A network information system endogenous security defense method, device, equipment and medium

Abstract

The present application discloses a method, device, equipment and medium for endogenous security defense of a network information system, and relates to the field of network security technology. The method includes: obtaining a target business request for a network information system; determining a target business type corresponding to the target business request, and determining a target trusted virtual machine corresponding to the target business type from a trusted virtual machine pre-created in a trusted virtual environment; the trusted virtual environment is a virtualized environment obtained by deploying trusted basic software and host security mechanisms on a trusted host system; and different trusted virtual machines carry different security defense services; using the security defense service in the target trusted virtual machine to process the business corresponding to the target business request, so as to realize the endogenous security defense of the network information system. Through the above technical solution, an endogenous security system of a network information system can be established to realize the endogenous security defense of the network information system.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an endogenous security defense method, device, equipment and medium for a network information system. Background Art

[0002] At present, facing the ever-changing network threats, network security has evolved to the era of "endogenous security", which requires the continuous growth of adaptive, autonomous and self-growing security capabilities from the information system through aggregation. In my country, the academic and industrial circles have also set off a research boom in endogenous security technology, and new security technologies such as Trusted Computing 3.0, Mimic Security, Dynamic Active Defense, and Zero Trust have emerged.

[0003] At present, network information systems in many industries such as civil aviation, railway passenger transport, and hotels are showing a trend of business flexibility and openness, which is bound to lead to the blurring of system security boundaries and the dispersion of traditional security protection capabilities. In summary, how to establish an endogenous security system for network information systems to achieve endogenous security defense of network information systems under limited resources needs to be further resolved. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a network information system endogenous security defense method, device, equipment and medium, which can establish a network information system endogenous security system to achieve endogenous security defense of the network information system under limited resources. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses an endogenous security defense method for a network information system, comprising:

[0006] Obtaining target business requests for network information systems;

[0007] Determine the target service type corresponding to the target service request, and determine the target trusted virtual machine corresponding to the target service type from the trusted virtual machines pre-created in the trusted virtual environment; the trusted virtual environment is a virtualized environment obtained by deploying trusted basic software and host security mechanisms on a trusted host system; and different trusted virtual machines carry different security defense services;

[0008] The security defense service in the target trusted virtual machine is used to process the business corresponding to the target business request, so as to realize the inherent security defense of the network information system.

[0009] Optionally, the determining a target service type corresponding to the target service request, and determining a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment, includes:

[0010] If the target service type is dynamic authentication for an identity subject, a target trusted virtual machine corresponding to the dynamic authentication is determined from trusted virtual machines pre-created in a trusted virtual environment.

[0011] Optionally, if the target service type is dynamic authentication for an identity subject, determining a target trusted virtual machine corresponding to the dynamic authentication from trusted virtual machines pre-created in a trusted virtual environment includes:

[0012] If the user corresponding to the dynamic authentication service request is an uncontrolled terminal user, a trusted virtual machine pre-deployed with an uncontrolled terminal access authentication service integrating physical information is determined as a target trusted virtual machine from trusted virtual machines pre-created in a trusted virtual environment, and a corresponding trusted virtual machine is separately allocated to the uncontrolled terminal user;

[0013] Accordingly, the process of using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request to achieve the inherent security defense of the network information system includes:

[0014] The uncontrolled terminal access authentication service in the target trusted virtual machine is used to process the service corresponding to the dynamic authentication service request, and the trusted virtual machine corresponding to the uncontrolled terminal user is used to reside the uncontrolled terminal user's data and access operations. If the uncontrolled terminal user is found to have abnormal or illegal behavior, the access of the uncontrolled terminal user is interrupted by suspending or shutting down the trusted virtual machine corresponding to the uncontrolled terminal user, so as to achieve secure access authentication between the uncontrolled terminal user and the network information system.

[0015] Optionally, when the target service type is dynamic authentication for an identity subject, determining a target trusted virtual machine corresponding to the dynamic authentication from trusted virtual machines pre-created in a trusted virtual environment includes:

[0016] If the user corresponding to the dynamic authentication service request is a controlled terminal user, determining a trusted virtual machine with a pre-deployed secure time forensics mechanism as a target trusted virtual machine from trusted virtual machines pre-created in a trusted virtual environment;

[0017] Accordingly, the process of using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request to achieve the inherent security defense of the network information system includes:

[0018] Generate a corresponding public-private key pair based on a unique identifier pre-inserted into a trusted module of the controlled terminal, and verify the security status of the controlled terminal based on the public-private key pair;

[0019] The secure time forensics mechanism in the target trusted virtual machine is used to monitor and collect forensics on the security events of the controlled terminal, so as to achieve secure access authentication between the controlled terminal user and the network information system.

