of various security products and achieve seamless docking of security capabilities, while the security product itself does not need to pay attention to the details of the interface, achieving an out-of-the-box effect, thereby improving the overall defense effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS
[0010] Figure 1 It is a flowchart of a specific implementation method of the method for implementing the universal network security interoperability interface of the present application;
[0011] Figure 2 is a schematic diagram of a specific example of the implementation of the universal network security interoperability interface in this application;
[0012] Figure 3 is a schematic diagram of a specific example of commonly used operations of the cybersecurity interoperability language in this application;
[0013] Figure 4It is a schematic diagram of a specific example of the implementation method of the universal network security interoperability interface of the present application. DETAILED DESCRIPTION
[0014] The preferred embodiments of the present application are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present application can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present application.
[0015] Figure 1 It is a flowchart of a specific implementation method of the implementation method of the universal network security interoperability interface of the present application.
[0016] exist Figure 1 In a specific embodiment shown, the implementation method of the universal network security interoperability interface of the present application includes process S101, extracting the universal functions of network security product interoperability, and designing the technical architecture of the universal network security interoperability interface, the technical architecture including a standardized language layer, a standardized control layer and a customized script calling interface.
[0017] In this specific implementation, the common capabilities of various scenario-based applications are analyzed, the common functions of product interoperability are extracted, and a set of common interface technology architecture is designed to achieve the implementation of the common interoperability interface through standardized language layer, standardized control layer and customized script calling interface methods.
[0018] Figure 2 It is a schematic diagram of a specific example of the implementation of the universal network security interoperability interface in this application.
[0019] like Figure 2 As shown, the universal network security interoperability interface of the present application mainly consists of three parts: a standardized language layer, a standardized control layer, and a customized script calling interface. Through the universal network security interoperability interface of the present application, different security products (such as Figure 2 The data source security products and disposal security products in the network are uniformly accessed and managed, and can be called by the upper application layer, thereby completing the implementation of the general network security interoperability interface.
[0020] exist Figure 1 In a specific implementation shown, the implementation method of the universal network security interoperability interface of the present application includes process S102, defining a standardized language layer, and using the network security interoperability language to uniformly manage access to network security products.
[0021] In a specific embodiment of the present application, a standardized language layer is defined, including: defining a network security interoperability language and its framework, introducing a standardized, function-centric command and control interface, and clarifying the syntax and data format of information transmitted by the communication protocol through information exchange and use between multiple heterogeneous systems or components.
[0022] Specifically, a standardized language layer, a Cyber Security Interoperability Language (CSIL), is proposed. It introduces a standardized, function-centric command and control interface, which is used for information exchange between multiple heterogeneous systems or components. It clarifies the syntax and data format of information transmitted by the communication protocol. The Cyber Security Interoperability Language can be used to achieve unified access management of network security products.
[0023] In a specific embodiment of the present application, common operations of the network security interoperability language include producers, consumers, executors, commands, and responses.
[0024] Figure 3 It is a schematic diagram of a specific example of commonly used operations of the network security interoperability language in this application.
[0025] Specifically, Figure 3 As shown in the figure, several common operations of the network security interoperability language include: 1. Producer: an entity (device, application, functional module) that generates and sends commands; 2. Consumer: an entity (device, application, functional module) that receives commands and operates on them, supporting multiple executor functions; 3. Actuator: a function performed by a consumer that executes commands; 4. Command: a message defined by an action-target pair, parameters, and instructions, sent by a producer, received by a consumer, and executed by an executor, where (1) Action: the task action to be performed, including (add, delete, update, get), which is the instruction from producer to consumer and is executed by the executor, (2) Target: the target of the action, such as IP address device, file, etc., (3) Argument: the fine-grained attributes of the action command, such as date, time, IP address, action content, description, which depends on the interface; 5. Response: a message from consumer to producer, confirming the command or returning the requested resource or status based on the previously received command.
[0026] In a specific embodiment of the present application, the protocols supported by the network security interoperability language include HTTP protocol, HTTPS protocol, SSH protocol and TELNET protocol.
[0027] In this specific embodiment, the CSIL language currently supports HTTP protocol, HTTPS protocol, SSH protocol and TELNET protocol, and can meet the transmission requirements of different scenarios. The CSIL language is designed to be technology-independent, concise, abstract and extensible, and is used to write messages for command and control of network defense systems and components.
