External equipment processing method, device and equipment based on electric red-ong system and medium

Abstract

The invention discloses an external equipment processing method and device based on an electric red-ong system, equipment and a medium. According to the specific scheme, when an external equipment access request is received, the equipment type of the external equipment is determined based on the access request; based on the device type, determining a security evaluation attribute corresponding to the external device, the security evaluation attribute being used for representing an isolation environment parameter to be allocated to the external device when the external device is accessed; when the security evaluation attribute meets a preset condition, configuring an isolation environment parameter for the external equipment, and deploying target management information corresponding to the external equipment based on the isolation environment parameter; and when the compliance verification of the request parameter in the equipment access request based on the target management information is passed, accessing the external equipment to obtain the external equipment corresponding to the electric red-in system. According to the invention, the security of the accessed external equipment is ensured, the unified security management of the external equipment is realized, and illegal access and malicious operation are effectively prevented.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device, equipment and medium for processing external devices based on a telecom system. Background Art

[0002] The Dianhong system is an industrial Internet of Things operating system for power equipment or power terminals. It is used to achieve interconnection between power equipment of different types and brands, thereby improving the intelligence and automation level of power grid operation.

[0003] At present, when processing and managing external devices, there is a lack of unified standards for access methods and management strategies. This not only makes it impossible to achieve unified management of external devices, but also easily leads to security risks in external devices, making the Dianhong system illegally accessed and maliciously operated by attackers. Summary of the invention

[0004] The present invention provides an external device processing method, device, equipment and medium based on the Dianhong system, which ensures the security of the connected external devices, realizes unified security management of the external devices, and effectively prevents illegal access and malicious operations.

[0005] According to one aspect of the present invention, a method for processing an external device based on a telecom system is provided. The telecom system includes a system layer, and the system layer is used to process the external device. The method includes:

[0006] Upon receiving an access request from an external device, determining a device type of the external device based on the access request;

[0007] Based on the device type, determine the security assessment attribute corresponding to the external device, wherein the security assessment attribute is used to characterize the isolation environment parameters to be allocated to the external device when the external device is connected;

[0008] When the security assessment attribute meets the preset condition, the isolation environment parameters are configured for the external device, so as to deploy the target management information corresponding to the external device based on the isolation environment parameters;

[0009] When the compliance check of the request parameters in the device access request based on the target management information is passed, the external device is connected to obtain the external device corresponding to the Dianhong system.

[0010] According to another aspect of the present invention, there is provided an external device processing device based on a telecom system, wherein the telecom system comprises a system layer, and the system layer is used to process the external device, and the device comprises:

[0011] A device type determination module, configured to determine the device type of the external device based on the access request when receiving an access request from the external device;

[0012] An assessment attribute determination module, used to determine the security assessment attribute corresponding to the external device based on the device type, wherein the security assessment attribute is used to characterize the isolation environment parameters to be allocated to the external device when the external device is connected;

[0013] A management information determination module, configured to configure isolation environment parameters for the external device when the security assessment attribute meets the preset conditions, so as to deploy target management information corresponding to the external device based on the isolation environment parameters;

[0014] The external device access module is used to access the external device when the compliance check of the request parameters in the device access request based on the target management information is passed, so as to obtain the external device corresponding to the Dianhong system.

[0015] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the external device processing method based on the telecom system of any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, which stores computer instructions, and the computer instructions are used to enable a processor to implement the external device processing method based on the telecom system of any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, there is provided a computer program product, comprising a computer program, characterized in that when the computer program is executed by a processor, the computer program implements a method for processing an external device based on a telecom system as in any embodiment of the present invention.

[0021] The technical solution of the embodiment of the present invention determines the device type of the external device according to the access request when receiving an external device access request. According to the device type, the security assessment attribute corresponding to the external device is determined. When the security assessment attribute meets the preset conditions, the isolation environment parameters are allocated to the external device to deploy the target management information corresponding to the external device according to the isolation environment parameters. Based on this, the allocation of isolation environments for external devices with different security assessment attributes is achieved. When the compliance check of the request parameters in the device access request based on the target management information is passed, the external device is accessed to obtain the external device corresponding to the Dianhong system, which facilitates the subsequent secure communication between the external device and the Dianhong system according to the target management information. The present invention solves the problems of the lack of a unified management strategy in the external device access processing and the security risks of the connected external devices in the prior art, ensures the security of the connected external devices, realizes the unified security management of the external devices, and effectively prevents illegal access and malicious operations.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 It is a flow chart of a method for processing an external device based on a telecom system provided by an embodiment of the present invention;

[0025] Figure 2 It is a flow chart of a method for processing an external device based on a telecom system provided by an embodiment of the present invention;

[0026] Figure 3 It is a structural schematic diagram of an external device processing device based on a telecom system provided by an embodiment of the present invention;

[0027] Figure 4 It is a structural schematic diagram of an electronic device that implements the external device processing method based on the telecom system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment 1

[0031] Figure 1 This is a flowchart of a method for processing an external device based on the Dianhong system provided in the first embodiment of the present invention. This embodiment can be applied to the case of performing device authentication and security management on external devices to be connected to the Dianhong system. The method can be executed by an external device processing device based on the Dianhong system. The external device processing device based on the Dianhong system can be implemented in the form of hardware and / or software. The external device processing device based on the Dianhong system can be configured in electronic devices such as mobile phones, computers or servers. Figure 1 As shown, the method includes:

[0032] S110. When receiving an access request from an external device, determine a device type of the external device based on the access request.

