Method and device for handling Internet of Things vulnerabilities

Abstract

A method and device for handling IoT vulnerabilities, for efficient verification, analysis, and automated handling of IoT vulnerabilities. The method comprises: a management platform obtaining vulnerability-related information from each IoT terminal device; the vulnerability-related information includes information about the vulnerability itself, information about the IoT terminal device where the vulnerability is located, and the verification result of the vulnerability; the management platform integrating the vulnerability-related information from each IoT terminal device through a batch processing layer and an acceleration layer; the management platform determining, through a service layer, handling recommendations corresponding to the vulnerabilities of each IoT terminal device based on the integrated vulnerability-related information from each IoT terminal device; and the management platform issuing handling instructions to the IoT terminal device where the vulnerability is located, or related devices and platforms associated with the IoT terminal device, based on the handling recommendations corresponding to the vulnerabilities of each IoT terminal device.

Description

Technical Field

[0001] The present application relates to the field of security monitoring technology, and in particular to a method and device for handling Internet of Things vulnerabilities. Background Art

[0002] With the rapid development of IoT technology, the number of IoT devices has exploded, and the IoT is becoming increasingly networked, integrated, and intelligent. However, security incidents involving IoT devices are becoming frequent, highlighting potential security risks and creating a serious security situation. Therefore, unified IoT security vulnerability monitoring is necessary to ensure timely discovery and rapid resolution.

[0003] Existing approaches to IoT vulnerabilities rely on traditional data processing architectures. This reduces processing efficiency when data volumes are large. Furthermore, discovery of vulnerabilities requires manual intervention, which is labor-intensive and prone to delayed response, exacerbating vulnerability security risks.

[0004] Therefore, there is an urgent need for a solution to efficiently verify, analyze, and automatically handle IoT vulnerabilities. Summary of the Invention

[0005] The present application provides an Internet of Things vulnerability handling method and device for efficient verification, analysis, and automated handling of Internet of Things vulnerabilities.

[0006] In a first aspect, the present application provides a method for handling Internet of Things vulnerabilities, the method comprising: a management platform obtaining vulnerability-related information of each Internet of Things terminal device; the vulnerability-related information includes the vulnerability's own information, information of the Internet of Things terminal device where the vulnerability is located, and verification results of the vulnerability; the management platform integrates the vulnerability-related information of each Internet of Things terminal device through a batch processing layer and an acceleration layer; the management platform determines, through a service layer, handling suggestions corresponding to the vulnerabilities of each Internet of Things terminal device based on the integrated vulnerability-related information of each Internet of Things terminal device; the management platform issues handling instructions to the Internet of Things terminal device where the vulnerability is located or related devices and platforms associated with the Internet of Things terminal device based on the handling suggestions corresponding to the vulnerabilities of each Internet of Things terminal device.

[0007] In the above technical solution, the management platform integrates the vulnerability-related information of each IoT terminal device, and then gives corresponding disposal suggestions based on the vulnerability level, degree of harm, and scope of affected assets. It also automatically issues vulnerability disposal instructions based on the binding status of the terminal device of the management platform to avoid the occurrence of security incidents.

[0008] In one possible design, the vulnerabilities include resolvable vulnerabilities and unresolvable vulnerabilities; the sending of disposal instructions to the IoT terminal device where the vulnerability is located or the related devices and platforms associated with the IoT terminal device includes: for resolvable vulnerabilities, sending corresponding disposal instructions to the IoT terminal device where the resolvable vulnerability is located, or the related devices and platforms associated with the IoT terminal device; for unresolvable vulnerabilities, sending vulnerability prompt messages and vulnerability disposal suggestions to inform the holder or manager of the IoT terminal device where the unresolvable vulnerability is located.

[0009] In the above technical solution, the management platform automatically issues disposal instructions to the IoT terminal device where the resolvable vulnerability is located or the related devices associated with the IoT terminal device in combination with the terminal device binding status of the management platform, so that the vulnerability can be disposed of in time to avoid security incidents; for non-resolvable vulnerabilities, the management platform can also send prompt messages to inform the holder or manager of the IoT terminal device in time so that the vulnerability can be disposed of in time.

