Perform security negotiation for network configuration

Abstract

A method for performing security negotiation for a network configuration in a network device, the method comprising: the network device obtaining security update information from a communication device assigned to a first security network segment. The first security network segment is associated with a first network segment security template. The security update information indicates at least one change of the first security template of the communication device. The method further comprises: the network device determining a second security network segment for the communication device based on the security update information. The network device provides an instruction to the communication device to connect to the determined second security network segment.

Description

Technical Field

[0001] The present invention relates generally to the field of network management and security; more particularly, to a method and apparatus for performing security negotiation for network configuration. Background Art

[0002] With the rapid development of network infrastructure, network management and security have become more and more concerned. Currently, network segmentation is widely used to manage the risk of security vulnerabilities. Generally, a network segment refers to a component of a network that is separated from other network segments by using traditional network devices (such as gateway devices, routers, etc.). Various communication devices (such as laptops, IoT devices, smartphones, servers, etc.) are usually selectively grouped into different network segments to manage the risk of security vulnerabilities in communication devices connected to the network and network infrastructure. In traditional methods and systems, decisions about network segment association are made based on the assumption that traditional network devices know and control all network-related functions and activities. Therefore, it is inappropriate for network devices to make decisions about network segment association entirely. For example, traditional network devices may be unable to allocate a given network segment (or the allocated network segment is inappropriate) to a given communication device that is unknown (for example, an unsupported device type) and exhibit unpredictable network behavior. This inability to allocate any specific network segment or the inappropriate allocation of the network segment (i.e., network segment mismatch) may cause security risks. As another example, a communication device (e.g., an IoT controller) may communicate with peer communication devices (e.g., other IoT devices) and cloud servers through an alternative network (e.g., a cellular network), bypassing the conventional communication channels of traditional network devices (e.g., a Wi-Fi network). Therefore, such communications through the alternative network may not be available (i.e., invisible) to traditional network devices through conventional communication channels. In such cases, traditional network devices may not be aware of all network-related functions and activities, and therefore may not be able to perform appropriate network configuration, resulting in hidden dangers in network security (i.e., security vulnerabilities). In other words, in such cases, the performance of dynamic network configuration and network segment association by traditional network devices on traditional communication devices may encounter many technical challenges, such as network segment mismatch and insufficient security. In addition, in such cases, traditional communication devices may not work properly, and a large amount of manpower may be required on traditional network devices to perform network management and configuration.

[0003] Therefore, in view of the above discussion, there is a need to overcome the above-mentioned shortcomings associated with traditional methods, systems and devices for network management and security. Summary of the invention

[0004] The present invention is directed to providing a method, apparatus and computer program product for performing security negotiation for network configuration. The decision on network segment association made entirely by traditional network devices leads to inefficient network management and insufficient network security, and the present invention is directed to providing a solution to the above-mentioned existing problems. The purpose of the present invention is to provide a solution that at least partially overcomes the problems encountered in the prior art and provides improved methods and apparatus to achieve efficient network management and provide sufficient network security.

[0005] The objects of the invention are achieved by what is presented in the attached independent claim. Advantageous implementations of the invention are further defined in the dependent claims.

[0006] In a first aspect, the present invention provides a method for performing security negotiation for a network configuration in a network device. The method includes: the network device obtains security update information from a communication device assigned to a first security network segment. The first security network segment is associated with a first network segment security template. The security update information indicates at least one change of the first security template of the communication device. The method also includes: the network device determines a second security network segment for the communication device based on the security update information. The method also includes: the network device provides an instruction to the communication device to connect to the determined second security network segment.

[0007] The method described in the first aspect enables the network device to determine a suitable security segment (i.e., the correct segment) from a plurality of security segments that conform to the latest changes in the first security template of the communication device. Since the security update information obtained from the communication device is used by the network device to determine the second security segment, the probability of a security segment mismatch is significantly reduced, thereby reducing the risk of security vulnerabilities in the communication device and improving overall network security. In addition, since the probability of a security segment mismatch is significantly reduced, the manpower used for network management and configuration is not required or at least reduced, thereby improving the efficiency of network management.

[0008] In a first implementation of the first aspect, the method further includes: the network device providing the communication device with a second network segment security template associated with the determined second security network segment. The communication device uses the second network segment security template to: verify a decision to connect to the second security network segment; and based on the verification, control enabling and disabling of one or more functions or services in the communication device according to the second network segment security template.

[0009] The second network segment security template shared with the communication device enables the communication device to verify the decision of whether to connect to the second security network segment, thereby ensuring that the communication device actively participates in the decision about the association with the determined second security network segment. In the event of successful verification, certain functions or services in the communication device that become incompatible due to the change of the first security template of the communication device are enabled or disabled according to the second network segment security template (for example, insecure functions can be disabled).

[0010] In a second implementation manner of the first aspect, the network device obtains the security update information according to a change in a device operating state of the communication device or a change in a network environment of the communication device.

[0011] Changes in the device operating state or network environment of the communication device dynamically change the first security template of the communication device. Therefore, by obtaining the security update information indicating such changes, the network device can quickly close security holes that may occur due to such changes in the communication device.

[0012] In a third implementation of the first aspect, determining the second security segment for the communication device includes: comparing a security attribute associated with at least one change of the indication of the first security template with a corresponding security attribute associated with each of a plurality of segment security templates associated with a plurality of security segments.

[0013] The comparison of the security attributes ensures that a secure network segment of the plurality of secure network segments that best matches the indicated change is determined for the communications device.

[0014] In a fourth implementation manner of the first aspect, the method further includes: after the communication device connects to the second security network segment and leaves the first security network segment, applying a specific network policy associated with the second security network segment to the communication device.

[0015] The application of the specific network policy associated with the second security segment provides adequate network security and ensures that after the communication device connects to the second security segment and leaves the first security segment, access to one or more new services required by the communication device is authorized due to the at least one change in the first security template of the communication device. Similarly, certain services that are no longer required are disabled (e.g., access rights are revoked) to minimize or at least reduce the risk of security vulnerabilities in the communication device connected to a network (e.g., the Internet) through the network device.

[0016] In a fifth implementation of the first aspect, the first security template includes one or more of the following: device attributes, device operating status, a network environment of the communication device, or a request to access one or more services in the communication device. The communication device updates the first security template to a second security template according to at least one change in the device operating status of the communication device or a change in the network environment of the communication device.

[0017] The first security template of the communication device is dynamic rather than static, so any changes in the device operating state or any changes in the network environment in which the communication device operates can be accommodated in the first security template. Therefore, in contrast to conventional systems and methods, the method is able to cope with the following situation: the device security template (i.e., the content of the first security template of the communication device) changes suddenly due to the change in the device operating state or the change in the network environment of the communication device.

[0018] In a sixth implementation of the first aspect, the security update information corresponds to at least one of the following: the second security template or one or more differences between the second security template and the first security template. The second security template includes one or more of the following: latest device attributes, current device operating state, last device operating state, an alternative network connection path used by the communication device, a request to access one or more services different from the services supported in the first security network segment assigned to the communication device, or a security event defining dynamically changing information associated with the communication device.

[0019] The security update information enables the network device to be aware of any changes in network-related functions and activities even if any network-related communications bypass the regular communication channels of the network device. Therefore, the method is able to quickly and adequately close security holes that may arise due to such updates or changes to the first security template (i.e., security requirements) of the communication device.

[0020] In a seventh implementation manner of the first aspect, determining the second security network segment for the communication device includes: using a message type indication and the second security template.

[0021] By considering the message type indication and the second security template, the accuracy of determining the second security network segment for the communication device is improved, thereby improving the efficiency of network management and reducing the security risk.

[0022] In an eighth implementation of the first aspect, the communication device is assigned to the first security network segment according to a first connection operation between the network device and the communication device. The first connection operation includes: when the communication device is in a state where it is not assigned to a given security network segment, the network device obtains the first security template from the communication device by negotiating the network segment. The first security template indicates the device capabilities and security requirements of the communication device in the unassigned state. The first connection operation also includes: the network device determines the first security network segment from a plurality of security network segments according to the obtained first security template to assign to the communication device. The first connection operation also includes: the network device provides the communication device with an instruction to connect to the first security network segment, wherein the instruction notifies the communication device of the determined first security network segment, and the determined first security network segment meets the device capabilities and security requirements of the communication device.

[0023] The first security template enables the network device to enhance its assessment of the security capabilities and security requirements of the communication device. For example, by using the first security template, certain security features (or security postures) of the communication device that the network device may not be able to detect (i.e., not exposed) through a conventional communication channel (e.g., using an automatic detection function) can be easily and accurately detected. Therefore, the first security template enables the network device to determine the most matching security network segment (i.e., the first security network segment in this case) from the multiple security network segments to allocate to the communication device, thereby providing sufficient security.

[0024] In a second aspect, the present invention provides a method for performing security negotiation for network configuration in a communication device. The method includes: the communication device provides security update information to a network device. The communication device is assigned to a first security network segment associated with a first network segment security template. The security update information indicates at least one change of the first security template of the communication device. The method also includes: the communication device obtains an instruction to connect to a second security network segment from the network device. The method also includes: the communication device connects to the second security network segment according to the obtained instruction, and the second security network segment complies with at least one change of the indication of the first security template of the communication device.