[0033] In an embodiment of the present invention, the Dianhong system is an industrial Internet of Things operating system for power equipment or power terminals. The Dianhong system includes a physical layer, a driver layer, a system layer, and an application layer. The physical layer is used to physically connect and communicate with external devices. The driver layer is used to load and manage external devices. The application layer is used to provide interfaces and record logs, etc. The system layer is used to determine whether external devices can be accessed and to deploy and manage target management information for external devices. The target management information can be used to manage external device access and control the secure communication between external devices and the Dianhong system. Through the physical layer, driver layer, system layer, and application layer of the Dianhong system, full-chain security protection of external devices from physical connection to data communication can be achieved.

[0034] Among them, the external device can be understood as an external device connected to the equipment belonging to the Dianhong system. The external device does not belong to the equipment deployed with the Dianhong system. The external device can communicate data with the Dianhong system. When the external device wants to access the Dianhong system, the external device will send an access request to the Dianhong system. The access request contains the device type and device parameter information of the external device. The device type can be understood as the type of the external device. The device parameter information may include the operating parameters of the external device during operation and the device hardware parameters, etc.

[0035] Specifically, when the Dianhong system receives an access request sent by an external device, it determines the device type of the external device based on the device type carried in the access request, and determines whether the external device is a secure device based on the device type.

[0036] S120: Determine a security assessment attribute corresponding to the external device based on the device type, wherein the security assessment attribute is used to characterize an isolation environment parameter to be allocated to the external device when the external device is connected.

[0037] Among them, the security assessment attribute can be used to determine whether the external device is a security device. Optionally, the security assessment attribute can be a security level corresponding to the external device. According to the security assessment attribute of the external device, it can be determined whether to allocate isolation environment parameters to the external device. The isolation environment parameters can be used to configure an isolation environment for the external device. Optionally, the isolation environment parameters may include system resource parameters allocated when configuring an isolation environment for the external device and access permission parameters of the isolation environment.

[0038] Specifically, the security assessment attribute of the current external device is determined according to the device type of the external device. When the security assessment attribute is a preset security assessment attribute, it means that the security of the external device is poor, and an isolation environment can be configured for the external device, and the isolation environment parameters to be allocated to the external device can be obtained. Correspondingly, if the security assessment attribute is not a preset security assessment attribute, an isolation environment may not be configured for the external device. Among them, the preset security assessment attribute can be a pre-set security assessment attribute, and it is necessary to configure the security assessment attribute of the isolation environment for the external device.

[0039] In an embodiment of the present invention, a method for determining the security assessment attributes of an external device may be: calling a pre-created assessment attribute mapping relationship table, wherein the assessment attribute mapping relationship table includes at least one device type to be selected, and at least one assessment attribute to be selected corresponding to the device type to be selected; based on the device type and the assessment attribute mapping relationship table, determining the security assessment attribute corresponding to the device type; wherein the device type is a type in at least one device type to be selected, and the security assessment attribute is an attribute in the assessment attribute to be selected.

[0040] The evaluation attribute mapping relationship table can be used to characterize the correspondence between the device type and the security evaluation attribute. The evaluation attribute mapping relationship table includes at least one device type to be selected and the evaluation attribute to be selected corresponding to each device type to be selected. The device type to be selected can be a pre-set, at least one device type of an external device. The evaluation attribute to be selected can be a pre-configured, security evaluation attribute corresponding to each device type to be selected.

[0041] Specifically, a pre-created evaluation attribute mapping relationship table is retrieved. According to the device type of the external device, the device type to be selected that is consistent with the device type in the evaluation attribute mapping relationship table is determined. And the evaluation attribute to be selected corresponding to the device type to be selected is used as the security evaluation attribute of the external device.

[0042] S130: When the security assessment attribute meets a preset condition, configure isolation environment parameters for the external device to deploy target management information corresponding to the external device based on the isolation environment parameters.

[0043] Among them, the preset conditions may include at least one preset security assessment attribute. The preset security assessment attribute may be a pre-set attribute that needs to configure the isolation environment for the external device. For example, if the security assessment attribute is a security level, the preset security assessment attribute may be a pre-set security level that needs to be configured for the external device. The isolation environment parameters can be used to configure the isolation environment for the external device. The isolation environment parameters may include information such as system resource information allocated to the isolation environment, the operating system corresponding to the isolation environment, network configuration parameters, storage configuration information, and access rights. The target management information may be information for managing the access of external devices and secure communication with the Dianhong system. The target management information can be used to authenticate the identity of the external device, and can also determine the encrypted communication method between the external device and the Dianhong system.