[0010] In one possible design, the management platform determines, through the service layer, the disposal suggestions corresponding to the vulnerabilities of each IoT terminal device based on the integrated vulnerability-related information of each IoT terminal device, including: the management platform, through the service layer, associates the vulnerability of each IoT terminal device with the corresponding disposal suggestion based on the integrated vulnerability-related information of each IoT terminal device in combination with a vulnerability disposal suggestion dictionary; the vulnerability disposal suggestion dictionary includes the vulnerability name, vulnerability number, vulnerability level, degree of harm, vulnerability description, scope of affected assets, and disposal suggestions.

[0011] In the above technical solution, the management platform gives vulnerability handling suggestions based on the vulnerability level, degree of harm, and scope of affected assets, so that handling instructions can be issued in a timely manner according to the handling suggestions to avoid security incidents.

[0012] In one possible design, before the management platform obtains vulnerability-related information of each IoT terminal device, it also includes: the management platform performs vulnerability scanning on each IoT terminal device under management to obtain possible vulnerabilities of each IoT terminal device; for any vulnerability that may exist in any IoT terminal device, a verification data packet corresponding to the vulnerability type of the vulnerability is sent; and a verification result of the vulnerability returned by the IoT terminal device based on the verification data packet is obtained.

[0013] In the above technical solution, the management platform can more accurately determine whether the IoT terminal device does have a vulnerability by performing a secondary verification of the vulnerability of the IoT terminal device.

[0014] In one possible design, the method further includes: the management platform sends a weak password verification package to each IoT terminal device under management, and obtains the verification results of the vulnerabilities returned by each IoT terminal device based on the weak password verification data packet.

[0015] In the above technical solutions, the problem of weak passwords will also bring potential security risks to IoT terminal devices. It is necessary to promptly discover the weak passwords in IoT terminal devices and make corrections to reduce the risk of IoT terminal devices being attacked.

[0016] In one possible design, the management platform integrates vulnerability-related information of each IoT terminal device through a batch layer and an acceleration layer, including: synchronously integrating vulnerability-related information of each IoT terminal device through a batch layer and an acceleration layer to obtain integrated data of the batch layer and integrated data of the acceleration layer; the service layer merges the integrated data of the batch layer and the integrated data of the acceleration layer to obtain merged vulnerability-related information.

[0017] In this technical solution, vulnerability verification results are consolidated in a data format based on the Lambda architecture. This architecture leverages the strengths of both stream and batch processing when processing large amounts of data. Batch processing provides comprehensive and accurate data, while stream processing provides low-latency data, thus achieving a balance between latency, throughput, and fault tolerance.

[0018] In one possible design, the handling instructions include port blocking instructions, access restriction instructions, network blocking instructions, and protocol traffic blocking instructions.

[0019] In a second aspect, an embodiment of the present application provides an IoT vulnerability handling device, comprising:

[0020] An acquisition module is used to obtain vulnerability-related information of each IoT terminal device; the vulnerability-related information includes information about the vulnerability itself, information about the IoT terminal device where the vulnerability is located, and verification results of the vulnerability;

[0021] The processing module is used to integrate vulnerability-related information of various IoT terminal devices through the batch processing layer and the acceleration layer;

[0022] The treatment module is used to determine the treatment suggestions corresponding to the vulnerabilities of each IoT terminal device based on the integrated vulnerability information of each IoT terminal device through the service layer;

[0023] The handling module is also used to issue handling instructions to the IoT terminal device where the vulnerability is located or related devices and platforms associated with the IoT terminal device based on the handling suggestions corresponding to the vulnerabilities of each IoT terminal device.

[0024] In one possible design, the vulnerabilities include resolvable vulnerabilities and unresolvable vulnerabilities; the handling module is also used to issue corresponding handling instructions to the IoT terminal device where the resolvable vulnerabilities are located, or related devices and platforms associated with the IoT terminal device for resolvable vulnerabilities; for unresolvable vulnerabilities, a vulnerability prompt message and vulnerability handling suggestions are sent to inform the owner or manager of the IoT terminal device where the unresolvable vulnerabilities are located.

