Security policy collaborative management method and device and medium

Abstract

The present disclosure provides a security policy collaborative management method and device and medium, relates to the technical field of network security, and is used for solving the problem of how to realize timely and effective collaboration of multiple parties to defend against new security events. The method comprises the following steps: a security platform acquires new security event data from a terminal security device; the security platform acquires a security policy of the new security event data, the security policy is formulated by the security platform in cooperation with multiple security policy devices, and is used for cooperative defense against a security event corresponding to the new security event data; and the security platform issues the security policy to the terminal security device. The security policy of the present disclosure is formulated by multiple parties in cooperation, which greatly improves the effectiveness of the security policy. Through the security platform, security event data and security policies are managed, so that new security events can be timely defended.

Description

Technical Field

[0001] This disclosure relates at least to the field of cybersecurity technology, and in particular to a security policy collaborative management system, a security platform, an endpoint security device, a security policy device, a security policy collaborative management system, and a computer-readable storage medium. Background Technology

[0002] Endpoint security devices are provided by security vendors and typically employ pre-configured security policies to defend against security incidents. However, with the development of network technology, new security incidents may emerge, and endpoint security devices may lack the ability to defend against these new incidents.

[0003] The formulation of existing security strategies often lacks multi-party collaboration, resulting in multiple security vendors acting independently and making it difficult to coordinate the security capabilities of multiple security vendors to jointly defend against security incidents, thus leading to weak security defense capabilities.

[0004] Therefore, it is necessary to promptly mobilize multiple parties to jointly formulate security strategies in response to new security incidents, improve the effectiveness of security strategies, and provide effective security strategies to terminal security devices in a timely manner to achieve timely and effective defense against new security incidents. Summary of the Invention

[0005] The technical problem to be solved by this disclosure is to address the above-mentioned shortcomings by providing a security policy collaborative management system, a security platform, an endpoint security device, a security policy device, a security policy collaborative management system, and a computer-readable storage medium, so as to solve the problem of how to achieve timely and effective collaborative participation of multiple parties to defend against new security incidents.

[0006] Firstly, this disclosure provides a method for collaborative management of security policies, wherein the method...

[0007] The law includes:

[0008] The security platform acquires new security event data from endpoint security devices;

[0009] The security platform acquires the new security event data through a security policy. This security policy is jointly formulated by the security platform and multiple security policy devices and is used to collaboratively defend against the security events corresponding to the new security event data.

[0010] The security platform distributes the security policy to the terminal security device.

[0011] Furthermore, the method also includes:

[0012] The security platform records the information of the new security incident data into the blockchain;

[0013] The security platform records information on collaboratively developed security strategies onto the blockchain;

[0014] The security platform records the security policy information on the blockchain.

[0015] Furthermore, new security event data is acquired from endpoint security devices, specifically including:

[0016] Receive raw security event data from terminal security devices, filter out new security event data from the raw security event data by querying the blockchain, and record the new security event data into the blockchain;

[0017] The security vendor acquires the new security event data, stores the new security event data in a trusted manner corresponding to the security vendor, and records the updated security event data storage directory to the blockchain.

[0018] Furthermore, the security platform acquires the new security event data through a security policy. This security policy is collaboratively formulated by the security platform and multiple security policy devices, specifically including the security platform itself.

[0019] Select smart contracts recorded on the blockchain based on the new security event data;

[0020] The smart contract identifies multiple security strategy devices that collaboratively formulate security strategies.

[0021] The security policy for the new security event data is formulated collaboratively by the multiple security policy devices.

[0022] Furthermore, based on the smart contract, multiple security policy devices are identified to collaboratively formulate security policies, specifically including:

[0023] The smart contract is sent to multiple security vendor devices and / or industrial control systems, so that the multiple security vendor devices and / or industrial control systems fill in information about their participation in the formulation of security policies into the smart contract;

[0024] The system receives the smart contracts from the various security vendors' devices and / or industrial control systems, after each vendor has filled in its own information, and sends the smart contracts with the information to the contract approver.

[0025] Receive approval instructions from the contract approver, and determine, based on the approval instructions, multiple security vendor devices and / or industrial control systems that will collaboratively develop a security strategy.

[0026] Furthermore, the security policy for the new security event data is formulated collaboratively by the multiple security policy devices, specifically including:

[0027] The new security event data is processed into debug data;

[0028] The debugging data is sent to the multiple security vendor devices so that the multiple security vendor devices can obtain the first local model result based on the debugging data;

[0029] The following steps are executed iteratively multiple times: receiving the local model results sent by the multiple security vendor devices, aggregating the multiple local model results to obtain the global model result, and sending the next initial model to the multiple security vendor devices according to the global model result, so that the multiple security vendor devices can obtain the next local model result according to the next initial model.

[0030] Until a certain global model result meets the first preset condition, the final global model is obtained based on the certain global model result;

[0031] Based on the final global model, a security strategy for the new security event data is formulated.