[0044] Specifically, when the security assessment attribute is an assessment attribute in at least one preset security assessment attribute, it is determined that there is a security risk in the external device. Then, the isolation environment configuration technology can be selected according to the isolation environment manager, and the corresponding isolation environment parameters can be configured for the external device according to the isolation environment configuration technology. The isolation environment is configured for the external device through the isolation environment parameters. And the target management information is deployed for the isolation environment corresponding to the external device. It should be noted that if the external device does not meet the preset conditions, it is not necessary to configure the isolation environment for the external device, and the target management information can be directly applied to verify whether the external device can be accessed, and the target management information can be used to control the encrypted communication between the external device and the Dianhong system. Creating an isolation environment through external devices whose security assessment attributes meet the preset conditions can prevent the spread of security risks between different external devices.

[0045] Exemplarily, the security assessment attribute is the security level, and the preset security assessment attribute is the preset security level as an example for explanation. According to the isolation environment manager, the security requirements of the electric Hong system are analyzed to determine at least one preset security level. The preset security level can be understood as a security level that requires an isolated environment to be isolated. When the security level of the external device belongs to the security level in at least one preset security level, system resources such as CPU resources, memory resources, and storage space are allocated to the external device. The isolation environment manager selects an isolation environment configuration technology in a virtualization technology or Docker container technology that is compatible with the external device. Optionally, the virtualization technology can be one of a Type-1 virtual machine hypervisor or a Type-2 virtual machine hypervisor. If the selected isolation environment configuration technology is virtualization technology, the operating system, network configuration parameters, storage configuration information, and access permission information corresponding to the isolation environment are configured. If the selected isolation environment configuration technology is container technology, the container image, container network information, container storage information, and access permission information corresponding to the isolation environment are configured. The target management information corresponding to the external device is configured in the isolation environment so that the external device in the isolation environment performs encrypted communication with the electric Hong system based on the target management information. Among them, the target management information may include access control rules for external devices to access the Dianhong system, as well as the method for external devices to conduct data encryption communication with the Dianhong system.

[0046] In an embodiment of the present invention, the preset conditions include at least one preset attribute level, and the configuration method of the isolation environment corresponding to the external device and the deployment method of the target management information can be: when the security assessment attribute is an attribute in at least one preset attribute level, the isolation environment parameters are allocated based on the device information of the external device to create an isolation environment based on the isolation environment parameters; the preset management policy consistent with the device type is called to obtain the target management information of the external device by parsing the preset management policy; the target management information is deployed in the isolation environment, so that when a business processing request from the external device is received, the business processing request is security verified and processed based on the target management information; wherein the isolation environment parameters also include access permission information for accessing the telecom system.

[0047] Among them, the preset conditions include at least one preset attribute level. The preset attribute level can be understood as a preset security level corresponding to the external device. Optionally, under the request that the security assessment attribute is a security level, the preset attribute level can be a preset security level. The device information may include external device type information, device operation parameter information, and hardware parameter information. The preset management policy may be a pre-configured security policy that controls the external device to access the Dianhong system. Optionally, the preset management policy may be a pre-configured security policy based on a predefined security policy template using a graphical display interface or a command line tool. Defining and editing the management policy corresponding to the external device through a graphical display interface or a command line tool can improve the flexibility and customizability of the preset management policy. The preset management policy may include access control rules for external devices to access the Dianhong system, data encryption requirements when the external device communicates with the Dianhong system, and the way in which the Dianhong system authenticates the external device. The preset management policy allows external devices that have passed identity authentication and perform data encryption communication in accordance with data encryption requirements to communicate normally with the Dianhong system. It can be understood that by executing the preset management strategy, the access and communication operations of external devices can be controlled and monitored in real time, thereby avoiding illegal access and malicious communication operations of external devices. The business processing request can be the request information associated with business processing sent by the external device when communicating data with the telecom system.

[0048] Specifically, when the security assessment attribute of the external device is an attribute in at least one preset attribute level, an isolation environment can be configured for the external device. That is, the isolation environment parameters corresponding to the external device are determined based on information such as the external device type information, device operation parameter information, and hardware parameter information of the external device. Among them, the isolation environment parameters include system resource information allocated to the external device, the operating system corresponding to the isolation environment, network configuration parameters, storage configuration information, and access permission information for accessing the Dianhong system. The access permission information can be used to control the access permission of the isolation environment to the Dianhong system to prevent the spread of potential security risks.