[0020] Optionally, the determining a target service type corresponding to the target service request, and determining a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment, includes:

[0021] If the target service type is software-defined security resource management, determining a trusted virtual machine in which a security resource management service is pre-deployed from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine;

[0022] Accordingly, the process of using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request to achieve the inherent security defense of the network information system includes:

[0023] Using the target trusted virtual machine to separate the security resource management software and hardware through virtualization technology and pool the security capability resources in the network information system to obtain pooled virtualized security capability resources;

[0024] The virtualized security capability resources are divided and recombined as needed according to the system security protection requirements corresponding to the target business, so as to realize the security capability resource management of the network information system.

[0025] Optionally, the determining a target service type corresponding to the target service request, and determining a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment, includes:

[0026] If the target service type is dynamic access control, determining a trusted virtual machine pre-deployed with a dynamic access control service from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine;

[0027] Accordingly, the process of using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request to achieve the inherent security defense of the network information system includes:

[0028] The target trusted virtual machine is used to perform precise dynamic access control on the preset dimensions of the access request in the target business, and the corresponding access control policy is adapted according to the changes in the attributes in the preset dimensions to achieve secure access and management of the access subject and the accessed business resources.

[0029] Optionally, the determining a target service type corresponding to the target service request, and determining a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment, includes:

[0030] If the target service type is attack detection and protection, determining a trusted virtual machine pre-deployed with attack detection and protection services from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine;

[0031] Accordingly, the process of using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request to achieve the inherent security defense of the network information system includes:

[0032] By using the data probe pre-installed in the target trusted virtual machine, the business resource application layer traffic of the network information system is collected through a bypass mirror to obtain corresponding collected data;

[0033] Based on the collected data and the preset security log based on deep traffic analysis, identify illegal access subjects with abnormal entity behavior from the corresponding access subjects and access objects;

[0034] Based on port hiding and access control rules, the access behavior of the illegal access subject is prohibited to achieve illegal attack defense of the network information system.

[0035] In a second aspect, the present application discloses an endogenous security defense device for a network information system, comprising:

[0036] A business request acquisition module is used to acquire target business requests for the network information system;

[0037] A trusted virtual machine determination module is used to determine the target service type corresponding to the target service request, and determine a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment; the trusted virtual environment is a virtualized environment obtained by deploying trusted basic software and host security mechanisms on a trusted host system; and different trusted virtual machines carry different security defense services;

[0038] The business request security processing module is used to utilize the security defense service in the target trusted virtual machine to process the business corresponding to the target business request, so as to realize the inherent security defense of the network information system.

[0039] In a third aspect, the present application discloses an electronic device, comprising:

[0040] Memory, used to store computer programs;

[0041] The processor is used to execute the computer program to implement the steps of the aforementioned method for endogenous security defense of network information system disclosed above.

[0042] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned method for endogenous security defense of a network information system are implemented.

[0043] When performing endogenous security defense of a network information system, the present application first obtains a target service request for the network information system; determines the target service type corresponding to the target service request, and determines the target trusted virtual machine corresponding to the target service type from the trusted virtual machines pre-created in the trusted virtual environment; the trusted virtual environment is a virtualized environment obtained by deploying trusted basic software and host security mechanisms on a trusted host system; and different trusted virtual machines carry different security defense services; the security defense services in the target trusted virtual machines are used to process the services corresponding to the target service request, so as to realize the endogenous security defense of the network information system. It can be seen that in the present application, a trusted virtual environment is obtained by deploying trusted basic software and host security mechanisms on a trusted host system, and a number of trusted virtual machines are preset in the trusted virtual environment, and corresponding security defense services are deployed for the trusted virtual machines; when a target service request for the network information system is obtained, the target trusted virtual machine corresponding to the target service type is determined from the trusted virtual machines by the target service type corresponding to the target service request. Therefore, when a target business request for a network information system is obtained, the preset trusted virtual machine is orchestrated and scheduled by the trusted virtual environment, so that the target virtual machine further completes the target business request in the endogenous security defense of the network information system, and integrates the security design with the network design based on trusted computing and virtual machines to achieve the integration of the business functions and security of the network information system. The target business request is processed by the preset trusted virtual machine instead of directly accessing the network information system, thereby improving the overall planning level of the network information system, so as to respond to unknown security threats, and at the same time establish an endogenous security system of the network information system that integrates multiple business requests to achieve endogenous security defense of the network information system under limited resources. In summary, the present application can establish an endogenous security system of the network information system to achieve endogenous security defense of the network information system under limited resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A flowchart of an endogenous security defense method for a network information system provided in this application;

