Network security service sharing method and system based on heterogeneous security capability fusion

Abstract

The invention discloses a network security service sharing method and system based on heterogeneous security capability fusion, and the method comprises the steps: simulating manual operation through employing a Python script based on the reverse analysis of a security system without an API interface; based on simulated manual operation, performing interface packaging on the security capability of the security system without the API interface to form a converted unified security capability API interface; based on a heterogeneous security system with an API interface, a Python script is utilized to carry out encapsulation conversion to form the API interface with unified security capability; based on a unified security capability API interface, a security capability management mechanism and a security capability authorization sharing mechanism are designed, and the exposure surface of a security system is reduced; based on a security capability management mechanism and a security capability authorization sharing mechanism, a security capability centralized auditing mechanism is designed, and an enterprise security defense system is constructed. According to the invention, the overall security defense system of the enterprise is more efficient and intelligent, complex security threats and challenges can be better handled, and the security management level of the enterprise is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a network security service sharing method and system based on heterogeneous security capability fusion. Background Art

[0002] Most of the security equipment and security systems in enterprises are of various types, dedicated, and decentralized. There are duplicate construction and waste of resources, information islands, difficulty in unified monitoring and management, inconsistent API interfaces, lack of API interfaces, inability to conduct effective security linkage, and lack of unified security audit capabilities. Its technical shortcomings are as follows:

[0003] 1. Security capabilities lack a unified API interface, and cannot build an automated handling capability linkage. Existing, outdated security equipment and systems lack effective API interface support, which makes it impossible to establish a close, automated linkage mechanism between security equipment and security systems and other key business systems, especially when it is necessary to quickly respond to and handle security incidents. At the same time, it also restricts the collaborative efficiency and intelligence level of the company's overall security defense system.

[0004] 2. Security capabilities are dispersed and cannot be centrally authorized and supervised. The use of security equipment system capabilities lacks unified security authentication and authorization management, resulting in cumbersome user password management, account information islands, security risks, and inconvenient management.

[0005] 3. The current security tools and systems of the unit lack sharing. The security tools, equipment and systems currently invested and operated by the unit are all exclusive and lack sharing. The security tool systems built by the superior units, such as threat intelligence platforms, vulnerability scanning equipment and other security capabilities, have not been shared and opened to the molecular units within the enterprise. Due to the lack of an effective sharing mechanism, the security capabilities built by the superior units have not been fully radiated to each molecular unit.

[0006] 4. Lack of unified security capability auditing, high security risks. Decentralized management of security equipment, decentralized security audit logs, heavy reliance on operator experience and level, lack of compliance, lack of comprehensive audit data, making it difficult for enterprises to accurately assess security risks and formulate effective security strategies and measures. Summary of the invention

[0007] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0008] In view of the above existing problems, the present invention is proposed.

[0009] Therefore, the present invention provides a network security service sharing method and system based on the integration of heterogeneous security capabilities to solve the problems that most of the security devices and security systems within an enterprise are of various types, dedicated, and decentralized in management, resulting in waste of resources due to duplicate construction, information silos, difficulty in unified monitoring and management, lack of API interfaces for effective security linkage, and lack of unified security auditing capabilities.

[0010] To solve the above technical problems, the present invention provides the following technical solutions:

[0011] In a first aspect, the present invention provides a network security service sharing method based on the integration of heterogeneous security capabilities, including:

[0012] Based on the reverse analysis of heterogeneous security systems without API interfaces, use Python scripts to simulate manual operations;

[0013] Based on the simulated manual operations, encapsulate the security capabilities of the security system without API interfaces to form a unified security capability API interface after conversion;

[0014] Based on heterogeneous security systems with API interfaces, use Python scripts to perform encapsulation and conversion to form a unified security capability API interface;

[0015] Based on the unified security capability API interface, design a security capability management mechanism and a security capability authorization sharing mechanism to reduce the exposure surface of the security system;

[0016] Based on the security capability management mechanism and the security capability authorization sharing mechanism, design a security capability centralized auditing mechanism to build an enterprise security defense system.

[0017] As a preferred solution of the network security service sharing method based on the integration of heterogeneous security capabilities according to the present invention, wherein:

[0018] The encapsulation of the security capabilities of the existing security system includes the following steps:

[0019] Use Python scripts to encapsulate the minimum actions of the security capabilities into atomic actions;

[0020] Combine multiple atomic actions into standard actions with a single security capability as the unit;

[0021] Based on the standard actions, complete the API interface call.

