A security capability opening system and a security capability assembly method

Abstract

The present application discloses a security capability exposure system and a method for assembling security capabilities, wherein the system includes: an acquisition layer, a storage layer, a capability layer and an application layer; wherein the acquisition layer is used to acquire at least one type of data; the storage layer is used to store the data acquired from the acquisition layer and the data generated by the capability layer; the capability layer is used to provide a variety of security capabilities based on the data stored in the storage layer; and the application layer is used to apply at least some of the multiple security capabilities provided by the capability layer to vertical industries.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a security capability exposure system and a security capability assembly method. Background Art

[0002] With the rapid development of computer network technology, network attacks have occurred frequently, and network security has become increasingly important. The country also attaches great importance to network information security, and has proposed that there is no national security without network security, elevating network security to the level of national security, and has intensively introduced a series of security laws and regulations such as the Cybersecurity Law and the Cryptography Law, raising network security to an unprecedented level.

[0003] At the same time, as communication technology gradually develops from 4G to 5G, the scale of 5G applications continues to increase, and the new infrastructure strategy is gradually implemented, further promoting the transformation of industrial digitalization and informatization, thereby giving rise to more network security needs for 5G vertical industries. The network security needs of established industries such as finance, securities and the Internet are increasing, and the security needs of new industries such as industrial energy and medical care are increasing in the process of digital evolution and intelligentization.

[0004] Therefore, there is an urgent need for a flexible and assemblable security capability technology system to quickly meet the different network security needs of different industries. Summary of the invention

[0005] In order to solve the above technical problems, the embodiments of the present invention provide a security capability opening system and a security capability assembly method, a chip and a computer-readable storage medium.

[0006] The security capability exposure system provided in the embodiment of the present application includes: a collection layer, a storage layer, a capability layer and an application layer; wherein:

[0007] The collection layer is used to collect at least one type of data;

[0008] The storage layer is used to store the data collected from the collection layer and the data generated by the capability layer;

[0009] The capability layer is used to provide multiple security capabilities based on the data stored in the storage layer;

[0010] The application layer is used to apply at least part of the multiple security capabilities provided by the capability layer to vertical industries.

[0011] In some optional implementations, the acquisition layer is specifically used to collect at least one type of data from at least one device, wherein:

[0012] The at least one device includes at least one of the following: a home terminal, a personal terminal, an industry terminal, a base station, a router, an access gateway, an access point device, a core network device, and an application server;

[0013] The at least one type of data includes at least one of the following: asset data, flow data, log data, and alarm data.

[0014] In some optional implementations, the storage layer includes at least one of the following: a database cluster, an object storage layer, and a message queue management layer.

[0015] In some optional implementations, the capability layer includes a security capability layer, a knowledge base, and a security capability application programming interface (Application Programming Interface, API); wherein,

[0016] The security capability layer is used to provide multiple security capabilities and output at least part of the multiple security capabilities to the security capability API;

[0017] The security capability API is used to provide API services corresponding to at least part of the security capabilities for the vertical industry, so as to apply at least part of the security capabilities to the vertical industry;

[0018] The knowledge base is used to support the knowledge calling and knowledge accumulation of the security capability layer.

[0019] In some optional implementations, the security capability layer includes a cloud security capability module and a trusted end security capability module; wherein,

[0020] The cloud security capability module is used to provide security decisions for the trusted end security capability module;

[0021] The trusted end security capability module is used to execute the security decision provided by the cloud security capability module.

[0022] In some optional implementations, the cloud security capability module includes at least one of the following: a security detection module, a security protection module, a traceability audit module, and a data security module; wherein:

[0023] The security detection module is used to provide security detection capabilities;

[0024] The security protection module is used to provide security protection capabilities;

[0025] The traceability audit module is used to provide traceability audit capabilities;

[0026] The data security module is used to provide data security capabilities.

[0027] In some optional implementations, the security detection capability includes at least one of the following:

[0028] Cyberspace mapping capability, high-risk port monitoring capability, weak password monitoring capability, risk situation awareness capability, vulnerability monitoring capability, vulnerability troubleshooting capability, terminal assessment capability, and firmware security assessment capability.