[0025] In one possible design, the handling module is also used to associate the vulnerability of each IoT terminal device with the corresponding handling suggestion through the service layer based on the integrated vulnerability-related information of each IoT terminal device and combined with a vulnerability handling suggestion dictionary; the vulnerability handling suggestion dictionary includes the vulnerability name, vulnerability number, vulnerability level, degree of harm, vulnerability description, scope of affected assets and handling suggestions.

[0026] In one possible design, the device also includes a verification module for obtaining possible vulnerabilities in each IoT terminal device by performing vulnerability scanning on each managed IoT terminal device; sending a verification data packet corresponding to the vulnerability type of any vulnerability that may exist in any IoT terminal device; and obtaining a verification result of the vulnerability returned by the IoT terminal device based on the verification data packet.

[0027] In one possible design, the verification module is also used to send a weak password verification package to each managed IoT terminal device, and obtain the verification results of the vulnerabilities returned by each IoT terminal device based on the weak password verification data package.

[0028] In one possible design, the processing module is also used to synchronously integrate vulnerability-related information of each IoT terminal device through a batch layer and an acceleration layer to obtain integrated data of the batch layer and integrated data of the acceleration layer; the service layer merges the integrated data of the batch layer and the integrated data of the acceleration layer to obtain merged vulnerability-related information.

[0029] In one possible design, the handling instructions include port blocking instructions, access restriction instructions, network blocking instructions, and protocol traffic blocking instructions.

[0030] In a third aspect, an embodiment of the present application further provides a computing device, including:

[0031] a memory for storing program instructions;

[0032] The processor is used to call the program instructions stored in the memory and execute the method described in any possible design of the first aspect according to the obtained program instructions.

[0033] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium storing computer-readable instructions. When a computer reads and executes the computer-readable instructions, the method described in any possible design of the first aspect above is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0035] Figure 1 A schematic diagram of a system architecture applicable to an embodiment of the present application;

[0036] Figure 2 A flowchart of a method for handling IoT vulnerabilities provided in an embodiment of the present application;

[0037] Figure 3 A schematic diagram of the structure of an IoT vulnerability handling device provided in an embodiment of the present application;

[0038] Figure 4 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0040] In the embodiments of the present application, "a plurality" refers to two or more. Terms such as "first" and "second" are used only for the purpose of distinguishing descriptions and should not be understood as indicating or implying relative importance or order.

[0041] The IoT vulnerability handling method provided in the embodiments of the present application can be applied to IoT-based smart life, smart cities, smart industries, smart buildings, environmental protection, agricultural water conservancy, energy monitoring and other aspects. Figure 1 A schematic diagram of a system architecture applicable to the embodiment of the present application is shown in FIG. Figure 1 As shown, the system architecture includes a management platform 110 and at least one IoT terminal device 120 .

[0042] The management platform 110 is used to perform vulnerability scanning, vulnerability verification, data processing, and the issuance of vulnerability handling instructions for IoT terminal devices 120 within its jurisdiction. The management platform 110 may include independent physical servers, or a server cluster or distributed system composed of multiple physical servers. It may also include cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0043] The IoT terminal devices 120 refer to various devices that are connected to the Internet through information sensing devices such as radio frequency identification (RFID), infrared sensors, global positioning systems, laser scanners, etc. according to agreed protocols to exchange and communicate information to achieve intelligent identification, positioning, tracking, monitoring and management.

[0044] This application does not limit the jurisdiction of the management platform. For example, the management platform can be used to manage home IoT terminal devices (such as smart speakers, sweeping robots, smart home gateways, electronic door locks, smart wearable devices and other smart home devices), and can also be used to manage IoT terminal devices in enterprises, communities or cities (such as smart street lights, smart express lockers, smart charging piles, surveillance cameras and other public facilities), and can also be used to manage IoT terminal devices in smart cars.

[0045] It should be noted that the above Figure 1 The application scenario shown is only an example, and the embodiments of this application do not specifically limit this. In specific implementations, variations of the same concept can be made based on the above scenario, and still fall within the scope of protection of this application.

[0046] Figure 2 The flowchart of a method for handling IoT vulnerabilities provided by an embodiment of the present application is shown as an example. The method can be applied to the above-mentioned management platform, such as Figure 2 As shown, the method includes the following steps:

[0047] Step 201: The management platform obtains vulnerability-related information of each IoT terminal device.