[0022] As a preferred solution of the network security service sharing method based on the integration of heterogeneous security capabilities according to the present invention, wherein:

[0023] The encapsulation of the minimum actions of security capabilities into atomic actions using Python scripts includes the following steps:

[0024] Perform an HTTP login for a security system without an API interface call, and determine whether there is a verification code;

[0025] If there is a verification code during login, obtain the image verification code through multiple refreshes, and perform verification code training to generate a verification code dataset;

[0026] If there is no verification code during login, the login is directly successful;

[0027] Generate a Python atomic action script for HTTP request login by reverse-analyzing the HTTP login request;

[0028] At the same time, generate a Python atomic action script for HTTP request security capability operation by reverse-analyzing the HTTP security capability operation request;

[0029] For heterogeneous security systems with API interface calls, encapsulate the API interface through Python scripts to generate a Python atomic action script for HTTP request security capability operation.

[0030] As a preferred solution of the network security service sharing method based on heterogeneous security capability fusion described in the present invention, wherein:

[0031] The combination of multiple atomic actions into standard actions with a single security capability as a unit includes the following steps:

[0032] If an atomic action script is generated, analyze the security service actions of the security system, combine the security capability atomic actions, and generate a standard action for automatic verification code recognition login and a standard action for security capabilities;

[0033] The completion of API interface call includes, if a login standard action and a security capability standard action are generated, encapsulating the standard actions as API interfaces and calling the API interfaces.

[0034] As a preferred solution of the network security service sharing method based on heterogeneous security capability fusion described in the present invention, wherein:

[0035] The security capability management mechanism includes standard action configuration parameter information and security capability standard action calls;

[0036] The manual configuration of standard action parameter information includes configuring the security system login address, configuring the login account information, and configuring the session automatic refresh time;

[0037] The security capability standard action call includes the following steps:

[0038] Based on the standard action configuration parameter information, determine whether the system has reached the session timeout time;

[0039] If the session timeout time is reached, automatically execute the login standard action to refresh the session and generate session authorization authentication information;

[0040] If the session timeout time is not reached, wait for 5 seconds and then check again;

[0041] Obtain the session authorization authentication information and execute the security capability standard action call.

[0042] As a preferred solution of the network security service sharing method based on heterogeneous security capability fusion described in the present invention, wherein:

[0043] The security capability authorization sharing mechanism includes a process of configuring the security capability sharing and a process of invoking the authorization API interface;

[0044] The process of configuring the security capability sharing includes the following steps:

[0045] Add a third-party platform;

[0046] Configure the authentication information of the third-party platform;

[0047] Third-party platform authentication configuration information;

[0048] Authorize the standard actions of the third-party platform;

[0049] Generate the standard action HTTP API interface for third-party platform invocation;

[0050] Record the security audit log information;

[0051] The process of invoking the authorization API interface includes the following steps:

[0052] After successful login, the third-party platform obtains the authorization credential and records the security audit log;

[0053] After the third-party platform successfully obtains the standard action authorization credential, directly invoke the authorized HTTP API interface and record the security audit log;

[0054] When the third-party platform invokes the API interface, perform authentication again. After successful authentication, access the standard action HTTP API interface.

[0055] As a preferred solution of the network security service sharing method based on heterogeneous security capability fusion described in the present invention, wherein:

[0056] The security capability centralized audit mechanism includes the following steps:

[0057] The user selects the retrieval conditions for security capability auditing;

[0058] The system conducts security capability authorization auditing and security capability invocation auditing;

[0059] After successful login to the third - party platform, the security capability auditing interface is called to obtain the security capability authorization log and the security invocation auditing log;

[0060] Conduct security capability authorization auditing and security capability operation auditing.

[0061] Second, the present invention provides a network security service sharing system based on heterogeneous security capability fusion, including:

[0062] A simulation module, which is used for reverse analysis of the non - API - interface security system and simulates manual operations using Python scripts;

[0063] A security capability encapsulation module, which is used for encapsulating the security capabilities of the non - API - interface security system based on the simulated manual operations to form a converted unified security capability API interface;

[0064] An interface standardization module, which is used for encapsulating and converting the API - interface heterogeneous security system using Python scripts to form a unified security capability API interface;

[0065] A security capability management and sharing module, which is used for designing a security capability management mechanism and a security capability authorization sharing mechanism based on the unified security capability API interface to reduce the exposure surface of the security system;

[0066] A security capability centralized auditing module, which is used for designing a security capability centralized auditing mechanism based on the security capability management mechanism and the security capability authorization sharing mechanism to build an enterprise security defense system.

