A smart terminal vulnerability repair mechanism and method in a smart home network environment

Abstract

The present invention proposes a smart terminal vulnerability repair mechanism and method in a smart home network environment. The present invention maintains the vulnerability information of the entire network of home devices, terminal model information and other information in the cloud, determines the vulnerability repair status and business load status in each home network through the home gateway, and dynamically calculates the best time to repair the vulnerability, so as to perform intelligent repair of smart terminal device vulnerabilities by actively pushing in the cloud, uniformly storing on the gateway side, and sending down at the appropriate time by the gateway.

Description

Technical Field

[0001] The present invention relates to the field of information security, and mainly to a smart terminal vulnerability repair mechanism and method in a home network environment. Background Art

[0002] Smart home services mainly involve three aspects: terminals, connections, and platforms. With the rise of IoT technology and smart home services, smart home application scenarios are becoming increasingly abundant, and their application methods are becoming more intelligent and complex, which has led to the gradual diversification of network access methods, diversification of device types, intelligence of terminal devices, and complexity of device configuration on the terminal side. However, the reality is that terminal device manufacturers are uneven. Due to limited terminal manufacturing investment costs or technical means, many terminal devices often have different levels of security issues, especially security vulnerabilities. The security defense capabilities of the terminal side are still relatively weak, which makes smart terminal devices easy to be illegally controlled, bringing many security risks to users' personal property, personal information, and privacy. Timely detection and discovery of these smart terminal device vulnerabilities and convenient and quick repairs have become issues to be solved in the scale development of smart home services.

[0003] The existing common methods for repairing terminal device vulnerabilities are mainly to install security protection software on the terminal, perform vulnerability scanning on the client, and actively report the scanning results to the remote server. The server establishes and maintains vulnerability repair libraries, user information libraries, vulnerability information libraries and other related information. After receiving the client's report information, it determines the vulnerabilities to be repaired through query and comparison, and then reminds the client to perform online upgrades.

[0004] The patent "Method and system for presenting the status of vulnerability repair in LAN terminals (CN 102769536B)" provides a method and system for presenting the status of vulnerability repair in LAN terminals. It establishes a server database, and then adds the unpatched vulnerability information reported by the client to the user information table in the server database. It determines the distribution and status of the vulnerabilities presented by the client based on the statistics of the vulnerability information, and provides the vulnerability repair information to the administrator of the LAN, who performs global monitoring and decision-making. This method can be universally applied to the vulnerability repair management of terminal devices in traditional networks, but the selection of repair timing is not intelligent, and often has a certain degree of randomness or needs to rely on the experience of the manager. However, the processing capabilities of smart terminals in the Internet of Things environment are different, and the load of devices in different business scenarios is also different. If the timing is uniformly selected for repair or the access of managers is required, it may have a certain impact on the current business, and a certain management cost needs to be invested.

[0005] The patent "A method and device for handling terminal vulnerabilities (CN 102750190 B)" proposes to periodically collect the current operating status information of the terminal. When there is a vulnerability in the terminal, it is determined whether the terminal vulnerability is currently repaired based on the current operating status information of the terminal. This method does take into account the use of resources such as the terminal CPU and memory, but there are three problems: 1) The judgment of whether the terminal is in a running state mainly depends on the identification of the process running on the terminal combined with whether the user uses keyboard input, whether the user uses mouse input and / or the identification of the process running on the terminal. However, most of the smart terminal devices in the smart home business scenarios under the current Internet of Things background do not support external input devices such as mouse and keyboard, and there are certain limitations on the use scenarios; 2) Periodic scanning and obtaining the process status of the terminal itself will also consume certain resources, reducing the efficiency of the terminal device; 3) The timing and frequency of the scanning cycle require a lot of experience to reach the optimal value.