[0048] Among them, the vulnerability-related information includes the vulnerability's own information, the information of the IoT terminal device where the vulnerability is located, and the verification result of the vulnerability. In the embodiment of the present application, before the management platform obtains the vulnerability-related information of each IoT terminal device, it performs vulnerability scanning on each IoT terminal device under its management to obtain the possible vulnerabilities of each IoT terminal device. Specifically, the management platform can periodically perform vulnerability scanning on the IoT terminal devices within its management scope through a scanner, and the scanning cycle can be adjusted according to actual needs. The scanning basis of the scanner can be an existing vulnerability library, for example, the Common Vulnerability and Exposures (CVE) vulnerability library, the Common Weakness Enumeration (CWE) vulnerability library, the China National Vulnerability Database of Information Security (CNNVD), etc., and preliminarily determine the possible vulnerabilities of the IoT terminal devices based on the existing vulnerability library.

[0049] After scanning the vulnerability database to identify multiple possible vulnerabilities in IoT terminal devices, the management platform first categorizes the returned vulnerability data to further verify the existence of the vulnerability based on vulnerability type, such as classifying vulnerabilities into common vulnerabilities and weak password issues. For any common vulnerability that may exist in any IoT terminal device, a verification data packet corresponding to the vulnerability type is sent, and then the IoT terminal device obtains the vulnerability verification result based on the verification data packet. Specifically, based on principled or non-principle vulnerability mechanisms, common vulnerabilities can be automatically verified through penetration testing, induced packet detection, and other methods, and any existing vulnerabilities can be processed further.

[0050] In addition to common vulnerabilities, IoT terminal devices may also have weak password issues. Weak passwords are passwords that are easily cracked. They are generally default passwords or relatively simple passwords set by users for ease of memorization, such as 123456, abcd, and admin. The management platform sends a weak password verification package to each IoT terminal device it manages and obtains the verification results of the vulnerabilities returned by each IoT terminal device based on the weak password verification data package. Specifically, the management platform can use the received weak password information to automatically verify and collect evidence of the weak passwords through conventional brute force attacks, login forensics, and other means. Vulnerabilities corresponding to existing weak passwords are then processed in the next step.

[0051] For example, the scanner scanned the IoT terminal device A based on the vulnerabilities in the CVE vulnerability library and found that the vulnerability numbered CVE-2021-24074 exists (this vulnerability is a critical vulnerability. Attackers can trigger related vulnerabilities by sending specially constructed data packet fragments to the system, and successfully exploit the vulnerability to execute arbitrary code on the system, which can endanger all connected assets in the network), and classified the vulnerability data as a regular vulnerability. The management platform sent the test data packet corresponding to the vulnerability through penetration testing. The test data packet was sent successfully, indicating that the vulnerability does exist in the current IoT mobile device, and the vulnerability will be processed in the next step.

[0052] It's understandable that IoT terminal devices are divided into those that have completed joint debugging and integration with the management platform and those that haven't. IoT terminal devices that have completed joint debugging and integration with the management platform have their data format adjusted to the standard format according to the management platform's requirements, allowing them to directly report data to the management platform. For IoT terminal devices that haven't completed joint debugging and integration with the management platform, their reported data needs to be adjusted to the standard format before uploading.

[0053] Step 202: The management platform integrates vulnerability-related information of each IoT terminal device through the batch processing layer and the acceleration layer.

[0054] In an embodiment of the present application, the management platform can integrate vulnerability-related information of IoT terminal devices based on the Lambda architecture, for example, by performing data aggregation and preprocessing on vulnerability-related information. The Lambda architecture includes three processing layers: a batch layer, an acceleration layer, and a serving layer. The management platform integrates vulnerability-related information of each IoT terminal device through the batch layer and the acceleration layer, respectively, to obtain integrated data from the batch layer and integrated data from the acceleration layer.