[0046] Figure 2 Schematic diagram of the intrinsic security infrastructure provided for this application;

[0047] Figure 3 Schematic diagram of the intrinsic security defense architecture of the network information system based on trusted computing and virtual machines provided for this application;

[0048] Figure 4 A flowchart of a specific network information system endogenous security defense method provided for this application;

[0049] Figure 5 A flowchart of a specific network information system endogenous security defense method provided for this application;

[0050] Figure 6 A schematic diagram of trusted dynamic authentication for identity subjects provided for this application;

[0051] Figure 7 A flowchart of a specific network information system endogenous security defense method provided for this application;

[0052] Figure 8 A flowchart of a specific network information system endogenous security defense method provided for this application;

[0053] Fig. 9 A flowchart of a specific network information system endogenous security defense method provided for this application;

[0054] Fig.10 A schematic diagram of dynamic access and attack detection provided for this application;

[0055] Fig.11 A schematic diagram of the structure of an endogenous security defense device for a network information system provided in this application;

[0056] Fig.12 A structural diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] At present, network information systems in many industries such as civil aviation, railway passenger transport, and hotels are showing a trend of business flexibility and openness, which is bound to lead to the blurring of system security boundaries and the dispersion of traditional security protection capabilities. To this end, the present application provides a network information system endogenous security defense method that can establish an endogenous security system for the network information system to achieve endogenous security defense of the network information system under limited resources.

[0059] The embodiment of the present invention discloses a method for endogenous security defense of a network information system, see Figure 1 As shown, the method includes:

[0060] Step S11: Obtain a target service request for the network information system.

[0061] In this embodiment, a target business request for a network information system is obtained, wherein the target business request includes but is not limited to onboard trusted dynamic authentication for identity subjects and onboard dynamic access control and attack detection based on zero trust, and the target business request for the network information system is obtained so that the target business request can be securely processed subsequently through the business processing service in the trusted virtual machine created in advance in the trusted virtual environment.

[0062] Step S12: Determine the target business type corresponding to the target business request, and determine the target trusted virtual machine corresponding to the target business type from the trusted virtual machines pre-created in the trusted virtual environment; the trusted virtual environment is a virtualized environment obtained by deploying trusted basic software and host security mechanisms on a trusted host system; and different trusted virtual machines carry different security defense services.

[0063] In this embodiment, the trusted virtual environment is a virtualized environment obtained by deploying trusted basic software and host security mechanisms on a trusted host system. That is, before obtaining a target service request, it also includes: building an endogenous security infrastructure framework for a network information system based on trusted computing. Specifically, the endogenous security infrastructure framework is as follows: Figure 2As shown, by using chips, storage cards, high-speed boards, etc. as physical trusted roots in physical form, trusted basic software and host security mechanisms are deployed on the trusted host system to build a trusted virtual environment; virtualization technology is used to virtualize the physical trusted root into several virtual trusted roots, and based on the virtual trusted roots, key generation, key distribution and key protection related to the trusted virtual machine are implemented in the trusted virtual environment, and business service processing modules corresponding to different business types are deployed in the preset trusted virtual machine to complete different types of security defense services; at the same time, the security management and orchestration scheduling of the preset trusted virtual machine are implemented through the trusted virtual environment, and the trust chain is passed to the virtual machine level to achieve integrity protection and virtualization security defense for hardware and software, and a dynamic security policy that can adapt to on-demand resource sharing in the virtualized environment is implemented in the security management and orchestration scheduling of the trusted virtual machine.

[0064] In this embodiment, the target service type corresponding to the target service request includes but is not limited to dynamic access control, attack detection and protection, software-defined security resource management, uncontrolled terminal authentication and controlled terminal authentication services. Figure 3 As shown, when the target business request is obtained and the target business type is determined, the preset trusted virtual machine is orchestrated and scheduled by the trusted virtual environment in the intrinsic security infrastructure of the network information system built based on trusted computing to determine the target trusted virtual machine corresponding to the target business type, so as to facilitate the subsequent use of the target trusted virtual machine to process the business corresponding to the target business request.

[0065] Step S13: Utilize the security defense service in the target trusted virtual machine to process the service corresponding to the target service request, so as to realize the inherent security defense of the network information system.

[0066] In this embodiment, the security defense service in the target trusted virtual machine is used to process the business corresponding to the target business request to realize the intrinsic security defense of the network information system. Through the above technical solution, with trusted computing and virtual machines as technical means, the security design and network design are integrated to realize the integration of network information system functions and security, and establish an intrinsic security protection mechanism integrating access authentication, process management, and resource control. It solves the problem of network information system security capabilities being backward, scattered, and incomplete under the development trend of increasing openness and flexibility in many industry fields such as civil aviation, railway passenger transportation, and hotels, and has achieved the goals of identity security, data security, and business security.