[0006] Therefore, how to adopt a more reasonable detection frequency and data collection method to ensure effective monitoring of the security of the home network environment while reducing computing resources and storage resources as much as possible is a problem worthy of further optimization and resolution. Summary of the invention

[0007] This Summary is provided to introduce some concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

[0008] According to one embodiment of the present invention, a method for repairing vulnerabilities of smart terminal devices in a home network is disclosed, comprising: implementing configuration initialization at a home smart gateway, the configuration initialization comprising obtaining device status information and service information of each smart terminal device hanging under the home smart gateway, repairing preference settings and / or vulnerability information; the home smart gateway monitoring and collecting home network service traffic status, obtaining home network traffic and home network usage related information; the home smart gateway calculating the repair priority of each to-be-repaired smart terminal device hanging under the home smart gateway, so as to sort the repair priority of one or more vulnerabilities in each to-be-repaired smart terminal device; the home smart gateway receiving an associated vulnerability list subset; and repairing the vulnerabilities of each to-be-repaired smart terminal device hanging under the home smart gateway based on the repair time, repair priority and repair rule of each to-be-repaired smart terminal device hanging under the home smart gateway.

[0009] According to another embodiment of the present invention, a system for repairing vulnerabilities of smart terminal devices in a home network is disclosed, comprising a home smart gateway and one or more smart terminal devices. The home smart gateway is configured to: implement configuration initialization, the configuration initialization includes obtaining device status information and service information of each smart terminal device hanging under the home smart gateway, repair preference settings and / or vulnerability information; monitor and collect home network service traffic status, obtain home network traffic and home network usage related information; calculate the repair priority of each smart terminal device to be repaired hanging under the home smart gateway, so as to sort the repair priority of one or more vulnerabilities in each smart terminal device to be repaired; receive an associated vulnerability list subset; for each of the smart terminal devices to be repaired, distribute one or more vulnerability repair packages corresponding to the smart terminal device to be repaired in the vulnerability list subset to the smart terminal device to be repaired at the repair time for the smart terminal device to be repaired, and trigger the vulnerability repair of the smart terminal device. The one or more smart terminal devices are configured to: repair the vulnerability of the smart terminal device based on the one or more vulnerability repair packages corresponding to the smart terminal device, wherein the one or more vulnerability repair packages are repaired according to the repair priority of the corresponding one or more vulnerabilities.

[0010] These and other features and advantages will become apparent by reading the following detailed description and by reference to the associated drawings.It is to be understood that the foregoing general description and the following detailed description are illustrative only and are not restrictive of the aspects of what is claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to understand the manner in which the above features of the present invention are used in detail, the above briefly summarized contents can be described in more detail with reference to various embodiments, some of which are shown in the accompanying drawings. However, it should be noted that the accompanying drawings only show some typical aspects of the present invention and should not be considered to limit its scope, because the description may allow for other equally effective aspects.

[0012] Figure 1 A block diagram of a system 100 for repairing vulnerabilities of smart terminals in a home network environment according to an embodiment of the present invention is shown;

[0013] Figure 2 A schematic diagram 200 of a home smart gateway 103 according to an embodiment of the present invention is shown;

[0014] Figure 3 A flow chart of a method 300 for repairing vulnerabilities of smart terminals in a home network environment according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0015] The present invention will be described in detail below in conjunction with the accompanying drawings, and the features of the present invention will be further revealed in the following specific description.

[0016] In the smart home business scenario, each home network is a small local area network. In the normal mode, all smart terminal devices need to be connected to the broadband network and exchange data and carry services through the gateway. The home gateway has become the most important control center for smart home services, and plays the role of a hub connecting the inside and outside of the home network. However, each family's business scenario, smart terminal device brand, model, processing power, and the frequency, duration, load peak and trough values ​​of each business function are different. Therefore, the vulnerability repair of smart terminal devices in the home scenario can be considered in combination with business models, device characteristics, resource usage, etc. Comprehensive weighing, make full use of the control capabilities of the home gateway for unified scheduling and processing, so as to smoothly carry out vulnerability repairs and upgrades without affecting the convenience and stability of daily home services.

