Password definition security architecture and rule execution method

Abstract

The invention relates to the technical field of network information security, in particular to a password definition security architecture and a rule execution method, the architecture comprises a device plane, a security plane, a computing plane, a network plane, a data plane, a rule plane and an application plane, and each plane realizes execution of security rules in a password protocol mode. The rule execution method of the password definition security architecture comprises the following steps: after an information system is initialized, planning a routing path, authenticating password definition security equipment on the path, establishing a security access channel by adjacent equipment to ensure the routing security of data on the path, and then packaging each packet of data based on a service data identifier to obtain a password definition security architecture; according to the method, service slicing and protocol filtering based on the authorization credential are realized, and then safe forwarding is performed according to a routing path specified by the authorization credential, so that covert channels and illegal external connection are prevented, and the safety of the whole access request session depends on the safety rule of the authorization credential. According to the invention, the security and compliance of the business data in the circulation process can be ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and particularly relates to a password definition security architecture and a rule execution method. Background Art

[0002] As a mature network security architecture technology, perimeter protection is a classic paradigm of network security. Classic network security solutions first establish perimeter protection facilities centered on the perimeter, encrypt and protect network communications inside and outside the perimeter, that is, the commonly used "perimeter + VPN" method. This method cannot resist threats occurring inside the perimeter and lateral attacks after a single point of breakthrough; with the development of industrial Internet and Internet of Things, the network architecture continues to change, the perimeter becomes increasingly blurred and indefinable. At the same time, as the network scale changes, the perimeter will become thicker and more complex, which is a challenging task for the implementation of network security policies and the configuration of security strategies. It is more difficult to eliminate security management loopholes, and the management cost is getting higher and higher.

[0003] Generally, classic VPN is used to protect network communications, but its drawbacks have become more prominent with the complex evolution of the network architecture. The prominent drawbacks are manifested in the following aspects:

[0004] (1) As a security product in the perimeter protection era, VPN implicitly uses a specific assumed trust relationship, that is, the network is implicitly divided into a trust domain (intranet), a perimeter domain, a non-trust domain (operator network), and a conditional trust domain (that is, remote users obtain the same trust as the intranet after passing VPN authentication). This implicit trust relationship is the basis for using VPN, which means that once remote users pass authentication, they can freely access resources in the enterprise network, opening a gap for "lateral attacks";

[0005] (2) Implicit trust is a high-risk trust relationship. One of the typical manifestations is that the risk of "illegal cross-border access" by internal users is very high, increasing the difficulty of security management; the second typical manifestation is the risk of "illegal access" by insecure external users, which is usually a typical attack method against VPN; the third typical risk is that it is impossible to improve the granularity and accuracy of access control. The authorization of access users is either too detailed, affecting the business and reducing the user experience, or too large, resulting in security management loopholes. The third type of risk stems from the inherent risk of the perimeter mode, and VPN inherits this risk.

[0006] (3) The VPN device itself may become a security problem. Like perimeter security facilities, due to management difficulties, the perimeter domain is usually defaulted to be a trust domain, which leads to positioning VPN as a trusted device in management. However, VPN is a typical target for attackers, and the risk of being breached is very high, becoming a "trusted" management loophole;

[0007] (4) The use of passwords by VPNs is neither systematic nor standardized, and it is very difficult to achieve standardization. This is a significant gap from the requirements of cryptography theory and engineering. Therefore, the security function of passwords cannot be effectively exerted, leaving a large loophole for attackers. For VPNs, the typical attack mode of attackers is not to crack passwords. Most attacks will break through the VPN through vulnerabilities in the boundary and the VPN system.

[0008] These weaknesses of VPNs are not only problems of VPNs themselves but also problems of the existing network security architecture paradigm. After using VPNs, the existing network security architecture is a combined mode of "network security + communication security", where network security and communication security are separated. Similarly, although VPNs apply passwords to communication security, VPNs cannot concern themselves with the systematic and standardized use of passwords, and the existing security architecture mode does not exert the system security function of passwords. Summary of the Invention

[0009] In view of the current network security status and the problems existing in the existing solutions, the present invention adopts a multi-plane architecture design method to propose a password-defined security architecture and a rule execution method. It adopts a security rule-driven method and uses a password protocol to execute these rules, giving full play to the comprehensive and systematic role of passwords in network security, solving problems such as covert channels, unauthorized external connections, and lateral attacks, and ensuring the security and compliance of business data during the transfer process.

[0010] To achieve the above object, the technical solution adopted is:

[0011] A password-defined security architecture, which includes seven planes: a device plane, a security plane, a computing plane, a network plane, a data plane, a rule plane, and an application plane. Each plane realizes the execution of security rules through a password protocol, and the seven planes work together to ensure the security of the information system.