[0067] It can be seen that in this embodiment, a trusted virtual environment is obtained by deploying trusted basic software and host security mechanism on a trusted host system, and a number of trusted virtual machines are preset in the trusted virtual environment, and corresponding security defense services are deployed for the trusted virtual machines; when a target service request for a network information system is obtained, a target trusted virtual machine corresponding to the target service type is determined from the trusted virtual machine by the target service type corresponding to the target service request. Thus, when a target service request for a network information system is obtained, the preset trusted virtual machine is orchestrated and scheduled by the trusted virtual environment, so that the target virtual machine further completes the target service request in the endogenous security defense of the network information system, and the security design is integrated with the network design based on trusted computing and virtual machines to realize the integration of network information system business functions and security, and the target service request is processed by the preset trusted virtual machine instead of directly accessing the network information system, thereby improving the overall planning level of the network information system, so as to deal with unknown security threats, and at the same time establish an endogenous security system of the network information system with integrated multi-service requests to realize the endogenous security defense of the network information system under limited resources. In summary, the present application can establish an endogenous security system of the network information system to realize the endogenous security defense of the network information system under limited resources.

[0068] See also Figure 4 As shown, the embodiment of the present invention discloses a specific method for endogenous security defense of a network information system. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution.

[0069] Step S21: Obtain a target service request for the network information system.

[0070] Step S22: If the target service type is dynamic authentication of an uncontrolled terminal user, a target trusted virtual machine corresponding to the dynamic authentication of the uncontrolled terminal user is determined from trusted virtual machines pre-created in a trusted virtual environment.

[0071] Specifically, if the user corresponding to the dynamic authentication service request is an uncontrolled terminal user, a trusted virtual machine pre-deployed with an uncontrolled terminal access authentication service integrating physical information is determined from the trusted virtual machines pre-created in the trusted virtual environment as the target trusted virtual machine, and the corresponding trusted virtual machine is separately allocated to the uncontrolled terminal user. It can be understood that in view of the problem that the existing simple authentication method for uncontrolled terminal users to access wireless networks is easy to be counterfeited, and then attack the network or even penetrate into the information system, the uncontrolled terminal access authentication service integrating physical information is pre-deployed in the trusted virtual machine, and the corresponding trusted virtual machine is separately allocated to each access user, so as to facilitate the subsequent use of the corresponding target trusted virtual machine for dynamic authentication of the uncontrolled terminal user.

[0072] Step S23: utilizing the dynamic authentication service of the uncontrolled terminal user in the target trusted virtual machine to process the service corresponding to the target service request, so as to realize the secure access authentication between the uncontrolled terminal user and the network information system.

[0073] The uncontrolled terminal access authentication service in the target trusted virtual machine is used to process the service corresponding to the dynamic authentication service request, and the trusted virtual machine corresponding to the uncontrolled terminal user is used to reside the uncontrolled terminal user data and access operations, and then further connected to the background business system and business resources. If the uncontrolled terminal user is found to have abnormal or illegal behavior, the access of the uncontrolled terminal user is interrupted by suspending or shutting down the trusted virtual machine corresponding to the uncontrolled terminal user, so as to realize the secure access authentication of the uncontrolled terminal user and the network information system.

[0074] It can be seen that in this embodiment, the business corresponding to the target business request is processed by the dynamic authentication service of the uncontrolled terminal user in the target trusted virtual machine, and the identity security and behavior security of the accessing user are guaranteed by authenticating first and then accessing, thereby improving the overall planning level of the system and the ability to deal with possible location security threats.

[0075] See also Figure 5 As shown, the embodiment of the present invention discloses a specific method for endogenous security defense of a network information system. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution.

[0076] Step S31: Obtain a target service request for the network information system.

[0077] Step S32: If the target service type is dynamic authentication of a controlled terminal user, a target trusted virtual machine corresponding to the dynamic authentication of the controlled terminal user is determined from trusted virtual machines pre-created in a trusted virtual environment.

[0078] Specifically, if the user corresponding to the dynamic authentication service request is a controlled terminal user, a trusted virtual machine pre-deployed with a secure time forensics mechanism is determined as a target trusted virtual machine from trusted virtual machines pre-created in a trusted virtual environment.

[0079] Step S33: utilizing the dynamic authentication service of the controlled terminal user in the target trusted virtual machine to process the service corresponding to the target service request, so as to realize the secure access authentication between the controlled terminal user and the network information system.