[0017] The present invention proposes a smart terminal vulnerability repair mechanism and method in a home network environment. The present invention maintains the vulnerability information of the entire network of home devices, terminal model information and other information in the cloud, determines the vulnerability repair status and business load status in each home network through the home gateway, and dynamically calculates the best time for vulnerability repair, thereby performing intelligent repair of smart terminal device vulnerabilities by actively pushing in the cloud, uniformly storing on the gateway side, and sending down at the appropriate time by the gateway.

[0018] Figure 1 A block diagram of a system 100 for repairing smart terminal vulnerabilities in a home network environment according to an embodiment of the present invention is shown. The system 100 mainly includes a cloud vulnerability repair management system 101, a home network connection management platform 102, a home smart gateway 103 and a smart terminal device 104.

[0019] It can be understood by those skilled in the art that the "whole network" in the present invention refers to the network of the operator (for example, China Telecom, China Mobile, etc.), and the "whole network home network" refers to all home networks within the operator network. Generally speaking, there are multiple home networks within the whole network. The home network is mainly composed of two parts: the home smart gateway and the smart terminal devices under the home smart gateway. For the purpose of simplicity, other components that constitute the home network are not described here. The home smart gateway is a bridge for the entire home network to connect with the external network. It can receive signals from the external network and transmit the signals to a certain smart terminal device through the home network. In other words, the home smart gateway is the central device of home intelligence, through which the system information collection, information input, information output, and centralized control, remote control, linkage control and other functions of various types of smart terminal devices are realized. The connection method between the home smart gateway and the smart terminal device can be diverse, such as Ethernet, WIFI, Zigbee, etc., and its connection method is not within the scope of discussion of the present invention.

[0020] refer to Figure 1 According to one embodiment of the present invention, the cloud vulnerability repair management system 101 can be regarded as a service management system deployed on a cloud server, which can support service requests and centralized data storage of the home network connection management platform 102 and the home smart gateway 103. Those skilled in the art can understand that in the cloud architecture, the cloud vulnerability repair management system 101 can communicate with the home network connection management platform 102 and the home smart gateway 103 in a variety of connection modes, and the specific communication mode is not within the protection scope of the present invention.

[0021] Specifically, the cloud-based vulnerability repair management system 101 is configured to manage the repair of vulnerabilities in the entire home network. The cloud-based vulnerability repair management system 101 can understand the connection status and vulnerability status of the smart terminal devices of the entire home users based on the vulnerability information library, device information library and other library information, and provide unified storage and management of vulnerability repair packages. According to one embodiment of the present invention, the vulnerability information library may include vulnerability information and related vulnerability repair packages for various types of smart terminal devices in the entire home network, and the device information library may include information such as the models and configurations of the smart terminal devices in the entire home network. According to one embodiment of the present invention, the cloud-based vulnerability repair management system 101 may be maintained by the operator and / or by a third-party supplier to ensure that the information in the vulnerability information library and the device information library is kept up to date.

[0022] By adopting the cloud vulnerability repair management system 101, for the same model of smart terminal devices in the entire home network, only one copy of vulnerability repair information needs to be maintained in the cloud, without the need to maintain separate vulnerability repair information in each home network.

[0023] According to one embodiment of the present invention, the home network connection management platform 102 is configured to serve as the management and control center of the entire network home smart gateway 103 (for example, home smart gateways 103-1 to 103N), and can realize unified operation and control of the entire network home smart gateway 103, including the distribution and uninstallation of plug-in packages, the distribution of vulnerability repair packages, etc. For example, the home network connection management platform 102 can store and maintain a home network relationship library, and the content maintained in the relationship library includes information such as the type, model, and IP address of the smart terminal device attached to the home smart gateway, so as to facilitate the subsequent distribution of vulnerability repair packages.

[0024] Figure 2 A schematic diagram 200 of a home smart gateway 103 according to an embodiment of the present invention is shown. According to an embodiment of the present invention, the home smart gateway 103 adds a traffic detection module 105, a vulnerability scanning module 106, a vulnerability storage module 107, a configuration management module 108 and a scheduling module 109 to the basic functions of a general gateway. Among them, any module can communicate with any other module, but all connections are not shown for the purpose of easy explanation. In addition, it is fully understood by those skilled in the art that this article only explains the above modules for the purpose of explanation, and the functions of one or more of the above modules can be merged into a single module or split into multiple modules. In addition, one or more of the above modules can be implemented in software, hardware or a combination thereof.