[0029] In some optional implementations, the security protection capability includes at least one of the following:

[0030] Website security protection capabilities, attack and defense drill capabilities, distributed denial of service attack (DDoS) protection capabilities, uniform resource locator (URL) detection and protection capabilities, linkage analysis and decision-making capabilities.

[0031] In some optional implementations, the traceability audit capability includes at least one of the following:

[0032] Attack trapping capability, behavior analysis capability, and source tracing audit capability.

[0033] In some optional implementations, the data security capability includes at least one of the following:

[0034] Sensitive data scanning capability, data correlation analysis capability, and sensitive data protection capability.

[0035] In some optional implementations, the trusted end security capability module includes a secure access module for providing secure access capabilities.

[0036] In some optional implementations, the secure access capability includes at least one of the following:

[0037] Channel encryption capability, access control capability, secure lightweight networking capability, malicious website detection capability, and malicious website blocking capability.

[0038] In some optional implementations, the knowledge base includes at least one of the following:

[0039] Asset library, rule library, intelligence library, risk library, and algorithm library.

[0040] The security capability assembly method provided in the embodiment of the present application is applied to any of the above-mentioned security capability exposure systems, and the method includes:

[0041] Identify the security needs of vertical industries;

[0042] Based on the security requirements of the vertical industry, selecting at least part of the security capabilities that meet the security requirements from the multiple security capabilities provided by the capability layer;

[0043] At least part of the security capabilities in the capability layer are called, and the at least part of the security capabilities are assembled to obtain a security application applied to the vertical industry.

[0044] In some optional embodiments, the method further comprises:

[0045] Collect at least one type of data;

[0046] storing the at least one type of data in a storage layer;

[0047] The capability layer is used to process the data stored in the storage layer to obtain the multiple security capabilities.

[0048] The chip provided in the embodiment of the present application includes: a processor, which is used to call and run a computer program from a memory, so that a device equipped with the chip executes any one of the above methods.

[0049] The core computer-readable storage medium provided in the embodiment of the present application is used to store a computer program, and the computer program enables a computer to execute any one of the above methods.

[0050] In the technical solution of the embodiment of this application, on the one hand, the security capability opening system for vertical industries can realize the flexible assembly and automatic arrangement of security capabilities, as well as the integration and integration of security capabilities and knowledge accumulation. On the other hand, the security capability opening system for vertical industries can not only quickly meet the different network security needs of different industries, but also feed back to the security applications of various industries and improve security capabilities. At the same time, it is also conducive to improving the elasticity and automatic scheduling level of resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 The structure of the security capability exposure system provided in the embodiment of the present application is Figure 1 ;

[0052] Figure 2 is a schematic diagram of a storage layer provided in an embodiment of the present application;

[0053] Figure 3 is a schematic diagram of the capability layer provided in an embodiment of the present application;

[0054] Figure 4 The structure of the security capability exposure system provided in the embodiment of the present application is Figure 2 ;

[0055] Figure 5It is a flowchart of a full-capability assembly method provided in an embodiment of the present application;

[0056] Figure 6 It is a schematic structural diagram of the chip of an embodiment of the present application. DETAILED DESCRIPTION

[0057] The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0058] With the increasing number of vertical industry applications for 5G and even 6G in the future, there is an urgent need for an open security capability framework that can flexibly assemble and automatically orchestrate decentralized and independent security capabilities to quickly meet the different network security needs of different industries. At the same time, these security capabilities can be integrated and connected to form knowledge accumulation, which can feed back to security applications in various industries and improve security capabilities.

[0059] To this end, the following technical solutions of the embodiments of this application are proposed. The technical solutions of the embodiments of this application propose a security capability opening system for vertical industries (also referred to as a security capability opening framework). The security capability opening system is a security capability opening framework built for vertical industries such as government affairs, finance, energy, industry, transportation, education, and medical care. It builds a deep defense system with known risks beforehand, treatable threats during the event, and traceable attacks after the event. It involves five major security capabilities: security detection, security protection, secure access, data security, and traceability auditing. It adopts the end-to-end cloud linkage between smart clouds and trusted ends, and empowers vertical industries through SaaS access, cloud access, local deployment, and other access methods.

[0060] It should be noted that the "vertical industry" in the technical solution of the embodiment of the present application can be but is not limited to the "5G vertical industry", such as the future 6G vertical industry, etc.