[0080] Specifically, a corresponding public-private key pair is generated based on a unique identifier pre-inserted into the trusted module of the controlled terminal, and the security status of the controlled terminal is verified based on the public-private key pair; when the controlled terminal user connects to the background business system and business resources, the security event of the controlled terminal is monitored and evidence is collected using the secure time forensics mechanism in the target trusted virtual machine to achieve secure access authentication between the controlled terminal user and the network information system. Trusted dynamic authentication for identity subjects Figure 6 As shown, when the identity subject is a controlled terminal, a trusted module is pre-inserted into the user terminal to realize a trusted description of the user's controlled terminal identity, terminal owner identity, terminal user identity, and its status information, and the monitoring, evidence collection, and auditing of terminal security events are realized through the target trusted virtual machine.

[0081] It can be seen that in this embodiment, the security events of the controlled terminal are monitored and evidence is collected through a trusted virtual machine with a pre-deployed secure time evidence collection mechanism to ensure data security and business security of the network information system.

[0082] See also Figure 7 As shown, the embodiment of the present invention discloses a specific method for endogenous security defense of a network information system. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution.

[0083] Step S41: Obtain a target service request for the network information system.

[0084] Step S42: If the target service type is software-defined security resource management, a target trusted virtual machine corresponding to the software-defined security resource management is determined from trusted virtual machines pre-created in a trusted virtual environment.

[0085] Specifically, if the target service type is software-defined security resource management, a trusted virtual machine in which a security resource management service is pre-deployed is determined from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine.

[0086] Step S43: Utilize the software-defined security resource management service in the target trusted virtual machine to process the service corresponding to the target service request, so as to implement security capability resource management of the network information system.

[0087] Specifically, the target trusted virtual machine is utilized to separate the security resource management software and hardware through virtualization technology and to pool the security capability resources in the network information system to obtain pooled virtualized security capability resources; the virtualized security capability resources are divided and recombined as needed according to the system security protection requirements corresponding to the target business to realize the security capability resource management of the network information system.

[0088] It can be seen that in this embodiment, the security resources in the network information system are managed by pre-deploying a trusted virtual machine of the security resource management service, so that the virtualized security capability resources can be divided and recombined as needed, thereby realizing the security resource management of the network information system.

[0089] See also Figure 8 As shown, the embodiment of the present invention discloses a specific method for endogenous security defense of a network information system. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution.

[0090] Step S51: Obtain a target service request for the network information system.

[0091] Step S52: If the target service type is dynamic access control, a target trusted virtual machine corresponding to the dynamic access control is determined from trusted virtual machines pre-created in a trusted virtual environment.

[0092] Specifically, if the target service type is dynamic access control, a trusted virtual machine pre-deployed with a dynamic access control service is determined from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine.

[0093] Step S53: Utilize the dynamic access control service in the target trusted virtual machine to process the service corresponding to the target service request, so as to achieve secure access and control of the access subject and the accessed service resources.

[0094] Specifically, the target trusted virtual machine is used to perform precise dynamic access control for the preset dimensions of the access request in the target business, and the corresponding access control strategy is adapted according to the changes in the attributes in the preset dimensions, so as to achieve secure access and control of the access subject and the accessed business resources. That is, when the access subjects such as user terminals in various services provided by the network information system access objects such as business resources, etc., they need to implement precise dynamic access control for different identity attributes, different permission attributes, different minimum granularity authorizations for access resources, etc., and adapt the access control strategy according to the changes in various attributes to achieve secure access and control of the access subject and the accessed business resources.

[0095] It can be seen that in this embodiment, precise dynamic access control is implemented for different identity attributes of access subjects and objects, different permission attributes, and different minimum granularity authorizations for access resources. The adaptive access control strategy is adaptively adapted according to the changes in various attributes to achieve secure access and control of onboard access subjects and accessed object business resources.

[0096] See also Fig. 9As shown, the embodiment of the present invention discloses a specific method for endogenous security defense of a network information system. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution.

[0097] Step S61: Obtain a target service request for the network information system.

[0098] Step S62: If the target service type is attack detection and protection, a target trusted virtual machine corresponding to the attack detection and protection is determined from trusted virtual machines pre-created in a trusted virtual environment.

[0099] Specifically, if the target service type is attack detection and protection, a trusted virtual machine pre-deployed with attack detection and protection services is determined from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine.

[0100] Step S63: Utilize the attack detection and protection service in the target trusted virtual machine to process the service corresponding to the target service request, so as to realize the defense against illegal attacks on the network information system.