[0025] According to one embodiment of the present invention, the traffic detection module 105 is configured to detect all uplink and downlink service traffic received and sent through the home smart gateway 103. The vulnerability scanning module 106 is configured to perform regular vulnerability detection and scanning on the smart terminal device 104. The vulnerability storage module 107 is configured to manage and store the vulnerability repair packages of the smart terminal devices to be repaired in the entire home network. The configuration management module 108 is configured to initialize and manage settings related to gateway vulnerability repair. The scheduling module 109 is configured to calculate the optimal scheduling strategy and vulnerability repair timing based on the actual situation of the home network combined with the configuration settings, and trigger the distribution of the vulnerability repair package of the smart terminal device.

[0026] According to one embodiment of the present invention, a home smart gateway 103 can be connected to multiple smart terminal devices 104 (e.g., 104-1 to 104N). As known to those skilled in the art, the types of smart terminal devices 104 can be various, such as smart speakers, smart TVs, smart refrigerators, smart microwave ovens, smart TVs, smart lights, etc. The smart terminal device 104 can be configured to communicate with the home smart gateway 103, such as receiving requests from the home smart gateway 103, performing vulnerability repairs and reporting related information.

[0027] In general, the cloud vulnerability repair management system 101 is used to manage the repair of vulnerabilities in the entire home network, and maintain the vulnerability information and corresponding repair packages of each smart terminal device in the entire home network. After receiving the repair request from each home smart gateway 103 in the entire network, the same vulnerabilities in the repair request from each home smart gateway 103 are collected, and a vulnerability list is issued to the home network connection management platform 102. The home network connection management platform 102 divides the vulnerability list based on different home smart gateways 103, and transmits each vulnerability list subset to the corresponding home smart gateway 103. The home smart gateway 103 obtains the vulnerability repair strategy based on the repair time, repair rules, and repair priority of each smart terminal device in the attached smart terminal device 104, so as to push the repair package for the smart terminal device 104 to the smart terminal device 104 at the appropriate repair time to repair the vulnerability.

[0028] Figure 3 A flow chart of a method 300 for repairing vulnerabilities of smart terminals in a home network environment according to an embodiment of the present invention is shown.

[0029] In step 301, configuration initialization is implemented at the home smart gateway. In this step, the home smart gateway collects device status information and service information from the smart terminal devices, obtains repair preference settings from the user, and obtains vulnerability information from the cloud vulnerability repair management system, thereby implementing configuration initialization related to the vulnerability repair strategy. According to one embodiment of the present invention, step 301 can be performed by the configuration management module 108 in the home smart gateway.

[0030] According to one embodiment of the present invention, the information collected by the smart terminal devices connected to the home smart gateway includes but is not limited to: 1) device status information: such as device name, model, brand, operating system version, online status, MAC, IP, memory capacity, etc.; 2) service information: such as main service type, service name, service priority, service importance, etc.

[0031] According to one embodiment of the present invention, the information collected by the home smart gateway from the user includes but is not limited to: 3) Repair preference settings: such as single device / multi-device repair, whether to block the current service, repair frequency, whether to distinguish vulnerability levels, repair time preference, etc. According to one embodiment of the present invention, the repair preference settings may not be collected from the user, but the default settings may be used. For example, the smart gateway manufacturer may set the smart gateway to "single device repair" by default. Generally speaking, in the case of "single device repair", the devices attached to the home smart gateway are repaired individually. In the case of "multi-device repair", multiple smart terminal devices of the same model in the devices attached to the home smart gateway can be repaired in batches.