[0061] To facilitate understanding of the technical solutions of the embodiments of the present application, the technical solutions of the present application are described in detail below through specific embodiments. The above related technologies can be combined arbitrarily with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application. The embodiments of the present application include at least part of the following contents.

[0062] Figure 1 The structure of the security capability exposure system provided in the embodiment of the present application is Figure 1 ,like Figure 1As shown, the system includes: a collection layer 11, a storage layer 12, a capability layer 13 and an application layer 14; wherein,

[0063] The collection layer 11 is used to collect at least one type of data;

[0064] The storage layer 12 is used to store the data collected from the collection layer 11 and the data generated by the capability layer 13;

[0065] The capability layer 13 is used to provide multiple security capabilities based on the data stored in the storage layer 12;

[0066] The application layer 14 is used to apply at least some of the various security capabilities provided by the capability layer 13 to vertical industries.

[0067] In some optional implementations, the acquisition layer 11 is specifically used to collect at least one type of data from at least one device, wherein:

[0068] The at least one device includes at least one of the following: a home terminal, a personal terminal, an industry terminal, a base station, a router, an access gateway, an access point device, a core network device, and an application server;

[0069] The at least one type of data includes at least one of the following: asset data, flow data, log data, and alarm data.

[0070] The security capability exposure system provided in the embodiment of the present application can open the security capabilities of network operators to vertical industries, give full play to the operator's sample advantages, intelligent pipeline advantages, and network performance and stability advantages. Compared with traditional security protection based on terminal defense, it has the characteristics of higher performance, stronger protection capabilities, more accurate detection, and more stable and reliable services, and can better empower vertical industries.

[0071] The following Figure 1 The storage layer 12, capability layer 13 and application layer 14 in the security capability exposure system shown in FIG. 1 are described. It should be noted that the following scheme can be used with Figure 1 Any combination of the schemes shown can be performed.

[0072] Figure 2 is a schematic diagram of a storage layer provided in an embodiment of the present application, such as Figure 2 As shown, the storage layer 12 includes at least one of the following: a database cluster 121 , an object storage layer 122 , and a message queue management layer 123 .

[0073] Here, the database cluster 121 includes but is not limited to a REDIS cluster, a MYSQL cluster, a SPARK cluster, a ZOOKEPPER cluster, and a MONGDB cluster.

[0074] Figure 3 is a schematic diagram of the capability layer provided in the embodiment of the present application, such as Figure 3 As shown, the capability layer 13 includes a security capability layer 131, a knowledge base 132 and a security capability API 133; wherein,

[0075] The security capability layer 131 is used to provide multiple security capabilities and output at least part of the multiple security capabilities to the security capability API 133;

[0076] The security capability API 133 is used to provide an API service corresponding to at least part of the security capability for a vertical industry, so as to apply at least part of the security capability to the vertical industry;

[0077] The knowledge base 132 is used to support the knowledge calling and knowledge accumulation of the security capability layer 131 .

[0078] In the embodiment of the present application, the security capability layer 131 includes a cloud security capability module 1311 and a trusted end security capability module 1312; wherein,

[0079] The cloud security capability module 1311 is used to provide security decisions for the trusted end security capability module 1312;

[0080] The trusted end security capability module 1312 is used to execute the security decision provided by the cloud security capability module 1311 .

[0081] In some optional implementations, the cloud security capability module 1311 includes at least one of the following: a security detection module, a security protection module, a traceability audit module, and a data security module; wherein:

[0082] The security detection module is used to provide security detection capabilities;

[0083] The security protection module is used to provide security protection capabilities;

[0084] The traceability audit module is used to provide traceability audit capabilities;

[0085] The data security module is used to provide data security capabilities.

[0086] In the above solution, as an optional implementation, the security detection capability includes at least one of the following:

[0087] Cyberspace mapping capability, high-risk port monitoring capability, weak password monitoring capability, risk situation awareness capability, vulnerability monitoring capability, vulnerability troubleshooting capability, terminal assessment capability, and firmware security assessment capability.

[0088] In the above scheme, as an optional implementation, the security protection capability includes at least one of the following:

[0089] Website security protection capabilities, attack and defense drill capabilities, distributed DDoS protection capabilities, resource locator URL detection and protection capabilities, and linkage analysis and decision-making capabilities.