[0101] Specifically, the data probe pre-installed in the target trusted virtual machine is used to collect the business resource application layer traffic of the network information system through a bypass mirror to obtain the corresponding collected data; based on the collected data and the preset security log based on deep traffic analysis, the illegal access subject with abnormal entity behavior is identified from the corresponding access subject and access object; based on port hiding and access control rules, the access behavior of the illegal access subject is prohibited to realize the illegal attack defense of the network information system. The schematic diagram of dynamic access control and attack detection is shown in the figure below. Fig.10 As shown, when the target service type is attack detection and protection, the data probe is used to collect bypass images and perform deep restoration on the application layer traffic of the service resources. The bypass image collection is a bypass deployment that does not affect the backbone network and resources. The deep restoration supports the analysis and restoration of service-specific protocols. Based on the security log of deep traffic analysis, entity behavior analysis is performed on access subjects such as users and access objects such as service resources, and compliance behavior rules are defined to identify abnormal behaviors of users and service resources, thereby discovering malicious behaviors originating from within and risky behaviors caused by accidents, and realizing security management of the application layer. Based on port hiding and refined access control, only traffic from legitimate users is allowed to pass, preventing illegal or untrusted users from collecting information, exploiting vulnerabilities, and launching attacks in the intranet through high-risk ports, thereby playing the role of service resource isolation and application protection.

[0102] It can be seen that in this embodiment, by using probes to perform bypass mirroring collection, deep restoration, and dynamic port hiding on the system application layer traffic, the purpose of business resource isolation and application protection is achieved, thereby improving the system security protection effect.

[0103] See also Fig.11 The embodiment of the present application discloses an endogenous security defense device for a network information system, including:

[0104] A service request acquisition module 11 is used to acquire a target service request for a network information system;

[0105] The trusted virtual machine determination module 12 is used to determine the target business type corresponding to the target business request, and determine the target trusted virtual machine corresponding to the target business type from the trusted virtual machines pre-created in the trusted virtual environment; the trusted virtual environment is a virtualized environment obtained by deploying trusted basic software and host security mechanisms on a trusted host system; and different trusted virtual machines carry different security defense services;

[0106] The business request security processing module 13 is used to utilize the security defense service in the target trusted virtual machine to process the business corresponding to the target business request, so as to realize the inherent security defense of the network information system.

[0107] It can be seen that in this embodiment, a trusted virtual environment is obtained by deploying trusted basic software and host security mechanism on a trusted host system, and a number of trusted virtual machines are preset in the trusted virtual environment, and corresponding security defense services are deployed for the trusted virtual machines; when a target service request for a network information system is obtained, a target trusted virtual machine corresponding to the target service type is determined from the trusted virtual machine by the target service type corresponding to the target service request. Thus, when a target service request for a network information system is obtained, the preset trusted virtual machine is orchestrated and scheduled by the trusted virtual environment, so that the target virtual machine further completes the target service request in the endogenous security defense of the network information system, and the security design is integrated with the network design based on trusted computing and virtual machines to realize the integration of network information system business functions and security, and the target service request is processed by the preset trusted virtual machine instead of directly accessing the network information system, thereby improving the overall planning level of the network information system, so as to deal with unknown security threats, and at the same time establish an endogenous security system of the network information system with integrated multi-service requests to realize the endogenous security defense of the network information system under limited resources. In summary, the present application can establish an endogenous security system of the network information system to realize the endogenous security defense of the network information system under limited resources.

[0108] In some specific embodiments, the trusted virtual machine determination module 12 is specifically used to: if the target business type is dynamic authentication for an identity subject, determine a target trusted virtual machine corresponding to the dynamic authentication from trusted virtual machines pre-created in a trusted virtual environment.

[0109] In some specific embodiments, the trusted virtual machine determination module 12 is specifically used to: if the user corresponding to the dynamic authentication service request is an uncontrolled terminal user, determine a trusted virtual machine pre-deployed with an uncontrolled terminal access authentication service integrating physical information from the trusted virtual machines pre-created in the trusted virtual environment as a target trusted virtual machine, and separately allocate a corresponding trusted virtual machine to the uncontrolled terminal user;

[0110] Correspondingly, the business request security processing module 13 is specifically used to: utilize the uncontrolled terminal access authentication service in the target trusted virtual machine to process the business corresponding to the dynamic authentication business request, and utilize the trusted virtual machine corresponding to the uncontrolled terminal user to reside the uncontrolled terminal user data and access operations. If it is found that the uncontrolled terminal user has abnormal or illegal behavior, the access of the uncontrolled terminal user is interrupted by suspending or shutting down the trusted virtual machine corresponding to the uncontrolled terminal user, so as to realize the secure access authentication of the uncontrolled terminal user and the network information system.