[0055] In the Lambda architecture, the batch processing layer pre-computes vulnerability-related information returned by IoT devices, enabling downstream processes to quickly obtain the desired results. Because batch processing relies on complete datasets, accuracy is guaranteed. The batch processing layer can use frameworks such as Hadoop, Spark, and Flink to perform preliminary data classification and integrate data based on the differences in vulnerability and weak password forensics results and processes, generating aggregated data for the batch layer.

[0056] The acceleration layer also consolidates vulnerability-related information. Its hallmark is low latency. Data accumulated in the batch layer is processed in the acceleration layer, filling in data gaps caused by the high latency of the batch layer, thereby improving data processing efficiency and big data analysis capabilities. The acceleration layer can utilize frameworks such as Storm, Spark Streaming, and Flink.

[0057] The service layer then merges the integrated data of the batch layer and the integrated data of the acceleration layer to obtain merged vulnerability-related information.

[0058] The Lambda architecture leverages the strengths of both stream and batch processing when processing large amounts of data. Batch processing provides comprehensive and accurate data, while stream processing provides low-latency data, achieving a balance between latency, throughput, and fault tolerance.

[0059] Step 203: The management platform determines, through the service layer, a disposal suggestion corresponding to the vulnerability of each IoT terminal device based on the integrated vulnerability-related information of each IoT terminal device.

[0060] In an embodiment of the present application, the management platform, through the service layer, associates the vulnerability of each IoT terminal device with the corresponding treatment suggestion based on the integrated vulnerability-related information of each IoT terminal device and the vulnerability treatment suggestion dictionary. Specifically, treatment suggestions for the vulnerabilities of each IoT terminal device can be given based on the level, degree of harm, and scope of affected assets of different vulnerabilities in the vulnerability treatment suggestion dictionary, and the treatment suggestions are bound to the data entries of the corresponding vulnerabilities to achieve a one-to-one association. The contents of the vulnerability treatment suggestion dictionary may include vulnerability name, vulnerability number, vulnerability level, degree of harm, vulnerability description, scope of affected assets, and treatment suggestions.

[0061] Taking the CVE-2021-24074 vulnerability in the above example as an example, the management platform, through the service layer, based on the integrated vulnerability-related information of each IoT terminal device and combined with the built-in vulnerability handling suggestion dictionary, confirms that the vulnerability is a type of vulnerability that needs to be handled urgently and requires full network access restrictions for the Internet terminal device.

[0062] Step 204: The management platform issues a handling instruction to the IoT terminal device where the vulnerability is located or related devices and platforms associated with the IoT terminal device based on the handling suggestions corresponding to the vulnerability of each IoT terminal device.

[0063] In an embodiment of the present application, the vulnerability handling suggestion may also include a vulnerability handling label, and the vulnerability handling label may include a label that does not require handling and a label that requires handling. Vulnerabilities corresponding to the label that does not require handling are generally low-risk vulnerabilities or information vulnerabilities and do not require handling. The management platform does not handle vulnerabilities with the label that does not require handling, but only displays relevant data on the page. If it is necessary to handle it, you can manually log in to the management platform and issue the corresponding handling instructions.

[0064] Furthermore, the vulnerabilities that need to be dealt with include resolvable vulnerabilities and non-resolvable vulnerabilities. Resolvable vulnerabilities refer to vulnerabilities that the management platform can automatically issue vulnerability handling instructions in batches based on vulnerability handling suggestions, and the vulnerability handling instructions can be received by the terminal device where the vulnerability is located or the related devices and platforms associated with the IoT terminal device. In other words, resolvable vulnerabilities need to meet the following four conditions: the vulnerability information is clear, the vulnerability handling suggestions and vulnerability handling instructions are clear, the address of the terminal device is clear, and the communication link for the management platform to issue handling instructions is reachable. When the management platform issues handling instructions for the vulnerabilities that need to be handled in the vulnerability handling suggestions through the service layer, for resolvable vulnerabilities, the corresponding handling instructions can be issued to the IoT terminal device where the resolvable vulnerability is located, or the related devices and platforms associated with the IoT terminal device. Specifically, when the management platform issues a disposal instruction, it can combine the IP information of the network products or terminal devices covered by the platform (such as the Endpoint Detection and Response (EDR) module, security module, or network terminal devices such as the linked switch associated with the IoT terminal device installed on the IoT terminal device) to issue the vulnerability disposal suggestion and disposal instruction to the IoT terminal device where the resolvable vulnerability is located, or the network terminal device and platform associated with the IoT terminal device. In addition, the issuance of the disposal instruction can also be completed in combination with the probe information of the IoT terminal device where the resolvable vulnerability is located. Among them, the disposal instruction may include port blocking instructions, access restriction instructions, network blocking instructions, and protocol traffic blocking instructions.