[0032] Furthermore, the security policy for the new security event data is formulated collaboratively by the multiple security policy devices, specifically including:

[0033] The new security event data is processed into debug data;

[0034] The debugging data is sent to the multiple security vendor devices so that the multiple security vendor devices can obtain the first phase of the initial local model results based on the debugging data.

[0035] The following steps are executed iteratively multiple times: receiving the local model results of the first phase sent by the multiple security vendor devices, aggregating the multiple local model results of the first phase to obtain the global model results of the first phase, and sending the next initial model of the first phase to the multiple security vendor devices according to the next initial model of the first phase, so that the multiple security vendor devices can obtain the next local model results of the first phase according to the next initial model of the first phase.

[0036] Until the result of a certain global model in the first stage meets the second preset condition, the final global model of the first stage is obtained based on the result of a certain global model in the first stage.

[0037] The initial model for the second stage is obtained based on the final global model of the first stage.

[0038] The debugging data and the second-stage initial model are sent to the plurality of industrial control systems so that the plurality of industrial control systems can obtain the second-stage initial local model results based on the debugging data and the second-stage initial model.

[0039] The following steps are executed iteratively multiple times: receiving the local model results of the second stage sent by the multiple industrial control systems, aggregating the multiple local model results of the second stage to obtain the global model results of the second stage, and sending the next initial model of the second stage to the multiple industrial control systems according to the next initial model of the second stage, so that the multiple industrial control systems can obtain the next local model results of the second stage according to the next initial model of the second stage.

[0040] Until the result of a certain global model in the second stage meets the third preset condition, the final global model of the second stage is obtained based on the result of a certain global model in the second stage.

[0041] Based on the final global model of the second phase, a security strategy for the new security event data is formulated.

[0042] Furthermore, the security policy for acquiring the new security event data is collaboratively formulated by the security platform and multiple security policy devices, and specifically includes:

[0043] In response to obtaining approximate security event data with a similarity greater than a preset threshold by querying the blockchain, the security policy of the approximate security event data is obtained as the security policy of the new security event data. The security policy of the approximate security event data is pre-formulated collaboratively by the security platform and multiple security policy devices based on the approximate security event data.

[0044] Furthermore, the security policy is distributed to the terminal security device, specifically including:

[0045] The security policy is stored in a security policy repository, and the security policy directory of the security policy repository is recorded in the blockchain;

[0046] The system receives security policy usage requests and distributes the security policies to terminal security devices according to these requests, while also recording the distributed security policy information on the blockchain.

[0047] Secondly, this disclosure provides a security platform, the security platform comprising:

[0048] The data processing module is used to acquire new security event data from the terminal security device;

[0049] The policy acquisition module, connected to the data processing module, is used to acquire the security policy of the new security event data. The security policy is jointly formulated by the security platform and multiple security policy devices and is used to collaboratively defend against the security events corresponding to the new security event data.

[0050] The policy management module, connected to the policy acquisition module, is used to distribute the security policy to the terminal security device.

[0051] Furthermore, the security platform also includes an information recording module, connected to the data processing module, policy acquisition module, and policy management module, for:

[0052] The information of the new security incident data will be recorded in the blockchain;

[0053] Information on collaboratively developing security strategies will be recorded on the blockchain;

[0054] The information regarding the security policy is recorded on the blockchain.

[0055] Furthermore, the data processing module specifically includes:

[0056] A data filter is used to receive raw security event data from terminal security devices, filter out new security event data from the raw security event data by querying the blockchain, and record the new security event data to the blockchain.

[0057] A trusted storage device, connected to a data filter, is used to acquire the new security event data from security vendors, store the new security event data in a trusted manner corresponding to the security vendors, and record the updated security event data storage directory to the blockchain.

[0058] Furthermore, the strategy acquisition module is specifically a strategy formulation module, which includes:

[0059] An operational domain server is configured to select smart contracts recorded on the blockchain based on the new security event data; and

[0060] Multiple security policy devices used to determine collaboratively formulated security policies based on the smart contract;

[0061] The computing cluster server, connected to the operation domain server, is used to collaboratively formulate security policies for the new security event data in conjunction with the multiple security policy devices.

[0062] Furthermore, the operating domain server specifically includes:

[0063] The first transceiver unit is used to send the smart contract to multiple security vendor devices and / or industrial control systems, so that the multiple security vendor devices and / or industrial control systems fill in their own information on participating in the formulation of security policies into the smart contract, and receive the smart contract after each of the multiple security vendor devices and / or industrial control systems has filled in its own information.

[0064] The second transceiver unit, connected to the first transceiver unit, is used to send the smart contract with the information filled in to the contract approver, receive the approval instruction from the contract approver, and determine multiple security vendor devices and / or industrial control systems that will collaboratively formulate security strategies based on the approval instruction.

[0065] Furthermore, the computing cluster server specifically includes:

[0066] The data debugging unit is used to process the new security event data into debugging data;

[0067] A model training unit, connected to a data debugging unit, is used to send the debugging data to the plurality of security vendor devices, so that the plurality of security vendor devices can obtain initial local model results based on the debugging data; and...