[0049] An isolated environment is created for the external device according to the isolated environment parameters. It should be noted that the system resources allocated to the isolated environment can be dynamically adjusted according to the system resource usage of the isolated environment. For example, if the system resource usage rate of the current isolated environment is high, more system resources are allocated to it.

[0050] According to the device type of the external device, call the preset management policy corresponding to the external device. Parse the preset management policy to obtain the target management information of the external device. Optionally, the parsed target management information can also be verified to ensure the accuracy and effectiveness of the target management information. Apply the target management information in the isolated environment and the Dianhong system, so that when the Dianhong system receives a business processing request from an external device, the business processing request is securely verified according to the access control rules in the target management information, and after the verification is passed, the business processing is performed according to the business processing request.

[0051] Exemplarily, the security assessment attribute is a security level, the preset attribute level is a preset security level, the preset management policy is a preset security policy, and the isolated environment is an isolated environment created based on the Docker container technology as an example. When the security level of the external device is a security level in at least one of the preset security levels, the isolation environment configuration technology is determined to be the Docker container technology according to the device information of the external device and the needs of the telecom system, and the isolation environment parameters are allocated to the external device. According to the Docker container technology and the isolation environment parameters, the container image is used to create a container instance corresponding to the external device, and the storage space and system resources are configured for the container instance. The resource restriction function of the Docker container technology and the system resource information that can be allocated to the external device in the isolation environment parameters are used to configure the usage limit of CPU resources and memory resources for the container instance. The security policy corresponding to the device type of the external device is applied to the container instance. The Linux Namespace mechanism is used to achieve isolation between container instances to ensure that the process in the container instance cannot access the resources of other container instances. The monitoring and logging functions of the Docker container technology are used to monitor the running status and log information of the container instance, and a monitoring report or log report is generated regularly or as needed. Regularly back up the container image and data corresponding to the container instance so that when the container instance fails, data recovery can be performed through the backup data.

[0052] S140. When the compliance check of the request parameters in the device access request based on the target management information is passed, the external device is connected to obtain the external device corresponding to the Dianhong system.

[0053] The request parameter may be sent by the external device and is used for authentication parameter information for identity authentication of the external device. The external device may be understood as an external device connected to the Dianhong system.

[0054] Specifically, according to the target management information and the preset verification algorithm, the request parameters in the device access request of the external device are subjected to compliance verification. When the request parameters are consistent with the pre-stored device parameters of the external device, it is determined that the compliance verification of the request parameters has passed, that is, the identity authentication of the external device has passed. At this point, the Dianhong system accesses the external device and treats the external device connected to the Dianhong system as an external device.

[0055] It should be noted that compliance verification processing can be performed on the external device based on at least one authentication algorithm or authentication method in the authentication algorithm library to achieve identity authentication of the external device. For example, the authentication algorithm can be a public key infrastructure (PKI) or open authorization (OAuth), etc. The authentication method can be compliance verification processing through a digital certificate or an authentication password.

[0056] In an embodiment of the present invention, the target management information includes device verification information corresponding to the external device, and the compliance of the request parameters in the device access request is checked based on the target management information, including: obtaining device-associated parameters of the external device in the device access request; wherein the device-associated parameters are unencrypted or decrypted parameters; and checking the compliance of the request parameters based on the pre-stored device parameters and device-associated parameters corresponding to the device type in the device verification information.

[0057] Among them, the target management information includes device verification information corresponding to the external device. The device verification information can be understood as parameter information for identity authentication of the external device. The device verification information includes pre-stored device parameters. The pre-stored device parameters can be understood as standard device association parameters corresponding to the external device. The device association parameters can include hardware parameter information and operation parameter information corresponding to the external device. Compliance verification can be used to verify whether the external device is a legal external device.

[0058] Specifically, the device access request sent by the external device carries the device-associated parameters of the external device. If the received device management parameters are encrypted parameters, the device management parameters can be decrypted. Correspondingly, if the received device management parameters are not encrypted parameters, there is no need to decrypt the device management parameters. Compliance verification is performed based on the pre-stored device parameters corresponding to the device type in the device verification information and the device management parameters corresponding to the external device. When the pre-stored device parameters are consistent with the device management parameters, the compliance verification result of the request parameters is passed, and the external device identity authentication passes. When the pre-stored device parameters are inconsistent with the device management parameters, the compliance verification of the request parameters fails, and the external device fails the identity authentication. Based on this, the device security and reliability of external devices connected to the Dianhong system can be guaranteed, and the access of risky external devices can be avoided.

[0059] Exemplarily, the device management parameter is used as the authentication information as an example for explanation. When receiving a device access request from an external device, the authentication information is decrypted based on at least one pre-stored authentication information and key in the authentication information database, and the external device is authenticated based on the decrypted authentication information and the pre-stored authentication information. When the decrypted authentication information is consistent with the pre-stored authentication information, the identity authentication of the external device is passed.