[0065] Taking the CVE-2021-24074 vulnerability in the above example as an example, the management platform finds that the IoT terminal device A has a security module installed. The management platform combines the handling suggestions for the vulnerability (urgent handling type vulnerability, requiring full network access restrictions on the Internet terminal device) and the terminal product type, and issues a network access restriction instruction. After receiving the instruction, the security module of the IoT terminal device A writes the policy, and then cuts off the network connection of the IoT terminal device A, completing the full network access restriction on the IoT terminal device A.

[0066] An unresolvable vulnerability refers to a vulnerability for which the management platform is unable to automatically issue a vulnerability remediation instruction, or a vulnerability remediation instruction cannot be received by the terminal device where the vulnerability is located or by related devices and platforms associated with the IoT terminal device. In other words, an unresolvable vulnerability is considered unresolvable if any of the following four conditions are not met: the vulnerability information is clear, the vulnerability remediation recommendations and vulnerability remediation instructions are clear, the terminal device address is clear, and the communication link for the management platform to issue remediation instructions is reachable. For unresolvable vulnerabilities, a vulnerability alert message and remediation recommendations can be sent to the owner or administrator of the IoT terminal device where the unresolvable vulnerability is located. For example, this can be done by displaying an alert on the platform page or by sending an email or text message to the owner or administrator of the IoT terminal device, prompting them to promptly address the vulnerability according to the remediation recommendations to avoid security incidents. For vulnerabilities that fail automated remediation, an email or text message can also be sent to notify the owner or administrator of the IoT terminal device of the vulnerability remediation failure, urging them to promptly address the failed vulnerability. Furthermore, for vulnerabilities that are verified as false positives, false positive selection can also be performed through the management platform.

[0067] Traditionally, the service layer in the Lambda architecture only merges data processed by the batch and speed layers and provides query services. Users must trigger the query service before the service layer returns the corresponding query results. This application management platform, based on the data merging completed by the service layer, provides disposal recommendations based on the vulnerability level, degree of harm, and scope of affected assets. It also automatically issues vulnerability disposal instructions based on the terminal binding status of the management platform, and can display the entire disposal process on the management platform.

[0068] This application provides an IoT vulnerability handling method. The management platform can automatically verify the vulnerabilities and weak passwords of IoT terminal devices in an orderly and efficient manner. After successful verification, the vulnerability is given a handling suggestion based on the vulnerability level, degree of harm, and scope of affected assets. According to the terminal binding status of the management platform, the vulnerability handling instructions are automatically issued to avoid the occurrence of security incidents.

[0069] Based on the same technical concept, Figure 3 The schematic diagram of the structure of an IoT vulnerability handling device provided by an embodiment of the present application is shown as an example. Figure 3 As shown, the device 300 includes:

[0070] An acquisition module 301 is configured to acquire vulnerability-related information of each IoT terminal device; the vulnerability-related information includes information about the vulnerability itself, information about the IoT terminal device where the vulnerability is located, and a verification result of the vulnerability;

[0071] Processing module 302, configured to integrate vulnerability-related information of each IoT terminal device through a batch processing layer and an acceleration layer;

[0072] The handling module 303 is used to determine a handling suggestion corresponding to the vulnerability of each IoT terminal device based on the integrated vulnerability information of each IoT terminal device through the service layer;

[0073] The handling module 303 is further configured to issue handling instructions to the IoT terminal device where the vulnerability is located or related devices and platforms associated with the IoT terminal device based on handling suggestions corresponding to the vulnerabilities of each IoT terminal device.