[0025] The method enables the communication device and the network device to actively participate together in the decision about the association with the security segment (for example, in this case, the determined second security segment). Since the communication device actively shares the security update information, the network device can determine the correct security segment (that is, in this case, the second security segment) from multiple security segments that conform to the latest changes in the first security template of the communication device. Therefore, the probability of security segment mismatch is significantly reduced, thereby reducing the risk of security vulnerabilities in the communication device and improving overall network security and network management efficiency. The communication device connects to the second security segment, so that security vulnerabilities that may arise due to such updates or changes (for example, changes in certain security attributes, services or features) of the first security template of the communication device can be quickly and fully closed.

[0026] In a first implementation manner of the second aspect, the communication device provides the security update information to the network device according to a change in a device operating state of the communication device or a change in a network environment of the communication device.

[0027] The security update information indicating such changes is actively provided by the communication device to the network device, so that the network device can quickly close security holes that may occur due to such changes in the communication device.

[0028] In a second implementation of the second aspect, the first security template includes one or more of the following: device attributes, device operating status, a network environment of the communication device, or a request to access one or more services in the communication device.

[0029] The first security template is comprehensive and fully specifies the device capabilities and security requirements of the communication device. For example, the first security template specifies the device type, uniform resource locator (URL) access list, supported protocols, open or closed ports, requirements for accessing certain network resources or services or disabling certain other services, download or upload permissions, etc. Therefore, the security update information indicating at least one change of the first security template (e.g., any change in device attributes, network environment, change in requirements for accessing new services or disabling currently accessed services) enables the network device to determine the best matching network segment from multiple security network segments to comply with the latest change of the first security template of the communication device.

[0030] In a third implementation manner of the second aspect, the method further includes: the communication device updating the first security template to a second security template according to at least one change in a device operating state of the communication device or a change in a network environment of the communication device.

[0031] The first security template of the communication device is dynamic rather than static, so any changes in the operating state of the device or any changes in the network environment in which the communication device operates can be accommodated in the first security template. Updating the first security template to the second security template can record the latest information related to device attributes, any changes in the operating state of the device, or any changes in the network environment of the communication device.

[0032] In a fourth implementation of the second aspect, the security update information corresponds to at least one of the following: the second security template or one or more differences between the second security template and the first security template; the second security template includes one or more of the following: the latest device attributes, the current device operating status, the last device operating status, the alternative network connection path used by the communication device, a request to access one or more services different from the services supported by the first security network segment, or a security event that defines dynamically changing information associated with the communication device; the network device uses the message type indication and the second security template to determine the second security network segment.

[0033] The security update information enables the network device to be aware of any changes in the network-related functions and activities of the communication device, even if any network-related communication bypasses the normal communication channel of the network device. Therefore, the method can quickly and adequately close security holes that may arise due to such updates or changes related to the security requirements of the communication device.

[0034] In a fourth implementation of the second aspect, the connection of the second security network segment includes: the communication device obtains one or more of the following items from the network device: a list of security services supported by the network device for the second security network segment, a second network segment security template associated with the second security network segment, or multiple network segment security templates for multiple security network segments available to the network device.

[0035] The acquisition of such information (e.g., the list of security services, the second network segment security template, and other available network segment security templates) enables security negotiation and mutual security verification between the communication device and the network device. In other words, both the network device and the communication device can perform security negotiation to achieve first network confirmation and on-demand network configuration (or reconfiguration), wherein one party (e.g., the network device) specifies a list of available options to allow the other party (e.g., the communication device) to select the best matching option (i.e., the correct security network segment), thereby reducing security segment mismatches and improving overall network security and network management efficiency.

[0036] In a fifth implementation of the second aspect, the method further includes: the communication device verifies the decision related to the connection of the second security network segment based on the evaluation of the obtained second network segment security template, and the obtained second network segment security template is associated with the second security network segment. The method further includes: if the verification is successful, the communication device controls the enabling and disabling of one or more functions or services in the communication device based on the obtained second network segment security template, and the obtained second network segment security template is associated with the second security network segment.

[0037] The method provides the communication device with an opportunity to evaluate the acquired second network segment security template associated with the second secure network segment to determine whether the second secure network segment complies with the change to the first security template (e.g., a change due to an internal firewall failure in the communication device). This enables the communication device and the network device to actively participate in the decision about the association with a secure network segment (e.g., in this case, the determined second secure network segment).

[0038] In a sixth implementation of the second aspect, the communication device is assigned to the first security network segment according to a first connection operation between the communication device and the network device. The first connection operation includes: when the communication device is in a state where it is not assigned to a given security network segment, the communication device provides the first security template to the network device by negotiating the network segment. The first security template indicates the device capabilities and security requirements of the communication device in the unassigned state. The first connection operation also includes: the communication device obtains an instruction to connect to the first security network segment from the network device. The first connection operation also includes: the communication device connects to the first security network segment according to the obtained instruction.

[0039] In the case where the communication device has not been assigned to any security network segment (i.e., the unassigned state), the first connection operation enables the network device to determine the best matching security network segment (i.e., the first security network segment) from the multiple security network segments according to the first security template to assign to the communication device, thereby providing sufficient security. For example, the first security template is used to easily and accurately detect certain security features (or security postures) of the communication device that may not be detected (i.e., not exposed) through a conventional communication channel (e.g., using an automatic detection function) between the communication device and the network device.

[0040] In a third aspect, the present invention provides a network device for performing security negotiation for a network configuration. The network device includes a control circuit, and the control circuit is used to obtain security update information from a communication device assigned to a first security network segment. The first security network segment is associated with a first network segment security template. The security update information indicates at least one change of the first security template of the communication device. The control circuit is also used to: determine a second security network segment for the communication device based on the security update information. The control circuit is also used to: provide an instruction to the communication device to connect to the determined second security network segment.

[0041] In other implementations of the network device of the third aspect, the control circuit is used to perform the functions of the implementation of the method according to the first aspect. Therefore, the implementation of the network device includes the functions of the corresponding implementation of the method of the first aspect.

[0042] The network device described in the third aspect realizes all the advantages and effects of the method described in the first aspect.

[0043] In a fourth aspect, the present invention provides a communication device for performing security negotiation for network configuration. The communication device includes a control circuit, and the control circuit is used to provide security update information from the communication device assigned to a first security network segment to a network device. The first security network segment is associated with a first network segment security template. The security update information indicates at least one change of the first security template of the communication device. The control circuit is also used to obtain an instruction to connect to a second security network segment from the network device. The control circuit is also used to connect to the second security network segment according to the obtained instruction, and the second security network segment complies with at least one change of the indication of the first security template of the communication device.

[0044] In other implementations of the communication device of the fourth aspect, the control circuit is used to perform the functions of the implementation of the method according to the second aspect. Therefore, the implementation of the communication device includes the functions of the corresponding implementation of the method of the second aspect.

[0045] The communication device described in the fourth aspect realizes all the advantages and effects of the method described in the second aspect.

[0046] In a fifth aspect, the present invention provides a computer program product, comprising a non-transitory computer-readable storage medium storing computer-readable instructions, wherein the computer-readable instructions can be executed by a computerized device, wherein the computerized device comprises processing hardware, and the processing hardware is used to execute the above-mentioned method of the first aspect or the second aspect.

[0047] The computer program product described in the fifth aspect realizes all the advantages and effects of the method described in the first aspect or the second aspect.

[0048] It should be noted that all equipment, elements, circuits, units and devices described in this application can be implemented by software or hardware elements or any type of combination thereof. All steps performed by various entities described in this application and the described functions to be performed by various entities are intended to indicate that the corresponding entities are used to perform the corresponding steps and functions. Although in the description of the following specific embodiments, the specific functions or steps performed by external entities are not reflected in the description of the specific detailed elements of the entities performing the specific steps or functions, it should be clear to the technician that these methods and functions can be implemented by corresponding hardware or software elements or any combination thereof. It should be understood that, without departing from the scope of the present invention defined in the appended claims, various combinations of features of the present invention can be performed.

[0049] Additional aspects, advantages, features and objects of the present invention will become apparent from the accompanying drawings and detailed description of illustrative implementations interpreted in conjunction with the following appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The above summary and the detailed description of the following illustrative embodiments may be better understood by reading in conjunction with the accompanying drawings. In order to illustrate the present invention, exemplary structures of the present invention are shown in the accompanying drawings. However, the present invention is not limited to the specific methods and tools disclosed herein. In addition, it should be understood by those skilled in the art that the accompanying drawings are not drawn to scale. Where possible, the same elements are represented by the same numbers.