[0090] In the above solution, as an optional implementation, the traceability audit capability includes at least one of the following:

[0091] Attack trapping capability, behavior analysis capability, and source tracing audit capability.

[0092] In the above solution, as an optional implementation, the data security capability includes at least one of the following:

[0093] Sensitive data scanning capability, data correlation analysis capability, and sensitive data protection capability.

[0094] In the embodiment of the present application, the trusted end security capability module 1312 includes a secure access module for providing secure access capabilities.

[0095] In the above solution, as an optional implementation mode, the secure access capability includes at least one of the following:

[0096] Channel encryption capability, access control capability, secure lightweight networking capability, malicious website detection capability, and malicious website blocking capability.

[0097] In the embodiment of the present application, the knowledge base 132 includes at least one of the following: an asset library 1321 , a rule library 1322 , an intelligence library 1323 , a risk library 1324 , and an algorithm library 1325 .

[0098] The above-mentioned technical solution of the embodiment of the present application is an open security capability system for vertical industries, which can realize the flexible assembly and automatic orchestration of security capabilities, as well as the integration and connection of security capabilities and the accumulation of knowledge.

[0099] The above technical solution of the embodiment of the present application is an open system for the security capabilities of vertical industries. On the one hand, it can quickly meet the different network security needs of different industries; on the other hand, it can feed back to the security applications of various industries and improve security capabilities. At the same time, it is also conducive to improving the elasticity and automatic scheduling of resources.

[0100] The above technical solution of the embodiment of the present application is an open system for security capabilities of vertical industries, which is easy to be commercialized and has good commercial application and promotion value. It can be applied not only in the security industry, but also in various vertical industries, such as the party, government, military, financial industry, industrial energy industry, Internet industry, transportation industry, medical industry, etc. In addition, it can also be used for security applications in various major security activities.

[0101] Figure 4 The structure of the security capability exposure system provided in the embodiment of the present application is Figure 2 ,like Figure 4 As shown, the security capability exposure system includes: a collection layer, a storage layer, a capability layer, and an application layer. The collection layer, storage layer, capability layer, and application layer are described below.

[0102] Collection Layer

[0103] The collection layer is used to obtain at least one of the following types of data from each device: asset data, traffic data, log data, and alarm data. Here, each device includes but is not limited to: home terminals, personal terminals, industry terminals, base stations, routers, access gateways, access point devices, core network devices, application servers, etc.

[0104] Storage Layer

[0105] The storage layer, including the REDIS cluster, MYSQL cluster, SPARK cluster, ZOOKEPPER cluster, MONGDB cluster, object storage layer, and message queue management layer, is mainly used to store data collected from the collection layer and data generated by the security capability exposure system, such as user data management and configuration information management related data.

[0106] Capability Layer

[0107] The capability layer includes the security capability layer, knowledge base, and security capability API.

[0108] 1. Security capability layer

[0109] The security capability layer is the core layer of the security capability open system. The various security capability functional modules in the security capability layer work relatively independently at this layer and output the capabilities to the security capability API layer, providing API services for vertical industries through the security capability API layer.

[0110] In the implementation of this application, the security capability layer includes: cloud security capability module (corresponding to Figure 4 Smart Cloud in the Figure 4 trusted end in the .

[0111] A) The cloud security capability module runs on a server cluster in the cloud. It communicates with multiple trusted terminals and provides intelligent decision-making for them. At the same time, when a trusted terminal sends suspicious data traffic, the cloud security capability module helps the trusted terminal to make a judgment and then returns the judgment result to the trusted terminal.

[0112] The cloud security capability modules include: security detection module, security protection module, source traceability audit module, and data security module.

[0113] The security detection module provides at least one of the following capabilities: cyberspace mapping capability, high-risk port monitoring capability, weak password monitoring capability, risk situation awareness capability, vulnerability monitoring capability, one-click troubleshooting capability for the latest vulnerabilities, new terminal evaluation capability, firmware security evaluation and other capabilities.

[0114] The security protection module provides at least one of the following capabilities: website security protection capability, attack and defense drill capability, DDoS protection capability, URL monitoring and protection capability, and linkage analysis and decision-making capability.

[0115] The source tracing audit module provides at least one of the following capabilities: attack trapping capability, behavior analysis capability, and source tracing audit capability.