[0111] In some specific embodiments, the trusted virtual machine determination module 12 is specifically used to: if the user corresponding to the dynamic authentication service request is a controlled terminal user, determine a trusted virtual machine with a pre-deployed secure time forensics mechanism as a target trusted virtual machine from trusted virtual machines pre-created in a trusted virtual environment;

[0112] Accordingly, the business request security processing module 13 specifically includes:

[0113] A security status verification unit, configured to generate a corresponding public-private key pair based on a unique identifier pre-inserted into a trusted module of the controlled terminal, and to verify the security status of the controlled terminal based on the public-private key pair;

[0114] A monitoring and evidence collection unit is used to monitor and collect evidence of security events of the controlled terminal using the secure time evidence collection mechanism in the target trusted virtual machine, so as to achieve secure access authentication between the controlled terminal user and the network information system.

[0115] In some specific embodiments, the trusted virtual machine determination module 12 is specifically used to: if the target service type is software-defined security resource management, determine a trusted virtual machine with a pre-deployed security resource management service from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine;

[0116] Accordingly, the business request security processing module 13 specifically includes:

[0117] A resource pooling unit, used to separate the security resource management software and hardware by virtualization technology using the target trusted virtual machine and to pool the security capability resources in the network information system to obtain pooled virtualized security capability resources;

[0118] The resource segmentation and reorganization unit is used to segment and reorganize the virtualized security capability resources on demand according to the system security protection requirements corresponding to the target business, so as to realize the security capability resource management of the network information system.

[0119] In some specific embodiments, the trusted virtual machine determination module 12 is specifically used to: if the target service type is dynamic access control, determine a trusted virtual machine pre-deployed with a dynamic access control service from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine;

[0120] Correspondingly, the business request security processing module 13 is specifically used to: utilize the target trusted virtual machine to perform precise dynamic access control on the preset dimensions of the access request in the target business, and adapt the corresponding access control policy according to the changes in the attributes in the preset dimensions, so as to achieve secure access and management of the access subject and the accessed business resources.

[0121] In some specific embodiments, the trusted virtual machine determination module 12 is specifically used to: if the target service type is attack detection and protection, determine a trusted virtual machine pre-deployed with attack detection and protection services from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine;

[0122] Accordingly, the business request security processing module 13 specifically includes:

[0123] A data collection unit, used to collect the business resource application layer traffic of the network information system through a bypass mirror by using a data probe pre-installed in the target trusted virtual machine to obtain corresponding collected data;

[0124] A data analysis unit, used to identify illegal access subjects with abnormal entity behaviors from corresponding access subjects and access objects based on the collected data and a preset security log based on traffic depth analysis;

[0125] The access control unit is used to prohibit the access behavior of the illegal access subject based on port hiding and access control rules, so as to realize the illegal attack defense of the network information system.

[0126] Fig.12 An electronic device 20 provided in an embodiment of the present application is shown. The electronic device 20 may further include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the endogenous security defense method of the network information system disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may be specifically an electronic computer.

[0127] In this embodiment, the power supply 23 is used to provide voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0128] In addition, the memory 22 as a carrier for storing resources may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0129] The operating system 221 is used to manage and control the hardware devices on the electronic device 20, and the computer program 222 may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the network information system endogenous security defense method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 may further include a computer program that can be used to complete other specific tasks.

[0130] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned disclosed network information system endogenous security defense method is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0131] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0132] The above is a detailed introduction to the intrinsic security defense method, device, equipment and medium of a network information system provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A network information system endogenous security defense method, characterized in that: include: Obtaining target business requests for network information systems; Determine the target service type corresponding to the target service request, and determine the target trusted virtual machine corresponding to the target service type from the trusted virtual machines pre-created in the trusted virtual environment; the trusted virtual environment is a virtualized environment obtained by deploying trusted basic software and host security mechanisms on a trusted host system; and different trusted virtual machines carry different security defense services; The security defense service in the target trusted virtual machine is used to process the business corresponding to the target business request, so as to realize the inherent security defense of the network information system.

2. The method for endogenous security defense of a network information system according to claim 1, characterized in that: The step of determining the target service type corresponding to the target service request, and determining a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment, includes: If the target service type is dynamic authentication for an identity subject, a target trusted virtual machine corresponding to the dynamic authentication is determined from trusted virtual machines pre-created in a trusted virtual environment.