[0051] Embodiments of the present invention will now be described, by way of example only, with reference to the following drawings, in which:

[0052] Figure 1 is a flow chart of a method for performing security negotiation for network configuration in a network device provided by an embodiment of the present invention;

[0053] Figure 2 is a flow chart of a method for performing security negotiation for network configuration in a communication device provided by an embodiment of the present invention;

[0054] Figure 3A is a network environment diagram of a system including a network device and a communication device provided by an embodiment of the present invention;

[0055] Figure 3B A block diagram showing various exemplary components of a network device provided by an embodiment of the present invention;

[0056] Figure 3C A block diagram showing various exemplary components of a communication device provided by an embodiment of the present invention;

[0057] Figure 4 A schematic diagram showing an exemplary communication between a network device and a communication device for performing security negotiation for network configuration provided by an embodiment of the present invention;

[0058] Figure 5 A diagram showing an exemplary scenario of the working principle of performing security negotiation for network configuration provided by an embodiment of the present invention;

[0059] Figure 6 A diagram is shown of an exemplary scenario in which different communication devices perform security negotiation for network configuration according to an embodiment of the present invention.

[0060] In the drawings, an underlined number is used to indicate the item in which the underlined number is located or an item adjacent to the underlined number. A non-underlined number refers to the item identified by the line connecting the non-underlined number to the item. When a number is not underlined and has an associated arrow, the non-underlined number is used to identify the general item to which the arrow points. DETAILED DESCRIPTION

[0061] The following detailed description describes embodiments of the invention and ways in which these embodiments may be implemented. Although some modes of implementing the invention have been disclosed, those skilled in the art will recognize that there may be other embodiments for implementing or practicing the invention.

[0062] Figure 1 1 is a flowchart of a method 100 for performing security negotiation for network configuration in a network device provided by an embodiment of the present invention. The method 100 comprises Figure 3A The method 100 includes steps 102 , 104 and 106 .

[0063] In step 102, the network device obtains security update information from a communication device assigned to a first security segment. The first security segment is associated with a first segment security template. In one example, the first security segment may also be referred to as a segment (i.e., one of many segments initially assigned to the communication device). The security update information indicates at least one change in a first security template (e.g., a device security template) of the communication device. For example, the first security template of the communication device may change due to a failure of an internal firewall application in the communication device. In one example, the network device obtains the security update information based on an on-demand request from the communication device (i.e., a request initiated by the communication device) to reallocate the segment from the currently assigned first security segment to a new security segment. Examples of the communication device, the network device, and various security templates and segments are described in Figure 3A and Figure 5 is further described in.

[0064] According to an embodiment, the first security template includes one or more of the following: device attributes, device operating status, network environment of the communication device, or a request to access one or more services in the communication device. The communication device updates the first security template to a second security template according to at least one change in the device operating status of the communication device or a change in the network environment of the communication device. Examples of the device attributes include, but are not limited to, device type, manufacturer name, current access list of uniform resource locators (URLs), list of protocols supported in the communication device (e.g., IPV4 or IPV6), list of open ports, list of closed ports, list of allowed control interfaces, content types entering and exiting the communication device, security posture of the communication device, etc. In one example, the device operating status specifies the application state or hardware state of the communication device at runtime. The network environment of the communication device includes information related to the current network connection path used by the communication device. In one example, it can be specified in the first security template (or inferred from the first security template) whether the data traffic entering and exiting the communication device is routed through the network device. In contrast to conventional systems and methods, the first security template of the communication device is dynamic (rather than static), and the first security template is able to adapt to such changes due to the changes in the device operating state of the communication device or the network environment.

[0065] According to an embodiment, the security update information corresponds to at least one of the following: the second security template or one or more differences between the second security template and the first security template. In one implementation, the entire second security template is provided to the network device. In other words, the second security template is exposed (e.g., announced or published) so that the network device can obtain the second security template. In another implementation, optionally, only the latest changes or updates (i.e., the one or more differences between the second security template and the first security template) are provided to the network device as the security update information, thereby saving network bandwidth and improving network performance. The second security template includes one or more of the following: the latest device attributes, the current device operating state, the last device operating state, an alternative network connection path used by the communication device, a request to access one or more services different from the services supported in the first security network segment assigned to the communication device, or a security event defining dynamically changing information associated with the communication device. In the conventional system and method, the network communication pattern does not immediately reflect such changes related to the security requirements in the communication device, so the conventional network device cannot know such changes. In contrast to conventional systems and methods, such changes may be discerned from the acquired security update information, thereby reducing the risk of security vulnerabilities in the communication device and improving overall network security and network management efficiency.

[0066] According to an embodiment, the communication device is assigned to the first security network segment according to a first connection operation between the network device and the communication device. The first connection operation includes: when the communication device is in a state where it is not assigned to a given security network segment, the network device obtains the first security template from the communication device through a negotiation network segment. In one example, the negotiation network segment may refer to a network segment that supports security negotiation and is temporarily used for communication by the network device and the communication device before a specific security network segment among a plurality of security network segments is actually assigned (or allocated). The first security template indicates the device capabilities and security requirements of the communication device in the unassigned state. The first connection operation also includes: the network device determines the first security network segment from the plurality of security networks according to the acquired first security template to assign to the communication device. The first connection operation also includes: the network device provides the communication device with an instruction to connect to the first security network segment. The instruction notifies the communication device of the determined first security network segment, and the determined first security network segment meets the device capabilities and security requirements of the communication device.

[0067] In step 104, the network device determines a second secure network segment for the communication device based on the security update information. The determined second secure network segment is a secure network segment that complies with at least one change of the indication of the first security template of the communication device. According to an embodiment, determining the second secure network segment for the communication device includes: comparing a security attribute associated with at least one change of the indication of the first security template with a corresponding security attribute associated with each of a plurality of network segment security templates, the plurality of network segment security templates being associated with the plurality of secure network segments. The comparison is performed in order to find the best matching network segment of the communication device (i.e., in this case, the second secure network segment) from the plurality of secure network segments of the communication device.

[0068] According to an embodiment, determining the second secure network segment for the communication device includes using a message type indication and the second security template. In one example, the message type indication may indicate an on-demand request for network segment reallocation.

[0069] In step 106, the network device provides the communication device with an instruction to connect to the determined second secure network segment. In other words, the network device provides instructions to the communication device to associate the communication device with (ie, connect to) a suitable secure network segment.

[0070] According to an embodiment, the method 100 further includes: the network device provides the communication device with a second network segment security template associated with the determined second security network segment. The communication device uses the second network segment security template to verify the decision to connect to the second security network segment. If the verification is successful (i.e., according to the security update information, the communication device and the network device mutually agree that the second security network segment is the best match), the communication device connects the second security network segment. The communication device also uses the second network segment security template to control the enabling and disabling of one or more functions or services in the communication device according to the second network segment security template based on the verification. In other words, in the case of successful verification, certain functions or services in the communication device (which become incompatible due to changes in the first security template of the communication device) are enabled or disabled according to the second network segment security template (for example, unsafe functions can be disabled).

[0071] According to an embodiment, the method 100 further includes: after the communication device connects to the second security segment and leaves the first security segment, applying a specific network policy associated with the second security segment to the communication device. In one example, the network device may include the functionality of a policy manager that manages different network policies associated with different security segments. A specific security segment has a specific network policy associated with it. After the security negotiation is performed and the communication device connects to the determined second security segment, the specific network policy associated with the second security segment is applied to proactively close potential security vulnerabilities that may arise due to the latest changes in the first security template of the communication device.

[0072] Steps 102, 104, and 106 are merely illustrative, and other alternatives may be provided in which one or more steps are added, one or more steps are deleted, or one or more steps are provided in a different order without departing from the scope of the claims herein.

[0073] Figure 2 1 is a flowchart of a method 200 for performing security negotiation for network configuration in a communication device provided by an embodiment of the present invention. The method 200 comprises Figure 3A The communication device described above is executed.

[0074] In step 202, the communication device provides security update information to the network device. The communication device is assigned to a first security segment associated with a first segment security template. Since the communication device actively shares the security update information with the network device, it can be ensured that the communication device actively participates in the decision about the security segment associated with the communication device. The security update information indicates at least one change of the first security template of the communication device. According to an embodiment, the first security template includes one or more of the following: device attributes, device operating status, network environment of the communication device, or a request to access one or more services in the communication device.

[0075] According to an embodiment, the communication device provides the security update information to the network device according to a change in the device operating state of the communication device or a change in the network environment of the communication device. According to an embodiment, the security update information corresponds to at least one of the following: the second security template or one or more differences between the second security template and the first security template. The second security template includes one or more of the following: the latest device attributes, the current device operating state, the last device operating state, an alternative network connection path used by the communication device, a request to access one or more services different from the services supported by the first security network segment, or a security event defining dynamically changing information associated with the communication device. The network device determines the second security network segment using the message type indication and the second security template.

[0076] In step 204, the communication device obtains instructions from the network device to connect to the second secure network segment. The security update information provided by the communication device enables the network device to be aware of any changes in network-related functions and activities even if any network-related communications bypass the regular communication channels of the network device. Therefore, the network device is able to determine the appropriate secure network segment (i.e., the second secure network segment in this case) and send an instruction to the communication device to connect to the determined second secure network segment.

[0077] In step 206, the communication device connects to the second security network segment according to the acquired instruction, and the second security network segment complies with at least one change of the indication of the first security template of the communication device. The communication device connects to the second security network segment so that security vulnerabilities that may arise due to such updates or changes (e.g., changes in certain security attributes, services, or features) of the first security template of the communication device can be quickly and fully closed.