[0068] The process is used to iteratively execute the following steps multiple times: receiving the current local model results sent by the multiple security vendor devices; aggregating the multiple current local model results to obtain the current global model result; and sending the next initial model to the multiple security vendor devices based on the current global model result, so that the multiple security vendor devices can obtain the next local model result based on the next initial model; and...

[0069] Used to obtain the final global model based on the global model result until a certain global model result meets the first preset condition;

[0070] The policy generation unit, connected to the model training unit, is used to formulate a security policy for the new security event data based on the final global model.

[0071] Furthermore, the computing cluster server specifically includes:

[0072] The data debugging unit is used to process the new security event data into debugging data;

[0073] The first-stage model training unit, connected to the data debugging unit, is used to send the debugging data to the multiple security vendor devices, so that the multiple security vendor devices can obtain the first-stage initial local model results based on the debugging data; and...

[0074] The process iteratively executes the following steps multiple times: receiving the first-stage local model results sent by the multiple security vendor devices; aggregating the multiple first-stage local model results to obtain the first-stage global model result; and sending the first-stage next initial model to the multiple security vendor devices based on the first-stage next initial model, so that the multiple security vendor devices can obtain the first-stage next local model result based on the first-stage next initial model; and

[0075] Used to obtain the final global model of the first stage based on the global model result of the first stage until the result of a certain global model in the first stage meets the second preset condition;

[0076] The second-stage model training unit, connected to the first-stage model training unit, is used to obtain the initial model for the second stage based on the final global model from the first stage; and...

[0077] Used to send the debugging data and the second-stage initial model to the plurality of industrial control systems, so that the plurality of industrial control systems can obtain the second-stage initial local model results based on the debugging data and the second-stage initial model; and

[0078] The system iteratively executes the following steps multiple times: receiving the second-stage local model results sent by the multiple industrial control systems; aggregating the multiple second-stage local model results to obtain the second-stage global model result; and sending the second-stage next initial model to the multiple industrial control systems based on the second-stage next initial model, so that the multiple industrial control systems can obtain the second-stage next local model result based on the second-stage next initial model; and...

[0079] Used until the result of a certain global model in the second stage meets the third preset condition, and then the final global model of the second stage is obtained based on the result of a certain global model in the second stage;

[0080] The policy generation unit, connected to the second-stage model training, is used to formulate security policies for the new security event data based on the final global model of the second stage.

[0081] Furthermore, the strategy acquisition module is specifically a strategy query module, used for:

[0082] In response to obtaining approximate security event data with a similarity greater than a preset threshold by querying the blockchain, the security policy of the approximate security event data is obtained as the security policy of the new security event data. The security policy of the approximate security event data is pre-formulated collaboratively by the security platform and multiple security policy devices based on the approximate security event data.

[0083] Furthermore, the strategy management module specifically includes:

[0084] A security policy library is used to store the security policies and record the security policy directory of the security policy library to the blockchain.

[0085] The policy invocation device is connected to the security policy library and is used to issue the security policy to the terminal security device according to the security policy usage requirements, and record the information of the security policy issuance to the blockchain.

[0086] Thirdly, this disclosure provides a terminal security device, the terminal security device comprising:

[0087] The data sending module is used to upload its own security event data to the security platform so that the security platform can obtain new security event data;

[0088] The policy receiving module, connected to the data sending module, is used to receive the security policy of the new security event data from the security platform. The security policy is jointly formulated by the security platform and multiple security policy devices and is used to collaboratively defend against the security events corresponding to the new security event data.

[0089] Fourthly, this disclosure provides a security policy device, the security policy device comprising:

[0090] The collaborative module is used to collaborate with several other security policy devices to formulate security policies under the joint action of the security platform. The security policies are used to collaboratively defend against security events corresponding to new security event data. The new security event data is uploaded to the security platform by the terminal security device, and the security policies are issued to the terminal security device by the security platform.

[0091] Fifthly, this disclosure provides a security policy collaborative management system, the system comprising:

[0092] The security platform described above;

[0093] The terminal security device described above is connected to the security platform;

[0094] The security policy device described above is connected to the security platform.

[0095] In a sixth aspect, this disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the security policy collaborative management method, security platform, terminal security device, security policy device, or security policy collaborative management system as described above.