[0067] Third, the present invention provides a computing device, including:

[0068] A memory for storing programs;

[0069] A processor for executing the computer - executable instructions, and when the computer - executable instructions are executed by the processor, the steps of the network security service sharing method based on heterogeneous security capability fusion are implemented.

[0070] Fourth, the present invention provides a computer - readable storage medium, including: when the program is executed by the processor, the steps of the network security service sharing method based on heterogeneous security capability fusion are implemented.

[0071] Advantages of the present invention:

[0072] 1) Enhance automated handling capabilities: By building effective API interfaces for heterogeneous security devices and systems, close linkage with other key business systems can be achieved. This will improve the response speed and handling efficiency of security incidents, ensure rapid action in case of emergencies, and enhance the overall security defense capabilities.

[0073] 2) Centralized authorization and supervision: Unified security authentication and authorization management will simplify user password management, eliminate account information silos, and reduce security risks. Centralized management can improve the supervision efficiency of the capabilities of security devices and systems, ensuring compliance and security.

[0074] 3) Improve the sharing of security tools and systems: By establishing an effective sharing mechanism, security tools and systems built by superior unit departments (such as threat intelligence platforms, vulnerability scanning devices, etc.) can be shared among various sub-units within the enterprise. This will improve resource utilization efficiency and enhance the coverage and effectiveness of the overall security capabilities.

[0075] 4) Unified security capability auditing: By centrally managing security audit logs and establishing a comprehensive audit data system, enterprises can more accurately assess security risks. This will help formulate effective security policies and measures, enhance compliance, and reduce security hazards.

[0076] 5) Improve the coordination efficiency and intelligence level of the overall security defense system: By solving the above problems, the overall security defense system of the enterprise will be more efficient and intelligent, able to better cope with complex security threats and challenges, and improve the enterprise's security management level. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts. Among them:

[0078] Figure 1 It is a schematic flowchart of the basic process of a network security service sharing method based on the integration of heterogeneous security capabilities provided by an embodiment of the present invention;

[0079] Figure 2 It is a structural diagram of the overall working principle of a network security service sharing method based on the integration of heterogeneous security capabilities provided by an embodiment of the present invention;

[0080] Figure 3 It is a flowchart of the conversion and encapsulation of the 1) security capability API interface of a network security service sharing method based on the integration of heterogeneous security capabilities provided by an embodiment of the present invention;

[0081] Figure 4 The flowchart of security service capability management and invocation for a network security service sharing method based on heterogeneous security capability integration provided by an embodiment of the present invention;

[0082] Figure 5 The flowchart of security capability service authorization and sharing for a network security service sharing method based on heterogeneous security capability integration provided by an embodiment of the present invention;

[0083] Figure 6 The flowchart of security capability centralized auditing for a network security service sharing method based on heterogeneous security capability integration provided by an embodiment of the present invention. Detailed implementation manners

[0084] To make the above objects, features, and advantages of the present invention more apparent and understandable, the following detailed description of the specific implementation manners of the present invention will be given in conjunction with the accompanying drawings of the specification. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all embodiments. All other embodiments obtained by those of ordinary skill in the art without creative efforts based on the embodiments in the present invention shall fall within the scope of protection of the present invention.

[0085] In the following description, many specific details are set forth to fully understand the present invention. However, the present invention can also be implemented in other ways different from those described herein. Those skilled in the art can make similar generalizations without departing from the connotation of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0086] Secondly, the so-called "one embodiment" or "embodiment" herein refers to specific features, structures, or characteristics that can be included in at least one implementation manner of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that excludes other embodiments.

[0087] The present invention will be described in detail in conjunction with schematic diagrams. When detailing the embodiments of the present invention, for the sake of convenience of explanation, the cross-sectional views showing the device structure will be enlarged locally out of the general proportion, and the schematic diagrams are only examples and should not limit the scope of protection of the present invention herein. In addition, in actual production, three-dimensional spatial dimensions including length, width, and depth should be included.