[0012] According to the password-defined security architecture of the present invention, further, the device plane constructs a platform device security protection level protocol, realizes self-protection based on passwords through a hardware password module, and provides password services upward; the defined security rules of the device plane include: the rule defines that the hardware password module has an independent random number generation function; the device plane also monitors the device security baseline and reports the results to the log and audit module of the application plane for inspection; the rule defines the software and hardware function scope of the password components detected by the device plane; the rule also defines the content, recording process, storage security, and upload security of the forensic log to ensure the security protection of the log file; the rule requires the device plane to synchronize time with the NTP server.

[0013] According to the cryptographic definition security architecture of the present invention, further, the security plane uses reconfigurable cryptographic technology to construct a CDX cryptographic security service grid and provide security services upward; the security rules defined for the security plane include: the rules define a multi-factor authentication mechanism, and different cryptographic algorithms and key sources are used for identity authentication according to the security protection level and threat level; the security rules for key negotiation include the protocol name, protocol version, algorithm suite, and protocol parameters; the security plane adopts attribute-based access control. After the access request passes, the rules plane issues authorization credentials, network routing rules, cryptographic rules, and logging rules to the access subject and security routing devices on the path.

[0014] According to the cryptographic definition security architecture of the present invention, further, the computing plane performs trust management on the behavior of the application program and constructs a CDX trusted computing system; the security rules defined for the computing plane include: the computing plane ensures that the application program cannot be dynamically written or modified during execution; the rules stipulate that the application program must verify the version and signature of the executable program before execution; the rules stipulate the minimum set of installed software; the computing plane manages the version and signature of the firmware.

[0015] According to the cryptographic definition security architecture of the present invention, further, the network plane establishes an access path and a session channel for each service session and constructs a CDX identity exchange network; the security rules defined for the network plane include: the security rules run at the link layer, network layer, and transport layer. By comparing the header information of each inbound or outbound packet, network traffic is blocked or allowed; the rules define how peer communication entities use security services for secure communication; the rules also define the process of the key exchange protocol and stipulate the life cycle management of device keys, working keys, and session keys; the security rules also define the NAT traversal protocol.

[0016] According to the cryptographic definition security architecture of the present invention, further, the security rules defined for the data plane include: the data plane identifies and tags the data; the data plane provides data access authentication services; the data plane authorizes the data transfer path according to the access control result; during the data delivery process, the data plane uses cryptographic technology to perform non-repudiation authentication on the data sender and receiver.

[0017] According to the cryptographic definition security architecture of the present invention, further, the security rules defined for the rules plane include: the rules plane decomposes the security policies input by the user into security rules executed by each plane and monitors the execution of these rules; the rules plane provides identity, identification, and policy management services; the rules plane realizes the measurable, controllable, and measurable execution of the policy. When an exception occurs in the policy execution or a sudden high-risk security threat occurs, control instructions are sent to the device plane; the rules plane receives the analysis feedback from the application plane log and audit module and adjusts and optimizes the execution of the security policy.

[0018] According to the cryptographically defined security architecture of the present invention, further, the security rules of the application plane are defined, including: the log and audit module of the application plane receives the log information reported by each plane, performs abnormal event analysis and audit, and works with the rule engine of the rule plane to automatically generate security rules to block abnormal access; the application plane provides a visualization module to display network traffic, channel status, and security policy execution results; the application plane allows users to arrange security policies according to business needs, and decompose these policies to each plane for execution; the application plane provides time synchronization services to ensure the time consistency of each plane.

[0019] Furthermore, the present invention also provides a rule execution method for a password-defined security architecture, comprising:

[0020] During the system initialization phase, the administrator registers the CDX Client Gateway, CDX Identity Router, CDX Server Gateway, CDX Security Controller, CDX Client, and CDX Server to obtain identity credentials and initial security rules; the Identity, Identification, and Policy Management module of the rule plane collects attribute information of security devices and user assets for the rule engine to match rules;

[0021] The administrator logs in to the security management system of the rule plane and configures the business security rules for CDX clients to access the CDX server;

[0022] CDX client gateway and CDX server gateway mutually authenticate with CDX security controller based on initial security rules and establish CDX security channel; CDX client gateway and CDX server gateway mutually authenticate and establish CDX security channel; CDX client and CDX client gateway, CDX server and CDX server gateway respectively authenticate and establish CDX security channel;

[0023] The user requests to access server resources through the client. The CDX security controller of the rule plane makes access control decisions based on the data identifier of the user's access resource and the attributes of the access request. After authorization, it issues authorization credentials to the client and the server.

[0024] The client uses the authorization credential to encapsulate the access request data and sends it to the server through the gateway and router; after the server verifies the request, it securely encapsulates the resource and returns it to the client along the path specified by the authorization credential.