[0116] The data security module provides at least one of the following capabilities: sensitive data scanning capability, data correlation analysis capability, and sensitive data protection (also known as desensitization) capability.

[0117] In the embodiment of the present application, the security detection module helps customers check the customer network before an attack occurs, prompts the risks and loopholes in the network, and assists administrators in repairing network loopholes; the security protection module helps customers block network attacks when an attack occurs; the data security module helps customers perform security protection and log correlation analysis on sensitive data; and the source tracing audit module helps customers trace the source of the attack.

[0118] B) The trusted end security capability module includes a secure access module. The secure access module provides access security capabilities including the access security (SafeLink) kit and the secure light networking kit. In addition, it has the capabilities of detecting and blocking malicious websites. In specific implementation, the trusted end is the device that actually executes cloud commands (or decisions). The trusted end can be implemented by installing an SDK development kit on the terminal. The SDK development kit implements the functions of the trusted end security capability module. The terminal here can be a gateway device, mobile device, etc. from different manufacturers. The trusted end and the cloud execute the decisions of the cloud. In addition, the trusted end also provides an encryption mechanism to ensure link encryption in some special scenarios to ensure a high level of data security.

[0119] 2. Knowledge Base

[0120] The knowledge base includes at least one of the following: an asset library, a rule library, an intelligence library, a risk library, and an algorithm library. Among them, the risk library stores the characteristic rules of the latest system vulnerabilities discovered on the current Internet, such as the system risk library used in the security detection module. The asset library stores platform assets or assets uploaded by customers. For example, a large number of IP addresses and address-related information used in the security detection module. The feature library stores the traffic feature library used in the platform's security monitoring and security protection functions. For example, the traffic feature library used in the website security protection module. The intelligence library stores the Internet intelligence analyzed by the platform through the arriving data traffic, and also includes Internet intelligence obtained by crawling the Internet and then analyzing it through crawlers. For example: malicious IP, malicious domain name, malicious files, etc.

[0121] 3. Security Capability API

[0122] The security capability API is an interface provided by the security capability development system. The security capability exposure system corresponds to a SaaS platform. The WebUI of the SaaS platform obtains the services provided by the security capability exposure system by calling the security capability API. Other programs of customers can also obtain the services provided by the security capability exposure system through the security capability API.

[0123] Here, the security capability API is an interface provided to the SaaS platform and other programs developed by customers. The security capability API converts external calls into calls to the internal modules of the security capability exposure system, and the called modules are responsible for the actual execution work.

[0124] Application Layer

[0125] The application layer is used to apply the capabilities of the capability layer to various vertical industries. The capabilities here include but are not limited to specific security capabilities, knowledge bases, security capability APIs, etc.; the vertical industries here include but are not limited to the party, government, military, financial industry, industrial energy industry, Internet industry, transportation industry, medical industry, etc.

[0126] Figure 5 is a flowchart of a security capability assembly method provided in an embodiment of the present application. The method can be implemented in combination with the security capability exposure system described in any of the above solutions, such as Figure 5 As shown, the method comprises the following steps:

[0127] Step 501: Determine the security requirements of vertical industries.

[0128] Step 502: Based on the security requirements of the vertical industry, select at least some security capabilities that meet the security requirements from a variety of security capabilities provided by the capability layer.

[0129] Step 503: Call at least part of the security capabilities in the capability layer, assemble the at least part of the security capabilities, and obtain a security application applied to the vertical industry.

[0130] In the embodiment of the present application, the various security capabilities provided by the capability layer can be obtained in the following ways:

[0131] 1) Collect at least one type of data.

[0132] Specifically, at least one type of data may be collected through the collection layer in the security capability exposure system. Here, the collection layer collects at least one type of data, and the description of the aforementioned related solutions may be referred to.

[0133] 2) Storing the at least one type of data in a storage layer.

[0134] Here, the composition and function of the storage layer can refer to the description of the aforementioned related solutions.

[0135] 3) Using the capability layer to process the data stored in the storage layer to obtain the multiple security capabilities.

[0136] Here, the composition and functions of the capability layer may refer to the description of the aforementioned related solutions.

[0137] The above technical solution of the embodiment of the present application is an open system for security capabilities of vertical industries, which is easy to be commercialized and has good commercial application and promotion value. It can be applied not only in the security industry, but also in various vertical industries, such as the party, government, military, financial industry, industrial energy industry, Internet industry, transportation industry, medical industry, etc. In addition, it can also be used for security applications in various major security activities.