[0088] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by terms such as "upper, lower, inner, and outer" is based on the orientation or positional relationship shown in the drawings. It is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation to the present invention. In addition, the terms "first, second, or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0089] Unless otherwise clearly defined and limited in the present invention, the terms "installation, connection, and coupling" shall be understood in a broad sense. For example, it may be a fixed connection, a detachable connection, or an integral connection; it may also be a mechanical connection, an electrical connection, or a direct connection, or may be indirectly connected through an intermediate medium, or may be the communication inside two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0090] Embodiment 1

[0091] Referring to Figure 1-6 , an embodiment of the present invention provides a network security service sharing method based on the integration of heterogeneous security capabilities. As Figure 1 shown, it includes the following steps:

[0092] In the embodiment of the present application, as Figure 2 shown, the overall working principle includes refining the security capabilities of security devices and systems through reverse analysis. Using Python scripts to encapsulate the minimum actions of these security capabilities into atomic actions, and combining one or more atomic actions into standard actions with a single security capability as a unit. Both atomic actions and standard actions exist in the form of Python functions and support configuring input parameters required for calls, such as usernames, passwords, and session timeouts. At the same time, centralized management is performed, and the centrally managed standard actions are authorized and opened to third-party platforms in the form of HTTP APIs. The process of authorizing third-party platforms and the entire process of the third-party platform initiating calls and authenticating standard actions (single security capabilities) are standardized to record logs. The logs can be audited within the system or authorized to a third party for security auditing through the API interface.

[0093] In the embodiment of the present application, as Figure 2As shown in the figure, the security service capability management module encapsulates the single security capabilities of existing security devices / systems into atomic actions with single functions through Python scripts to implement security atomic capabilities. For example: login, scanning, firewall setting rules, etc. Then, multiple atomic actions are combined through Python scripts to form standard actions to implement security handling capabilities. For example, the standard action of firewall IP blocking needs to be composed of two atomic actions, namely the atomic action of first logging in to the security device and then the atomic action of calling the firewall rule setting.

[0094] In the embodiment of the present application, as Figure 2 shown in the figure, the security capability service authorization and sharing module includes converting the standard actions encapsulated by the security service capability management module into callable HTTP API interfaces to achieve unified management of the security capability interfaces. When calling, there is no need to pay attention to the login method, account, and login process of the security device, etc. For example, IP blocking action interface, port blocking action interface, protocol blocking action interface, etc. Through the application, authorization, and call audit log records of the security interfaces, the sharing of security capabilities and the recording of security capability audit data are realized. Third-party platforms (such as Platform A, Platform B, and Platform C) use these API interfaces to call security capabilities through steps such as registration, interface application, interface authorization, and interface call.

[0095] In the embodiment of the present application, as Figure 2 shown in the figure, the centralized audit of security capabilities includes querying the call audit logs of security capabilities to achieve the call audit of all security devices within the system. Through the HTTP API interface of security capability authorization audit, the security capability audit data is provided to third-party platforms for call audit.

[0096] In the embodiment of the present application, as Figure 2 shown in the figure, the security device / system includes Device A that supports SSH login and restarting the MySQL service, Device B that supports SSH login, adding blocking rules, deleting rules, and restarting the firewall, and Device C that supports HTTPS login, initiating vulnerability scanning, and obtaining scanning results.

[0097] In the embodiment of the present application, as Figure 2 shown in the figure, the security device / system interacts with the network security service sharing system based on heterogeneous security capability fusion through different interfaces (such as SSH, HTTPS) to perform specific security operations.

[0098] In the embodiment of the present application, as Figure 2 shown in the figure, the security service capability management module encapsulates the capabilities of these devices into atomic actions and standard actions, and combines them through Python scripts.

[0099] In the embodiment of the present application, as Figure 2As shown, the security capability service authorization sharing module converts these standard actions into HTTP API interfaces for third-party platforms to call.

[0100] In the embodiment of the present application, as Figure 2 shown, the security capability centralized audit module records all call audit logs and provides audit data to third-party platforms to ensure transparency and traceability.