[0078] According to an embodiment, the connection of the second security network segment includes: the communication device obtains one or more of the following items from the network device: a list of security services supported by the network device for the second security network segment, a second network segment security template associated with the second security network segment, or multiple network segment security templates of multiple security network segments available to the network device. In other words, such information obtained from the network device (e.g., the list of security services, the second network segment security template, and other available network segment security templates) enables security negotiation and mutual security verification between the communication device and the network device. Both the network device and the communication device can perform security negotiation, wherein one party (e.g., the network device) specifies a list of available options to allow the other party (e.g., the communication device) to select the best matching option (i.e., the correct security network segment), thereby reducing security segment mismatches and improving overall network security and network management efficiency.

[0079] According to an embodiment, the connection of the second secure network segment further includes: the communication device verifies the decision related to the connection of the second secure network segment based on the evaluation of the obtained second network segment security template, and the obtained second network segment security template is associated with the second secure network segment. If the verification is successful (i.e., according to the security update information, the communication device and the network device mutually agree that the second secure network segment is the best match), the communication device connects the second secure network segment. If the verification is successful, the enabling and disabling of one or more functions or services in the communication device are controlled according to the obtained second network segment security template, and the obtained second network segment security template is associated with the second secure network segment. For example, if the network device (e.g., a router) does not support a dedicated secure network segment for such functions, the communication device can disable firmware updates via a Wi-Fi network because firmware updates via a flat network (e.g., a network to which all communication devices are connected through the same network device) are considered unsafe for the communication device.

[0080] According to an embodiment, the method 200 further includes: the communication device updating the first security template to a second security template according to at least one change in a device operating state of the communication device or a change in a network environment of the communication device.

[0081] Steps 202, 204, and 206 are merely illustrative, and other alternatives may be provided in which one or more steps are added, one or more steps are deleted, or one or more steps are provided in a different order without departing from the scope of the claims herein.

[0082] Figure 3AFIG. 3 is a network environment diagram of a system 300 including network devices and communication devices provided by an embodiment of the present invention. Figure 3A , which shows a network environment of the system 300 including a network device 302 and a communication device 304. In addition, a first communication network 306, a second communication network 308 and an alternative network connection path 310 are also shown.

[0083] The network device 302 refers to network hardware that acts as a gateway or intermediary between two networks (e.g., a first communication network 306 and a second communication network 308). For example, the communication device 304 can be communicatively coupled to the network device 302 through the first communication network 306 (e.g., a wireless local area network (WLAN)). The communication device 304 can access the second communication network 308 (e.g., the Internet) through the network device 302. The network device 302 includes multiple network segment security templates associated with multiple security network segments. The multiple security network segments refer to different components of a network (e.g., the first communication network 306), and the components are separated from other network segments by the network device 302. The multiple security network segments can also be referred to as network segments formed after network segmentation. Network segmentation refers to dividing a communication network into subnets, each of which is referred to as a security network segment (segment). Examples of the network device 302 include, but are not limited to, a home gateway device, a router, a bridge router (i.e., a bridging router), a network controller, a fixed wireless access (FWA) device, a server, a firewall device, or a network security device.

[0084] In one implementation, the network device 302 may include a security negotiation-specific application programming interface (API) that supports authentication and data encryption to prevent potential network adversaries. The communication device 304 may also include such a compatible API to support security negotiations with the network device 302. For example, requests and data to and from the communication device 304 and the network device 302 may be encrypted and optionally digitally signed to ensure confidentiality, integrity, and availability of the information provided.

[0085] The communication device 304 may comprise suitable logic, circuitry, interfaces and / or code for communicating with the network device 302 via the first communication network 306. Examples of the communication device 304 include, but are not limited to, a smartphone, an Internet-of-Things (IoT) device, a laptop device, a tablet device, a personal computer, a machine type communication (MTC) device, an evolved universal mobile telecommunications system (UMTS) terrestrial radio access network (E-UTRAN) NR dual connectivity (EN-DC) device, a server, an IoT controller, a drone, a handheld computing device, custom hardware for wireless telecommunications, or any other portable or non-portable electronic device.

[0086] The first communication network 306 may include a medium through which one or more communication devices such as the communication device 304 can communicate with the network device 302. Examples of the first communication network 306 may include, but are not limited to, a short-range network (e.g., a home network), a two-way radio frequency network (e.g., a Bluetooth-based network), a wireless personal area network (Wireless Personal Area Network, WPAN) and / or a WLAN, such as a Wireless Fidelity (Wireless Fidelity, Wi-Fi) network. Various communication devices such as the communication device 304 may be used to connect to the network device 302 in the first communication network 306 according to various wired or wireless communication protocols. Examples of such wired or wireless communication protocols or technical standards may include, but are not limited to, International Organization for Standardization (ISO) Technical Committee (TC) 16058, Bluetooth protocol, infrared protocol, Wireless Fidelity (Wi-Fi) protocol, ZigBee protocol, IEEE 802.11, 802.16, cellular communication protocol, Near Field Communication (NFC) protocol, Universal Serial Bus (USB) protocol and / or Wireless USB protocol.

[0087] In one example, the second communication network 308 may be different from the first communication network 306. The second communication network 308 may be accessed by one or more communication devices such as the communication device 304 through the network device 302, which acts as an intermediary or gateway between the first communication network 306 and the second communication network 308. In some cases, the second communication network 308 may be directly accessed by one or more communication devices using an alternative network connection path 310, bypassing the network device 302. Examples of the second communication network 308 may include, but are not limited to, the Internet, a cloud network, a local area network (LAN), a telephone line (POTS), a metropolitan area network (MAN), a wireless sensor network (WSN), and / or a cellular network, such as a 3G, long-term evolution (LTE) 4G or 5G network. Various devices in the network environment may be used to connect to the second communication network 308 according to various wireless communication protocols. Examples of such wireless communication protocols, communication standards and techniques may include, but are not limited to, IEEE 802.11, 802.11p, 802.15, 802.16, 1609, Worldwide Interoperability for Microwave Access (Wi-MAX), Transmission Control Protocol and Internet Protocol (TCP / IP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), Long-term Evolution (LTE), File Transfer Protocol (FTP), Enhanced Data GSM Environment (EDGE), voice over Internet Protocol (VoIP), protocols for email, instant messaging and / or short message service (SMS), and / or cellular communication protocols.

[0088] The alternative network connection path 310 refers to a communication channel (or connection path) that bypasses the network device 302 and connects to a network (e.g., the second communication network 308). For example, the communication device 304 can be communicatively coupled to the network device 302 via a Wi-Fi network (e.g., the first communication network 306), and can access the Internet (e.g., the second communication network 308) via the network device 302. In some cases, the communication device 304 can bypass the conventional communication channel (e.g., the Wi-Fi network) and directly access the Internet via a cellular network. Therefore, in this case, the cellular network corresponds to the alternative network connection path 310.

[0089] According to an embodiment, the communication device 304 includes a first security template (i.e., a device security template). The first security template includes one or more of the following: device attributes, device operating status, a network environment of the communication device 304, or a request to access one or more services in the communication device 304. The first security template has a data structure including a plurality of fields. Each of the plurality of fields includes a security attribute. In one example, the device attributes define security attributes, such as a device type, a manufacturer name, a current access list of a uniform resource locator (URL), a list of protocols (e.g., IPV4 or IPV6) supported in the communication device 304, a list of open ports, a list of closed ports, a list of allowed control interfaces, content types entering and exiting the communication device 304, and a security posture of the communication device 304. The term "security posture" refers to a security status associated with one or more software and hardware of the communication device 304. The security posture may indicate current controls and measures implemented in the communication device 304 for the purpose of protecting the communication device 304 and other devices communicating with the communication device 304. For example, the security posture of the communication device 304 may specify current configuration settings and permissions associated with pre-installed applications and an operating system in the communication device 304, a list of services running in the communication device 304, a list of disabled services in the communication device 304, a data recovery configuration, enabled or disabled hardware components, and supported accessory components in the communication device 304.

[0090] In one example, the device operating state specifies an application state or hardware state of the communication device 304 when it is running. For example, the device operating state may indicate that a local firewall application is currently running and has the latest virus definitions. The network environment of the communication device 304 includes information related to the current network connection path used by the communication device 304. For example, whether data traffic to and from the communication device 304 is routed via the first communication network 306 through the network device 302, or whether the communication device 304 directly accesses the second communication network 308 (e.g., the Internet) through a cellular connection path (e.g., an alternative network connection path 310). In one example, the network environment of the communication device 304 may also indicate a communication mode of the communication device 304. The request to access one or more services in the communication device 304 may include a list of services additionally requested by the communication device 304. The request to access one or more services may also include a list of services that need to be disabled. For example, the request may specify requirements for access to network resources (e.g., access to a data server, access to a new folder in a data server, access to a new application in a data server or other server (e.g., an application server), specific types of access control permissions (i.e., read, write, modify, or special permissions) to a network drive or folder in a network drive or a local drive of the communication device 304).