[0032] According to one embodiment of the present invention, the information collected by the home smart gateway to the cloud vulnerability repair management system includes but is not limited to: vulnerability information (vulnerability associated devices, vulnerability severity, vulnerability name, vulnerability type), etc. As described above, the cloud vulnerability repair management system stores and maintains the latest vulnerability information related to the smart terminal devices, so the home smart gateway can obtain the latest vulnerability information. According to one embodiment of the present invention, the home smart gateway can provide the cloud vulnerability repair management system with the specific model of the attached smart terminal device to obtain the vulnerability information corresponding to the model of the smart terminal device. According to another embodiment of the present invention, the home smart gateway can obtain all vulnerability information from the cloud vulnerability repair management system.

[0033] In step 302, the home smart gateway monitors and collects the state of home service traffic, and obtains home network traffic and home network usage related information. The information obtained includes but is not limited to the network connection mode, connection state, memory capacity of the home smart gateway itself, CPU occupancy, uplink and downlink peak traffic and time of different services, uplink and downlink trough traffic and trough time set of different services, etc. According to one embodiment of the present invention, step 302 can be performed by the traffic detection module 105 in the home smart gateway.

[0034] In step 303, the home smart gateway calculates the repair priority of each connected smart terminal device to be repaired according to the information collected in steps 301 and 302.

[0035] According to an embodiment of the present invention, the vulnerability scanning module 106 in the home smart gateway scans and detects the vulnerabilities of the connected smart terminal devices, and compares the detected vulnerabilities with the vulnerability information collected from the cloud vulnerability repair management system in step 301 to find the vulnerabilities existing in the connected smart terminal devices. It can be understood by those skilled in the art that there are currently many ways to detect vulnerabilities in smart terminal devices, and how to detect vulnerabilities in smart terminal devices is not within the protection scope of the present invention.

[0036] After discovering the vulnerability in the connected smart terminal device, the vulnerability repair priority of each smart terminal device is calculated. According to one embodiment of the present invention, for smart terminal device i, the priority P of its vulnerability i repair is fix The calculation rules of i are as follows:

[0037] Selected configuration input items: vulnerability severity level Si, vulnerability weight ratio P1, repair time (i.e., the time required to modify the vulnerability) weight P2, business priority set<B1,B2....Bn> , service priority weight P4, service set uplink and downlink traffic set <network uplink traffic UPin, network downlink traffic UDin>, traffic weight P3, then:

[0038]

[0039] Therefore, according to the vulnerability situation of each smart terminal device, a vulnerability repair priority list set of smart terminal device i can be established:

[0040] DEVICE i =(<vulnerability id-1,P fix 1>,<Vulnerability id-2,P fix 2>......<Vulnerability id-i, P fix i>)

[0041] In step 304, the home smart gateway initiates a vulnerability repair request to the cloud vulnerability repair management system. According to one embodiment of the present invention, the vulnerability repair request may include the following information: home network broadband number, <device identification code, vulnerability level, vulnerability name (may be empty)>. According to one embodiment of the present invention, if the vulnerability detected by the home smart gateway in the vulnerability comparison process of step 303 is not recorded in the vulnerability information obtained from the cloud vulnerability repair management system, then the "vulnerability name" may be empty.

[0042] In step 305, the associated vulnerability list subset is sent to the home smart gateway. According to one embodiment of the present invention, the cloud vulnerability repair management system collects requests from different home smart gateways, selects the vulnerability repair package to be sent according to the vulnerability version in the vulnerability information library, forms a vulnerability list to be distributed across the entire network and submits it to the home network connection management platform. The home network connection management platform then cuts the vulnerability list according to the home broadband account and sends a directly associated vulnerability list subset to each corresponding home smart gateway.

[0043] For example, when the home smart gateways 103-1 to 103-N all send vulnerability repair requests to the cloud vulnerability repair management system, the cloud vulnerability repair management system can collect the same vulnerabilities contained in the vulnerability repair request (for example, the same vulnerabilities for devices of the same model) and find the vulnerability repair package corresponding to the vulnerability. The cloud vulnerability repair management system can form a vulnerability list based on vulnerability information, vulnerability repair packages, home network broadband numbers and other information to submit to the home network connection management platform. For example, the vulnerability list may have the following fields {device model, vulnerability name, vulnerability version, vulnerability repair package, home network bandwidth number 1, home network bandwidth number 2...home network bandwidth number N} for each vulnerability to illustrate which home networks have the vulnerability for the current vulnerability. Of course, it is fully understood by those skilled in the art that the above fields are merely schematic, and other styles of field combinations are also within the scope of the present invention.