[0096] This disclosure provides a security policy collaborative management system, a security platform, an endpoint security device, a security policy device, a security policy collaborative management system, and a computer-readable storage medium. The security platform acquires new security event data from the endpoint security device and the security policy that acquires the new security event data. The security policy is formulated by mobilizing multiple security policy devices to participate collaboratively, thereby greatly improving the effectiveness of the security policy. At the same time, by managing security event data and security policies through the security platform, the endpoint security device can acquire targeted security policies for new security events, so that new security events can be defended in a timely manner. Attached Figure Description

[0097] Figure 1 This is a flowchart of a security policy collaborative management method according to an embodiment of this disclosure;

[0098] Figure 2 This is an architecture and process interaction diagram of a security policy collaborative management system according to an embodiment of the present disclosure;

[0099] Figure 3 This is an architecture and process interaction diagram of another security policy collaborative management system according to an embodiment of this disclosure;

[0100] Figure 4 This is an architecture and process interaction diagram of another security policy collaborative management system according to an embodiment of the present disclosure;

[0101] Figure 5 This is a schematic diagram of the structure of a security platform according to an embodiment of this disclosure;

[0102] Figure 6 This is a schematic diagram of the structure of a terminal security device according to an embodiment of this disclosure;

[0103] Figure 7 This is a schematic diagram of the structure of a security strategy device according to an embodiment of this disclosure;

[0104] Figure 8 This is a schematic diagram of the structure of a security policy collaborative management system according to an embodiment of this disclosure. Detailed Implementation

[0105] To enable those skilled in the art to better understand the technical solutions of this disclosure, the embodiments of this disclosure will be further described in detail below with reference to the accompanying drawings.

[0106] It is understood that the specific embodiments and accompanying drawings described herein are for illustrative purposes only and are not intended to limit the scope of this disclosure.

[0107] It is understood that, without conflict, the various embodiments and features in the embodiments of this disclosure can be combined with each other.

[0108] It is understood that, for ease of description, only the parts relevant to this disclosure are shown in the accompanying drawings, while parts unrelated to this disclosure are not shown in the drawings.

[0109] It is understood that each unit or module involved in the embodiments of this disclosure may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0110] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this disclosure may occur in a different order than that marked in the accompanying drawings.

[0111] It is understood that the flowcharts and block diagrams of this disclosure illustrate the architecture, functions, and operations of possible implementations of systems, apparatuses, devices, and methods according to various embodiments of this disclosure. Each block in a flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagrams and flowcharts may be implemented using a hardware-based system to implement the specified function, or using a combination of hardware and computer instructions.

[0112] It is understood that the units and modules involved in the embodiments of this disclosure can be implemented by software or by hardware, for example, the units and modules can be located in a processor.

[0113] To facilitate understanding of this disclosure, the inventive concept will first be explained in conjunction with a specific scenario:

[0114] Security risk prevention in Industry 4.0 often requires acquiring data from multiple sources, such as sensitive information from Industrial Internet of Things (IIoT) applications. Therefore, building efficient and trustworthy models for data from different sources is crucial. However, current industrial scenarios lack secure and efficient model and data sharing mechanisms. Protecting local models and data from leakage during transmission and training is an important research direction. By using blockchain-authorized data sharing schemes, the security of the sharing process can be enhanced without centralized trust. Integrating federated learning into the consensus process of permissioned blockchains, and using privacy-based federated learning technology, can not only improve the utilization of computing resources but also increase the efficiency of data sharing schemes.

[0115] Therefore, the security strategy collaborative management method and apparatus provided in this disclosure can be specifically used for the security protection of industrial networks, and can improve their security based on blockchain-assisted privacy computing.

[0116] This disclosure, in the process of using blockchain to provide source data on-chain services for federated computing, allows for the recording of data operations, such as data deletion, data addition, and data modification, preventing malicious data tampering, deletion, or poisoning. The inherent advantage of blockchain in reliable data recording can be used to assist privacy-preserving computing in tracking data usage records.

[0117] This disclosure takes into account that in the context of the Industrial Internet, the computing resources of industrial terminal equipment (especially terminal security equipment) are often limited. Therefore, it is necessary to design a more efficient data storage and transmission solution, which needs to combine new technological developments, such as edge computing, compression algorithms or customized encryption schemes, to improve data processing efficiency and reduce computing resource consumption in order to meet the application needs of lightweight computing scenarios.

[0118] This disclosure addresses industrial internet application scenarios, specifically the limited computing and storage capabilities of industrial terminal equipment and the fragmented security landscape within the industrial sector. It utilizes blockchain-assisted privacy computing to design a collaborative framework for industrial internet security policies. This framework aims to achieve secure data sharing and collaborative security policies while ensuring that industrial security data is available but not visible, thereby enhancing the security protection capabilities of the industrial internet.

[0119] Meanwhile, this framework fully considers the advantages of blockchain's trusted data recording, linking all aspects to the blockchain to ensure that critical operations and data records are stored on the blockchain. By adding corresponding modules to filter duplicate and malicious data, the system's computational burden is reduced. Furthermore, the computational burden is primarily concentrated on existing, high-performance central computing servers (specifically, a security platform composed of server clusters) and security vendors (mainly referring to dedicated equipment with high computing power provided by security vendors). Terminal devices (mainly terminal security devices) only handle data collection, uploading, and receiving security policies, improving the overall efficiency of the framework.

[0120] This disclosure presents a novel solution for industrial network security policy management, facilitating security vendors to model and analyze security incidents reported by the system, generating corresponding and optimized security policies for collaborative security operations. It achieves data "usable but not visible" and "computable but not knowable," protecting the core interests of each security vendor while promoting collaboration among them. Furthermore, it utilizes blockchain technology to assist in the immutable storage and consensus management of data circulation and usage processes, contract execution status, and operational procedures, enabling on-chain evidence storage, multi-party collaboration, and value circulation. This is something traditional security management solutions cannot achieve.