[0091] According to an embodiment, the communication device 304 is in a state where it is not assigned to a specific security network segment. When the communication device 304 is in the unassigned state (i.e., it has not been assigned to any security network segment by the network device 302), a first connection operation is performed between the communication device 304 and the network device 302. When the communication device 304 is in the unassigned state, in the first connection operation, the communication device 304 is used to provide the first security template to the network device 302 through the negotiation network segment. As described above, the first security template indicates the device capabilities and security requirements of the communication device 304 in the unassigned state. In one example, the negotiation network segment may refer to a network segment that supports security negotiation and is temporarily used for communication by the network device 302 and the communication device 304 before actually assigning (or allocating) a security network segment in a plurality of security network segments.

[0092] According to an embodiment, when the communication device 304 is in the unallocated state, the network device 302 is used to obtain the first security template from the communication device 304 through the negotiated network segment. The network device 302 is also used to determine a first security network segment from multiple security network segments according to the acquired first security template to allocate to the communication device 304. The network device 302 is also used to provide an instruction to connect to the first security network segment to the communication device 304. The instruction notifies the communication device 304 of the determined first security network segment, and the determined first security network segment meets the device capability and security requirements of the communication device 304.

[0093] The communication device 304 is further configured to obtain an instruction to connect to the first secure network segment from the network device 302. The communication device 304 is further configured to obtain a first network segment security template associated with the first secure network segment. The first network segment security template may be used to evaluate and verify whether the first secure network segment is suitable according to the first security template, and the first security template indicates the device capabilities and security requirements of the communication device 304. Therefore, it may be ensured that the communication device 304 actively participates in the decision regarding the association with the determined first secure network segment.

[0094] The communication device 304 is also used to connect the first security network segment according to the acquired instruction. Therefore, according to the first connection operation between the communication device 304 and the network device 302, the communication device 304 is assigned to the first security network segment. In some cases, the device operation state of the communication device 304 or the network environment of the communication device 304 may change. In such cases, the communication device 304 is also used to update the first security template to a second security template according to at least one change in the device operation state of the communication device 304 or the change in the network environment of the communication device 304. According to an embodiment, the second security template includes one or more of the following: the latest device attribute, the current device operation state, the last device operation state, the alternative network connection path used by the communication device 304, a request to access one or more services different from the services supported in the first security network segment assigned to the communication device 304, or a security event defining dynamically changing information associated with the communication device 304. The dynamically changing information is potentially related to a change in the application state or the hardware state of the communication device (eg, a sudden deactivation of a microphone or activation of a built-in camera (if any)).

[0095] In one example, the first security template of the communication device 304 may be updated due to an internal firewall application failure. In another example, the communication device 304 may be an IoT controller. First, the IoT controller may communicate with peer IoT devices via the first communication network 306 (e.g., a Wi-Fi channel) through the network device 302. The network connection path may suddenly change, wherein the IoT controller may start communicating with peer IoT devices and cloud servers directly through the second communication network 308 (e.g., a cellular network), thereby bypassing the first communication network 306 (i.e., the Wi-Fi channel). The first security template may be updated to reflect this change, so that the network device 302 can distinguish such communications conducted through an alternative network connection path 310 (i.e., a cellular network in this example). In another example, the communication device 304 may be an IoT device. For the IoT device, the IoT device is typically required to disconnect from the Wi-Fi network (e.g., the first communication network 306) when securely provisioned. The first security template may be updated to reflect such a requirement for temporary disconnection. In the conventional system and method, the network communication pattern does not immediately reflect such changes, so the conventional network device cannot know such changes. In addition, the conventional communication device has a static security template (i.e., a static device template). Compared with the conventional system and method, the first security template of the communication device 304 is dynamic and can adapt to changes.

[0096] In response to the first security template being updated to the second security template, the communication device 304 is configured to transmit a request to the network device 302. The request may be an on-demand request for reassigning a network segment from the currently assigned first security segment to a new security segment, and the new security segment is suitable according to at least one change of the first security template (e.g., a change of the device operating state of the communication device 304 or a change of the network environment of the communication device 304). Optionally, the request is potentially transmitted in the form of a message with a message type indication, and the message type indication indicates that the request is an on-demand request for reassigning a network segment from the communication device 304.

[0097] The communication device 304 is configured to provide security update information to the network device 302. When the communication device 304 is still assigned to the first security network segment associated with the first network segment security template, the communication device 304 provides the security update information. The security update information indicates at least one change of the first security template of the communication device 304. The network device 302 is configured to obtain the security update information from the communication device 304 assigned to the first security network segment.

[0098] According to an embodiment, the security update information corresponds to at least one of the following: the second security template or one or more differences between the second security template and the first security template. In one implementation, the entire second security template is provided to the network device 302 through the negotiation network segment. In other words, the second security template will be exposed (e.g., announced or published in the form of a list) so that the network device 302 can obtain the second security template. In another implementation, optionally, only the latest changes or updates (i.e., one or more differences between the second security template and the first security template) are provided (or exposed) to the network device 302 as the security update information, thereby saving network bandwidth and improving network performance. In such an implementation, the network device 302 can store the security template (e.g., the first security template) last received from the communication device 304, so that the second security template can be derived using the latest changes received. Alternatively, since the network device 302 has assigned the first network segment security template associated with the first security network segment to the communication device 304, receiving one or more differences between the second security template and the first security template may be sufficient to find a new security network segment that conforms to the one or more differences (i.e., the latest changes) in addition to other features of the first network segment security template.

[0099] The network device 302 is also used to determine a second secure network segment for the communication device 304 based on the security update information. The network device 302 is used to compare the security attribute associated with at least one change of the indication of the first security template with the corresponding security attribute associated with each of a plurality of network segment security templates, wherein the plurality of network segment security templates are associated with a plurality of secure network segments. The comparison is performed in order to find the best matching network segment of the communication device 304 (i.e., the second secure network segment in this case) from the plurality of secure network segments. According to an embodiment, the network device 302 is used to determine the second secure network segment using both a message type indication (which indicates information such as a network segment reallocation on-demand request) and the second security template.

[0100] The network device 302 is further configured to provide an instruction to connect to the determined second secure network segment to the communication device 304. According to an embodiment, the network device 302 is further configured to provide a second network segment security template associated with the determined second secure network segment to the communication device 304. The second network segment security template shared with the communication device enables the communication device 304 to verify the decision of whether to connect to the second secure network segment, thereby ensuring that the communication device 304 actively participates in the decision regarding the association with the determined second secure network segment.

[0101] Alternatively, according to an embodiment, the communication device 304 is further configured to obtain (or retrieve) the following items from the network device 302: a list of security services supported by the network device 302 for the second security network segment, a second network segment security template associated with the second security network segment, or multiple network segment security templates of the multiple security network segments available to the network device 302. Such information obtained from the network device 302 enables the communication device 304 to verify whether the second security network segment is suitable according to at least one change (i.e., the latest change) of the first security template. In other words, such information obtained from the network device 302 (e.g., the list of security services, the second network segment security template, and other available network segment security templates) enables security negotiation and mutual security verification between the communication device 304 and the network device 302. In other words, both the network device 302 and the communication device 304 can perform security negotiation, wherein one party (e.g., the network device 302) specifies a list of available options to allow the other party (e.g., the communication device 304) to select the best matching option (i.e., the correct security network segment), thereby reducing security network segment mismatches and improving overall network security and network management efficiency. Therefore, according to an embodiment, the communication device 304 is also used to verify the decision related to the connection of the second security network segment based on at least an evaluation of the obtained second network segment security template, and the obtained second network segment security template is associated with the second security network segment.

[0102] The communication device 304 is also used to connect the second security network segment according to the acquired instruction, and the second security network segment complies with at least one change of the indication of the first security template of the communication device. If the verification is successful (i.e., according to the security update information, the communication device 304 and the network device 302 mutually agree that the second security network segment is the best match), the communication device 304 connects the second security network segment. According to an embodiment, if the verification is successful, the communication device 304 is also used to control the enabling and disabling of one or more functions or services in the communication device 304 according to the acquired second network segment security template, and the acquired second network segment security template is associated with the second security network segment. The enabling and disabling of one or more functions or services in the communication device 304 may be performed after the verification is successful, and the communication device 304 connects the second security network segment. For example, if the network device 302 (e.g., a router) does not support a dedicated secure network segment for such functionality, the communication device 304 may disable firmware updates via the first communication network 306 (e.g., a Wi-Fi network) because, for certain communication devices such as the communication device 304, firmware updates via a flat network (e.g., the first communication network 306 in which all communication devices are connected through the same network device 302) are considered unsafe.

[0103] The network device 302 is also used to apply a specific network policy associated with the second security segment to the communication device after the communication device connects to the second security segment and leaves the first security segment. For example, the communication device 304 can be an IoT device. During pairing, the IoT device may need to connect only to a mobile phone (another communication device) and a specified cloud URL. Such requirements can be transmitted to the network device 302 by the communication device 304 as the security update information. In response, the network device 302 can temporarily connect the IoT device to a dedicated security segment (or allocate the dedicated security segment), which supports the assignment of the IoT device by a specific cloud and a specific mobile phone, and the dedicated security segment has a dedicated access policy associated with it (e.g., the specific network policy).