[0138] Those skilled in the art should understand that Figure 5 The full-capability assembly method shown can be understood by referring to the relevant description of the aforementioned security capability exposure system.

[0139] Figure 6 It is a schematic structural diagram of the chip of an embodiment of the present application. Figure 6 The chip 600 shown includes a processor 610, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0140] Alternatively, if Figure 6 As shown, the chip 600 may further include a memory 620. The processor 610 may call and run a computer program from the memory 620 to implement the method in the embodiment of the present application.

[0141] The memory 620 may be a separate device independent of the processor 610 , or may be integrated into the processor 610 .

[0142] Optionally, the chip 600 may further include an input interface 630. The processor 610 may control the input interface 630 to communicate with other devices or chips, and specifically, may obtain information or data sent by other devices or chips.

[0143] Optionally, the chip 600 may further include an output interface 640. The processor 610 may control the output interface 640 to communicate with other devices or chips, and specifically, may output information or data to other devices or chips.

[0144] Optionally, the chip can be applied to the network device in the embodiments of the present application, and the chip can implement the corresponding processes implemented by the network device in each method of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0145] Optionally, the chip can be applied to the mobile terminal / terminal device in the embodiments of the present application, and the chip can implement the corresponding processes implemented by the mobile terminal / terminal device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0146] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0147] It should be understood that the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and performed. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, and other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0148] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0149] It should be understood that the above-mentioned memory is exemplary but not restrictive. For example, the memory in the embodiments of the present application may also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM), etc. That is to say, the memory in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

[0150] An embodiment of the present application also provides a computer-readable storage medium for storing a computer program.

[0151] Optionally, the computer-readable storage medium can be applied to the network device in the embodiments of the present application, and the computer program enables the computer to execute the corresponding processes implemented by the network device in the various methods of the embodiments of the present application. For the sake of brevity, they are not repeated here.

[0152] Optionally, the computer-readable storage medium can be applied to the mobile terminal / terminal device in the embodiments of the present application, and the computer program enables the computer to execute the corresponding processes implemented by the mobile terminal / terminal device in the various methods of the embodiments of the present application. For the sake of brevity, they are not repeated here.

[0153] An embodiment of the present application also provides a computer program product, including computer program instructions.

[0154] Optionally, the computer program product can be applied to the network device in the embodiments of the present application, and the computer program instructions enable the computer to execute the corresponding processes implemented by the network device in the various methods of the embodiments of the present application. For the sake of brevity, they are not repeated here.

[0155] Optionally, the computer program product can be applied to the mobile terminal / terminal device in the embodiments of the present application, and the computer program instructions enable the computer to execute the corresponding processes implemented by the mobile terminal / terminal device in the various methods of the embodiments of the present application. For the sake of brevity, they are not repeated here.

[0156] The embodiment of the present application also provides a computer program.

[0157] Optionally, the computer program can be applied to the network device in the embodiments of the present application. When the computer program runs on a computer, the computer executes the corresponding processes implemented by the network device in the various methods in the embodiments of the present application. For the sake of brevity, they are not described here.

[0158] Optionally, the computer program can be applied to the mobile terminal / terminal device in the embodiments of the present application. When the computer program runs on the computer, the computer executes the corresponding processes implemented by the mobile terminal / terminal device in the various methods of the embodiments of the present application. For the sake of brevity, they are not repeated here.

[0159] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0160] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0161] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0162] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0163] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0164] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0165] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A security capability exposure system, characterized in that: The system includes: a collection layer, a storage layer, a capability layer and an application layer; wherein, The collection layer is used to collect at least one type of data; The storage layer is used to store the data collected from the collection layer and the data generated by the capability layer; The capability layer is used to provide multiple security capabilities based on the data stored in the storage layer; The application layer is used to apply at least part of the multiple security capabilities provided by the capability layer to vertical industries; The capability layer includes a security capability layer, a knowledge base and a security capability application program interface API; wherein, The security capability layer is used to provide multiple security capabilities and output at least part of the multiple security capabilities to the security capability API; The security capability API is used to provide API services corresponding to at least part of the security capabilities for the vertical industry, so as to apply at least part of the security capabilities to the vertical industry; The knowledge base is used to support the knowledge call and knowledge accumulation of the security capability layer; the knowledge base includes at least one of the following: an asset library, a rule library, an intelligence library, a risk library, and an algorithm library; The security capability layer includes a cloud security capability module and a trusted end security capability module; wherein, The cloud security capability module is used to provide security decisions for the trusted end security capability module; the cloud security capability module includes at least one of the following: a security detection module, a security protection module, a traceability audit module, and a data security module; The trusted end security capability module is used to execute the security decision provided by the cloud security capability module; the trusted end security capability module includes a security access module, which is used to provide security access capability.