[0121] The concepts of data, models, etc., related to this disclosure are explained as follows:

[0122] Data refers to the network security-related data provided by various security vendors, including event descriptions, event characteristics, and defense methods for security incidents. This data includes network security incident data, network security policy data, network security traffic data, user behavior data, security device log data, vulnerability scan data, and threat intelligence data. Taking network security incident data as an example, it includes category, level, description, cause, identification criteria, attack source, attack target, attack time, attack method, impact scope, loss assessment, and response measures.

[0123] Examples of security incident categories are shown in Table 1 below:

[0124] Table 1. Classification of Security Incidents

[0125]

[0126]

[0127]

[0128]

[0129]

[0130] Cybersecurity incidents are classified into four levels based on the importance of the affected entities, the severity of business losses, and the severity of social harm: extremely serious incidents, serious incidents, relatively serious incidents, and general incidents, which are respectively Level 1, Level 2, Level 3, and Level 4 from highest to lowest.

[0131] Network security incident identification relies on various methods, including feature-based identification schemes. For example, to detect a network attack targeting a Schneider Quantum PLC (Programmable Logic Controller), the device is shut down. The corresponding detection strategy is: "alert tcp any any->any 502 (msg:"Schneider PLC(Quantumn) uses function code 90 for communications the Unity pro software Set PLC CPU STOP";content:"|00 00|";offset:2;depth:2;content:"|5a|";offset:7;depth:1;content:"|40|";offset:9;depth:1;sid:8999114;)"); anomaly-based identification methods; and intelligence-based identification schemes. Therefore, the description information for network security incidents can be set relatively flexibly.

[0132] Model: For event data, such as a temperature increase of 10 degrees, security vendors make judgments and extract data based on the characteristics of the data collected by their own security devices. Different security vendors have different security devices, so the models they build are also different.

[0133] For the analysis of cybersecurity incidents, the MITER and ATT&CK models are typically used to reconstruct the process of the security incident. For example, the corresponding steps are framed into detailed categories such as Initial Access, Execution, Persistence, Evasion, Discovery, Lateral Movement, Collection, Command and Control, Inhibit Response Function, Impair Process Control, and Impact.

[0134] In industrial internet security scenarios, more detailed security detection models can be set up by combining business logic. Taking the Modbus communication protocol, which is commonly used in industrial scenarios, as an example, in-depth analysis of the protocol and security detection of business logic can be implemented.

[0135] The MODBUS protocol defines a simple Protocol Data Unit (PDU) that is independent of the underlying communication layer. The MODBUS protocol mapping on a specific bus or network can introduce some additional fields on the Application Data Unit (ADU).

[0136] The MODBUS protocol defines three types of PDUs. They are:

[0137] MODBUS requests PDU, mb_req_pdu

[0138] MODBUS responds to PDUs, mb_rsp_pdu

[0139] MODBUS exception response PDU, mb_excep_rsp_pdu

[0140] Define mb_req_pdu as:

[0141] mb_req_pdu={function_code,request_data}, where

[0142] function_code - [1 byte] MODBUS function code

[0143] The request_data field, consisting of [n bytes], is related to the function code and typically includes information such as variable references, variables, data offsets, and sub-function codes.

[0144] Define mb_rsp_pdu as:

[0145] mb_rsp_pdu={function_code,response_data}, where

[0146] function_code - [1 byte] MODBUS function code

[0147] The response_data field, consisting of [n bytes], is related to the function code and typically includes information such as variable references, variables, data offsets, and sub-function codes.

[0148] Define mb_excep_rsp_pdu as:

[0149] mb_excep_rsp_pdu={function_code,request_data}, where

[0150] function_code - [1 byte] MODBUS function code + 0x80

[0151] exception_code - [1 byte], the MODBUS exception codes are defined in the table below.

[0152] When Modbus requests data, it may request a segment rather than an exact one. For example, if it needs two words at address 42100, the corresponding request message may request 100 addresses starting from 42080.

[0153] The following example illustrates this:

[0154] Function code 1

[0155] The file 2.pcapng, network packet number 81, request address 1801, and the corresponding point table are shown in Table 2 below:

[0156] Table 2 Example of Function Code 1

[0157]

[0158] Function code 2

[0159] File 2.pcapng, network packet number 18, requests 119 addresses starting from address 42100, the corresponding point table is shown in Table 3 below:

[0160] Table 3 Example of Function Code 2

[0161]

[0162] Through a deep understanding of the protocols and business processes described above, business data can be reconstructed from network traffic data, thereby enabling the establishment of corresponding security detection models for the business. For example, if the normal temperature of a tank is 10-20 degrees Celsius, a response strategy for this temperature can be set in the platform, including the protocol, location address, data type, endianness, data length, data parsing rules, and the required security policies, such as the normal temperature range, the tolerable temperature range, and the alarm temperature range.