[0104] According to an embodiment, both or one of the network device 302 or the communication device 304 may support a traditional mode and a secure negotiation mode. In the case where a given network device (e.g., the network device 302) and a given communication device (e.g., the communication device 304) do not support the various operations performed by the network device 302 or the communication device 304 for secure negotiation as described above, such devices may continue to operate in the traditional mode (i.e., as defined in the existing systems and methods for network configuration). In addition, in the case where the network device 302 or the communication device 304 supports secure negotiation as described above in various operations, the specific network device or the communication device may switch to the secure negotiation mode. In other words, the disclosed network device 302 and the communication device 304 are backward compatible and support the allocation and connection of specific secure network segments according to their capabilities.

[0105] Figure 3B A block diagram showing various exemplary components of a network device provided by an embodiment of the present invention is shown. Figure 3C Combination Figure 3A Describes the elements in . Figure 3B , which shows the network device 302. The network device 302 includes a control circuit 312, a network interface 314, and a memory 316. The control circuit 312 can be communicatively coupled to the network interface 314 and the memory 316.

[0106] The control circuit 312 of the network device 302 is used to obtain the security update information from the communication device 304. The security update information indicates at least one change of the first security template of the communication device 304. In one implementation, the control circuit 312 may be a general-purpose processor. In one implementation, the control circuit 312 is used to execute instructions stored in the memory 316. Examples of the control circuit 312 may include, but are not limited to, a microprocessor, a microcontroller, a complex instruction set computing (CISC) processor, an application-specific integrated circuit (ASIC) processor, a reduced instruction set (RISC) processor, a very long instruction word (VLIW) processor, a central processing unit (CPU), a state machine, a data processing unit, and other processors or circuits. In addition, the control circuit 312 may refer to one or more independent processors, processing devices, and processing units as part of a machine.

[0107] The network interface 314 may include suitable logic, circuitry, and / or interfaces that may be used to communicate with one or more external devices such as the network device 302 or a peer communication device. Examples of the network interface 314 may include, but are not limited to, a radio frequency (RF) transceiver, an antenna, a telematics unit, one or more amplifiers, one or more oscillators, a digital signal processor, a coder-decoder (CODEC) chipset, and / or a subscriber identity module (SIM) card. The network interface 314 may communicate wirelessly using various wired or wireless communication protocols.

[0108] The memory 316 may include suitable logic, circuits and / or interfaces, which may be used to store machine code and / or instructions using at least one code segment executable by the control circuit 312. The memory 316 may store the multiple network segment security templates. Implementation examples of the memory 316 may include, but are not limited to, an electrically erasable programmable read-only memory (EEPROM), a random access memory (RAM), a read-only memory (ROM), a hard disk drive (HDD), a flash memory, a secure digital (SD) card, a solid-state drive (SSD), a computer-readable storage medium and / or a CPU cache memory. The memory 316 may store an operating system and / or other program products for operating the network device 302. The computer-readable storage medium for providing non-transient memory may include, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof.

[0109] Figure 3C A block diagram showing various exemplary components of a communication device provided by an embodiment of the present invention is shown. Figure 3C Combination Figure 1 , Figure 2 , Figure 3A and Figure 3B Describe. Figure 3C, which shows the communication device 304. The communication device 304 includes a control circuit 318, a network interface 320, an input / output (I / O) device 322, and a memory 324. The control circuit 318 can be communicatively coupled to the network interface 320, the I / O device 322, and the memory 324.

[0110] The control circuit 318 of the communication device 304 is used to provide the security update information to the network device 302. In one implementation, the control circuit 318 is used to execute instructions stored in the memory 324. The control circuit 318 is similar to the control circuit 312 ( Figure 3B ). Similarly, the implementation examples of the network interface 320 and the memory 324 are respectively similar to Figure 3B The implementation examples of the network interface 314 and the memory 316 are similar.

[0111] The I / O device 322 refers to an input and output device that can receive input from a user and provide output to the user. The I / O device 322 can be communicatively coupled to the control circuit 318. Examples of input devices may include, but are not limited to, a touch screen (e.g., a touch screen of a display device), a microphone, a motion sensor, a light sensor, a dedicated hardware input unit (e.g., a button or a keyboard), and a docking station. Examples of output devices include a display device and a speaker. Examples of the display device include, but are not limited to, a display screen, a smart glass display, a projection-based display, a virtual reality-based display, or other display screens.

[0112] Figure 4 Various exemplary functional components of a network device and a communication device for performing security negotiation for network configuration provided by an embodiment of the present invention are shown. Figure 4 Combination Figure 1 , Figure 2 and FIG. 3A to FIG. 3C Describe the elements of Figure 4 , which shows the network device 302 and the communication device 304, and also shows the security negotiation part 402, the security segment management part 404, the traffic controller 406, the packet switch 408 and the network interface 314 in the network device 302. The security negotiation part 402 includes a security negotiator 402a, a device registrar 402b, a security analyzer 402c and a policy manager 402d. In addition, the security negotiator 410, the policy enforcer 412, the application function 414, the system status 416 and the network interface 320 in the communication device 304 are also shown. In addition, the negotiation segment 418, the first security segment 420 and the second security segment 422 are also shown.

[0113] The various exemplary functional components of the network device 302 and the communication device 304 may be implemented as software modules, hardware modules, or a combination of software and hardware elements (e.g., executable code, logic, interface, or circuit). In one implementation, the operations or functions performed by such functional components (e.g., the security negotiation portion 402, the security segment management portion 404, the flow controller 406, and the packet switch 408) in the network device 302 may be implemented in the control circuit 312 ( Figure 3B ) for centralized management and operation under the control of the control circuit 318 of the network device 304. In another implementation, all functions or operations of the various functional components of the network device 302 may be performed by the control circuit 312 of the network device 302. Similarly, the various functional components of the communication device 304 (e.g., the security negotiator 410, the policy enforcer 412, the application function 414, and the system state 416) may be centrally managed and operated under the control of the control circuit 318 of the communication device 304. Figure 3C ) under the control of.

[0114] The security negotiation part 402 of the network device 302 supports security negotiation with multiple communication devices such as the communication device 304. The security negotiation part 402 is used to communicate with the multiple communication devices such as the communication device 304 through the negotiation network segment 418. The security negotiation part 402 includes a security negotiator 402a.

[0115] The security negotiator 402a is used to obtain (or sense) information related to each of the plurality of communication devices such as the communication device 304 (e.g., through the network interface 314), and the plurality of communication devices are communicatively coupled to the network device 302. The security negotiator 402a is also used to provide the sensed information (i.e., the information obtained from the communication device 304) to other functional components, such as the device registrar 402b, the security analyzer 402c, the policy manager 402d, the traffic controller 406, and the packet switch 408, for determining a specific security network segment from the plurality of security network segments suitable for the communication device 304. In one example, the security negotiator 402a is further configured to utilize information retrieved from multiple specified application programming interfaces (APIs) (e.g., open device APIs), use application layer protocols (e.g., simple network management protocol (SNMP)), specified cloud services (e.g., manufacturer usage description (MUD) specifications) and / or use communication analysis of the communication device 304 to determine the correct security segment (e.g., the first security segment or the second security segment) for the communication device 304. Advantageously, the security negotiator 402a supports various functions, such as assigning (or announcing or publishing in the network) a list of security services supported by the network device 302 and the multiple segment security templates of the multiple security segments available to the network device 302 to the multiple communication devices such as the communication device 304. The security negotiator 402a also satisfies requests related to information requests, network segment reallocation requests, network segment template sharing requests, or template update requests when receiving these requests from the communication device 304 and other communication devices.

[0116] In one example, the device register 402b may be a database in which a list of communication devices registered in the network device 302 is maintained. For example, a current list of communication devices that have connected to a specific security segment among the multiple security segments may be registered in the device register 402b. Optionally, the device register 402b may also maintain historical data (e.g., timestamps and corresponding device identifiers) related to a communication device (e.g., the communication device 304) among the multiple communication devices connecting to and leaving a specific security segment.

[0117] The security analyzer 402c is configured to compare security attributes associated with a given security template of a communication device (e.g., the communication device 304) with corresponding security attributes associated with each of a plurality of network segment security templates, the plurality of network segment security templates being associated with a plurality of secure network segments. The security analyzer 402c is communicatively coupled to the network segment manager 404a via the traffic controller 406.

[0118] The policy manager 402d is used to manage different network policies associated with different security network segments. In addition, the policy manager 402d is used to apply a specific network policy associated with a specific security network segment to a specific communication device (such as the communication device 304) after the communication device connects to the specific security network segment.

[0119] The secure network segment management part 404 supports managing the multiple network segment security templates of the multiple secure network segments in the network device 302. The secure network segment management part 404 includes the network segment manager 404a and the network builder 404b. The network segment manager 404a is potentially responsible for creating and managing the multiple network segment security templates, and further sharing such network segment security templates according to requests received from the multiple communication devices (e.g., the communication device 304).

[0120] The traffic controller 406 is responsible for managing the flow of information and instructions into and out of the network device 302 for the first connection operation, as well as the on-demand network segment reallocation requests received from the plurality of communication devices (eg, the communication device 304).