[0025] The beneficial effects achieved by adopting the above technical solution are:

[0026] 1. Comprehensive coverage of security requirements for business scenarios

[0027] Business activities involve the interactions among multiple entities within a business scenario. The present invention defines business security rules through multi-dimensional attributes (such as user activities, network environment, time, physical location, data flow characteristics, etc.), covering the endogenous security requirements of the business scenario to the greatest extent and ensuring the security of business activities.

[0028] 2. Systematic and standardized use of cryptographic technologies

[0029] By adopting cryptographic identifiers for business data, business behaviors are transformed into cryptographic behaviors, and business security is described based on the standardization of cryptography, realizing the deterministic, controllable, measurable, and observable secure transfer of business data among business entities, and giving full play to the system security role of cryptographic technologies.

[0030] 3. Deep defense with a multi-plane architecture

[0031] A multi-plane approach is adopted to define a cryptographic definition security architecture, comprehensively solving a series of attack problems faced by systems stacked with multiple protocol stacks. For security problems at each level, flexible and targeted deep defense is achieved.

[0032] 4. Controllability, measurability, and observability of business flow

[0033] Through the cryptographic definition security architecture, the business flow topology is determined, realizing the controllability, measurability, and observability of the business, and ensuring the security and compliance of business data during the transfer process.

[0034] 5. Close integration of security and business

[0035] The present invention realizes the integration of security and business, solves the problem of the separation of security and business in traditional security architectures, ensures that security policies can flexibly adapt to business requirements, and improves the overall security of the system.

[0036] 6. Prevention of unauthorized external connection and lateral attacks

[0037] Through business slicing and protocol filtering based on authorization credentials, and then secure forwarding according to the routing path of authorization credentials, unauthorized external connection and lateral attacks are prevented, ensuring that the security of access request sessions depends on the security rules of authorization credentials. After the expiration of authorization credentials, new authentication and authorization will be carried out. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings of the embodiments of the present invention will be briefly introduced below. Among them, the drawings are only used to show some embodiments of the present invention, rather than limiting all embodiments of the present invention thereto.

[0039] Figure 1 It is a framework diagram of the cryptographic definition security architecture of Embodiment 1 of the present invention;

[0040] Figure 2 is a flowchart of the rule execution method of the password definition security architecture according to the first embodiment of the present invention;

[0041] Figure 3 is an example diagram of device registration according to the second embodiment of the present invention;

[0042] Figure 4 is an example diagram of generating a contact list according to the second embodiment of the present invention;

[0043] Figure 5 is an example diagram of a logical connection topology according to the second embodiment of the present invention;

[0044] Figure 6 is an example diagram of user login according to the second embodiment of the present invention;

[0045] Figure 7 is an example diagram of email sending according to the second embodiment of the present invention; Detailed implementation manners

[0046] In the following, the exemplary solutions of the embodiments of the present invention will be clearly and completely described in conjunction with the drawings of the specific embodiments of the present invention. Unless otherwise defined, the technical terms or scientific terms used in the present invention should have the ordinary meaning understood by those of ordinary skill in the art.

[0047] Embodiment 1

[0048] This embodiment discloses a password definition security architecture, which adopts a multi-plane architecture design and includes seven planes: a device plane, a security plane, a computing plane, a network plane, a data plane, a rule plane, and an application plane, as Figure 1 shown, and defines the security rules for each plane. The seven planes work together to implement the execution of security rules in the form of a password protocol, giving full play to the advantages of password technology and ensuring the security of the information system.

[0049] (1) The device plane specifies the construction method of the underlying devices of the password definition security architecture. First, a platform device security protection level protocol (SLA) is constructed. For different security environment requirements, with a hardware password module as the core, self-protection based on passwords is realized, and password services are provided upward.

[0050] (2) The security plane uses reconfigurable password technology to construct a CDX password security service grid and provides security services such as authentication, access control, availability, confidentiality, integrity, non-repudiation, and availability upward. CDX (Cryptography Defined X), where X represents computing, network, data, device; the Chinese meaning of CDX is: cryptography-defined computing, cryptography-defined network, cryptography-defined data, cryptography-defined device, which constitutes the complete concept and implementation method of cryptography-defined security.

[0051] (3) The computing plane performs trust management on the application behavior, constructs a CDX trust computing system, and ensures the security of data throughout the computing process.

[0052] (4) The network plane establishes an access path and a session channel for each business session, maintains the visibility of the session process, protects the compliance security of the session process, constructs a CDX identity exchange network, and for each independent business session traffic, orchestrates and executes network functions according to the access control policy.

[0053] (5) The data plane performs security services such as identifying data, providing data access authentication services, routing control services, and non-repudiation of data delivery.

[0054] (6) The rule plane decomposes the security policies input by users into security rules executed by each plane, monitors the execution of the rules, and at the same time provides services such as identity, identification and access management, policy management, and log and evidence management for entities (including devices, people, resources), access requests, etc.