[0163] Example 1:

[0164] like Figure 1 As shown, this disclosure provides a method for collaborative management of security policies, the method comprising:

[0165] S1. The security platform acquires new security event data from endpoint security devices;

[0166] S2. The security policy for the security platform to acquire the new security event data. The security policy is jointly formulated by the security platform and multiple security policy devices and is used to collaboratively defend against the security events corresponding to the new security event data.

[0167] S3. The security platform sends the security policy to the terminal security device.

[0168] In this embodiment, the method obtains new security event data from the terminal security device through a security platform, and then the security platform obtains security policies for the new security event data. The security policies are formulated collaboratively by multiple security policy devices mobilized by the security platform, thereby greatly improving the effectiveness of the security policies. At the same time, by managing security event data and security policies through the security platform, new security events can be discovered in a timely manner, thereby obtaining security policies for the new security events in a timely manner. The terminal security device can obtain targeted security policies for the new security events and use the targeted security policies for security protection, so that the new security events can be defended in a timely manner.

[0169] More specifically, as the application scope of the Industrial Internet continues to expand, the security risks faced by the industrial control field are constantly increasing. However, at present, security vendors in the Industrial Internet do not trust each other due to competition. Security strategies, security data, and security vulnerabilities are not shared, and each security vendor has limited capabilities under such non-cooperation.

[0170] The capabilities of industrial internet security devices are also limited. On the one hand, traditional industrial networks are relatively simple, and security incidents are relatively few, resulting in limited security device capabilities and a narrow management scope. On the other hand, the industrial internet promotes the convergence of IT (Information Technology), CT (Communication Technology), and OT (Operational Technology), breaking the relatively closed and trustworthy production environment of traditional industrial control networks. This greatly increases attack paths, posing unprecedented threats to traditional industrial control systems.

[0171] Therefore, a new method is needed to achieve collaboration and jointly improve the protection capabilities of the Industrial Internet without disclosing the core intellectual property rights of security vendors. When the method provided in this embodiment is applied to the security protection of the Industrial Internet, the security platform can consist of a cluster server, including a data processing module for acquiring new security event data from terminal security devices, a policy acquisition module for acquiring the new security event data, and a policy management module for managing and distributing security policies. Security policies are collaboratively formulated by the security platform in conjunction with multiple security policy devices. The policy acquisition module includes a computing cluster server that collaborates with multiple security policy devices to collaboratively formulate security policies. The multiple security policy devices include a collaborative module that, in conjunction with the security platform, collaborates with several other security policy devices to collaboratively formulate security policies. Specifically, the security policy devices can be security vendor equipment or industrial control systems. Terminal security devices include a data sending module that uploads its own security event data to the security platform and a policy receiving module that receives the new security event data from the security platform. Specifically, the terminal security devices can be IT / CT / OT network security devices, generally provided by a security vendor, which can connect to the industrial control system and be deployed in the industrial field to provide network security protection. Through the above structure and the application of... Figure 1 The method shown can effectively achieve security protection for the Industrial Internet and ensure the safety of industrial production.

[0172] In one embodiment, the method further includes:

[0173] The security platform records the information of the new security incident data into the blockchain;

[0174] The security platform records information on collaboratively developed security strategies onto the blockchain;

[0175] The security platform records the security policy information on the blockchain.

[0176] In this embodiment, providing trusted records through blockchain includes: using blockchain to record information about new security event data, which can be used to determine whether a new security event has been collected. If a new security event has been collected, it may be necessary to formulate a new security policy, or a security policy can be selected based on similar old security events to protect against the new security event; using blockchain to record information about collaboratively formulating security policies, which can be used to determine the contribution of multiple security policy devices to the formulation of security policies, and can serve as a basis for punishing malicious devices or rewarding active devices. Blockchain can also be used to assist privacy computing, providing trusted data while ensuring that the data is available but not visible, realizing security policy collaboration among security vendors, and enhancing the enthusiasm of all parties to participate in collaborative protection; and using blockchain to record information about security policies, so as to facilitate the management of security policies and record the use of security policies.

[0177] In one implementation, acquiring new security event data from the terminal security device specifically includes:

[0178] Receive raw security event data from terminal security devices, filter out new security event data from the raw security event data by querying the blockchain, and record the new security event data into the blockchain;

[0179] The security vendor acquires the new security event data, stores the new security event data in a trusted manner corresponding to the security vendor, and records the updated security event data storage directory to the blockchain.

[0180] In this embodiment, Figure 2-4 Three industrial network security policy management framework solutions are provided, utilizing blockchain (blockchain platform) and privacy computing to achieve collaborative management of industrial network security policies in scenarios involving multiple security vendors. Among them, Figure 2 This is a collaborative management framework for industrial network security policies involving multiple security vendors. Figure 3 This is a collaborative management framework for industrial network security policies based on historical security data. Figure 4 It is a collaborative management framework for industrial network security strategies involving multiple parties, including industrial control systems and security vendors.