[0101] S1: Based on the reverse analysis of the security system without API interfaces, use Python scripts to simulate manual operations;

[0102] S2: Based on the simulated manual operations, encapsulate the interfaces of the security capabilities of the security system without API interfaces to form a unified security capability API interface after conversion;

[0103] S3: Based on the heterogeneous security system with API interfaces, use Python scripts to perform encapsulation and conversion to form a unified security capability API interface;

[0104] In the embodiment of the present application, as Figure 3 shown, the process of converting and encapsulating the security capability API interface is as follows:

[0105] (1) Generate atomic actions: Perform an HTTP login for security devices / systems that do not have API interface calls. For systems with verification codes during login, obtain image verification codes by refreshing multiple times and perform verification code training to generate a verification code dataset; for systems without verification codes and systems with verification codes that enter the correct verification codes, directly log in successfully; then, through reverse analysis of the HTTP login request, generate a Python atomic action script for HTTP request login; at the same time, through reverse analysis of the HTTP security capability operation request, generate a Python atomic action script for HTTP request security capability operation. This process usually only needs to be carried out once.

[0106] (2) Generate standard actions: Analyze the security service actions of the security system, combine the security capability atomic actions, and generate a login standard action (filled according to the login URL, account, and password configuration information, and the verification code dataset is automatically recognized), as well as a security capability standard action (the prerequisite for the security capability standard action is to ensure the successful automatic login of the security device / system). This process also usually only needs to be carried out once.

[0107] (3) API interface call: For the API interface after the security capability conversion and encapsulation, the converted API interface can be called by the program to achieve the API call of the security capabilities that do not have API interface calls. This process needs to be repeated multiple times to ensure the stability and reliability of the API interface.

[0108] In an embodiment of the present application, a security device or system is logged in through a reasonable authorization method (such as a user name, password, and verification code). After a successful login, the user can access specific security functions. In the debugging mode of the browser, obtain the HTTP interface that the system is not open to the outside world. Use Python scripts to convert these interfaces into minimized functional interfaces open to the outside world, and each encapsulated interface forms a Python script called an atomic action. A security capability of a security device or system consists of one or more atomic actions. By encapsulating and combining multiple atomic actions, an interface action set is formed, which is called a standard action. Standard actions are the basic units for implementing a certain security capability, which can be encapsulated and provide API interfaces to the outside world.

[0109] In the embodiment of the present application, the security API interface conversion and encapsulation is to use Python scripting technology to simulate the login of a security device or system that does not have an API interface and obtain its operation interface. Subsequently, the obtained operation interface is converted and encapsulated by Python scripting, thereby realizing the conversion, encapsulation and output of the API interface not provided by the security device or system.

[0110] S3: Based on the unified security capability API interface, design a security capability management mechanism and a security capability authorization sharing mechanism to reduce the exposure of the security system;

[0111] In the embodiments of the present application, Figure 4 As shown, the security service capability management calling process is as follows:

[0112] (1) Manually configure standard action control parameters: configure the login URL information of the security device / system, configure the username and password of the login URL, and configure the session automatic refresh time of the security device / system (the automatic refresh time should be less than the system timeout time); when setting the login information, session refresh time and other parameters of the security device / system for the first time, these operations only need to be performed once. Configuration update: If any configuration related to the security device / system is changed later (such as changing the login URL, username, password or session refresh time), then these configuration tasks need to be performed again to ensure that the new settings take effect.

[0113] (2) Security capability standard action call: Automatically determine whether the session timeout has been reached. If the session timeout has been reached, automatically execute the login standard action to refresh the session according to the configuration parameters and generate session authorization and authentication information. When the system receives a security capability call request (it only needs to provide the security capability call parameters without having to understand how the security device / system logs in, or knowing the user name, password, session timeout, and other parameters), it directly obtains the session authorization and authentication information and executes the security capability standard action call. The checking and possible refreshing process is continuous until it is no longer necessary to keep the session active.

[0114] In the embodiments of the present application, as Figure 5 shown, the process of security capability service authorization sharing is as follows:

[0115] (1) Configure the security capability sharing process: In the security capability service authorization sharing module, add a third-party platform, configure the authentication information of the third-party platform, and generate the authentication configuration information for the third-party platform to log in to the security capability service authorization sharing module; configure the standard actions of the third-party platform, generate the standard action HTTP API interface called by the third-party platform, and record the security audit log information;

[0116] (2) Process of calling the authorization API interface: After the third-party platform security capability service authorization sharing module logs in successfully, it obtains the authorization credential and records the security audit log; after the third-party platform successfully obtains the standard action authorization credential, it directly calls the authorized HTTP API interface and records the security audit log; when the third-party platform calls the API interface, it performs authentication again. After successful authentication, it can access the standard action HTTP API interface to implement the security capability call of the security device / system.

