A cloud platform network line communication security assessment method, system and storage medium

Abstract

The present invention discloses a cloud platform network line communication security assessment method, system and storage medium, which relate to the technical field of communication security assessment, including obtaining cloud platform configuration information and a cloud platform network topology diagram, determining cloud platform component layout information, determining component configuration information of each cloud platform component based on the cloud platform component layout information, evaluating the overall configuration of the cloud platform based on the cloud platform network topology diagram, the cloud platform configuration information and the component configuration information of each cloud platform component, obtaining a cloud platform comprehensive configuration index, judging whether the cloud platform configuration information and the component configuration information of each cloud platform component need to be optimized, timely discovering the impact between the cloud platform configuration and the configuration of each cloud platform component, avoiding the overall resources of the cloud platform being restricted, thereby affecting the configuration of each component, and avoiding the network configuration of the cloud platform affecting the network connection of each component.

Description

Technical Field

[0001] The present invention relates to the technical field of communication security assessment, and in particular to a cloud platform network line communication security assessment method, system and storage medium. Background Art

[0002] The cloud platform network line communication security assessment method aims to systematically check and improve data transmission and network security in the cloud environment. Potential risks and security risks are assessed through vulnerability scanning, penetration testing, traffic analysis and other means. This assessment helps ensure that network configurations meet best practices, protect data from attacks and leaks, and improve the overall security level of the enterprise. Its applications include ensuring the security of sensitive data, meeting compliance requirements, and optimizing network security policies, which is of great significance to maintaining the stability and credibility of the cloud platform.

[0003] The existing cloud platform network line communication security assessment method, due to the mutual influence between the cloud platform configuration and the configuration of each cloud platform component, causes the overall resources of the cloud platform to be limited, which in turn affects the configuration of each component. At the same time, the network configuration of the cloud platform will also affect the network connection of each component, resulting in communication problems or security risks between services. When the assessment system performs regular assessments, it is difficult to detect emerging or complex vulnerabilities, which may cause the system to be invaded, resulting in data leakage or service interruption. Therefore, it is necessary to provide a cloud platform network line communication security assessment method, system and storage medium to solve the above-mentioned problems. Summary of the invention

[0004] In order to solve the above-mentioned technical problems, a cloud platform network line communication security assessment method, system and storage medium are provided. The technical solution solves the problem that the cloud platform configuration and the configuration of each cloud platform component proposed in the above-mentioned background technology will influence each other, thereby causing the overall resources of the cloud platform to be limited, and then affecting the configuration of each component. At the same time, the network configuration of the cloud platform will also affect the network connection of each component, resulting in communication problems or security risks between services.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0006] A cloud platform network line communication security assessment method, comprising:

[0007] Obtain cloud platform configuration information and cloud platform network topology diagram, and determine cloud platform component layout information;

[0008] Determine component configuration information of each cloud platform component based on the cloud platform component layout information;

[0009] Evaluate the overall configuration of the cloud platform based on the cloud platform network topology diagram, cloud platform configuration information, and component configuration information of each cloud platform component to obtain a comprehensive configuration index of the cloud platform;

[0010] Based on the cloud platform comprehensive configuration index, determine whether the cloud platform configuration information and the component configuration information of each cloud platform component need to be optimized. If so, consult the cloud platform's security policy, operation documents, and network configuration documents to optimize the cloud platform configuration information and the component configuration information of each cloud platform component. If not, perform vulnerability scans on the cloud platform and each cloud platform component to obtain known vulnerability information.

[0011] Repair vulnerabilities based on known vulnerability information, obtain the cloud platform vulnerability repair capability index, and optimize the cloud platform vulnerability repair capability;

[0012] Conduct penetration testing on the optimized cloud platform, obtain penetration testing information, and evaluate the penetration testing information to obtain the cloud platform defense capability index;

[0013] Optimize the cloud platform defense capability based on the cloud platform defense capability index.

[0014] Preferably, the overall configuration of the cloud platform is evaluated based on the cloud platform network topology diagram, the cloud platform configuration information and the component configuration information of each cloud platform component to obtain the cloud platform comprehensive configuration index, specifically including:

[0015] According to the cloud platform network topology diagram and cloud platform component layout information, determine the physical distance, network distance, logical distance and control distance between the cloud platform and each cloud platform component;

[0016] With the cloud platform as the origin, the physical distance between the cloud platform and each cloud platform component as the X-axis, the superposition value of the network distance and the logical distance as the Y-axis, and the control distance as the Z-axis, a three-dimensional space coordinate system is established;

[0017] Determine respectively the preset ratio of the physical distance, the preset ratio of the superposition value of the network distance and the logical distance, and the preset ratio of the control distance;

[0018] Determine the coordinate value of each cloud platform component in the three-dimensional space coordinate system based on the actual physical distance, actual network distance, actual logical distance, and actual control distance between the cloud platform and each cloud platform component;

[0019] Based on the coordinate values ​​of the cloud platform and each cloud platform component in the three-dimensional space coordinate system, obtain the distance influence coefficient between the cloud platform and each cloud platform component;

[0020] Based on the cloud platform configuration information and the component configuration information of each cloud platform component, obtain a cloud platform configuration index and a component configuration index of each cloud platform component;

[0021] The cloud platform comprehensive configuration index is obtained according to the cloud platform configuration index, the component configuration index of each cloud platform component, and the distance influence coefficient between the cloud platform and each cloud platform component.