[0181] In all three frameworks, the endpoint security device is an IT / CT / OT network security device, and the data processing module of the security platform includes a data filter and a trusted storage environment. The data processing flow is similar. Figure 1 For example, Figure 1 The data processing flow, corresponding to the first stage of the operation, is as follows:

[0182] Step 1: Industrial IT / CT / OT network security equipment (i.e., endpoint security equipment) collects industrial network security data (mainly referring to raw security event data) and uploads it to the data filter after encryption;

[0183] Step 2: The data filter filters the data collected by industrial IT / CT / OT network security equipment, removes impurities and duplicate data, and uploads it to the storage cluster server (i.e., trusted storage environment) after encryption.

[0184] Step 3: The blockchain (i.e., the blockchain platform) records the encrypted upload event;

[0185] Step 4: The raw data of security incidents is encrypted and stored in the storage environment, and managed hierarchically according to the manufacturer (i.e., security vendor) of the device (i.e., the terminal security device), and the data directory is recorded to the blockchain in real time;

[0186] By following the above four steps, you can complete the necessary preparations for signing contracts with security equipment manufacturers and platform systems.

[0187] right Figure 2-4 The following are explanations of some of the terms that appear in the text:

[0188] IT / CT / OT network security equipment (also known as endpoint security equipment, secure endpoint equipment, etc.): In the Industrial Internet, network security endpoint equipment that can provide industrial network security related data to upper-layer platforms, such as network probes, firewalls, network isolation devices, industrial gateways, etc.; at the same time, it can also execute industrial security policies.

[0189] Data filtering (i.e., data filter): used to filter out impurities and identify abnormal data collected by IT / CT / OT network security terminal devices, and to compare current data with historical data.

[0190] Trusted encrypted storage (trusted storage environment, also known as trusted storage, etc.): used to store industrial network security data collected by IT / CT / OT network security terminal devices after screening and encryption, and to implement hierarchical and classified management. The data catalog is maintained through blockchain.

[0191] Trusted Production Environment: A trusted execution environment based on TEE (Trusted Execution Environment) technology, including a secure hardware and software environment, used to protect sensitive data and perform critical tasks. Operations in a trusted production environment are safe and risk-free.

[0192] Debugging environment: The encrypted data obtained by homomorphically encrypting or differential privacy processing the original data is provided to security vendors and other devices through table structures and other means to achieve privacy protection for model training.

[0193] Security Policy Repository: Used to manage and maintain collaborative security policies from various security vendors and other entities obtained through privacy computation throughout the system. The policy catalog is recorded and maintained by a blockchain.

[0194] Security policy invocation: Utilizing the security policy set in the security policy library, it provides security policy references for manual policy handling and optimal policies for automated policy handling. Through both manual and automated policy handling modes, it issues applicable security collaboration policies to industrial network security devices.

[0195] Security vendors (mainly referring to security vendor equipment): can initiate privacy computing to computing cluster servers and achieve industrial network security policy collaboration with other security vendors.

[0196] Contract approver: Manages all parties involved in privacy computing and reviews the conditions for participating in the contract.

[0197] In one embodiment, S2, the security platform acquires the security policy for the new security event data. This security policy is collaboratively formulated by the security platform and multiple security policy devices, specifically including the security platform itself.

[0198] Select smart contracts recorded on the blockchain based on the new security event data;

[0199] The smart contract identifies multiple security strategy devices that collaboratively formulate security strategies.

[0200] The security policy for the new security event data is formulated collaboratively by the multiple security policy devices.

[0201] In this embodiment, as Figure 2 and 4 As shown, all involve the process of developing new security strategies for new security incident data. This process establishes trust among the participants by invoking smart contracts. A smart contract (referred to as a contract in the diagram) is an automated, secure, and programmable contract that can execute automatically without relying on a third party, ensuring the fairness, transparency, and credibility of the contract. Smart contracts are represented in the form of code, with the contract's content and execution rules written into the code. Once the contract is initiated, it will execute automatically, preventing errors or falsification due to human factors. The smart contracts disclosed herein can stipulate the following information: the identity information of the security policy device, data information, and data usage requirements (including the number of uses and the amount of data).

[0202] In one embodiment, multiple security policy devices that collaboratively formulate security policies are determined according to the smart contract, specifically including:

[0203] The smart contract is sent to multiple security vendor devices and / or industrial control systems, so that the multiple security vendor devices and / or industrial control systems fill in information about their participation in the formulation of security policies into the smart contract;

[0204] The system receives the smart contracts from the various security vendors' devices and / or industrial control systems, after each vendor has filled in its own information, and sends the smart contracts with the information to the contract approver.

[0205] Receive approval instructions from the contract approver, and determine, based on the approval instructions, multiple security vendor devices and / or industrial control systems that will collaboratively develop a security strategy.