[0060] The technical solution of this embodiment, when receiving an access request from an external device, determines the device type of the external device according to the access request. According to the device type, determines the security assessment attribute corresponding to the external device. When the security assessment attribute meets the preset conditions, the isolation environment parameters are allocated to the external device to deploy the target management information corresponding to the external device according to the isolation environment parameters. Based on this, the allocation of isolation environments for external devices with different security assessment attributes is achieved. When the compliance check of the request parameters in the device access request based on the target management information is passed, the external device is accessed to obtain the external device corresponding to the Dianhong system, which facilitates the subsequent secure communication between the external device and the Dianhong system according to the target management information. The present invention solves the problems of the lack of a unified management strategy in the external device access processing and the security risks of the connected external devices in the prior art, ensures the security of the connected external devices, realizes the unified security management of the external devices, and effectively prevents illegal access and malicious operations.

[0061] Embodiment 2

[0062] Figure 2 This is a flow chart of a method for processing an external device based on the telecom system provided in the second embodiment of the present invention. The embodiment of the present invention is based on the above embodiment. After the external device is connected, an encrypted communication method between the external device and the telecom system can be set to realize encrypted data transmission between the telecom system and the external device through the encrypted communication method. The specific implementation method can refer to the technical solution of this embodiment. Among them, the technical terms that are the same as or corresponding to the above embodiment will not be repeated here. Figure 2 As shown, the method includes:

[0063] S210: When receiving an access request from an external device, determine a device type of the external device based on the access request.

[0064] S220: Determine a security assessment attribute corresponding to the external device based on the device type, wherein the security assessment attribute is used to characterize an isolation environment parameter to be allocated to the external device when the external device is connected.

[0065] S230: When the security assessment attribute meets the preset condition, configure the isolation environment parameters for the external device to deploy the target management information corresponding to the external device based on the isolation environment parameters.

[0066] Optionally, when it is detected that the conditions for updating the target management information are met, the target management information stored in the isolation environment is updated; wherein the conditions for updating the target management information include at least one of a condition based on changes to the target management information by an upstream system, a condition based on scheduled tasks to update the target management information on a scheduled basis, and a condition of detecting changes in the target management information.

[0067] The upstream system can be understood as a superior system that communicates with the telecom system. The scheduled task can include a preset time for updating the target management information. When the preset time is reached from the last update of the target management information, the target management information is updated.

[0068] Specifically, if an update instruction is detected from the upstream system through the application layer interface of the Dianhong system, or the time between the current time and the time when the target management information was last updated reaches the preset time, or a change in the target management information is detected, the target management information is updated. The updated target management information is deployed in an isolated environment.

[0069] Exemplarily, when receiving an update instruction issued by an upstream system through an application layer interface triggering policy, or when receiving an update instruction issued by a security policy library after detecting a change in the current target management information, the update instruction is parsed and processed to obtain parsed information. The target management information is updated according to the parsed information, so as to synchronize the updated target management information to the Dianhong system and the isolated environment to ensure the timeliness and consistency of the target management information.

[0070] S240. When the compliance check of the request parameters in the device access request based on the target management information is passed, the external device is connected to obtain the external device corresponding to the Dianhong system.

[0071] S250: After the external device is connected, a first target key is issued to the external device, so that when the external device receives feedback information corresponding to the service processing request, the feedback information is decrypted based on the first target key.

[0072] The first target key may be a key used by an external device to decrypt data information sent by the telecom system. That is, the first target key is used to decrypt the feedback information. The service processing request may be used to request service data corresponding to the telecom system. The feedback information may be service data corresponding to the service processing request sent by the telecom system.

[0073] Specifically, after the external device is connected, a data encryption communication channel can be established between the external device and the Dianhong system to ensure the confidentiality and integrity of data transmission between the external device and the Dianhong system. Specifically, a first target key can be issued to the external device so that when the external device receives feedback information corresponding to the business processing request fed back by the Dianhong system, it uses the first target key to decrypt the feedback information.

[0074] S260. When receiving a service processing request sent by an external device, decrypt the service processing request based on the stored second target key corresponding to the first target key to determine feedback information corresponding to the decrypted service processing request.

[0075] Among them, the business processing request may be a request information associated with business processing sent by an external device. Through the business processing request sent by the external device, the Dianhong system can feedback the business data corresponding to the business processing request, that is, feedback information. The second target key may be used to decrypt the business processing request sent by the external device. It should be noted that the first target key in S250 and the second target key in S260 are key pairs determined based on the same encryption algorithm. For example, the encryption algorithm may be an Advanced Encryption Standard (AES) encryption algorithm or an RSA encryption algorithm. The key pair can be managed and stored by the corresponding key management module to ensure the security and reliability of the key.

[0076] Specifically, when receiving a service processing request sent by an external device, the service processing request is decrypted according to the second target key corresponding to the first target key stored in the key management module to obtain a decrypted service processing request, and corresponding feedback information is fed back to the external device according to the decrypted service processing request.