[0022] Preferably, judging whether the cloud platform configuration information and the component configuration information of each cloud platform component need to be optimized based on the cloud platform comprehensive configuration index specifically includes:

[0023] Set the monitoring time value and obtain the cloud platform comprehensive configuration index at each moment within the monitoring time value;

[0024] Taking the average value of the cloud platform comprehensive configuration index at each moment as the first average value, and taking the first average value as a benchmark to obtain the difference value of the cloud platform comprehensive configuration index at each moment;

[0025] Determine the total number of cloud platform components, and use the quotient of the average value of the difference value of the cloud platform comprehensive configuration index at each moment and the total number of cloud platform components as the component configuration index threshold of each cloud platform component;

[0026] The ratio of the number of cloud platforms to the total number of cloud platform components is used as the first weight, and the average value of the difference value of the cloud platform comprehensive configuration index at each moment multiplied by the first weight is used as the cloud platform configuration index threshold;

[0027] Respectively obtain the cloud platform configuration index of the cloud platform and the component configuration index of each cloud platform component, and use the average value of the component configuration index of each cloud platform component at each moment within the monitoring time value as the second average value, and use the average value of the cloud platform configuration index of the cloud platform at each moment within the monitoring time value as the third average value;

[0028] Taking the second average value as a benchmark, obtaining a difference value of a configuration benchmark value of one of the cloud platform components at a certain moment;

[0029] Obtaining the difference value of the cloud platform configuration index at a certain moment of the cloud platform based on the third average value;

[0030] If the difference value of the configuration baseline value of one of the cloud platform components at a certain moment is greater than or equal to the component configuration index threshold, the component configuration information of the cloud platform component needs to be optimized;

[0031] If the difference value of the cloud platform configuration index of the cloud platform at a certain moment is greater than or equal to the cloud platform configuration index threshold, the cloud platform configuration information of the cloud platform needs to be optimized.

[0032] Preferably, the consulting the security policy, operation documents and network configuration documents of the cloud platform to optimize the cloud platform configuration information and the component configuration information of each cloud platform component specifically includes the following steps:

[0033] S400: If the cloud platform configuration information of the cloud platform and / or the component configuration information of the cloud platform components need to be optimized, all configurations in the cloud platform configuration information of the cloud platform and / or the component configuration information of the cloud platform components are updated based on the security policy of the cloud platform;

[0034] S401, collecting operation document information while updating all configurations of cloud platform configuration information of the cloud platform and / or component configuration information of the cloud platform components;

[0035] S402: Determine the accuracy of the update operation based on the operation document information, and update the operation document information based on the latest configuration and update operation;

[0036] S403, after updating the operation document information, obtaining resource usage information and adjusting resource configuration;

[0037] S404: After adjusting the resource configuration, set a new monitoring time value, and obtain the cloud platform comprehensive configuration index at each moment within the new monitoring time value;

[0038] S405. Finally, based on the comprehensive configuration index of the cloud platform at each moment within the new monitoring time value, determine whether the difference value of the configuration benchmark value of the platform component at a certain moment is greater than or equal to the component configuration index threshold and / or the difference value of the cloud platform configuration index of the cloud platform at a certain moment is greater than or equal to the cloud platform configuration index threshold.

[0039] Preferably, the method of repairing the vulnerability based on the known vulnerability information, obtaining the cloud platform vulnerability repair capability index, and optimizing the cloud platform vulnerability repair capability specifically includes:

[0040] Establish a known vulnerability information database through known vulnerability information;

[0041] Determine the system information, component information, and data information affected by the vulnerability based on the known vulnerability information in the known vulnerability information database;

[0042] Obtain the vulnerability impact scope index based on the system information, component information, and data information affected by the vulnerability;

[0043] Determine the vulnerability repair difficulty index based on known vulnerability information, and determine the vulnerability repair priority index based on the vulnerability impact scope index and the vulnerability repair difficulty index;

[0044] Prioritize the known vulnerability information in the known vulnerability information database based on the vulnerability repair priority index;

[0045] Repair the cloud platform according to the known vulnerability information sorted by priority to obtain vulnerability repair information;

[0046] Based on the vulnerability repair information, obtain the cloud platform vulnerability repair capability index.

[0047] Preferably, the penetration test is performed on the tuned cloud platform to obtain the penetration test information, and the penetration test information is evaluated to obtain the cloud platform defense capability index, which specifically includes:

[0048] Set the scope of the penetration test and simulate the test environment;

[0049] Use the known vulnerability information in the known vulnerability information database to simulate attacking the cloud platform n times within a preset time;

[0050] Collect system performance information, log file information, storage data information, and monitoring data information of the cloud platform for n simulated attacks, and obtain privilege escalation information and data access information of the simulated attacks;

[0051] Process system performance information, log file information, storage data information, monitoring data information, privilege escalation information, and data access information to obtain penetration test information;

[0052] Evaluate the penetration test information and obtain the cloud platform defense capability index.

[0053] Furthermore, a cloud platform network line communication security assessment system is proposed, which is used to implement the above-mentioned assessment method, and is characterized by comprising:

[0054] A network monitoring module, which is used to monitor and analyze network traffic and abnormal activities in real time;

[0055] A network assessment module, the network assessment module is used to assess component configuration information, vulnerability repair information and penetration test information;

[0056] A network management module, which is used to optimize and manage the cloud platform configuration information and the component configuration information of each cloud platform component, and generate configuration logs, perform vulnerability scans on the cloud platform and each cloud platform component to obtain known vulnerability information, repair the cloud platform according to the known vulnerability information, obtain vulnerability repair information, and generate vulnerability repair logs, perform penetration testing on the tuned cloud platform, obtain penetration testing information, tune the cloud platform defense capabilities, and generate security events and defense logs;

[0057] A data transmission module, which is used to transmit data information between the network monitoring module, the network evaluation module, the network management module and the display module;

[0058] The display module is used to display the monitoring process and results of the network monitoring module, the evaluation process and results of the network evaluation module, and the management content of the network management module.