[0117] In the embodiments of the present application, the login authorization information of the security device or system is centrally managed and passed as a parameter for calling the encapsulated API interface (standard action) after conversion to ensure that the standard action can effectively operate the security device or system. At the same time, ensure that the security device or system is always in the logged-in state to meet the account isolation requirements for security capability calls and ensure the normal progress of each API interface (standard action) call.

[0118] In the embodiments of the present application, access authorization control is performed on the API interface (standard action) of the security device or system, including authentication, interface authorization, and access control. Authentication is performed by obtaining a Token. Interface authorization supports methods such as validity period, access IP address, and time period. Access control verifies the Token and authorization credential information for each interface and records all authorization operations and call information of the API interface (standard action).

[0119] In the embodiments of the present application, security service capability management is to realize the management of the login credentials of the security device or system by constructing a security service management service, use the login credentials and Python mapping API interfaces for login and access, and users can uniformly access different security devices and services that they ultimately need to access through the security capability integration service.

[0120] In the embodiments of the present application, security capability service authorization sharing means that by constructing a security capability sharing service, authorization and shared access control are implemented for the Python mapping API interfaces of security devices or systems, so as to achieve security capability sharing between security devices and services. When the caller calls the shared API interface, it does not need to know the information of specific security devices, such as IP addresses, ports, login usernames, passwords, etc.

[0121] S4: Based on the security capability management mechanism and the security capability authorization sharing mechanism, design a security capability centralized audit mechanism and construct an enterprise security defense system.

[0122] In the embodiments of the present application, as Figure 6 shown, the process of security capability centralized audit is as follows:

[0123] (1) Security capability centralized audit: The user enters the security capability centralized audit module and selects the retrieval conditions for security capability audit (such as third-party systems, security capabilities, time periods, etc.) within the system to query the security capability authorization situation and the security capability invocation situation.

[0124] (2) Security capability third-party audit: The third-party platform logs in to the security capability centralized audit module. After successful login, it calls the security capability audit interface to obtain the security capability authorization log and the security invocation audit log, so as to conduct security capability authorization audit and security capability operation audit.

[0125] In the embodiments of the present application, based on the security capability sharing service, the authorization logs and access logs of all security devices or systems are recorded, and centralized audit and audit API interfaces for security capabilities are provided.

[0126] In the embodiments of the present application, security capability centralized audit means that through the security sharing service, standardized audit log records are made for the calls and accesses of all API interfaces that apply to use Python script mapping, ensuring that each call is detailedly recorded in the call log for subsequent security audit and compliance inspection.

[0127] In the embodiments of the present application, by reverse-analyzing existing security devices / systems without API interfaces and using Python scripts to simulate manual operations, the security capabilities of existing security devices / systems are encapsulated with interfaces to form converted unified security capability API interfaces; through the management, authorized access, and sharing of the converted unified security capability APIs, the exposure surface of security systems and security capabilities is reduced, and security is enhanced; through the recording of call logs of the converted unified security capability API interfaces, centralized audit of all security capabilities is achieved.

[0128] This embodiment also provides a network security service sharing system based on heterogeneous security capability fusion, including:

[0129] A simulation module, which is used to simulate manual operations by using Python scripts based on the reverse analysis of a security system without an API interface;

[0130] A security capability encapsulation module, which is used to encapsulate the security capabilities of a security system without an API interface based on the simulated manual operations to form a unified security capability API interface after conversion;

[0131] An interface standardization module, which is used to form a unified security capability API interface after encapsulation and conversion by using Python scripts based on a heterogeneous security system with an API interface;

[0132] A security capability management and sharing module, which is used to design a security capability management mechanism and a security capability authorization and sharing mechanism based on the unified security capability API interface to reduce the exposure surface of the security system;

[0133] A security capability centralized auditing module, which is used to design a security capability centralized auditing mechanism based on the security capability management mechanism and the security capability authorization and sharing mechanism to build an enterprise security defense system.

[0134] Furthermore, it further includes:

[0135] A memory, which is used to store programs;

[0136] A processor, which is used to load the program to execute the network security service sharing method based on the fusion of heterogeneous security capabilities.

[0137] This embodiment also provides a computer-readable storage medium, which stores a program, and when the program is executed by a processor, the network security service sharing method based on the fusion of heterogeneous security capabilities is implemented.