[0077] Optionally, the method also includes: recording an interaction log during communication with an external device; obtaining an interaction report during the communication process by extracting and analyzing the log data in the interaction log; wherein the interaction report includes the interaction results in at least one dimension, and the at least one dimension includes: at least one of the isolation environment operation dimension, the isolation environment system resource allocation dimension, the data encryption communication dimension, and the isolation environment fault handling dimension.

[0078] Among them, the external device is the external device connected to the Dianhong system. For the convenience of subsequent explanations, the external devices mentioned below are external devices connected to the Dianhong system. The interaction log can be used to record the loading time of the external device access, the record of the external device accessing the Dianhong system, the operation of the isolated environment to which the external device belongs, the system resource information allocated to the isolated environment, and the fault handling of the isolated environment. The interaction report can be a report obtained after analyzing and processing the log data, which can enable the corresponding management personnel to use the interaction report to monitor the access and encrypted communication of the external device and trace abnormal problems. The interaction report can be generated regularly or on demand based on the interaction results under at least one dimension.

[0079] The interaction result can be understood as the result of data interaction between the Dianhong system and the external device. The interaction result can be the result under at least one dimension. At least one dimension includes: at least one of the isolation environment operation dimension, the system resource allocation dimension of the isolation environment, the data encryption communication dimension, and the isolation environment fault handling dimension. Among them, the interaction result of the isolation environment operation dimension can be used to characterize the information for interaction with the operating state of the isolation environment. For example, the operating state of the isolation environment may include the system resource usage of the isolation environment and the security events of the isolation environment. The interaction result of the system resource allocation dimension of the isolation environment can be used to characterize the information for interaction with the system resources allocated to the isolation environment. The interaction result of the data encryption communication dimension can be used to characterize the information for data encryption communication when the external device performs business processing with the Dianhong system. The interaction result of the isolated environment fault handling dimension can be used to characterize the information for interaction with the Dianhong system in the case of a failure in the isolation environment. For example, when a failure occurs in the isolation environment, the isolation environment manager corresponding to the isolation environment can be used to automatically repair the isolation environment or report it to the Dianhong system and provide fault repair suggestions, so that the Dianhong system reminds the corresponding management personnel to troubleshoot and repair the isolation environment.

[0080] Specifically, when the Dianhong system communicates with an external device, the log information corresponding to the external device and the log information corresponding to the Dianhong system can be recorded to obtain an interaction log. For example, the log information corresponding to the external device may include the version and type of the external device, the loading time when connected, the access information of the external device to the Dianhong system, etc. The log data in the interaction log is extracted, and the extracted log data is analyzed and processed to detect whether there are abnormal interaction behaviors and security issues during the communication between the Dianhong system and the external device, and obtain an interaction report corresponding to the communication process. The interaction report may include the interaction results under at least one of the dimensions of the isolated environment operation dimension, the isolated environment system resource allocation dimension, the data encryption communication dimension, and the isolated environment fault handling dimension, so as to monitor and detect abnormalities of the external device, the isolated environment to which the external device belongs, and the encrypted communication between the external device and the Dianhong system through the interaction report.

[0081] The technical solution of this embodiment, when receiving an access request from an external device, determines the device type of the external device according to the access request. According to the device type, determines the security assessment attribute corresponding to the external device. When the security assessment attribute meets the preset conditions, the isolation environment parameters are allocated to the external device to deploy the target management information corresponding to the external device according to the isolation environment parameters. Based on this, the allocation of isolation environments for external devices with different security assessment attributes is realized. When the compliance check of the request parameters in the device access request based on the target management information is passed, the external device is accessed. Based on this, the security and reliability of the accessed external device are guaranteed. After accessing the external device, the first target key issued to the external device is used to decrypt the feedback information corresponding to the business processing request when the external device receives the feedback information corresponding to the business processing request based on the first target key. And, when receiving the business processing request sent by the external device, the business processing request is decrypted based on the second target key corresponding to the first target key stored to determine the feedback information corresponding to the decrypted business processing request. By encrypting the communication data between the external device and the telecom system, the security of data transmission is enhanced. The present invention solves the problems in the prior art of lack of a unified management strategy for external device access processing and security risks of connected external devices, ensures the security of connected external devices, realizes unified security management of external devices, and effectively prevents illegal access and malicious operations.

[0082] Embodiment 3

[0083] Figure 3 FIG. 1 is a schematic diagram of a structure of an external device processing device based on a telecom system provided by Embodiment 3 of the present invention. Figure 3As shown, the apparatus includes: a device type determination module 310 , an evaluation attribute determination module 320 , a management information determination module 330 and an external device access module 340 .