[0059] Preferably, the network evaluation module specifically includes:

[0060] A configuration evaluation unit, the configuration evaluation unit is used to evaluate the overall configuration of the cloud platform according to the cloud platform configuration information and the component configuration information of each cloud platform component, and obtain a comprehensive configuration index of the cloud platform;

[0061] A vulnerability assessment unit, wherein the vulnerability assessment unit is used to assess the vulnerability repair information one by one to obtain a cloud platform vulnerability repair capability index;

[0062] A security assessment unit is used to assess the penetration test information.

[0063] Preferably, the network management module specifically includes:

[0064] A configuration management unit, the configuration management unit is used to optimize and manage cloud platform configuration information and component configuration information of each cloud platform component, and generate a configuration log;

[0065] A vulnerability management unit, the vulnerability management unit is used to scan the cloud platform and each cloud platform component for vulnerabilities, obtain known vulnerability information, repair the cloud platform according to the known vulnerability information, obtain vulnerability repair information, and generate a vulnerability repair log;

[0066] A security management unit is used to perform penetration testing on the optimized cloud platform, obtain penetration testing information, optimize the defense capabilities of the cloud platform, and generate security events and defense logs.

[0067] Furthermore, a storage medium is proposed, in which a computer program is stored. When the computer program is run on a computer, the computer executes any one of the above-mentioned evaluation methods.

[0068] Compared with the prior art, the present invention has the following beneficial effects:

[0069] This solution proposes a cloud platform network line communication security assessment method, system and storage medium, which evaluates the overall configuration of the cloud platform through the cloud platform network topology diagram, cloud platform configuration information and component configuration information of each cloud platform component, obtains the cloud platform comprehensive configuration index, and based on the cloud platform comprehensive configuration index, determines whether the cloud platform configuration information and the component configuration information of each cloud platform component need to be optimized, and promptly discovers the impact between the cloud platform configuration and the configuration of each cloud platform component, avoids the overall resources of the cloud platform being restricted, thereby affecting the configuration of each component, and at the same time avoids the cloud platform network configuration affecting the network connection of each component, resulting in communication problems or security risks between services;

[0070] This solution proposes a cloud platform network line communication security assessment method, system and storage medium. By performing penetration testing on the optimized cloud platform, the penetration test information is obtained, and the penetration test information is evaluated to obtain the cloud platform defense capability index. When the assessment system performs regular assessments, emerging or complex vulnerabilities can be detected, thereby avoiding system intrusions, data leakage or service interruptions. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 A flowchart of a cloud platform network line communication security assessment method proposed by the present invention;

[0072] Figure 2 This is a flowchart for obtaining the cloud platform comprehensive configuration index in the present invention;

[0073] Figure 3 This is a flow chart of configuration information optimization judgment in the present invention;

[0074] Figure 4 This is a system framework diagram of a cloud platform network line communication security assessment system proposed by the present invention. DETAILED DESCRIPTION

[0075] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0076] Reference Figure 1 - Figure 4 As shown, a cloud platform network line communication security assessment method includes:

[0077] Obtain cloud platform configuration information and cloud platform network topology diagram, and determine cloud platform component layout information;

[0078] Determine component configuration information of each cloud platform component based on the cloud platform component layout information;

[0079] Evaluate the overall configuration of the cloud platform based on the cloud platform network topology diagram, cloud platform configuration information, and component configuration information of each cloud platform component to obtain a comprehensive configuration index of the cloud platform;

[0080] Based on the cloud platform comprehensive configuration index, determine whether the cloud platform configuration information and the component configuration information of each cloud platform component need to be optimized. If so, consult the cloud platform's security policy, operation documents, and network configuration documents to optimize the cloud platform configuration information and the component configuration information of each cloud platform component. If not, perform vulnerability scans on the cloud platform and each cloud platform component to obtain known vulnerability information.

[0081] Repair vulnerabilities based on known vulnerability information, obtain the cloud platform vulnerability repair capability index, and optimize the cloud platform vulnerability repair capability;

[0082] Conduct penetration testing on the optimized cloud platform, obtain penetration testing information, and evaluate the penetration testing information to obtain the cloud platform defense capability index;

[0083] Optimize the cloud platform defense capability based on the cloud platform defense capability index.

[0084] Specifically, cloud platform configuration information includes account settings, network configuration, computing resources, database settings, etc. The cloud platform network topology diagram is a visual diagram used to describe the network structure in the cloud environment and the connection relationship between various components. It helps users understand the distribution of cloud resources, network connection methods and security settings. The cloud platform component layout information is the deployment and configuration method of various resources and services in the cloud environment. The cloud platform comprehensive configuration index is a comprehensive index after the quantitative total value of the cloud platform configuration information and the configuration information of each cloud platform component is influenced by the mutual influence between the cloud platform and the configuration of each cloud platform component. The cloud platform vulnerability repair capability index is the quantitative value of the cloud platform's repair capability after a vulnerability or attack. The penetration test information includes the penetration test scope, information on the simulated test environment, known vulnerability information in the known vulnerability information library, etc. The cloud platform defense capability index is the ability of the cloud platform to resist vulnerabilities and attacks.