[0055] (7) The application plane is user-oriented, allowing users to orchestrate rules and policies according to their own needs and business situations, perform log auditing, and visual management, etc.

[0056] The following focuses on describing the security rules of the seven planes of the password-defined security architecture. These security rules are edited and input by the application plane, decomposed by the rule plane into each plane, and monitored for execution, and jointly act to support the password-defined security architecture.

[0057] (1) Security rules of the device plane

[0058] In the device plane, the security rules define the measures to ensure device security. The administrator sets the cycle and frequency of vulnerability scanning, anti-virus scanning, and software patch updates for security devices, and reports the scanning results to the security policy module of the application plane for device security level assessment. Monitor the device security baseline for security devices, including weak password checks for device logins, unauthorized device login access, and the usage of resources such as CPU, memory, non-volatile storage media, and network bandwidth, and report them to the log and audit module of the application plane for inspection, which is also used as the basis for device security level assessment.

[0059] The security rules of the device plane define that the hardware password module has an independent random number generation function to meet the security requirements of password operations. The security rules define the storage security of password algorithms, keys, and critical data; define the physical security of the hardware module.

[0060] The security rules of the device plane define the scope of software and hardware functions for detecting password components in the device plane to ensure the normal operation of the components.

[0061] The security rules for the device plane define the content of the forensic log, the recording process, storage security, and upload security. The content of the forensic log includes the identification of three types of user identities, date and time, sensitive operation information of the three types of users, certificate information, data identifiers, executed policy identifiers, abnormal event dictionaries, etc. The rules define the triggering timing, recording frequency, whether to upload in real time, upload compression, authentication and encryption conditions, etc. of the recording process. The rules define the security protection of the log file. According to different security levels of the log file, corresponding cryptographic requirements such as confidentiality, integrity, authentication, verifiability, and non-repudiation are met to achieve goals such as resisting malicious changes, illegal access, and network forensics. The rules require the device plane to synchronize time with the NTP server to ensure accurate dates and events.

[0062] (2) Security rules for the security plane

[0063] The cryptographic services provided by the security plane include authentication, key negotiation, access control, confidentiality, integrity, non-repudiation, and availability. Key management services are provided and finally implemented in the form of cryptographic protocols. Next, the security rules are described from several aspects such as authentication, key negotiation, access control, confidentiality, integrity, and non-repudiation.

[0064] ① Authentication

[0065] In the security architecture defined by the cipher, during logical connection, for entities using the same protocol, identity credibility is provided. Here, the entities generally refer to people (PE) or devices (non-people, NPE). The authentication rules are described as follows:

[0066] Authenticated entities: A, B.

[0067] Authentication goal: Does A authenticate whether B is the claimed entity? Yes / No.

[0068] Security protection level: Security_level

[0069] 1: Use single-factor authentication, and password mechanisms may not be used;

[0070] 2: At least two-factor authentication, and symmetric password mechanisms need to be used;

[0071] 3: At least two-factor authentication, and asymmetric password mechanisms need to be used;

[0072] 4: At least two-factor authentication, and asymmetric password mechanisms need to be used, and hardware password modules such as smart password keys need to be used.

[0073] Threat level: Threat_level

[0074] 1: Entity B is normal and has no bad records;

[0075] 2: When the cumulative number of entity B authentication failure records reaches 3 or more, it returns to normal;

[0076] 3: When the cumulative number of entity B authentication failure records reaches 3 or more, and there are warning records of being attacked.

[0077] Cipher algorithm suites: Alg: 01: Symmetric algorithm + HASH, 02: Asymmetric algorithm + HASH.

[0078] Key source: Key: 01: Identity credential of B; 02: Symmetric key bound to the identity of B.

[0079] ② Rule constraints

[0080] Table 1 Cipher mechanism encoding

[0081] Index Cryptographic algorithm Key source Crypto_0102 01 02 Crypto_0201 02 01 Crypto_0000 "” 0

[0082] Table 2 Authentication rule constraints

[0083]

[0084]

[0085] ③ Key negotiation

[0086] The purpose of key negotiation is for both communication parties to negotiate a session key. In a secure key negotiation, both negotiators already know each other, that is, they are authenticated. In the case of using an asymmetric cryptosystem, both parties know the public key of the other party; in the case of using a symmetric cipher mechanism, both parties share a symmetric key and the same MAC function.

[0087] The following security rules need to be specified during the key negotiation process:

[0088] {

[0089] Protocol name: DH, ECDH, ECDHE, etc.

[0090] Protocol version: V.x

[0091] Algorithm suite:

[0092] Protocol parameters: Key length, the minimum acceptable parameter set, such as (p, q, g) in DH, etc.