[0028] In one specific instance of the present application, all consumers can receive a single command (e.g., deny / block a specific IP address) and can execute that command in the same manner, demonstrating that the language, transport specification, and particularly the actuator profile are robust enough to be effectively used across a set of different network defense systems and components of the same network defense functionality.
[0029] In a specific embodiment of the present application, all producers using the network security interoperability language are automatically recorded into a unified format by defining a standardized language layer.
[0030] In this specific embodiment, a standardized safety class device paradigm language layer is defined to automatically record all producers using the CSIL language in the format of date, host name, module name and command details.
[0031] In a specific example of the present application, a producer is proposed to use the CSIL language paradigm definition, and the command formats sent by the producer are all sent in the form of strings, and the definitions are shown in Table 1 below:
[0032] Table 1
[0033] <pri_id> time hostname daemon msg_data
[0034] in:
[0035] 1. pri_id is the sent module number (facility)*8+priority. The module number is uniformly defined.
[0036] 2. time: time, defined as month (abbreviation of 12 months) + day (number) + time (hh:mm:ss), with a space between month and day, and a space between date and time. If the day is a single digit, two spaces are used between month and day. (For example, Nov 03 10:10:10 or 2022-11-03 12:12:12 or 2022-11-03T12:12:12);
[0037] 3. Hostname: producer name, reflecting producer identification information;
[0038] 4. daemon: producer function module identifier;
[0039] 5. msg_data: command content. The command adopts the following format: key=value. The '=' content in the key and value content needs to be added with % to ensure that the content can be correctly identified. If the command is a string with spaces, double quotes are required to enclose the command content. Command content example: <1001> Nov 03 12:12:12dp_ips:src_ip=192.168.1.12dst_ip=202.118.1.23data="xxx".
[0040] In a specific example of the present application, the convention for using Chinese encoding in the CSIL language is: the Chinese characters in the command sent by the producer support two encoding formats among GB18030, UTF8, and unicode, and GB18030 encoding is used by default.
[0041] In a specific embodiment of the present application, after the producer's command is automatically parsed and mapped by the executor, the level of the command is specified when it is output.
[0042] Specific:
[0043] (1)#define LOG_EMERG 0 The system cannot be used
[0044] (2)#define LOG_ALERT 1 needs to be processed immediately
[0045] (3)#define LOG_CRIT 2 Important conditions
[0046] (4)#define LOG_ERR 3 Error condition
[0047] (5)#define LOG_WARNING 4 Warning condition
[0048] (6)#define LOG_NOTICE 5 Normal but serious conditions
[0049] (7)#define LOG_INFO 6 General information only
[0050] (8)#define LOG_DEBUG 7 Debug information
[0051] In a specific example of the present application, the level and mapping principle of the command after being automatically parsed by the executor are as follows:
[0052] (1) Error information of software or hardware failure, which is displayed as error information from LOG_EMERG level to LOG_WARNING level (for example, duplicate IP address is found, memory reaches critical state, protocol receives error message, protocol finds configuration error, etc.), corresponding to level 0-4;
[0053] (2) Interface up / down information and system restart information are displayed at the LOG_NOTICE level, which is level 5;
[0054] (3) Normal information of each module and protocol is displayed at the LOG_INFO level, i.e. level 6;
[0055] (4) The output of debug information is displayed as LOG_DEBUG level, which is level 7.
[0056] In a specific example of the present application, the standardized data structure of the command content msg_data is shown in Table 2 below:
[0057] Table 2
[0058] Keywords explain Value range dev_ip Device IP IP address format src_ip Source IP address ipv4 or ipv6 dst_ip Destination Address ipv4 or ipv6 src_port Source Port 1～65535 dst_port Destination Port 1～65535 protocol Protocol Number Protocol ID proto_name Protocol Name Standard name of the protocol event_name Event Name <100 bytes event_time Event time yyyy-mm-dd hh:mm:ss event_level Event Level 0-4 action Event execution action Such as: accept / drop / block, etc. Result Event processing results
[0059] The definition of event levels is shown in Table 3 below:
[0060] Table 3
[0061] Level ID English Chinese 0 info Tips / Notifications / No Risk 1 low Low risk 2 medium Moderate 3 high High risk 4 critical critical
[0062] In a specific example of the present application, the command sent by the producer is as follows:
[0063] <1001> Nov 03 12:12:12dp_ips:src_ip=192.168.1.12dst_ip=202.118.1.23Src_port=11231Dst_port=8088Event_name=”Test send”Event_time=”2022-11-03 12:11:11”Event_Level=2Action=accept Protocol_name=http data=”xxxxxxxx”.