[0085] It is understandable that according to the cloud platform defense capability index, the cloud platform defense capability is tuned. Corresponding multi-segment thresholds can be set for the cloud platform defense capability index. When the cloud platform defense capability index is within one of the thresholds, a corresponding tuning strategy is set to tune the cloud platform. The specific steps of tuning are:

[0086] S100, analyze the defense capability index and identify existing security weaknesses and risk areas;

[0087] S101. Adjust the security configuration and access control policy of the cloud platform based on the analysis results, such as enhancing the identity authentication and authorization mechanism;

[0088] S102. Ensure that all systems and applications have the latest security patches and updates installed to fix known vulnerabilities;

[0089] S103. Strengthen the network monitoring module, configure more sensitive alarm thresholds, and develop emergency response plans to quickly respond to potential threats;

[0090] S104. Implement data encryption and regular backup strategies to protect the confidentiality and integrity of data;

[0091] S105. Update penetration test information in real time, simulate attacks to discover new vulnerabilities, and repair them.

[0092] Furthermore, the overall configuration of the cloud platform is evaluated based on the cloud platform network topology diagram, the cloud platform configuration information, and the component configuration information of each cloud platform component to obtain a comprehensive configuration index of the cloud platform, including:

[0093] According to the cloud platform network topology diagram and cloud platform component layout information, determine the physical distance, network distance, logical distance and control distance between the cloud platform and each cloud platform component;

[0094] With the cloud platform as the origin, the physical distance between the cloud platform and each cloud platform component as the X-axis, the superposition value of the network distance and the logical distance as the Y-axis, and the control distance as the Z-axis, a three-dimensional space coordinate system is established;

[0095] Determine respectively the preset ratio of the physical distance, the preset ratio of the superposition value of the network distance and the logical distance, and the preset ratio of the control distance;

[0096] Determine the coordinate value of each cloud platform component in the three-dimensional space coordinate system based on the actual physical distance, actual network distance, actual logical distance, and actual control distance between the cloud platform and each cloud platform component;

[0097] Based on the coordinate values ​​of the cloud platform and each cloud platform component in the three-dimensional space coordinate system, obtain the distance influence coefficient between the cloud platform and each cloud platform component;

[0098] Based on the cloud platform configuration information and the component configuration information of each cloud platform component, obtain a cloud platform configuration index and a component configuration index of each cloud platform component;

[0099] The cloud platform comprehensive configuration index is obtained according to the cloud platform configuration index, the component configuration index of each cloud platform component, and the distance influence coefficient between the cloud platform and each cloud platform component.

[0100] Specifically, the physical distance between the cloud platform and each cloud platform component refers to the location of the cloud platform from each cloud platform component. The cloud platform is usually composed of cloud platforms distributed in different geographical locations. Each cloud platform hosts various cloud platform components, including computing resources, storage, network devices, etc. The physical distance affects data transmission latency and network performance. In the cloud platform, virtual networks (such as virtual private clouds and subnets) connect different cloud platform components together. The network distance refers to the relative position between the cloud platform and cloud platform components, and between cloud platform components and cloud platform components in the virtual network. The network distance has a direct impact on data transmission speed, latency and bandwidth. Cloud platform components communicate through defined APIs and service interfaces. The logical distance refers to the complexity of these interfaces and the network protocols used. The interface design between cloud platform components affects the complexity and performance of calls. Cloud platforms are usually divided into control planes and data planes. The control plane is responsible for managing and configuring services, while the data plane handles the actual data flow. The "distance" between the control plane and the data plane depends on the coordination of management operations and data flows.

[0101] It is understandable that the preset ratio of physical distance, the preset ratio of the superposition value of network distance and logical distance, and the preset ratio of control distance are determined respectively. Before determining the preset ratio, it is necessary to quantify the distance. For example, for physical distance, the actual kilometers between cloud platforms and between cloud platforms and cloud platform components can be used as the physical distance. The network distance can be expressed by latency (milliseconds) or bandwidth (MBps), and the logical distance is based on service dependencies or hierarchical structure, usually expressed in abstract units or levels. For control distance, the number of management and control levels can be evaluated and recorded, and the added complexity of each level can be converted into distance in the coordinate system. The preset ratio of physical distance, the preset ratio of the superposition value of network distance and logical distance, and the preset ratio of control distance can be defined according to needs and specific application scenarios. For example, the preset ratio of physical distance is: 1 km = 1 unit coordinate, the preset ratio of network distance is: 1 millisecond delay = 0.1 unit coordinate, and the preset ratio of logical distance is: service level 1 = 10 unit coordinates. If the ratio of physical distance is set to 1 km = 1 unit coordinate, the actual distance from data center A to B is 200 kilometers, then the distance between A and B in the coordinate system is 200 unit coordinates. If the ratio of network delay is set to 1 millisecond = 0.1 unit coordinate and the delay is 50 milliseconds, then the coordinate distance corresponding to this delay in the coordinate system is 5 unit coordinates.

[0102] Among them, the distance influence coefficient between the cloud platform and each cloud platform component can be obtained by , calculated, For the The X-axis coordinate of each cloud platform component in the three-dimensional space coordinate system, For the The Y-axis coordinate of each cloud platform component in the three-dimensional space coordinate system, For the The Z-axis coordinate of each cloud platform component in the three-dimensional space coordinate system, For the The X-axis coordinate of a cloud platform in the three-dimensional space coordinate system, For the The Y-axis coordinate of a cloud platform in the three-dimensional space coordinate system, For the The Z-axis coordinate of a cloud platform in the three-dimensional space coordinate system, is the error term coefficient. Generally speaking, a cloud service system controlled by a cloud platform establishes a three-dimensional space coordinate system with the cloud platform as the origin. However, there are multiple cloud platforms in a multi-cloud environment. In this case, it is necessary to establish a three-dimensional space coordinate system with one of the cloud platforms as the origin. The distance influence coefficient between the cloud platform and each cloud platform component can be analyzed based on the correlation between the cloud platform and each cloud platform component. If the correlation between one of the cloud platforms and the cloud platform components is high, the distance influence coefficient between this cloud platform component and the origin cloud platform and the cloud platform can be added. But generally speaking, in a cloud service system controlled by a single cloud platform ( , , ) are all (0, 0, 0).