[0138] The storage medium proposed in this embodiment and the network security service sharing method based on the fusion of heterogeneous security capabilities proposed in the above embodiment belong to the same inventive concept. Technical details not described in detail in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0139] From the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software and necessary general-purpose hardware. Of course, it can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on this understanding, the technical solution of the present invention, in essence, or the part that makes contributions to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disc of a computer, etc., including several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0140] Embodiment 2

[0141] This is an embodiment of the present invention, which provides a network security service sharing method based on the fusion of heterogeneous security capabilities. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through specific implementation manners and implementation effects.

[0142] The specific embodiments are as follows:

[0143] 1) The conversion and encapsulation process of a firewall IP blacklist policy API interface

[0144] First, open the firewall URL in the browser to enter the login page. If the system login requires a verification code and the verification code cannot be automatically recognized by the system, then refresh the page multiple times to download different verification code materials for marking training to obtain a verification code recognition data set. After logging in to the system successfully by entering the username, password, and verification code in the browser debugging mode, add a blacklist policy to the firewall and record all Http requests and response results. Package all unopened Http interface requests and responses for logging in to the firewall and adding the blacklist policy through a Python script into a login atomic action (Python request function, response processing function) and an atomic action for adding a blacklist policy (Python request function, response processing function). The conversion of unopened Http interfaces and responses into atomic actions only needs to be done once, and then it can be reused.

[0145] One or more atomic actions can be encapsulated into a standard action. The standard action provides a functional unit for security capabilities, such as the standard action for the blacklist policy, which is composed of one atomic action for logging in to the firewall device and one atomic action for submitting a blacklist policy request.

[0146] 2) The security capability management process for the firewall to add an IP blacklist policy

[0147] By adding firewall information in the security service capability management, including the access URL, username, password, selecting the standard actions corresponding to configuring this type of firewall, and setting the URL, username, and password parameters, and configuring the session automatic refresh time interval, to ensure that the session connection for invoking the standard actions of the firewall IP blacklist policy remains logged in at all times.

[0148] 3) Firewall adding IP blacklist policy security capability sharing process

[0149] In the security capability service authorization sharing module, add third-party platforms that need to invoke the firewall to add the IP blacklist policy and configure the authorization information, including the source IP address, authorization validity period, username and password information for obtaining the Token, etc.; select the already configured third-party platform, authorize the configured API interface (standard action) that can be invoked to add the IP blacklist policy, and generate the API interface (standard action) call document; when the third-party platform invokes the authorized API interface to add the IP blacklist policy, the security capability service authorization sharing module will perform authorization authentication on the request (login information, source IP, access validity period), and directly invoke the API interface (standard action) request to add the IP blacklist policy of the firewall after successful authentication, to achieve adding the IP blacklist policy of the firewall; the service authorization sharing module records all configurations, authorizations, and call shared API interface logs (calling platform, source IP address, time, security capability, executed actions, execution results, etc.).

[0150] 4) Security capability centralized audit process:

[0151] In the security capability centralized audit module, all shared and authorized security capability authorization information and call shared API interface logs can be queried according to conditions; the security capability authorization logs and security capability call logs can provide HTTP-based interfaces for third-party platforms to call to achieve security capability authorization audit and security capability call audit.

[0152] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present invention, and they should all be covered within the scope of the claims of the present invention.

Claims

1. A network security service sharing method based on the integration of heterogeneous security capabilities, characterized in that, Including: Based on the reverse analysis of heterogeneous security systems without API interfaces, use Python scripts to simulate manual operations; Based on the simulated manual operations, encapsulate the security capabilities of security systems without API interfaces to form a unified security capability API interface after conversion; Based on heterogeneous security systems with API interfaces, use Python scripts to perform encapsulation and conversion to form a unified security capability API interface; Based on the unified security capability API interface, design a security capability management mechanism and a security capability authorization and sharing mechanism to reduce the exposure surface of the security system; Based on the security capability management mechanism and the security capability authorization and sharing mechanism, design a security capability centralized audit mechanism to build an enterprise security defense system.

2. The network security service sharing method based on heterogeneous security capability integration according to claim 1, characterized in that: The encapsulation of the security capabilities of the existing security system includes the following steps: Use Python scripts to encapsulate the minimum actions of security capabilities into atomic actions; Combine multiple atomic actions into standard actions with a single security capability as the unit; Based on the standard actions, complete the API interface call.