[0074] In one possible design, the vulnerabilities include resolvable vulnerabilities and unresolvable vulnerabilities; the handling module 303 is further used to issue corresponding handling instructions to the IoT terminal device where the resolvable vulnerability is located, or related devices and platforms associated with the IoT terminal device, for resolvable vulnerabilities; and for unresolvable vulnerabilities, send vulnerability prompt messages and vulnerability handling suggestions to inform the owner or manager of the IoT terminal device where the unresolvable vulnerability is located.

[0075] In one possible design, the handling module 303 is also used to associate the vulnerability of each IoT terminal device with the corresponding handling suggestion through the service layer based on the integrated vulnerability-related information of each IoT terminal device and combined with the vulnerability handling suggestion dictionary; the vulnerability handling suggestion dictionary includes the vulnerability name, vulnerability number, vulnerability level, degree of harm, vulnerability description, affected asset scope and handling suggestion.

[0076] In one possible design, the device also includes a verification module 304, which is used to obtain possible vulnerabilities in each IoT terminal device by performing vulnerability scanning on each IoT terminal device under management; for any vulnerability that may exist in any IoT terminal device, send a verification data packet corresponding to the vulnerability type of the vulnerability; and obtain a verification result of the vulnerability returned by the IoT terminal device based on the verification data packet.

[0077] In one possible design, the verification module 304 is further used to send a weak password verification package to each managed IoT terminal device, and obtain the verification results of the vulnerabilities returned by each IoT terminal device based on the weak password verification data package.

[0078] In one possible design, the processing module 302 is also used to synchronously integrate vulnerability-related information of each IoT terminal device through a batch layer and an acceleration layer to obtain integrated data of the batch layer and integrated data of the acceleration layer; the service layer merges the integrated data of the batch layer and the integrated data of the acceleration layer to obtain merged vulnerability-related information.

[0079] In one possible design, the handling instructions include port blocking instructions, access restriction instructions, network blocking instructions, and protocol traffic blocking instructions.

[0080] Based on the same technical concept, the embodiment of the present application provides a computing device, such as Figure 4 As shown, it includes at least one processor 401 and a memory 402 connected to the at least one processor. The specific connection medium between the processor 401 and the memory 402 is not limited in the embodiment of the present application. Figure 4 For example, the processor 401 and the memory 402 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, and the like.

[0081] In an embodiment of the present application, the memory 402 stores instructions that can be executed by at least one processor 401. The at least one processor 401 can execute the above-mentioned IoT vulnerability handling method by executing the instructions stored in the memory 402.

[0082] Among them, the processor 401 is the control center of the computing device, which can use various interfaces and lines to connect various parts of the computer device, and perform resource settings by running or executing instructions stored in the memory 402 and calling data stored in the memory 402.

[0083] Optionally, processor 401 may include one or more processing units. Processor 401 may integrate an application processor and a modem processor, wherein the application processor primarily processes the operating system, user interface, and application programs, and the modem processor primarily processes wireless communications. It is understood that the modem processor may not be integrated into processor 401. In some embodiments, processor 401 and memory 402 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0084] The processor 401 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0085] The memory 402 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 402 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 402 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 402 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0086] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer-executable program. The computer-executable program is used to enable a computer to execute any of the IoT vulnerability handling methods listed in the above-mentioned manner.

[0087] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0088] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0089] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0090] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0091] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0092] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for handling Internet of Things vulnerabilities, characterized in that: The Lambda architecture includes a batch processing layer, an acceleration layer, and a service layer. The method includes: The management platform obtains vulnerability-related information for each IoT terminal device; the vulnerability-related information includes information about the vulnerability itself, information about the IoT terminal device where the vulnerability is located, and verification results of the vulnerability, wherein the verification results of the vulnerability are obtained by scanning the vulnerability library to obtain multiple vulnerabilities suspected to exist in each IoT terminal device and verifying whether the multiple vulnerabilities actually exist based on the vulnerability type; The management platform synchronously integrates vulnerability-related information of each IoT terminal device through the batch processing layer and the acceleration layer to obtain integrated data of the batch processing layer and integrated data of the acceleration layer; The management platform merges the integrated data of the batch processing layer and the integrated data of the acceleration layer through the service layer to obtain vulnerability-related information of each IoT terminal device after the merger, and determines a corresponding disposal suggestion for the vulnerability of each IoT terminal device based on the vulnerability-related information of each IoT terminal device after the merger. The management platform provides a disposal suggestion for the vulnerability of each IoT terminal device through the service layer based on the integrated vulnerability-related information of each IoT terminal device, combined with the level, degree of harm, and affected asset scope of different vulnerabilities in the vulnerability disposal suggestion dictionary; each disposal suggestion includes a disposal tag for the vulnerability, and the disposal tag includes a tag that does not require disposal and a tag that requires disposal; When a vulnerability in any IoT terminal device corresponds to a tag that requires disposal, the management platform issues a disposal instruction to the IoT terminal device where the vulnerability is located or related devices and platforms associated with the IoT terminal device based on the disposal suggestion for the vulnerability and the terminal binding status.