3. The method for endogenous security defense of a network information system according to claim 2, characterized in that: If the target service type is dynamic authentication for an identity subject, determining a target trusted virtual machine corresponding to the dynamic authentication from trusted virtual machines pre-created in a trusted virtual environment includes: If the user corresponding to the dynamic authentication service request is an uncontrolled terminal user, a trusted virtual machine pre-deployed with an uncontrolled terminal access authentication service integrating physical information is determined as a target trusted virtual machine from trusted virtual machines pre-created in a trusted virtual environment, and a corresponding trusted virtual machine is separately allocated to the uncontrolled terminal user; Accordingly, the process of using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request to achieve the inherent security defense of the network information system includes: The uncontrolled terminal access authentication service in the target trusted virtual machine is used to process the service corresponding to the dynamic authentication service request, and the trusted virtual machine corresponding to the uncontrolled terminal user is used to reside the data and access operations of the uncontrolled terminal user. If the uncontrolled terminal user is found to have abnormal or illegal behavior, the access of the uncontrolled terminal user is interrupted by suspending or shutting down the trusted virtual machine corresponding to the uncontrolled terminal user, so as to realize the secure access authentication of the uncontrolled terminal user and the network information system.

4. The method for endogenous security defense of a network information system according to claim 2, characterized in that: When the target service type is dynamic authentication for an identity subject, determining a target trusted virtual machine corresponding to the dynamic authentication from trusted virtual machines pre-created in a trusted virtual environment includes: If the user corresponding to the dynamic authentication service request is a controlled terminal user, determining a trusted virtual machine with a pre-deployed secure time forensics mechanism as a target trusted virtual machine from trusted virtual machines pre-created in a trusted virtual environment; Accordingly, the process of using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request to achieve the inherent security defense of the network information system includes: Generate a corresponding public-private key pair based on a unique identifier pre-inserted into a trusted module of the controlled terminal, and verify the security status of the controlled terminal based on the public-private key pair; The secure time forensics mechanism in the target trusted virtual machine is used to monitor and collect forensics on the security events of the controlled terminal, so as to achieve secure access authentication between the controlled terminal user and the network information system.

5. The method for endogenous security defense of network information system according to claim 1, characterized in that: The step of determining the target service type corresponding to the target service request, and determining a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment, includes: If the target service type is software-defined security resource management, determining a trusted virtual machine in which a security resource management service is pre-deployed from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine; Accordingly, the process of using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request to achieve the inherent security defense of the network information system includes: Using the target trusted virtual machine to separate the security resource management software and hardware through virtualization technology and pool the security capability resources in the network information system to obtain pooled virtualized security capability resources; The virtualized security capability resources are divided and recombined as needed according to the system security protection requirements corresponding to the target business, so as to realize the security capability resource management of the network information system.

6. The method for endogenous security defense of a network information system according to claim 1, characterized in that: The step of determining the target service type corresponding to the target service request, and determining a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment, includes: If the target service type is dynamic access control, determining a trusted virtual machine pre-deployed with a dynamic access control service from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine; Accordingly, the process of using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request to achieve the inherent security defense of the network information system includes: The target trusted virtual machine is used to perform precise dynamic access control on the preset dimensions of the access request in the target business, and the corresponding access control policy is adapted according to the changes in the attributes in the preset dimensions to achieve secure access and management of the access subject and the accessed business resources.

7. The method for endogenous security defense of a network information system according to any one of claims 1 to 6, characterized in that: The step of determining the target service type corresponding to the target service request, and determining a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment, includes: If the target service type is attack detection and protection, determining a trusted virtual machine pre-deployed with attack detection and protection services from trusted virtual machines pre-created in a trusted virtual environment as a target trusted virtual machine; Accordingly, the process of using the security defense service in the target trusted virtual machine to process the service corresponding to the target service request to achieve the inherent security defense of the network information system includes: By using the data probe pre-installed in the target trusted virtual machine, the business resource application layer traffic of the network information system is collected through a bypass mirror to obtain corresponding collected data; Based on the collected data and the preset security log based on deep traffic analysis, identify illegal access subjects with abnormal entity behaviors from the corresponding access subjects and access objects; Based on port hiding and access control rules, the access behavior of the illegal access subject is prohibited to achieve illegal attack defense of the network information system.

8. An endogenous security defense device for a network information system, characterized in that: include: A business request acquisition module is used to acquire target business requests for the network information system; A trusted virtual machine determination module is used to determine the target service type corresponding to the target service request, and determine a target trusted virtual machine corresponding to the target service type from trusted virtual machines pre-created in a trusted virtual environment; the trusted virtual environment is a virtualized environment obtained by deploying trusted basic software and host security mechanisms on a trusted host system; and different trusted virtual machines carry different security defense services; The business request security processing module is used to utilize the security defense service in the target trusted virtual machine to process the business corresponding to the target business request, so as to realize the inherent security defense of the network information system.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the network information system endogenous security defense method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the intrinsic security defense method for a network information system as described in any one of claims 1 to 7 are implemented.

Images