[0103] The calculation formula of the cloud platform comprehensive configuration index is:

[0104] ;

[0105] In the formula, For the The component configuration index of each cloud platform component, For the The component baseline configuration values ​​of the cloud platform components, For the The component configuration index of each cloud platform component, For the The component baseline configuration values ​​of the cloud platform components, For the The cloud platform configuration index of each cloud platform, For the The cloud platform baseline configuration values ​​for each cloud platform, For cloud platforms and The distance influence coefficient between cloud platform components, is the weight coefficient of the impact of the cloud platform on the cloud platform components, is the total number of cloud platform components, is the total number of cloud platforms;

[0106] The component baseline configuration value of the cloud platform component and the component configuration index of the cloud platform component can both be obtained from historical data analysis. Similarly, the cloud platform configuration index and the cloud platform baseline configuration value can also be obtained from historical data, such as using the average or median in the historical data as the baseline configuration value, or setting a set of standard configuration values ​​as a baseline based on industry standards or best practices, such as setting standard configuration values ​​for CPU, memory, and storage to meet application performance requirements. For example, select an appropriate instance type (such as AWS's t3.medium or m5.large) to handle the expected load, then the performance baseline value can be 3 or 5, set the encryption standard for data during transmission and storage, such as using AES-256 for data encryption to protect the confidentiality and integrity of the data, then the security baseline value can be 256, and the baseline configuration value is the sum of these baseline values.

[0107] Furthermore, based on the cloud platform comprehensive configuration index, it is determined whether the cloud platform configuration information and the component configuration information of each cloud platform component need to be optimized, specifically including:

[0108] Set the monitoring time value and obtain the cloud platform comprehensive configuration index at each moment within the monitoring time value;

[0109] Taking the average value of the cloud platform comprehensive configuration index at each moment as the first average value, and taking the first average value as a benchmark to obtain the difference value of the cloud platform comprehensive configuration index at each moment;

[0110] Determine the total number of cloud platform components, and use the quotient of the average value of the difference value of the cloud platform comprehensive configuration index at each moment and the total number of cloud platform components as the component configuration index threshold of each cloud platform component;

[0111] The ratio of the number of cloud platforms to the total number of cloud platform components is used as the first weight, and the average value of the difference value of the cloud platform comprehensive configuration index at each moment multiplied by the first weight is used as the cloud platform configuration index threshold;

[0112] Respectively obtain the cloud platform configuration index of the cloud platform and the component configuration index of each cloud platform component, and use the average value of the component configuration index of each cloud platform component at each moment within the monitoring time value as the second average value, and use the average value of the cloud platform configuration index of the cloud platform at each moment within the monitoring time value as the third average value;

[0113] Taking the second average value as a benchmark, obtaining a difference value of a configuration benchmark value of one of the cloud platform components at a certain moment;

[0114] Obtaining the difference value of the cloud platform configuration index at a certain moment of the cloud platform based on the third average value;

[0115] If the difference value of the configuration baseline value of one of the cloud platform components at a certain moment is greater than or equal to the component configuration index threshold, the component configuration information of the cloud platform component needs to be optimized;

[0116] If the difference value of the cloud platform configuration index of the cloud platform at a certain moment is greater than or equal to the cloud platform configuration index threshold, the cloud platform configuration information of the cloud platform needs to be optimized.

[0117] Further, the cloud platform's security policies, operation documents, and network configuration documents are consulted to optimize the cloud platform configuration information and the component configuration information of each cloud platform component, specifically including the following steps:

[0118] S400: If the cloud platform configuration information of the cloud platform and / or the component configuration information of the cloud platform components need to be optimized, all configurations in the cloud platform configuration information of the cloud platform and / or the component configuration information of the cloud platform components are updated based on the security policy of the cloud platform;

[0119] S401, collecting operation document information while updating all configurations of cloud platform configuration information of the cloud platform and / or component configuration information of the cloud platform components;

[0120] S402: Determine the accuracy of the update operation based on the operation document information, and update the operation document information based on the latest configuration and update operation;

[0121] S403, after updating the operation document information, obtaining resource usage information and adjusting resource configuration;

[0122] S404: After adjusting the resource configuration, set a new monitoring time value, and obtain the cloud platform comprehensive configuration index at each moment within the new monitoring time value;

[0123] S405. Finally, based on the comprehensive configuration index of the cloud platform at each moment within the new monitoring time value, determine whether the difference value of the configuration benchmark value of the platform component at a certain moment is greater than or equal to the component configuration index threshold and / or the difference value of the cloud platform configuration index of the cloud platform at a certain moment is greater than or equal to the cloud platform configuration index threshold.