[0093] }

[0094] ④ Access control and authorization

[0095] The security plane adopts attribute-based access control (ABAC). Here, not too much description is made on the access control rules themselves. The focus is on the obligations (Obligations) and operations to be executed after an access request passes in the information system.

[0096] After the access request passes, the rules plane issues authorization credentials, network routing rules, password rules, and logging rules to the access subject and the security routing devices on the path, supporting data security, computing security, and network security during the access process.

[0097] (i) Authorization credential network function: Secure routing path.

[0098] Password policy: Peer-to-peer connection; between adjacent routing devices; data security; device itself is trustworthy. Logging policy: Log classification, format, reporting period, etc.

[0099] Credential signature: The signature of the authorization credential by the authorization credential issuing authority.

[0100] Table 3 Description of authorization credential content

[0101] Serial number Voucher content Description 1 Voucher unique identifier Identifying authorization voucher 2 Subject unique identifier Access subject unique identifier 3 Object unique identifier Access object unique identifier 4 Object attribute Accessible object attribute information 5 Operation Action of authorized operation 6 Edge exchange routing device information (TSR1) Close to the subject 7 Edge exchange routing device information (TSR2) Close to the object 8 Authorized voucher public key information Authorized voucher public key information 9 Authorized voucher private key ciphertext information Authorized voucher private key ciphertext 10 Pre-shared key encryption key ciphertext For encapsulating data (unidirectional) 11 Pre-shared key decryption key ciphertext For encapsulating data (unidirectional) 12 Pre-shared key MAC1 key ciphertext For encapsulating data (unidirectional) 13 Pre-shared key MAC2 key ciphertext For encapsulating data (unidirectional) 14 Initial vector IV1 For encapsulating data (unidirectional) 15 Initial vector IV2 For encapsulating data (unidirectional) 16 Authorized voucher validity period The validity period ends and this authorization ends 17 Cryptographic algorithm suite Such as: SM2_SM3_SM4 18 Signature value Rule system signature value

[0102] (ii) Network rules

[0103] The network rules for a single security routing device are shown in Table 4.

[0104] Table 4 Network rules for a single security routing device

[0105]

[0106]

[0107] (3) Security rules for the computing plane

[0108] In the computing plane, during the execution of the application, it cannot be dynamically written or modified. The application verifies the version and signature of the executable program. Only when the verification is correct can the original program be replaced and executed. When the verification fails, an event log for program upgrade exception is generated and reported to the logging and auditing module in the application plane, and the execution of non-upgrade operations of the application is stopped.

[0109] In the computing plane, the security rules specify the minimum set of installed software, and these software need to be registered and filed in the identification and policy management module in the rules plane to reduce potential security risks. The computing plane manages the version and signature of the firmware to ensure the security and reliability of the firmware and prevent unauthorized firmware upgrades.

[0110] (4) Security rules for the network plane

[0111] The security design principle of the network plane adopts a structured design method, based on the design principle of the network 7-layer model and the security rules set by Internet protocols.

[0112] The packet filtering security rules run at the link layer, network layer, and transport layer. By comparing the header information of each inbound or outbound packet, which includes the source MAC address and destination MAC address, source and destination IP addresses, ports, protocol numbers (such as TCP, UDP, ICMP), communication direction (inbound, outbound), and the interface of the security device where the packet is received and sent, it determines whether to block or allow network traffic, achieving the ability to prevent denial-of-service attacks, ACL control, and related attacks.

[0113] The security rules of the network plane define how peer communication entities use security services for secure communication. It defines all the information required by network security services, such as the security services at the 3rd layer, i.e., the IP layer, such as the authentication header authentication. The authentication header defines the data integrity, data source authentication, and anti-replay attack of the data packet; the 4th layer transport layer provides encapsulating security payloads, providing functions such as data confidentiality and data integrity. The security rules define the process of the key exchange protocol, which can be based on IPSec, SSL, or a custom security protocol. The security rules define the data padding rules, such as the padding alignment and confusion of authentication data. The security rules also define the security requirements for each stage of the life cycle of device keys, working keys, and session keys, such as defining key updates, and updating working keys and session keys according to two conditions: time period and message traffic.

[0114] The security rules of the network plane also define the NAT traversal protocol to ensure network availability.

[0115] (5) Security rules of the data plane

[0116] In the data plane, rules for defining data identifiers are defined to tag the data. According to the data identifiers, rules for data access authentication and access control are specified. Based on the access control results, the data transfer path is authorized. During the data delivery process, cryptographic techniques are used to perform non-repudiation authentication on the data sender (original) and data receiver (destination), ensuring the trusted delivery of the data.

[0117] The data plane provides data identification services, data access services, routing control services, and data delivery services to ensure the security of data throughout its life cycle.