2. The method according to claim 1, characterized in that Vulnerabilities with the "need to be addressed" label include resolvable vulnerabilities and non-resolvable vulnerabilities; The issuing of a disposal instruction to the IoT terminal device where the vulnerability is located or related devices and platforms associated with the IoT terminal device includes: For remediable vulnerabilities, issue corresponding remediation instructions to the IoT terminal device where the remediable vulnerability is located, or to related devices and platforms associated with the IoT terminal device; For unresolvable vulnerabilities, a vulnerability prompt message and vulnerability handling suggestions are sent to inform the owner or manager of the IoT terminal device where the unresolvable vulnerability is located.

3. The method according to claim 1, characterized in that The management platform verifies whether the multiple vulnerabilities actually exist according to the following steps; For any suspected vulnerability in any IoT terminal device, send a verification data packet corresponding to the vulnerability type of the vulnerability; Obtain a verification result of the vulnerability returned by the IoT terminal device based on the verification data packet.

4. The method according to claim 3, characterized in that The method further comprises: The management platform sends a weak password verification package to each IoT terminal device under management, and obtains the verification results of the vulnerabilities returned by each IoT terminal device based on the weak password verification data package.

5. The method according to any one of claims 1 to 4, characterized in that The disposal instructions include port blocking instructions, access restriction instructions, network blocking instructions, and protocol traffic blocking instructions.

6. An IoT vulnerability handling device, characterized in that: The Lambda architecture includes a batch processing layer, an acceleration layer, and a service layer. The device includes: An acquisition module is configured to acquire vulnerability-related information for each IoT terminal device; the vulnerability-related information includes information about the vulnerability itself, information about the IoT terminal device where the vulnerability is located, and a verification result of the vulnerability, wherein the verification result is obtained by scanning a vulnerability library to obtain multiple vulnerabilities suspected to exist in each IoT terminal device and then verifying whether the multiple vulnerabilities actually exist based on the vulnerability type; A processing module, configured to synchronously integrate vulnerability-related information of each IoT terminal device through the batch processing layer and the acceleration layer to obtain integrated data of the batch processing layer and integrated data of the acceleration layer; a disposal module configured to merge the integrated data of the batch processing layer and the integrated data of the acceleration layer through the service layer to obtain vulnerability-related information of each IoT terminal device after the merger, and determine a disposal suggestion corresponding to the vulnerability of each IoT terminal device based on the vulnerability-related information of each IoT terminal device after the merger, wherein the service layer provides a disposal suggestion for the vulnerability of each IoT terminal device based on the integrated vulnerability-related information of each IoT terminal device, combined with the level, degree of harm, and affected asset scope of different vulnerabilities in the vulnerability disposal suggestion dictionary; each disposal suggestion includes a disposal tag for the vulnerability, wherein the disposal tag includes a tag that does not require disposal and a tag that requires disposal; The disposal module is also used to issue disposal instructions to the IoT terminal device where the vulnerability is located or related devices and platforms associated with the IoT terminal device based on the disposal suggestions and terminal binding status of the vulnerability when the vulnerability of any IoT terminal device corresponds to a disposal label.

7. A computing device, characterized in that include: a memory for storing program instructions; A processor is configured to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 5 according to the obtained program instructions.

8. A computer-readable storage medium, characterized in that The method comprises computer-readable instructions, which, when read and executed by a computer, enable the method according to any one of claims 1 to 5 to be implemented.

Images