[0044] After receiving the vulnerability list for the entire home network, the home network connection management platform can divide the vulnerability list on the basis of "home network bandwidth number" according to the "home network bandwidth number" field in the vulnerability list to form a vulnerability list subset corresponding to each home smart gateway, and send the vulnerability list subset to the corresponding home smart gateway. For example, the vulnerability list subset for home smart gateway 1 may include the following fields: {device model to be repaired, vulnerability name, vulnerability repair package}. Of course, it is fully understood by those skilled in the art that the above fields are merely illustrative, and other styles of field combinations are also within the scope of the present invention.

[0045] In step 306, the vulnerabilities in the smart terminal devices to be repaired under the home smart gateway are repaired. According to one embodiment of the present invention, after receiving the subset of the vulnerability list to be repaired, the home smart gateway stores it locally (for example, in the vulnerability storage module 107), and triggers the calculation of the vulnerability repair strategy for the smart terminal devices under the home smart gateway (this calculation can be performed by the scheduling module 109). The vulnerability repair strategy is comprehensively weighed from the following three dimensions: repair time, repair rules (for example, single device repair, same type of device repair, all repair), and repair priority (for example, vulnerability level from high to low, without distinguishing vulnerability priority). It can be understood by those skilled in the art that "single device repair" means that each of the multiple devices under the home network smart gateway is repaired in turn, that is, only one device can be repaired at a time. "Same type of device repair" means that multiple devices of the same type (for example, multiple smart TVs of the same model) under the home smart gateway can be repaired in batches. "All repair" means that all devices under the home smart gateway are repaired in batches.

[0046] The repair rule may be taken from the repair preference setting obtained in step 301 or the default setting of the home smart gateway, and the repair priority has been calculated in step 303. Next, the optimal repair time is calculated.

[0047] First, based on the repair rule, the DEVICE i =(<vulnerability id-1,P fix 1>,<Vulnerability id-2,P fix 2>......<Vulnerability id-i, P fix i>) to sort the vulnerabilities in order to form a vulnerability repair set set{leak(vulnerability) i ,leak j ......}. Calculate the CPU occupancy rate of the intelligent terminal device to be repaired at a certain time interval Δt di And count the average minimum CPU usage of the device within a week di-min; Count the bandwidth Speed ​​of the home gateway every certain time Δt -r 、User-ordered bandwidth Speed -o , and bandwidth utilization B u =Speed -o -Speed -r / Speed -o ; and count the lowest value of home gateway bandwidth utilization within a week B u-min .

[0048] For the vulnerability leak of the smart terminal device to be repaired i The final time to trigger the repair is T recover(修复) :

[0049] If the CPU di ≦CPU di-min +5%, and When T recover = current time. According to an embodiment of the present invention, the above “5%” and “10%” are only for illustration purposes, and the parameter value can be reconfigured according to actual conditions.

[0050] For batch repair of the same type of smart terminal devices, the repair trigger time is also determined according to the above calculation method.

[0051] In the calculated T recover Distribute one or more vulnerability repair packages corresponding to the smart terminal device to be repaired in the vulnerability list subset to the smart terminal device, and trigger the vulnerability repair of the smart terminal device. In step 307, the home smart gateway reports the vulnerability repair information to the cloud vulnerability repair management system according to the vulnerability repair status of each connected smart terminal device to be repaired, and cleans up the locally stored data. According to one embodiment of the present invention, the home smart gateway can obtain the vulnerability repair status of the connected smart terminal device (for example, vulnerability repair success, vulnerability repair failure, reason for failure, etc.), and report the vulnerability repair status to the cloud vulnerability repair management system. Based on the reported vulnerability repair status, the cloud vulnerability repair management system can update its vulnerability information library and / or device information library to maintain the accuracy of its library information.