[0084] The device type determination module 310 is used to determine the device type of the external device based on the access request when an external device access request is received; the assessment attribute determination module 320 is used to determine the security assessment attributes corresponding to the external device based on the device type, wherein the security assessment attributes are used to characterize the isolation environment parameters to be allocated to the external device when the external device is accessed; the management information determination module 330 is used to configure the isolation environment parameters for the external device when the security assessment attributes meet the preset conditions, so as to deploy the target management information corresponding to the external device based on the isolation environment parameters; the external device access module 340 is used to access the external device when the compliance check of the request parameters in the device access request is passed based on the target management information, so as to obtain the external device corresponding to the Dianhong system.

[0085] The technical solution of this embodiment, when receiving an access request from an external device, determines the device type of the external device according to the access request. According to the device type, determines the security assessment attribute corresponding to the external device. When the security assessment attribute meets the preset conditions, the isolation environment parameters are allocated to the external device to deploy the target management information corresponding to the external device according to the isolation environment parameters. Based on this, the allocation of isolation environments for external devices with different security assessment attributes is achieved. When the compliance check of the request parameters in the device access request based on the target management information is passed, the external device is accessed to obtain the external device corresponding to the Dianhong system, which facilitates the subsequent secure communication between the external device and the Dianhong system according to the target management information. The present invention solves the problems of the lack of a unified management strategy in the external device access processing and the security risks of the connected external devices in the prior art, ensures the security of the connected external devices, realizes the unified security management of the external devices, and effectively prevents illegal access and malicious operations.

[0086] On the basis of the above embodiment, optionally, an assessment attribute determination module is used to call a pre-created assessment attribute mapping relationship table, wherein the assessment attribute mapping relationship table includes at least one device type to be selected, and at least one assessment attribute to be selected corresponding to the device type to be selected; based on the device type and the assessment attribute mapping relationship table, determine the security assessment attribute corresponding to the device type; wherein the device type is a type in at least one device type to be selected, and the security assessment attribute is an attribute in the assessment attribute to be selected.

[0087] Optionally, the preset conditions include at least one preset attribute level, and a management information determination module, which is used to allocate isolation environment parameters based on device information of the external device when the security assessment attribute is an attribute in at least one preset attribute level, so as to create an isolation environment based on the isolation environment parameters; call a preset management policy consistent with the device type to obtain target management information of the external device by parsing the preset management policy; deploy the target management information in the isolation environment, so as to perform security verification and business processing on the business processing request based on the target management information when a business processing request from the external device is received; wherein the isolation environment parameters also include access permission information for accessing the telecom system.

[0088] Optionally, the target management information includes device verification information corresponding to the external device, and compliance verification of request parameters in the device access request is performed based on the target management information, including: obtaining device-associated parameters of the external device in the device access request; wherein the device-associated parameters are unencrypted or decrypted parameters; and compliance verification of the request parameters based on pre-stored device parameters and device-associated parameters corresponding to the device type in the device verification information.

[0089] Optionally, after connecting to the external device, the device also includes: an encryption communication module, used to issue a first target key to the external device, so that when the external device receives feedback information corresponding to the business processing request, the feedback information is decrypted based on the first target key; and when a business processing request sent by the external device is received, the business processing request is decrypted based on the stored second target key corresponding to the first target key to determine the feedback information corresponding to the decrypted business processing request.

[0090] Optionally, the device also includes: a management information update module, used to update the target management information stored in the isolation environment when it is detected that the conditions for updating the target management information are met; wherein the conditions for updating the target management information include at least one of the conditions based on the upstream system's changes to the target management information, the conditions for updating the target management information based on a scheduled task, and the conditions for detecting changes in the target management information.

[0091] Optionally, the device also includes: an interaction report generation module, which is used to record interaction logs during communication with external devices; by extracting and analyzing the log data in the interaction log, an interaction report of the communication process is obtained; wherein the interaction report includes the interaction results under at least one dimension, and the at least one dimension includes: at least one of the isolation environment operation dimension, the isolation environment system resource allocation dimension, the data encryption communication dimension and the isolation environment fault handling dimension.

[0092] The external device processing apparatus based on the telecom system provided in the embodiment of the present invention can execute the external device processing method based on the telecom system provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0093] Embodiment 4

[0094] Figure 4 1 is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0095] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0096] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0097] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as an external device processing method based on the Dianhong system.

[0098] In some embodiments, the external device processing method based on the electric Hong Kong system can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the external device processing method based on the electric Hong Kong system described above can be executed. Alternatively, in other embodiments, the processor 11 can be configured to execute the external device processing method based on the electric Hong Kong system in any other appropriate manner (for example, by means of firmware).

[0099] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0100] The computer program for implementing the external device processing method based on the Dianhong system of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or the block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, as an independent software package, partially on the machine and partially on a remote machine, or completely on a remote machine or server.