[0118] (6) Security rules of the rules plane

[0119] The identity, identification and policy management module of the rule plane stores the port and service list, vulnerability library scan version and scan time, virus library scan version and scan time, and software patch version submitted by the device plane as the basis for security level judgment. The reasonable value range of resources such as CPU, memory, hard disk, network bandwidth, etc. of the storage device plane is used as the basis for security level judgment. The version and signature of the firmware submitted by the computing plane are stored as part of the security rules.

[0120] The identity, identification and policy management module of the rule plane provides registration services for various plane attributes.

[0121] The policy execution and management module of the rule plane makes policy execution measurable, controllable and measurable. When policy execution is abnormal or a high-risk security threat occurs suddenly, it sends shutdown, restart, fault diagnosis and control instructions to the device plane; checks the security policies being executed by each plane; receives policy execution feedback from the analysis of application plane logs and audit modules to achieve closed-loop control of policy execution.

[0122] (7) Safety rules for application planes

[0123] On the application plane, the log and audit module receives weak password checks and unauthorized device login access exception event logs reported by the device plane, analyzes the exception events, and works with the rule engine of the rule plane to automatically generate security rules that block access as a security action. The log and audit module receives firmware upgrade exception event logs reported by the computing plane, analyzes the logs, locates the firmware upgrade device identification, firmware version, and upgrade failure reasons, and alerts the administrator through the visualization module of the application plane. The visualization module provides a version rollback option for restoring the use of a firmware version on the computing plane.

[0124] The log and audit module receives the network traffic and channel status (establishment time, encrypted traffic, validity period) reported periodically by the network plane, and displays them through the visualization module. According to the device status abnormality rules set by the rule plane, when the log analysis finds an abnormality, the visualization module alerts the administrator and notifies the policy execution and management module of the rule plane of the rule execution abnormality. The log and audit module receives the security policy execution result information reported by the network plane, and reports the security policy execution measurement results to the policy execution and management module of the rule plane, including the policy identification, execution results, and the periodically reported channel status.

[0125] The time synchronization module of the application plane provides time synchronization services to the device plane to meet the time requirements in the security rules.

[0126] This embodiment also discloses a rule execution method for a password-defined security architecture, such as Figure 2As shown below, taking the example of a user logging in to a client program and securely accessing server data, this describes the method of rule execution under the password-defined security architecture. The entities involved are users, administrators, CDX clients, client applications, CDX client gateways, CDX identity routers, CDX servers, CDX server applications, security management systems, identity, identification, and policy management modules, and CDX security controllers. The entity descriptions are as follows:

[0127] User: A user of the CDX information system, responsible for business access and processing;

[0128] Administrator: An administrator of the CDX information system, responsible for the orchestration and distribution of security policies;

[0129] CDX Client: A client device based on the password-defined security architecture, containing functional components of the password-defined security device plane, security plane, computing plane, network plane, and data plane, responsible for the execution of security rules;

[0130] CDX Client Application: A program running on the CDX client;

[0131] CDX Client Gateway: A gateway close to the CDX client, executing security rules for the security device plane, security plane, computing plane, network plane, and data plane to ensure the secure flow of data;

[0132] CDX Identity Router: A security routing device on the data flow path, with a function similar to that of the CDX client gateway;

[0133] CDX Server: A server based on the password-defined security architecture, containing functional components of the password-defined security device plane, security plane, computing plane, network plane, and data plane, storing resources to be accessed, and responsible for the execution of security rules;

[0134] CDX Server Program: A program running on the CDX server;

[0135] Security Management System: On the rule plane, responsible for the registration, information management, and policy execution monitoring functions of CDX security devices;

[0136] Identity, Identification, and Policy Management Module: Identity management, credential management, and access control management;

[0137] CDX Security Controller: Policy decision-making.

[0138] Specifically, it includes the following steps:

[0139] Step S101. In the system initialization phase, the administrator registers the CDX client gateway, CDX identity router, CDX server gateway, and CDX security controller with the identity, identification, and policy management module. These password-defined security devices obtain identity credentials and initial security rules for device power-on. The administrator registers user assets, such as CDX clients and CDX servers, with the identity, identification, and policy management module to obtain identity credentials and local authentication security rules. The identity, identification, and policy management module obtains the attribute information of security devices and user assets for rule matching by the rule engine.

[0140] Step S102. The administrator logs in to the security management system and configures the business security rules for the CDX client to access the CDX server. These security rules are related to specific services and include, but are not limited to, service access time limits, service operation limits, service security levels, and security rules for each plane of the service session-associated devices.

[0141] Step S103. The CDX client gateway and CDX server gateway mutually authenticate with the CDX security controller based on the initial security rules for device power-on, and negotiate to establish a CDX secure channel using the identity credentials obtained through registration. The CDX client gateway and CDX server gateway mutually authenticate with each other based on the initial security rules for device power-on, and negotiate to establish a CDX secure channel using the identity credentials obtained through registration.