[0064] In a specific example of the present application, after the basic data structure is defined, non-keyword fields can be customized when different production use interfaces.
[0065] exist Figure 1In a specific implementation shown, the implementation method of the universal network security interoperability interface of the present application includes process S103, defining a standardized control layer, and using a network security interoperability language to implement interoperability between network security products.
[0066] In this specific implementation, seamless communication of the network defense system is achieved by building a universal CSIL language, and incremental upgrades are supported, so that interoperability between different technologies can be achieved and the response time to network attacks can be shortened.
[0067] In a specific embodiment of the present application, a standardized control layer is defined to send the producer's commands and data to a designated consumer.
[0068] In a specific embodiment of the present application, the data formats supported by the network security interoperability language include JSON format and XML format.
[0069] In a specific embodiment of the present application, defining a standardized control layer includes: defining a blacklist and whitelist control and defining an ACL security policy control, wherein the ACL security policy control is divided into a time object, an address object, a service object, and a security policy object.
[0070] In a specific example of the present application, the consumer defines the blacklist and whitelist control, and the agreed basic data is shown in Table 4 below:
[0071] Table 4
[0072]
[0073] In a specific example of the present application, the consumer defines ACL security policy control, which is divided into time object, address object, service object and security policy object, where:
[0074] (1) Key parameters of time objects, agreed basic data are shown in Table 5 below:
[0075] Table 5
[0076]
[0077]
[0078] (2) Key parameters of address object, the agreed basic data is shown in Table 6 below:
[0079] Table 6
[0080]
[0081] (3) Key parameters of service objects, the agreed basic data are shown in Table 7 below:
[0082] Table 7
[0083]
[0084]
[0085] (4) Key parameters of security policy objects. The agreed basic data is shown in Table 8 below:
[0086] Table 8
[0087]
[0088] In a specific embodiment of the present application, interoperability between network security products is achieved using a network security interoperability language, including: using a network security interoperability language to separate functional blocks and standardized interfaces in a network defense system to achieve interoperability between network security products.
[0089] exist Figure 1 In a specific implementation shown, the implementation method of the universal network security interoperability interface of the present application includes process S104, defining a customized script calling interface to implement flexible calling at the application layer.
[0090] In this specific implementation, a customized script calling interface is proposed to increase the flexibility and scalability of the language.
[0091] In a specific embodiment of the present application, a customized script calling interface is defined to implement flexible calling at the application layer, including: customizing scripts according to security scenario requirements, providing feedback information standards, and implementing flexible calling at the application layer through a RESTful API.
[0092] In this specific embodiment, custom scripts are supported according to security scenario requirements, and feedback information standards are provided. In addition, the customized script calling interface supports the RESTful API format to be provided to the upper-level application for calling.
[0093] In a specific embodiment of the present application, the data processed and parsed according to the network security interoperability language is encapsulated as a customized script calling interface
[0094] In this specific embodiment, as a supplement to the standardized control layer, the data processed and parsed according to the CSIL language can be flexibly encapsulated into an interface form, that is, a customized script calling interface.
[0095] In a specific example of the present application, the standardization definition return information is shown in Table 9 below:
[0096] Table 9
[0097] parameter type illustrate code int Return Code message string Return information data string Return to content
[0098] The definition of the return code is shown in Table 10 below:
[0099] Table 10
[0100] Return Code illustrate 0 Success, the server returns the data requested by the user 1 Operation not allowed, such as authentication failure 2 Lack of corresponding interface call permission (user does not have permission) 3 Parameter error 4 Timeout connection 5 Interface and parameter check errors 6 User is not logged in 7 The corresponding interface does not exist 8 Out of range, such as string transitions 9 Internal interface exception 10 The user sent an error request, and the server did not create or modify data.
[0101] Figure 4 It is a schematic diagram of a specific example of the implementation method of the universal network security interoperability interface of the present application.
[0102] like Figure 4 As shown, the present application can uniformly access and manage various network security products by using the CSIL network security interoperability language, and can communicate with network security products, and the universal network security interoperability interface of the present application can communicate with the upper-layer application client through CSIL command requests and CSIL command responses. By encapsulating the network security interoperability interface using the CSIL language that supports multiple interoperability protocols and multiple data formats, a universal network security interoperability interface is implemented, and commands of various security products can be identified, and security products do not have to pay attention to the details of the interface, so that the effect of being ready to use out of the box is achieved.