[0124] Furthermore, based on the known vulnerability information, the vulnerability is repaired to obtain the cloud platform vulnerability repair capability index, and the cloud platform vulnerability repair capability is optimized, including:

[0125] Establish a known vulnerability information database through known vulnerability information;

[0126] Determine the system information, component information, and data information affected by the vulnerability based on the known vulnerability information in the known vulnerability information database;

[0127] Obtain the vulnerability impact scope index based on the system information, component information, and data information affected by the vulnerability;

[0128] Determine the vulnerability repair difficulty index based on known vulnerability information, and determine the vulnerability repair priority index based on the vulnerability impact scope index and the vulnerability repair difficulty index;

[0129] Prioritize the known vulnerability information in the known vulnerability information database based on the vulnerability repair priority index;

[0130] Repair the cloud platform according to the known vulnerability information sorted by priority to obtain vulnerability repair information;

[0131] Based on the vulnerability repair information, obtain the cloud platform vulnerability repair capability index.

[0132] Specifically, the vulnerability impact index is an indicator that assesses the scope and severity of security vulnerabilities. It is often used to help organizations prioritize vulnerabilities to reduce potential risks and damage. The vulnerability impact index usually includes an assessment of the scope of systems, applications, network components, or data that the vulnerability may affect, an assessment of the potential harm of the vulnerability, such as whether unauthorized access, data leakage, system control, etc. are allowed, and an assessment of the ease of exploitation of the vulnerability, including the skill level and resources required by attackers. The assessment results are quantified and the quantified values ​​are summed to obtain the vulnerability impact index; the vulnerability repair difficulty index can be evaluated from the vulnerability impact index of known vulnerability information. The larger the vulnerability impact index, the greater the vulnerability repair difficulty index, and the higher the vulnerability repair priority index of the cloud platform. The shorter the time required for the cloud platform to repair the vulnerability, the greater the cloud platform vulnerability repair capability index.

[0133] Furthermore, the optimized cloud platform is subjected to penetration testing to obtain penetration test information, and the penetration test information is evaluated to obtain the cloud platform defense capability index, which specifically includes:

[0134] Set the scope of the penetration test and simulate the test environment;

[0135] Use the known vulnerability information in the known vulnerability information database to simulate attacking the cloud platform n times within a preset time;

[0136] Collect system performance information, log file information, storage data information, and monitoring data information of the cloud platform for n simulated attacks, and obtain privilege escalation information and data access information of the simulated attacks;

[0137] Process system performance information, log file information, storage data information, monitoring data information, privilege escalation information, and data access information to obtain penetration test information;

[0138] Evaluate the penetration test information and obtain the cloud platform defense capability index.

[0139] Specifically, in order to enable the assessment system to detect emerging or complex vulnerabilities during regular assessments, when setting the scope of the penetration test and simulating the test environment, the scope of the penetration test can be gradually increased each time the cloud platform is simulated for n attacks. The preset time can be arranged according to the time period when the cloud platform is least vulnerable to attacks, so as to avoid irreversible losses to the cloud platform due to the dual attacks of simulated attacks and malicious attacks. The penetration test information is evaluated to obtain the cloud platform defense capability index. Simulated attacks may cause an increase in the CPU, memory and network bandwidth usage in the cloud platform, so the system performance information is the increase in the CPU, memory and network bandwidth usage in the cloud platform after the simulated attack, as well as the system load, and is scored. All key assets (such as virtual machines, storage, databases, etc.) and their security configurations in the system performance information and storage data information can be identified and classified to determine whether the system performance of the cloud platform has been lost after being simulated for n times, and to score it. Simulated attacks may generate a large number of security logs or event records. These logs may show abnormal login attempts, access behaviors or system errors, so the log file information is the output of security logs or event records after the cloud platform is subjected to simulated attacks, as well as the accuracy of security logs or event records, and they are scored. Simulated attacks may cause changes in network traffic patterns, such as traffic surges or abnormal traffic patterns, which may affect normal network operations, so the monitoring data information is the abnormal values ​​of network traffic after the simulated attack, which are scored. All scores are weighted and summed to obtain the cloud platform defense capability index.

[0140] Furthermore, a cloud platform network line communication security assessment system is proposed, which is used to implement the above-mentioned assessment method, and is characterized by comprising:

[0141] A network monitoring module, which is used to monitor and analyze network traffic and abnormal fluctuations in real time. The network monitoring module also includes a first monitoring unit and a second monitoring unit. The first monitoring unit is used to monitor the cloud platform, and the second monitoring unit is used to monitor each cloud platform component.

[0142] Network assessment module, which is used to assess component configuration information, vulnerability repair information, and penetration test information;

[0143] Network management module: The network management module is used to optimize and manage the cloud platform configuration information and the component configuration information of each cloud platform component, and generate configuration logs; perform vulnerability scans on the cloud platform and each cloud platform component to obtain known vulnerability information; repair the cloud platform based on the known vulnerability information to obtain vulnerability repair information and generate vulnerability repair logs; perform penetration testing on the optimized cloud platform to obtain penetration testing information; optimize the cloud platform defense capabilities and generate security events and defense logs;

[0144] Data transmission module, which is used for transmitting data information between the network monitoring module, the network evaluation module, the network management module and the display module;

[0145] Display module, the display module is used to display the monitoring process and results of the network monitoring module, display the evaluation process and results of the network evaluation module, and display the management content of the network management module.

[0146] Furthermore, the network assessment module specifically includes:

[0147] A configuration evaluation unit, the configuration evaluation unit is used to evaluate the overall configuration of the cloud platform according to the cloud platform configuration information and the component configuration information of each cloud platform component, and obtain a comprehensive configuration index of the cloud platform;

[0148] A vulnerability assessment unit is used to assess vulnerability repair information one by one to obtain a cloud platform vulnerability repair capability index;

[0149] Security Assessment Unit,The security assessment unit is used to evaluate the penetration test information.