3. The method for sharing network security services based on heterogeneous security capability fusion according to claim 1 or 2, characterized in that: The use of Python scripts to encapsulate the minimum actions of security capabilities into atomic actions includes the following steps: Perform an HTTP login on the security system without API interface calls and determine whether there is a verification code; If there is a verification code during login, obtain the image verification code through multiple refreshes and perform verification code training to generate a verification code dataset; If there is no verification code during login, the login is directly successful; Generate a Python atomic action script for HTTP request login through reverse analysis of the HTTP login request; At the same time, generate a Python atomic action script for HTTP request security capability operation through reverse analysis of the HTTP security capability operation request; For heterogeneous security systems with API interface calls, encapsulate the API interface through Python scripts to generate a Python atomic action script for HTTP request security capability operation.

4. The method for sharing network security services based on heterogeneous security capability integration according to claim 3, characterized in that: The combination of multiple atomic actions into standard actions with a single security capability as the unit includes the following steps: If an atomic action script is generated, analyze the security business actions of the security system, combine the security capability atomic actions, and generate a standard action for automatic verification code recognition login and a standard action for security capabilities; The completion of the API interface call includes that if a login standard action and a security capability standard action are generated, then encapsulate the standard actions as an API interface and call the API interface.

5. The method for sharing network security services based on heterogeneous security capability integration according to claim 4, wherein: The security capability management mechanism includes standard action configuration parameter information and security capability standard action calls; The manual configuration of standard action parameter information includes configuring the security system login address, configuring the login account information, and configuring the session automatic refresh time; The security capability standard action call includes the following steps: Based on the standard action configuration parameter information, determine whether the system has reached the session timeout time; If the session timeout time is reached, automatically execute the login standard action to refresh the session and generate session authorization authentication information; If the session timeout time is not reached, wait for 5 seconds and then check again; Obtain the session authorization authentication information and perform a security capability standard action call.

6. The method for sharing network security services based on the integration of heterogeneous security capabilities according to claim 5, characterized in that: The security capability authorization and sharing mechanism includes the process of configuring the security capability sharing and the process of invoking the authorization API interface; The process of configuring the security capability sharing includes the following steps: Add a third-party platform; Configure the authentication information of the third-party platform; The third-party platform authenticates the configuration information; Authorize the standard actions of the third-party platform; Generate the standard action HTTP API interface for the third-party platform to call; Record the security audit log information; The process of invoking the authorization API interface includes the following steps: After successful login, the third-party platform obtains the authorization credential and records the security audit log; After successfully obtaining the standard action authorization credential, the third-party platform directly invokes the authorized HTTP API interface and records the security audit log; When the third-party platform invokes the API interface, it performs authentication again. After successful authentication, it accesses the standard action HTTP API interface.

7. The method for sharing network security services based on heterogeneous security capability fusion according to claim 6, characterized in that: The security capability centralized audit mechanism includes the following steps: The user selects the security capability audit retrieval conditions; Perform security capability authorization audit and security capability invocation audit within the system; After the third-party platform logs in successfully, it invokes the security capability audit interface to obtain the security capability authorization log and the security invocation audit log; Perform security capability authorization audit and security capability operation audit.

8. A system for a network security service sharing method based on heterogeneous security capability fusion according to claim 1, characterized in that: A simulation module, which is used for reverse analysis of a security system without an API interface and simulates manual operations using Python scripts; A security capability encapsulation module, which is used for encapsulating the security capabilities of a security system without an API interface based on the simulated manual operations to form a converted unified security capability API interface; An interface standardization module, which is used for forming a unified security capability API interface through encapsulation and conversion using Python scripts based on a heterogeneous security system with an API interface; A security capability management and sharing module, which is used for designing a security capability management mechanism and a security capability authorization and sharing mechanism based on the unified security capability API interface to reduce the exposure surface of the security system; A security capability centralized audit module, which is used for designing a security capability centralized audit mechanism based on the security capability management mechanism and the security capability authorization and sharing mechanism to build an enterprise security defense system.

9. A computing device, characterized in that, Including: A memory for storing programs; A processor for loading the program to execute the steps of the network security service sharing method based on heterogeneous security capability fusion according to any one of claims 1-7.

10. A computer-readable storage medium stores a program, characterized in that, When the program is executed by the processor, it implements the steps of the network security service sharing method based on heterogeneous security capability fusion according to any one of claims 1-7.

Images