[0121] The packet switch 408 enables data to be transmitted in the form of data packets between the network device 302 and each of the plurality of communication devices (e.g., the communication device 304) through the assigned secure network segment (e.g., the first secure network segment 420 or the second secure network segment 422). Each data packet may include various detailed information, such as a source IP address, a destination IP address, and unique data and a data packet identifier. After the communication device 304 connects to the second secure network segment 422 and leaves the first secure network segment 420, the packet switch 408 is used to exchange data traffic and related communications only through the second secure network segment 422.

[0122] The security negotiator 410 of the communication device 304 supports security negotiation with the network device 302 through the negotiation network segment 418, etc. Advantageously, the security negotiator 410 supports various functions, such as providing the first security template (i.e., device security template) to the network device 302, or announcing or publishing in the network so that the network device 302 can obtain the published first security template. The security negotiator 410 is used to transmit various requests to the network device 302, such as the information request, the network segment reallocation request, the network segment template sharing request, or the template update request. If there is any change in the security requirements of the communication device 304 (e.g., the security update information indicating the latest change of the first security template), the security negotiator 410 will update the network device 302. The security negotiator 410 is further configured to retrieve a list of security services supported by the network device 302, a segment security template assigned to a new secure segment (e.g., the second secure segment 422) assigned to the communication device 304, or the plurality of segment security templates of the plurality of secure segments available to the network device 302. The security negotiator 410 ensures that the communication device 304 actively participates in the decision regarding the association with a particular secure segment determined (or assigned) by the network device 302. The security negotiator 410 is configured to notify the policy enforcer 412 to perform a local policy enforcement function according to the segment security template of the secure segment (e.g., the first secure segment 420 or the second secure segment 422) to which the communication device 304 is connected.

[0123] The policy enforcer 412 is responsible for enabling and disabling one or more functions or services in the communication device 304 according to the segment security template of the security segment (eg, the first security segment 420 or the second security segment 422) to which the communication device 304 is connected.

[0124] The application function 414 is used to detect changes in the application state of one or more applications, operating systems, and associated data, or changes in the hardware state of the communication device 304. For example, any changes in the device operating state of the communication device 304, or the changes in the network environment of the communication device 304 that potentially affect the security of the communication device 304 are detected. Such detected changes are notified to the system state 416.

[0125] The system state 416 may refer to a recorder (or database) that records such changes detected and notified by the application function 414. The first security template is updated to the second security template according to one or more changes in the device operating state or network environment of the communication device 304. Then, the security negotiator 410 updates such changes in security requirements to the network device 302 in the form of security update information indicating the latest changes in the first security template of the communication device 304.

[0126] Figure 5 A diagram of an exemplary scenario 500 illustrating the working principle of performing security negotiation for network configuration provided by an embodiment of the present invention is shown. Figure 5 Combination Figure 1 , Figure 2 , Figures 3A to 3C and Figure 4 Reference Figure 5 , which shows the exemplary scenario 500, describing the first security template 502 and the second security template 504 of the communication device 304. In addition, the network device 302 ( Figure 3A )'s first network segment security template 506 and the second network segment security template 508, and the first security network segment 420 and the second security network segment 422 are also shown.

[0127] According to the exemplary scenario 500, template definitions of various security templates (e.g., the first security template 502, the second security template 504, the first network segment security template 506, and the second network segment security template 508) are represented by functional vectors (e.g., features, services, or security requirements), where "V" indicates "must be supported", "X" indicates "must be disabled", and a blank box indicates a neutral state in which any state is acceptable.

[0128] As shown, the communication device 304 may include the first security template 502 indicating the first device operation state of the communication device 304. As shown, in the first security template 502, there are a plurality of fields including "V", blank boxes, or "X". The communication device 304 having the first security template 502 in the first device operation state is assigned to the first security segment 420. The first security segment 420 is associated with the first segment security template 506, which is suitable for the communication device 304 according to the first security template 502 of the communication device 304. For example, in the first security template 502, the field 510A is a blank box, and no security requirements are established for a specific function of the field 510A (e.g., FTP upload to a specific URL). Thus, when connected to the first secure network segment 420 associated with the first network segment security template 506, in which a given function (e.g., FTP upload to a specific URL) is allowed and supported (indicated by "V" in the corresponding field 510B), the communication device 304 has sufficient security. However, the device operating state of the communication device 304 may change from the first device operating state to the second device operating state. Then, the first security template 502 is updated to the second security template 504 to reflect the change in the device operating state. For example, a new requirement may be related to "backup of user credentials", and therefore, the given function in field 510A of the second security template 504 may begin to conflict (i.e., conflict) with the corresponding field 510B of the first network segment security template 506. The new requirement is that during backup (e.g., during FTP upload to a specific URL), a given feature (or function) must be disabled. The communication device 304 is used to transmit a request to reallocate a secure network segment to the network device 302. After detecting the template conflict (and before the communication device 304 initiates the actual backup using the given URL), the communication device 304 also provides the second security template 504 to the network device 302. In response to the received request and the second security template 504, the network device 302 is configured to determine the second security segment 422 as the best match that meets the new requirements (i.e., the latest changes). For example, the second segment security template 508 associated with the second security segment 422 disables a given function in field 510B (e.g., disables "backup of user credentials" during backup). Therefore, in this case, when the communication device connects to the second security segment 422, the security is strengthened.

[0129] Figure 6 A diagram of an exemplary scenario 600 for different communication devices to perform security negotiation for a network configuration according to an embodiment of the present invention is shown. Figure 6Combination Figure 1 , Figure 2 , Figures 3A to 3C , Figure 4 and Figure 5 Reference Figure 6 , which shows the exemplary scenario 600, including a gateway device 602, a group of untrusted devices 604, a group of trusted devices 606, and a group of IoT devices 608. In addition, a first secure network segment 610, a second secure network segment 612, a third secure network segment 614, a communication network 616, an alternative network connection path 618, and a group of network connections 620 from an IoT controller 622 in the group of IoT devices 608 to peer IoT devices are also shown.

[0130] According to the exemplary scenario 600, the gateway device 602 corresponds to the network device 302 ( Figure 3A Each of the group of untrusted devices 604, the group of trusted devices 606, and the group of IoT devices 608 corresponds to the communication device 304 ( Figure 3A ). Each of the group of untrusted devices 604, the group of trusted devices 606, and the group of IoT devices 608 may be directly connected to the gateway device 602 via a Wi-Fi network, and may access network resources of the communication network 616 (e.g., the Internet) through the gateway device 602. Some IoT devices (e.g., the IoT device 624) may not be directly connected to the gateway device 602, and may be communicatively coupled to another IoT device, such as the IoT controller 622, via the group of network connections 620.

[0131] Typically, in conventional systems and methods, the communication between the IoT controller 622 and the IoT device 624 through the set of network connections 620 may not be visible to conventional gateway devices. In other words, the conventional gateway device may not be aware of such communication, which may have adverse security implications. In addition, some IoT devices (e.g., the IoT controller 622) may bypass the gateway device 602 and directly access the communication network 616 (i.e., the Internet) by using the alternative network connection path 618 (e.g., a cellular network). In conventional systems and methods, the conventional gateway device may also be unaware of such communication through the alternative network connection path 618, which may have adverse security implications. In contrast to conventional systems and methods, the disclosed method and device (e.g., the gateway device 602) uses a security template (e.g., the first security template) of each communication device (e.g., each of the set of untrusted devices 604, the set of trusted devices 606, and the set of IoT devices 608a has its own security template, referred to as the first security template) to capture such unexposed communications. Such a first security template provided by each of the group of untrusted devices 604, the group of trusted devices 606, and the group of IoT devices 608 enables the gateway device 602 to enhance its assessment of the security capabilities and security requirements of each device. For example, by using the first security template, certain security features (or security postures) of each communication device that the gateway device 602 may not be able to detect (i.e., not exposed) through a conventional Wi-Fi communication channel (e.g., using an automatic detection function) can be easily and accurately detected. Therefore, the first security template enables the gateway device 602 to determine the most matching security network segment from the multiple security network segments to allocate to the corresponding communication device, thereby providing sufficient security. For example, the group of untrusted devices 604 can be guest devices (e.g., devices with unknown device types, unsupported manufacturers, or unknown vendors may exhibit unpredictable behavior), and a dedicated security network segment, such as the first security network segment 610, can be allocated to the guest device. Compared with the group of trusted devices 606, security will be relatively more strengthened (i.e., access is restricted) in the first security network segment 610. Similarly, according to the first security template obtained from each communication device, the gateway device 602 is also used to determine the second security segment 612 for the group of trusted devices 606 and the third security segment 614 for the group of IoT devices 608. When the device operation status or the network environment of one or more communication devices (for example, one or more of the group of untrusted devices 604, the group of trusted devices 606, and the group of IoT devices 608) changes, the security update information corresponding to such communication devices is actively provided to the gateway device 602.Such communication device initiated updates (i.e., the security update information) enable each connected communication device to actively participate in the decision about the association with the security segment. Since each communication device actively shares the security update information, the gateway device 602 can determine the correct security segment that conforms to the latest changes of the first security template of the corresponding communication device in real time or near real time. Therefore, the probability of security segment mismatch is significantly reduced, thereby reducing the risk of security vulnerabilities in each participating communication device and improving overall network security and network management efficiency.