[0052] Compared with the prior art, the present invention has the following significant advantages:

[0053] (1) Universal applicability and ease of use: The scenario of the present invention is aimed at all home networks rather than a specific home LAN. Only one piece of information needs to be maintained for the vulnerabilities of all smart terminal devices of the same type in the entire network. It makes full use of the network management and control capabilities of the gateway to achieve dynamic and personalized automatic vulnerability repair for tens of millions of households. No manual intervention by network administrators is required. Users have a sense of security but do not need additional learning and usage costs. It is simple and easy to use.

[0054] (2) Practicality: According to the present invention, the home network serves as a control center, which can not only detect all smart devices, but also make intelligent judgments based on the overall load situation in the home network, and choose the appropriate time to select a certain type or a certain device for batch or targeted vulnerability repair according to business needs, thereby optimizing the processing capacity of the home network, reducing the impact on existing businesses, and improving the processing efficiency of the overall smart home business while ensuring security in a timely manner.

[0055] (3) Stronger personalized management and control capabilities: The present invention fully considers the business conditions of individual households, the load status of the network, and the resource conditions of the equipment, and provides users with personalized configuration. With the help of the control center capabilities of the home gateway, it automatically determines the vulnerability repair mechanism and method, and has high personalized management and control features. Different families can make dynamic adjustments based on the actual situation of the smart home business and better enjoy personalized services.

[0056] (4) Scenario scalability: It can be extended to scenarios in which edge nodes in the Internet of Things are used as central control devices to perform unified vulnerability repairs on the managed smart devices. It can also be expanded to scenarios where applications are automatically updated and upgraded in the Internet of Things environment.

[0057] Although various aspects of the present invention have been described so far with reference to the accompanying drawings, the above-described methods, systems and devices are merely examples, and the scope of the present invention is not limited to these aspects, but is limited only by the appended claims and their equivalents. Various components may be omitted or replaced by equivalent components. In addition, the steps may be implemented in an order different from the order described in the present invention. In addition, various components may be combined in various ways. It is also important that, as technology develops, many of the components described may be replaced by equivalent components that appear later.

Claims

1. A method for repairing vulnerabilities of smart terminal devices in a home network, comprising: Implementing configuration initialization at the home smart gateway, the configuration initialization includes obtaining device status information and service information of each smart terminal device connected to the home smart gateway, and repairing preference settings and / or vulnerability information; The home smart gateway monitors and collects the home network service flow status, and obtains home network flow and home network usage related information; The home smart gateway calculates the repair priority of each to-be-repaired smart terminal device attached to the home smart gateway, so as to sort the repair priority of one or more vulnerabilities in each to-be-repaired smart terminal device; Among them, the priority P of the vulnerability i repair fix i is calculated by the following formula: Among them, Si represents the severity level of the vulnerability, P1 represents the vulnerability weight ratio, P2 represents the repair time weight, and P3 represents the traffic weight; The home smart gateway receives an associated vulnerability list subset; and Based on the repair time, repair priority and repair rule of each to-be-repaired smart terminal device hung under the home smart gateway, the vulnerability of each to-be-repaired smart terminal device hung under the home smart gateway is repaired.

2. The method according to claim 1, characterized in that Implementing configuration initialization at the home smart gateway further includes: the home smart gateway collects vulnerability information from a cloud vulnerability repair management system, and the vulnerability information includes vulnerability information for each smart terminal device connected to the home smart gateway.

3. The method according to claim 2, characterized in that The home smart gateway further calculates the repair priority of each to-be-repaired smart terminal device connected to the home smart gateway: The home smart gateway scans and detects the vulnerabilities of each smart terminal device connected to it, and compares the detected vulnerabilities with the vulnerability information collected from the cloud vulnerability repair management system to discover the vulnerabilities existing in the connected smart terminal devices, thereby identifying each smart terminal device to be repaired connected to the home smart gateway.

4. The method according to claim 1, characterized in that The repair preference setting is a preference setting provided by a user or a default setting set by the manufacturer of the home smart gateway.