2. The system according to claim 1, characterized in that The acquisition layer is specifically used to collect at least one type of data from at least one device, wherein: The at least one device includes at least one of the following: a home terminal, a personal terminal, an industry terminal, a base station, a router, an access gateway, an access point device, a core network device, and an application server; The at least one type of data includes at least one of the following: asset data, flow data, log data, and alarm data.

3. The system according to claim 1, characterized in that The storage layer includes at least one of the following: a database cluster, an object storage layer, and a message queue management layer.

4. The system according to claim 1, characterized in that The security detection module is used to provide security detection capabilities; The security protection module is used to provide security protection capabilities; The traceability audit module is used to provide traceability audit capabilities; The data security module is used to provide data security capabilities.

5. The system according to claim 4, characterized in that The security detection capability includes at least one of the following: Cyberspace mapping capability, high-risk port monitoring capability, weak password monitoring capability, risk situation awareness capability, vulnerability monitoring capability, vulnerability troubleshooting capability, terminal assessment capability, and firmware security assessment capability.

6. The system according to claim 4, characterized in that The security protection capability includes at least one of the following: Website security protection capabilities, attack and defense drill capabilities, distributed denial of service attack DDoS protection capabilities, resource locator URL detection and protection capabilities, linkage analysis and decision-making capabilities.

7. The system according to claim 4, characterized in that The traceability audit capability includes at least one of the following: Attack trapping capability, behavior analysis capability, and source tracing audit capability.

8. The system according to claim 4, characterized in that The data security capability includes at least one of the following: Sensitive data scanning capability, data correlation analysis capability, and sensitive data protection capability.

9. The system according to claim 1, characterized in that The secure access capability includes at least one of the following: Channel encryption capability, access control capability, secure lightweight networking capability, malicious website detection capability, and malicious website blocking capability.

10. A method for assembling a safety capability, characterized in that: The security capability exposure system applied to any one of claims 1 to 9, the method comprising: Identify the security needs of vertical industries; Based on the security requirements of the vertical industry, selecting at least part of the security capabilities that meet the security requirements from the multiple security capabilities provided by the capability layer; Calling at least part of the security capabilities in the capability layer, assembling the at least part of the security capabilities, and obtaining a security application applied to the vertical industry; The capability layer includes a security capability layer, a knowledge base and a security capability application program interface API; wherein, The security capability layer is used to provide multiple security capabilities and output at least part of the multiple security capabilities to the security capability API; The security capability API is used to provide an API service corresponding to at least part of the security capability for a vertical industry, so as to apply at least part of the security capability to the vertical industry; The knowledge base is used to support the knowledge call and knowledge accumulation of the security capability layer; the knowledge base includes at least one of the following: an asset library, a rule library, an intelligence library, a risk library, and an algorithm library; The security capability layer includes a cloud security capability module and a trusted end security capability module; wherein, The cloud security capability module is used to provide security decisions for the trusted end security capability module; the cloud security capability module includes at least one of the following: a security detection module, a security protection module, a traceability audit module, and a data security module; The trusted end security capability module is used to execute the security decision provided by the cloud security capability module; the trusted end security capability module includes a security access module, which is used to provide security access capability.

11. The method according to claim 10, characterized in that The method further comprises: Collect at least one type of data; storing the at least one type of data in a storage layer; The capability layer is used to process the data stored in the storage layer to obtain the multiple security capabilities.

12. A chip, characterized in that: The device comprises: a processor, configured to call and run a computer program from a memory, so that a device equipped with the chip executes the method as claimed in any one of claims 10 to 11.

13. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein the computer program causes a computer to execute the method according to any one of claims 10 to 11.

Images