[0103] In the implementation method of the universal network security interoperability interface of the present application, a standardized, function-centric command and control interface is introduced, and the syntax and data format of the information transmitted by the communication protocol are clarified through the information exchange memory between multiple heterogeneous systems or components, and the CSIL language and framework are defined to achieve the definition of a standardized language layer and standardize the basic data structure of the language layer; a standardized control layer is defined, and the control layer data structure is standardized based on the CSIL language; a customized script calling interface is defined to achieve flexible calling of the application layer; the interface is encapsulated by using the CSIL language to achieve a universal network security product interoperability interface, which can identify the commands of various security products and achieve seamless docking of security capabilities. The security product itself does not need to pay attention to the details of the interface, and achieves an out-of-the-box effect, thereby improving the overall defense effectiveness.
[0104] In a specific embodiment of the present application, a computer-readable storage medium stores computer instructions, which are operated to execute the implementation method of the universal network security interoperability interface described in any embodiment. The storage medium can be directly in hardware, in a software module executed by a processor, or in a combination of the two.
[0105] The software modules may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from and write information to the storage medium.
[0106] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, or any combination thereof. A general-purpose processor may be a microprocessor, but in an alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration. In an alternative, the storage medium may be integrated with the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and the storage medium may reside in a user terminal as discrete components.
[0107] In a specific embodiment of the present application, a computer device includes a processor and a memory, wherein the memory stores computer instructions, wherein the processor operates the computer instructions to execute the implementation method of the universal network security interoperability interface described in any embodiment.
[0108] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0109] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0110] The above description is only an embodiment of the present application and does not limit the patent scope of the present application. Any equivalent structural transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.
Claims
1. A method for implementing a universal network security interoperability interface, characterized in that: include: Extract the common functions of network security product interoperability and design the technical architecture of the universal network security interoperability interface, which includes a standardized language layer, a standardized control layer and a customized script calling interface; Defining the standardized language layer, and using the network security interoperability language to uniformly manage network security products; Defining the standardized control layer and using the network security interoperability language to achieve interoperability between network security products; as well as Define customized script calling interface to realize flexible calling at the application layer.
2. The method for implementing the universal network security interoperability interface according to claim 1, characterized in that: The defining of the standardized language layer comprises: Define the network security interoperability language and its framework, introduce a standardized, function-centric command and control interface, and clarify the syntax and data format of information transmitted by the communication protocol through information exchange and use between multiple heterogeneous systems or components.
3. The method for implementing the universal network security interoperability interface according to claim 1, characterized in that: The defining of the standardized control layer comprises: Define blacklist and whitelist control and define ACL security policy control, wherein the ACL security policy control is divided into time object, address object, service object and security policy object.
4. The method for implementing a universal network security interoperability interface according to claim 1, characterized in that: The using of the network security interoperability language to achieve interoperability between network security products includes: The network security interoperability language is used to separate functional blocks and standardized interfaces in a network defense system, thereby achieving interoperability between network security products.
5. The method for implementing a universal network security interoperability interface according to claim 1, characterized in that: The customized script calling interface is defined to realize flexible calling of the application layer, including: Customize scripts according to security scenario requirements, provide feedback information standards, and implement flexible application layer calls through RESTful APIs.
6. The method for implementing the universal network security interoperability interface according to claim 2, characterized in that: Common operations of the network security interoperability language include producers, consumers, executors, commands, and responses.
7. The method for implementing the universal network security interoperability interface according to claim 6, characterized in that: By defining the standardized language layer, all producers using the cybersecurity interoperability language are automatically documented into a unified format.
8. The method for implementing the universal network security interoperability interface according to claim 6, characterized in that: By defining the standardized control layer, the commands and data of the producer are sent to the designated consumer.
9. A computer-readable storage medium storing computer instructions, wherein the computer instructions are operated to execute the method for implementing the universal network security interoperability interface according to any one of claims 1 to 8.
10. A computer device comprising a processor and a memory, wherein the memory stores computer instructions, wherein the processor operates the computer instructions to execute the method for implementing the universal network security interoperability interface according to any one of claims 1 to 8.