5. The method according to claim 1, characterized in that The home smart gateway receiving the associated vulnerability list subset further includes: The home smart gateway initiates a vulnerability repair request to the cloud vulnerability repair management system, wherein the vulnerability repair request includes the home network broadband number, <device identification code, vulnerability level, vulnerability name>; The cloud vulnerability repair management system collects the same vulnerabilities contained in the vulnerability repair requests sent by multiple home smart gateways across the network, and searches for vulnerability repair packages corresponding to the vulnerabilities; The cloud vulnerability repair management system submits the vulnerability list to the home network connection management platform. The vulnerability list includes the following fields for each vulnerability: vulnerability information, vulnerability repair package, and home network broadband number; and The home network connection management platform divides the vulnerability list based on the home network bandwidth number to form a vulnerability list subset corresponding to each home smart gateway, and sends the vulnerability list subset to the corresponding home smart gateway, wherein the vulnerability list subset includes the following fields: device model to be repaired, vulnerability name, and vulnerability repair package.

6. The method according to claim 1, characterized in that The repair rule specifies single device repair, same type device repair, or all repairs.

7. The method according to claim 5, wherein repairing the vulnerability of each to-be-repaired smart terminal device connected to the home smart gateway further comprises: For each of the smart terminal devices to be repaired, at the repair time for the smart terminal device to be repaired, distribute one or more vulnerability repair packages corresponding to the smart terminal device to be repaired in the vulnerability list subset to the smart terminal device to be repaired, and trigger the vulnerability repair of the smart terminal device; The one or more vulnerability repair packages are repaired according to the repair priorities of the corresponding one or more vulnerabilities.

8. A system for repairing vulnerabilities of smart terminal devices in a home network, comprising: A home smart gateway, wherein the home smart gateway is configured to: Implementing configuration initialization, the configuration initialization includes obtaining device status information and service information of each smart terminal device connected to the home smart gateway, and repairing preference settings and / or vulnerability information; Monitor and collect the status of home network service traffic, and obtain information related to home network traffic and home network usage; Calculating the repair priority of each to-be-repaired smart terminal device attached to the home smart gateway to sort the repair priorities of one or more vulnerabilities in each to-be-repaired smart terminal device; Among them, the priority P of the vulnerability i repair fix i is calculated by the following formula: Among them, Si represents the severity level of the vulnerability, P1 represents the vulnerability weight ratio, P2 represents the repair time weight, and P3 represents the traffic weight; receiving an associated subset of vulnerability lists; For each of the smart terminal devices to be repaired, at the repair time for the smart terminal device to be repaired, distribute one or more vulnerability repair packages corresponding to the smart terminal device to be repaired in the vulnerability list subset to the smart terminal device to be repaired, and trigger the vulnerability repair of the smart terminal device; One or more intelligent terminal devices, wherein the one or more intelligent terminal devices are configured to: Based on one or more vulnerability repair packages corresponding to the smart terminal device, the vulnerability of the smart terminal device is repaired, wherein the one or more vulnerability repair packages are repaired according to the repair priority of the corresponding one or more vulnerabilities.

9. The system according to claim 8, characterized in that Further including: A cloud-based vulnerability repair management system, wherein the cloud-based vulnerability repair management system is configured to store and maintain a vulnerability information library and a device information library; The cloud-based vulnerability repair management system is further configured to collect the same vulnerabilities contained in the vulnerability repair requests sent from multiple home smart gateways across the entire network, and search for vulnerability repair packages corresponding to the vulnerabilities to form a vulnerability list, wherein the vulnerability list includes the following fields for each vulnerability: vulnerability information, vulnerability repair package, and home network broadband number.

10. The system according to claim 9, characterized in that Further including: A home network connection management platform, wherein the home network connection management platform is configured to: The received vulnerability list is segmented based on the home network bandwidth number to form a vulnerability list subset corresponding to each home smart gateway, and the vulnerability list subset is sent to the corresponding home smart gateway, wherein the vulnerability list subset includes the following fields: device model to be repaired, vulnerability name, and vulnerability repair package.

Images