[0101] Embodiment 5

[0102] Embodiment 5 of the present invention further provides a computer-readable storage medium, the computer-readable storage medium storing computer instructions, the computer instructions are used to enable a processor to execute a method for processing an external device based on a telecom system, the method comprising:

[0103] When an external device access request is received, the device type of the external device is determined based on the access request; based on the device type, the security assessment attributes corresponding to the external device are determined, wherein the security assessment attributes are used to characterize the isolation environment parameters to be allocated to the external device when the external device is accessed; when the security assessment attributes meet preset conditions, the isolation environment parameters are configured for the external device to deploy target management information corresponding to the external device based on the isolation environment parameters; when the compliance check of the request parameters in the device access request is passed based on the target management information, the external device is accessed to obtain the external device corresponding to the Dianhong system.

[0104] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0105] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0106] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0107] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0108] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0109] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for processing an external device based on a telecom system, wherein the telecom system includes a system layer, and the system layer is used to process the external device, characterized in that: The method comprises: Upon receiving an external device access request, determining a device type of the external device based on the access request; Based on the device type, determining a security assessment attribute corresponding to the external device, wherein the security assessment attribute is used to characterize an isolation environment parameter to be allocated to the external device when the external device is connected; When the security assessment attribute meets a preset condition, configuring an isolation environment parameter for the external device to deploy target management information corresponding to the external device based on the isolation environment parameter; When the compliance check of the request parameters in the device access request based on the target management information is passed, the external device is connected to obtain the external device corresponding to the telecom system.

2. The method according to claim 1, characterized in that The determining, based on the device type, a security assessment attribute corresponding to the external device includes: Retrieving a pre-created evaluation attribute mapping relationship table, wherein the evaluation attribute mapping relationship table includes at least one device type to be selected and the evaluation attribute to be selected corresponding to the at least one device type to be selected; Determine the security assessment attribute corresponding to the device type based on the device type and the assessment attribute mapping relationship table; The device type is a type in the at least one device type to be selected, and the security assessment attribute is an attribute in the assessment attribute to be selected.

3. The method according to claim 1, characterized in that The preset condition includes at least one preset attribute level, and when the security assessment attribute satisfies the preset condition, configuring the isolation environment parameter for the external device to deploy the target management information corresponding to the external device based on the isolation environment parameter includes: When the security assessment attribute is an attribute in the at least one preset attribute level, allocating the isolation environment parameter based on the device information of the external device to create an isolation environment based on the isolation environment parameter; Retrieving a preset management policy consistent with the device type, and obtaining target management information of the external device by parsing the preset management policy; Deploy the target management information in the isolated environment so as to perform security verification and business processing on the business processing request based on the target management information when receiving the business processing request of the external device; Among them, the isolation environment parameters also include access permission information for accessing the telecom system.

4. The method according to claim 1, characterized in that: The target management information includes device verification information corresponding to the external device, and the compliance check of the request parameter in the device access request based on the target management information includes: Acquire a device-associated parameter of the external device in the device access request; wherein the device-associated parameter is an unencrypted or decrypted parameter; The request parameter compliance is checked based on the pre-stored device parameters corresponding to the device type in the device authentication information and the device-associated parameters.

5. The method according to claim 1, characterized in that: After accessing the external device, the method further includes: issuing a first target key to the external device, so that when the external device receives feedback information corresponding to the service processing request, the feedback information is decrypted based on the first target key; and, When receiving the service processing request sent by the external device, the service processing request is decrypted based on the stored second target key corresponding to the first target key to determine feedback information corresponding to the decrypted service processing request.

6. The method according to claim 1, characterized in that The method further comprises: When it is detected that a condition for updating the target management information is met, updating the target management information stored in the isolation environment; The conditions for updating the target management information include at least one of a condition based on a change in the target management information by an upstream system, a condition based on a scheduled task to update the target management information regularly, and a condition that a change in the target management information is detected.

7. The method according to claim 1, characterized in that The method further comprises: During the communication with the external device, recording an interaction log; By extracting and analyzing the log data in the interaction log, an interaction report in the communication process is obtained; The interaction report includes interaction results in at least one dimension, and the at least one dimension includes: at least one of an isolation environment operation dimension, an isolation environment system resource allocation dimension, a data encryption communication dimension, and an isolation environment fault handling dimension.

8. An external device processing device based on a telecom system, the telecom system comprising a system layer, the system layer being used to process the external device, characterized in that: include: A device type determination module, configured to determine the device type of the external device based on the access request when receiving an access request from an external device; An assessment attribute determination module, used to determine a security assessment attribute corresponding to the external device based on the device type, wherein the security assessment attribute is used to characterize an isolation environment parameter to be allocated to the external device when the external device is connected; A management information determination module, configured to configure isolation environment parameters for the external device when the security assessment attribute meets a preset condition, so as to deploy target management information corresponding to the external device based on the isolation environment parameters; An external device access module is used to access the external device when the compliance check of the request parameters in the device access request based on the target management information is passed, so as to obtain the external device corresponding to the telecom system.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the external device processing method based on the telecom system as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the processor to implement the external device processing method based on the telecom system as described in any one of claims 1-7 when executed.

Images