[0150] Furthermore, the network management module specifically includes:

[0151] A configuration management unit, which is used to optimize and manage cloud platform configuration information and component configuration information of each cloud platform component, and generate configuration logs;

[0152] A vulnerability management unit is used to scan the cloud platform and each cloud platform component for vulnerabilities, obtain known vulnerability information, repair the cloud platform according to the known vulnerability information, obtain vulnerability repair information, and generate a vulnerability repair log;

[0153] Security management unit,The security management unit is used to perform penetration testing on the tuned cloud platform, obtain penetration testing information, tune the cloud platform's defense capabilities, and generate security events and defense logs.

[0154] Furthermore, a storage medium is proposed, in which a computer program is stored. When the computer program is run on a computer, the computer executes any one of the above-mentioned evaluation methods.

[0155] In summary, the advantages of the present invention are: evaluating the overall configuration of the cloud platform through the cloud platform network topology diagram, cloud platform configuration information and component configuration information of each cloud platform component, obtaining the cloud platform comprehensive configuration index, and judging whether the cloud platform configuration information and the component configuration information of each cloud platform component need to be optimized based on the cloud platform comprehensive configuration index, timely discovering the impact between the cloud platform configuration and the configuration of each cloud platform component, avoiding the overall resources of the cloud platform being restricted, thereby affecting the configuration of each component, and at the same time avoiding the network configuration of the cloud platform affecting the network connection of each component, resulting in communication problems or security risks between services;

[0156] By conducting penetration tests on the tuned cloud platform, obtaining penetration test information, and evaluating the penetration test information, we can obtain the cloud platform defense capability index, so that when the evaluation system conducts regular evaluations, it can detect emerging or complex vulnerabilities, thereby avoiding system intrusions, data leaks or service interruptions.

[0157] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A cloud platform network line communication security assessment method, characterized in that: include: Obtain cloud platform configuration information and cloud platform network topology diagram, and determine cloud platform component layout information; Determine component configuration information of each cloud platform component based on the cloud platform component layout information; Evaluate the overall configuration of the cloud platform based on the cloud platform network topology diagram, cloud platform configuration information, and component configuration information of each cloud platform component to obtain a comprehensive configuration index of the cloud platform; Based on the cloud platform comprehensive configuration index, determine whether the cloud platform configuration information and the component configuration information of each cloud platform component need to be optimized. If so, consult the cloud platform's security policy, operation documents, and network configuration documents to optimize the cloud platform configuration information and the component configuration information of each cloud platform component. If not, perform vulnerability scans on the cloud platform and each cloud platform component to obtain known vulnerability information. Repair vulnerabilities based on known vulnerability information, obtain the cloud platform vulnerability repair capability index, and optimize the cloud platform vulnerability repair capability; Conduct penetration testing on the optimized cloud platform, obtain penetration testing information, and evaluate the penetration testing information to obtain the cloud platform defense capability index; Optimize the cloud platform defense capability based on the cloud platform defense capability index; The overall configuration of the cloud platform is evaluated based on the cloud platform network topology diagram, the cloud platform configuration information and the component configuration information of each cloud platform component to obtain the cloud platform comprehensive configuration index, which specifically includes: According to the cloud platform network topology diagram and cloud platform component layout information, determine the physical distance, network distance, logical distance and control distance between the cloud platform and each cloud platform component; With the cloud platform as the origin, the physical distance between the cloud platform and each cloud platform component as the X-axis, the superposition value of the network distance and the logical distance as the Y-axis, and the control distance as the Z-axis, a three-dimensional space coordinate system is established; Determine respectively the preset ratio of the physical distance, the preset ratio of the superposition value of the network distance and the logical distance, and the preset ratio of the control distance; Determine the coordinate value of each cloud platform component in the three-dimensional space coordinate system based on the actual physical distance, actual network distance, actual logical distance, and actual control distance between the cloud platform and each cloud platform component; Based on the coordinate values ​​of the cloud platform and each cloud platform component in the three-dimensional space coordinate system, obtain the distance influence coefficient between the cloud platform and each cloud platform component; Based on the cloud platform configuration information and the component configuration information of each cloud platform component, obtain a cloud platform configuration index and a component configuration index of each cloud platform component; Obtain a cloud platform comprehensive configuration index according to the cloud platform configuration index, the component configuration index of each cloud platform component, and the distance influence coefficient between the cloud platform and each cloud platform component; The method of repairing the vulnerability based on the known vulnerability information, obtaining the cloud platform vulnerability repair capability index, and optimizing the cloud platform vulnerability repair capability specifically includes: Establish a known vulnerability information database through known vulnerability information; Determine the system information, component information, and data information affected by the vulnerability based on the known vulnerability information in the known vulnerability information database; Obtain the vulnerability impact scope index based on the system information, component information, and data information affected by the vulnerability; Determine the vulnerability repair difficulty index based on known vulnerability information, and determine the vulnerability repair priority index based on the vulnerability impact scope index and the vulnerability repair difficulty index; Prioritize the known vulnerability information in the known vulnerability information database based on the vulnerability repair priority index; Repair the cloud platform according to the known vulnerability information sorted by priority to obtain vulnerability repair information; Based on the vulnerability repair information, a cloud platform vulnerability repair capability index is obtained; the penetration test is performed on the tuned cloud platform to obtain the penetration test information, and the penetration test information is evaluated to obtain the cloud platform defense capability index, which specifically includes: Set the scope of the penetration test and simulate the test environment; Use the known vulnerability information in the known vulnerability information database to simulate attacking the cloud platform n times within a preset time; Collect system performance information, log file information, storage data information, and monitoring data information of the cloud platform for n simulated attacks, and obtain privilege escalation information and data access information of the simulated attacks; Process system performance information, log file information, storage data information, monitoring data information, privilege escalation information, and data access information to obtain penetration test information; Evaluate the penetration test information and obtain the cloud platform defense capability index.