[0132] Without departing from the scope of the invention as defined by the appended claims, the embodiments of the invention described above may be modified. Expressions such as "including", "combined with", "having", "is" etc. used to describe and claim the present invention are intended to be interpreted in a non-exclusive manner, that is, items, parts or elements that are not explicitly described are allowed to exist. References to the singular should also be interpreted as being related to the plural. The word "exemplary" used herein means "as an example, instance or illustration". Any embodiment described as "exemplary" is not necessarily interpreted as being more preferred or more advantageous than other embodiments, and / or excluding the combination of the features of other embodiments. The word "optionally" used herein means "provided in some embodiments and not provided in other embodiments". It should be understood that some features of the present invention described in the context of a separate embodiment for the sake of clarity may also be provided in combination in a single embodiment. On the contrary, the various features of the present invention described in the context of a single embodiment for the sake of brevity may also be provided separately, in any suitable combination, or suitable for any other described embodiment of the present invention.

Claims

1. A method (100) for performing security negotiation for network configuration in a network device (302), characterized in that: The method (100) comprises: The network device (302) obtains security update information from a communication device (304) assigned to a first security network segment (420, 610), the first security network segment (420, 610) being associated with a first network segment security template (506), wherein the security update information indicates at least one change of the first security template (502) of the communication device (304); The network device (302) determines a second security network segment (422, 612) for the communication device (304) according to the security update information; The network device (302) provides the communication device (304) with an instruction to connect to the determined second secure network segment (422, 612).

2. The method (100) according to claim 1, characterized in that: The method (100) also includes: the network device (302) provides the communication device (304) with a second network segment security template (508) associated with the determined second security network segment (422, 612), wherein the communication device (304) uses the second network segment security template (508) to: verify the decision to connect to the second security network segment (422, 612); and based on the verification, control the enabling and disabling of one or more functions or services in the communication device (304) according to the second network segment security template (508).

3. The method (100) according to claim 1 or 2, characterized in that: The network device (302) obtains the security update information according to a change in the device operating state of the communication device (304) or a change in the network environment of the communication device (304).

4. The method (100) according to claim 1 or 2, characterized in that: Determining the second secure network segment (422, 612) for the communication device (304) includes comparing a security attribute associated with at least one change of the indication of the first security template (502) with a corresponding security attribute associated with each of a plurality of network segment security templates, the plurality of network segment security templates being associated with a plurality of secure network segments.

5. The method (100) according to claim 1 or 2, characterized in that: The method (100) also includes: after the communication device (304) connects to the second secure network segment (422, 612) and leaves the first secure network segment (420, 610), applying a specific network policy associated with the second secure network segment (422, 612) to the communication device (304).

6. The method (100) according to claim 1 or 2, characterized in that: The first security template (502) includes one or more of the following: device attributes, device operating status, the network environment of the communication device (304), or a request to access one or more services in the communication device (304); the communication device (304) updates the first security template (502) to a second security template based on at least one change in the device operating status of the communication device (304) or a change in the network environment of the communication device (304).

7. The method (100) according to claim 6, characterized in that: The security update information corresponds to at least one of the following: the second security template (504) or one or more differences between the second security template (504) and the first security template (502); the second security template (504) includes one or more of the following: the latest device attributes, the current device operating status, the last device operating status, an alternative network connection path used by the communication device (304), a request to access one or more services different from the services supported in the first security network segment (420, 610) assigned to the communication device (304), or a security event defining dynamically changing information associated with the communication device (304).

8. The method (100) according to claim 7, characterized in that: Determining the second secure network segment (422, 612) for the communication device (304) includes using a message type indication and the second security template.

9. The method (100) according to claim 1 or 2, characterized in that: The communication device (304) is allocated to the first security network segment (420, 610) according to a first connection operation between the network device (302) and the communication device (304), and the first connection operation includes: When the communication device (304) is in a state where a given security network segment is not allocated, the network device (302) obtains the first security template (502) from the communication device (304) by negotiating a network segment (418), and the first security template (502) indicates the device capability and security requirements of the communication device (304) in the unallocated state; The network device (302) determines the first security network segment (420, 610) from a plurality of security network segments according to the acquired first security template (502) to allocate the first security network segment to the communication device (304); An instruction for connecting to the first secure network segment (420, 610) is provided to the communication device (304), wherein the instruction notifies the communication device (304) of the determined first secure network segment (420, 610), and the determined first secure network segment (420, 610) complies with the device capabilities and security requirements of the communication device (304).

10. A method (200) for performing security negotiation for network configuration in a communication device (304), characterized in that: The method (200) comprises: The communication device (304) provides security update information to a network device (302), the communication device (304) being assigned to a first security network segment (420, 610) associated with a first network segment security template (506), wherein the security update information indicates at least one change to the first security template (502) of the communication device (304); The communication device (304) obtains an instruction for connecting to a second secure network segment (422, 612) from the network device (302); The communication device (304) connects to the second security network segment (422, 612) according to the acquired instruction, and the second security network segment (422, 612) complies with at least one change of the indication of the first security template (502) of the communication device (304).

11. The method (200) according to claim 10, characterized in that: The communication device (304) provides the security update information to the network device (302) according to a change in the device operation state of the communication device (304) or a change in the network environment of the communication device (304).

12. The method (200) according to claim 10 or 11, characterized in that: The first security template (502) includes one or more of the following: device attributes, device operating status, a network environment of the communication device (304), or a request to access one or more services in the communication device (304).

13. The method (200) according to claim 10 or 11, characterized in that: The method (200) further includes: the communication device (304) updating the first security template (502) to a second security template (504) according to at least one change in the device operating state of the communication device (304) or a change in the network environment of the communication device (304).

14. The method (200) according to claim 13, characterized in that: The security update information corresponds to at least one of the following: the second security template (504) or one or more differences between the second security template (504) and the first security template (502); the second security template (504) includes one or more of the following: the latest device attributes, the current device operating status, the last device operating status, an alternative network connection path used by the communication device (304), a request to access one or more services different from the services supported by the first security segment (420, 610), or a security event defining dynamically changing information associated with the communication device (304); the network device (302) uses the message type indication and the second security template (504) to determine the second security segment (422, 612) for the communication device (304).

15. The method (200) according to claim 10 or 11, characterized in that: The connection of the second security network segment (422, 612) includes: the communication device (304) obtains one or more of the following items from the network device (302): a list of security services supported by the network device (302) for the second security network segment (422, 612), a second network segment security template (508) associated with the second security network segment (422, 612), or multiple network segment security templates for multiple security network segments available to the network device (302).

16. The method (200) according to claim 15, characterized in that: The connection of the second secure network segment (422, 612) further includes: The communication device (304) verifies a decision related to the connection of the second secure network segment (422, 612) based on an evaluation of the acquired second network segment security template (508), the acquired second network segment security template (508) being associated with the second secure network segment (422, 612); If the verification is successful, the communication device (304) controls the enabling and disabling of one or more functions or services in the communication device (304) according to the acquired second network segment security template (508), and the acquired second network segment security template (508) is associated with the second security network segment (422, 612).

17. The method (200) according to claim 10, characterized in that: The communication device (304) is assigned to the first security network segment (420, 610) according to a first connection operation between the communication device (304) and the network device (302), and the first connection operation includes: When the communication device (304) is in a state where a given security network segment is not allocated, the communication device (304) provides the first security template (502) to the network device (302) by negotiating a network segment (418), wherein the first security template (502) indicates device capabilities and security requirements of the communication device (304) in the unallocated state; The communication device (304) obtains an instruction for connecting to the first secure network segment (420, 610) from the network device (302); The communication device (304) connects to the first secure network segment (420, 610) according to the acquired instruction.

18. A network device (302) for performing security negotiation for a network configuration, characterized in that The network device (302) comprises: A control circuit (312), the control circuit (312) being configured to: Obtaining security update information from a communication device (304) assigned to a first security network segment (420, 610), the first security network segment (420, 610) being associated with a first network segment security template (506), wherein the security update information indicates at least one change to the first security template (502) of the communication device (304); Determining a second secure network segment (422, 612) for the communication device (304) according to the security update information; An instruction to connect to the determined second secure network segment (422, 612) is provided to the communication device (304).

19. A communication device (304) for performing security negotiation for a network configuration, characterized in that The communication device (304) comprises: A control circuit (318), wherein the control circuit (318) is configured to: providing security update information from the communication device (304) assigned to a first secure network segment (420, 610) to a network device (302), the first secure network segment (420, 610) being associated with a first network segment security template (506), wherein the security update information indicates at least one change to the first security template (502) of the communication device (304); Obtaining an instruction to connect to a second secure network segment (422, 612) from the network device (302); The second security network segment (422, 612) is connected according to the acquired instruction, and the second security network segment (422, 612) complies with at least one change of the indication of the first security template (502) of the communication device (304).

20. A computer program product comprising a non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores computer-readable instructions for performing the method according to any one of claims 1 to 9 when a computerized device including processing hardware is capable of executing the computer-readable instructions.

21. A computer program product comprising a non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores computer-readable instructions for performing the method according to any one of claims 10 to 17 when a computerized device including processing hardware is capable of executing the computer-readable instructions.

Images