[0142] Step S104. The user logs in to the CDX client application. The CDX client application authenticates the user according to the local authentication security rules. After passing the authentication, the user is allowed to access the services of the CDX server through the CDX client. Mutual authentication is performed between the CDX client and the CDX client gateway based on the identity credentials obtained through registration, and a CDX secure channel is negotiated and established.

[0143] Step S105. When the CDX server is powered on, it mutually authenticates with the CDX server gateway based on the identity credentials obtained through registration, and negotiates to establish a CDX secure channel.

[0144] Step S106. The user requests to access server resources through the client. The CDX security controller makes an access control decision based on the data identifier of the user's accessed resources and the attributes of the access request, and issues an authorization credential to the user's access request through the identity, identification, and policy management module. At the same time, the CDX security controller issues the access credential for this access to the server for verification.

[0145] Step S107. The client encapsulates the access request data packet with the authorization credential. The access request sends the access request encapsulated data to the server via the client gateway, CDX identity router, and server gateway according to the routing path specified by the authorization credential.

[0146] Step S108: The server verifies the source and authenticity of the access request, securely encapsulates the resource to be accessed, and sends it to the client according to the path and security method specified in the authorization credential.

[0147] Embodiment 2

[0148] Taking a secure email system as an example, the entities involved are email client devices, email server devices, client email gateway devices, server email gateway devices, secure email management systems, email client programs, and email server programs. The key business processes involved are system initialization, user login, sending emails, and receiving emails.

[0149] (1) System initialization

[0150] The administrator starts and logs in to the email management system

[0151] ① As Figure 3 shown, device registration. The administrator registers devices such as email servers, email clients, client gateways, server gateways, and management gateways through the secure email management system, generates a unique identifier for the registered devices, issues identity credentials, adjacent gateway or device information, and issues identity credentials to the email client application and the email server.

[0152] ② Allocate personal accounts, allocate read and write authorizations, allocate the email clients to be used, and generate a recipient list, as Figure 4 shown.

[0153] ③ Generate the logical connection topology of the devices.

[0154] After the device registration is completed and the device goes online, the client gateway establishes CDX secure channels with the management gateway, the client gateway with the server gateway, the server gateway with the management gateway, and the server gateway with the email server, generates a logical secure connection topology (as Figure 5 shown), and constructs an Overlay secure network for email services.

[0155] (2) User login

[0156] The user starts the email client application, enters the username and password according to the prompt, and enters the email operation interface. The user login process is as Figure 6 shown.

[0157] ① The user starts the email client application and enters the authentication information (username / password, smart password key + password) according to the authentication rules;

[0158] ② The email client establishes a CDX secure channel with the client gateway;

[0159] ③The mail client application establishes a secure connection with the secure mail management system;

[0160] ④The mail client application transmits the user authentication information and the mail client information to the secure mail management system through the secure connection;

[0161] ⑤The secure mail management system authenticates the mailbox account, conducts access control authentication, and issues a CDX authorization credential after passing the authentication;

[0162] ⑥The secure mail management system issues security rules to the relevant security gateways;

[0163] ⑦The mail client application establishes a secure mail sending and receiving path (CDX-Path) between the mail client application and the mail server to prepare for the secure forwarding of mails.

[0164] (3) Sending a mail

[0165] When the user clicks to trigger the mail sending command, the client application sends the mail content to the server. The mail sending process is as Figure 7 shown.

[0166] Business rule - Prerequisite: The user logs in and a CDX-Path secure path is established.

[0167] ①The client application encapsulates the mail sending content into the CDX mail encapsulation format using the CDX authorization credential;

[0168] ②The client application sends the mail to the server application through the CDX-Path;

[0169] ③The server application verifies whether the client has write permission using the CDX authorization credential, and verifies and receives the mail.

[0170] (4) Receiving a mail

[0171] When the user clicks to trigger the mail receiving command, the client application sends a read request form to the mail server, and the mail server sends the mail to the client application.

[0172] Business rule - Prerequisite: The user's CDX authorization credential includes the "read" authorization.

[0173] ①The client application encapsulates the read mail request form into the CDX mail encapsulation format using the CDX authorization credential;

[0174] ②The client application sends the encapsulated request form to the server application through the CDX-Path;

[0175] ③ The server application program verifies whether there is a "read" permission. After passing the verification, it encapsulates the email with the CDX authorization credential and sends it back to the client application program.

[0176] Finally, it should be noted that the above-described embodiments are only specific implementation manners of the present invention, used to illustrate the technical solutions of the present invention, rather than limiting it. The protection scope of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that any person skilled in the art within the technical scope disclosed by the present invention can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A cryptographic definition security architecture, characterized in that, The architecture includes seven planes: the device plane, the security plane, the computing plane, the network plane, the data plane, the rules plane, and the application plane. Each plane implements the execution of security rules through cryptographic protocols, and the seven planes work together to ensure the security of the information system.