2. A cloud platform network line communication security assessment method according to claim 1, characterized in that: The step of judging whether the cloud platform configuration information and the component configuration information of each cloud platform component need to be optimized based on the cloud platform comprehensive configuration index specifically includes: Set the monitoring time value and obtain the cloud platform comprehensive configuration index at each moment within the monitoring time value; Taking the average value of the cloud platform comprehensive configuration index at each moment as the first average value, and taking the first average value as a benchmark to obtain the difference value of the cloud platform comprehensive configuration index at each moment; Determine the total number of cloud platform components, and use the quotient of the average value of the difference value of the cloud platform comprehensive configuration index at each moment and the total number of cloud platform components as the component configuration index threshold of each cloud platform component; The ratio of the number of cloud platforms to the total number of cloud platform components is used as the first weight, and the average value of the difference value of the cloud platform comprehensive configuration index at each moment multiplied by the first weight is used as the cloud platform configuration index threshold; Respectively obtain the cloud platform configuration index of the cloud platform and the component configuration index of each cloud platform component, and use the average value of the component configuration index of each cloud platform component at each moment within the monitoring time value as the second average value, and use the average value of the cloud platform configuration index of the cloud platform at each moment within the monitoring time value as the third average value; Taking the second average value as a benchmark, obtaining a difference value of a configuration benchmark value of one of the cloud platform components at a certain moment; Obtaining the difference value of the cloud platform configuration index at a certain moment of the cloud platform based on the third average value; If the difference value of the configuration baseline value of one of the cloud platform components at a certain moment is greater than or equal to the component configuration index threshold, the component configuration information of the cloud platform component needs to be optimized; If the difference value of the cloud platform configuration index of the cloud platform at a certain moment is greater than or equal to the cloud platform configuration index threshold, the cloud platform configuration information of the cloud platform needs to be optimized.

3. A cloud platform network line communication security assessment method according to claim 2, characterized in that: The step of consulting the cloud platform's security policies, operation documents, and network configuration documents to optimize the cloud platform configuration information and the component configuration information of each cloud platform component specifically includes the following steps: S400: If the cloud platform configuration information of the cloud platform and / or the component configuration information of the cloud platform components need to be optimized, all configurations in the cloud platform configuration information of the cloud platform and / or the component configuration information of the cloud platform components are updated based on the security policy of the cloud platform; S401, collecting operation document information while updating all configurations of cloud platform configuration information of the cloud platform and / or component configuration information of the cloud platform components; S402: Determine the accuracy of the update operation based on the operation document information, and update the operation document information based on the latest configuration and update operation; S403, after updating the operation document information, obtaining resource usage information and adjusting resource configuration; S404: After adjusting the resource configuration, set a new monitoring time value, and obtain the cloud platform comprehensive configuration index at each moment within the new monitoring time value; S405. Finally, based on the comprehensive configuration index of the cloud platform at each moment within the new monitoring time value, determine whether the difference value of the configuration benchmark value of the platform component at a certain moment is greater than or equal to the component configuration index threshold and / or the difference value of the cloud platform configuration index of the cloud platform at a certain moment is greater than or equal to the cloud platform configuration index threshold.

4. A cloud platform network line communication security assessment system, used to implement the assessment method according to any one of claims 1 to 3, characterized in that: include: A network monitoring module, which is used to monitor and analyze network traffic and abnormal activities in real time; A network assessment module, the network assessment module is used to assess component configuration information, vulnerability repair information and penetration test information; A network management module, which is used to optimize and manage the cloud platform configuration information and the component configuration information of each cloud platform component, and generate configuration logs, perform vulnerability scans on the cloud platform and each cloud platform component to obtain known vulnerability information, repair the cloud platform according to the known vulnerability information, obtain vulnerability repair information, and generate vulnerability repair logs, perform penetration testing on the tuned cloud platform, obtain penetration testing information, tune the cloud platform defense capabilities, and generate security events and defense logs; A data transmission module, which is used to transmit data information between the network monitoring module, the network evaluation module, the network management module and the display module; A display module, which is used to display the monitoring process and results of the network monitoring module, the evaluation process and results of the network evaluation module, and the management content of the network management module; The network evaluation module specifically includes: A configuration evaluation unit, the configuration evaluation unit is used to evaluate the overall configuration of the cloud platform according to the cloud platform configuration information and the component configuration information of each cloud platform component, and obtain a comprehensive configuration index of the cloud platform; A vulnerability assessment unit, wherein the vulnerability assessment unit is used to assess the vulnerability repair information one by one to obtain a cloud platform vulnerability repair capability index; A security assessment unit, wherein the security assessment unit is used to assess the penetration test information; The network management module specifically includes: A configuration management unit, the configuration management unit is used to optimize and manage cloud platform configuration information and component configuration information of each cloud platform component, and generate a configuration log; A vulnerability management unit, the vulnerability management unit is used to scan the cloud platform and each cloud platform component for vulnerabilities, obtain known vulnerability information, repair the cloud platform according to the known vulnerability information, obtain vulnerability repair information, and generate a vulnerability repair log; A security management unit is used to perform penetration testing on the optimized cloud platform, obtain penetration testing information, optimize the defense capabilities of the cloud platform, and generate security events and defense logs.

5. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is run on a computer, the computer is enabled to execute the evaluation method according to any one of claims 1 to 3.

Images