2. The password definition security architecture according to claim 1, wherein The device plane constructs a platform device security protection level protocol, realizes self-protection based on cryptography through a hardware cryptographic module, and provides cryptographic services upward. The security rules defined for the device plane include: the rule defines that the hardware cryptographic module has an independent random number generation function. The device plane also monitors the device security baseline and reports the results to the log and audit module of the application plane for inspection. The rule defines the software and hardware function scope of the cryptographic components detected by the device plane. The rule also defines the content, recording process, storage security, and upload security of the forensic log to ensure the security protection of the log file. The rule requires the device plane to synchronize time with the NTP server.

3. The password definition security architecture according to claim 1, characterized in that The security plane uses reconfigurable cryptography technology to construct a CDX cryptographic security service grid and provides security services upward. The security rules defined for the security plane include: the rule defines a multi-factor authentication mechanism, and different cryptographic algorithms and key sources are used for identity authentication according to the security protection level and threat level. The security rules for key negotiation include the protocol name, protocol version, algorithm suite, and protocol parameters. The security plane adopts attribute-based access control. After the access request passes, the rules plane issues authorization credentials, network routing rules, cryptographic rules, and log rules to the access subject and the security routing devices on the path.

4. The password definition security architecture according to claim 1, wherein The computing plane conducts trust management on the behavior of application programs and constructs a CDX trusted computing system. The security rules defined for the computing plane include: the computing plane ensures that the application program cannot be dynamically written or modified during execution. The rule stipulates that the application program must verify the version and signature of the executable program before execution. The rule stipulates the minimum set of installed software. The computing plane manages the version and signature of the firmware.

5. The password definition security architecture according to claim 1, characterized in that, The network plane establishes an access path and a session channel for each business session and constructs a CDX identity exchange network. The security rules defined for the network plane include: the security rules run at the link layer, network layer, and transport layer. By comparing the header information of each inbound or outbound packet, the network communication flow is blocked or allowed to pass. The rule defines how peer communication entities use security services for secure communication. The rule also defines the process of the key exchange protocol and stipulates the life cycle management of device keys, working keys, and session keys. The security rule also defines the NAT traversal protocol.

6. The password definition security architecture according to claim 1, characterized in that, The security rules defined for the data plane include: the data plane identifies and tags data; the data plane provides data access authentication services; the data plane authorizes the data transfer path according to the access control result; during the data delivery process, the data plane uses cryptographic technology to conduct non-repudiation authentication on the data sender and receiver.

7. The cryptographic definition security architecture according to claim 1, characterized in that The security rules that define the rule plane include: the rule plane decomposes the security policy input by the user into security rules executed by each plane, and monitors the execution of these rules; the rule plane provides identity, identification and policy management services; the rule plane realizes the measurability, controllability and measurability of policy execution, and sends control instructions to the device plane when the policy execution is abnormal or a high-risk security threat occurs suddenly; the rule plane receives analysis feedback from the application plane log and audit module to adjust and optimize the execution of security policies.

8. The password definition security architecture according to claim 1, wherein The security rules for defining the application plane include: the log and audit module of the application plane receives the log information reported by each plane, performs abnormal event analysis and audit, and works with the rule engine of the rule plane to automatically generate security rules to block abnormal access; the application plane provides a visualization module to display network traffic, channel status, and security policy execution results; the application plane allows users to orchestrate security policies according to business needs and decompose these policies into various planes for execution; the application plane provides time synchronization services to ensure time consistency among various planes.

9. A method for rule execution of a password definition security architecture according to any one of claims 1-8, characterized in that, Include: During the system initialization phase, the administrator registers the CDX Client Gateway, CDX Identity Router, CDX Server Gateway, CDX Security Controller, CDX Client, and CDX Server to obtain identity credentials and initial security rules; the Identity, Identification, and Policy Management module of the rule plane collects attribute information of security devices and user assets for the rule engine to match rules; The administrator logs in to the security management system of the rule plane and configures the business security rules for CDX clients to access the CDX server; CDX client gateway and CDX server gateway mutually authenticate with CDX security controller based on initial security rules and establish CDX security channel; CDX client gateway and CDX server gateway mutually authenticate and establish CDX security channel; CDX client and CDX client gateway, CDX server and CDX server gateway respectively authenticate and establish CDX security channel; The user requests to access server resources through the client. The CDX security controller of the rule plane makes access control decisions based on the data identifier of the user's access resource and the attributes of the access request. After authorization, it issues authorization credentials to the client and the server. The client uses the authorization credential to encapsulate the access request data and sends it to the server through the gateway and router; after the server verifies the request, it securely encapsulates the resource and returns it to the client along the path specified by the authorization credential.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, the steps of the method according to claim 9 are implemented.

Images