[0206] In this embodiment, as Figure 2 and 4 As shown, security strategy devices can specifically be security vendor equipment and / or industrial control systems. Multiple security strategy devices establish a collaborative relationship through smart contracts. By including information such as the identities of the participating parties, the data users, the number of times data is used, and the amount of data used in the contract terms, and by combining blockchain technology with smart contracts, the fairness, transparency, credibility, and traceability of the contracts are guaranteed. By applying blockchain smart contract technology, various behavioral logs of data providers and data requesters, such as registration, login, operation behavior, data upload, fusion computing contract establishment and modification, debugging and execution, and result set download, are encrypted and uploaded to the blockchain, realizing trust collaboration and consistent action among multiple entities.

[0207] In one embodiment, the security policy for the new security event data is formulated collaboratively by the multiple security policy devices, specifically including:

[0208] The new security event data is processed into debug data;

[0209] The debugging data is sent to the multiple security vendor devices so that the multiple security vendor devices can obtain the first local model result based on the debugging data;

[0210] The following steps are executed iteratively multiple times: receiving the local model results sent by the multiple security vendor devices, aggregating the multiple local model results to obtain the global model result, and sending the next initial model to the multiple security vendor devices according to the global model result, so that the multiple security vendor devices can obtain the next local model result according to the next initial model.

[0211] Until a certain global model result meets the first preset condition, the final global model is obtained based on the certain global model result;

[0212] Based on the final global model, a security strategy for the new security event data is formulated.

[0213] In this embodiment, as Figure 2 As shown, this framework involves security vendors (generally manufacturers of endpoint security devices, but not necessarily the manufacturers of the endpoint security devices uploading new security event data), security data collectors (generally collected by endpoint security devices), security policy managers (generally managed by the security platform), and data storage and computing environment managers (implemented on the security platform, which can adopt a multi-server collaborative mode, i.e., using a cluster server). Among them, security device manufacturers are both providers of factory security equipment and executors of security policy smart contracts; security data collectors mainly collect security data on factory security endpoint devices, and in special cases, data can also be collected on industrial control terminal devices and network devices. Because there are multiple data sources, and industrial control terminal equipment, network equipment, and security equipment (collectively referred to as terminal security equipment) all have responsible management departments, for ease of description, all data acquisition channels are collectively referred to as data acquisition parties; security policy management parties mainly collect security policies generated by security vendors' smart contracts and distribute security policies to security devices manually or automatically to achieve security policy collaboration, that is, including managing the security policy library in the diagram and calling security policies, which can be the responsibility of security management departments or third-party security service organizations; data storage and computing environment management parties mainly provide trusted data storage, trusted production environments, and debugging environments, which are usually the responsibility of IT management departments to provide resource environments.

[0214] This is a collaborative management framework for industrial network security policies involving multiple security vendors. It includes IT / CT / OT network security terminal devices, data filtering, trusted encrypted storage, trusted production environments, debugging environments, security policy libraries, security policy management, and security equipment vendors. The collaborative management process for industrial network security policies involving multiple security vendors can be divided into three stages: the first stage is data collection, filtering, and contract preparation; the second stage is smart contract application, approval, and execution; and the third stage is security policy download, security policy processing, and collaborative policy distribution. For example... Figure 2 The specific operational process, which can be divided into three stages, is as follows:

[0215] The operation process in the first phase:

[0216] Step 1: Industrial network security data collected by industrial IT / CT / OT network security equipment is uploaded to the data filter after being encrypted;

[0217] Step 2: The data filter filters the data collected by industrial IT / CT / OT network security equipment, removes impurities and duplicate data, and uploads it to the storage cluster server after encryption;

[0218] Step 3: The blockchain records the encrypted upload event;

[0219] Step 4: The raw data of security incidents is encrypted and stored in the storage environment, managed according to the manufacturer of the corresponding device, and the data directory is recorded to the blockchain in real time;

[0220] By following the above four steps, you can complete the necessary preparations for signing contracts with security equipment manufacturers and platform systems.

[0221] The second phase of the operation process:

[0222] Step 5: Industrial security vendors submit contract requests to the computing cluster server based on their own security data analysis or the requirements of the security policy management party.

[0223] Step 6: The relevant management departments approve the contract;

[0224] Step 7: After receiving approval, the industrial security vendor initiates the execution of the security collaboration strategy contract;

[0225] Step 8: The encrypted data in the trusted storage is decrypted in the trusted production environment, and then optimized using cryptographic techniques to generate a debug data with the same table structure, which is then sent to the debug environment.

[0226] Step 9: The computing cluster server provides the initial model and debugging data to the security equipment manufacturer according to the training task, so that the manufacturer can develop a local model for training. The local model is uploaded to the server for aggregation to obtain the global model, and then the global model is distributed to the industrial security equipment manufacturer again to continue training the local model. This process is repeated iteratively.

[0227] Step 10: Record the models generated during the iteration process to the blockchain;

[0228] Step 11: After the iteration is complete or convergence is achieved, the final global model is obtained, and the security policy is generated.

[0229] Through the above 7 steps, the smart contract execution between security vendors is completed, and a global security collaboration strategy for the industrial network, namely a joint security strategy, is obtained.

[0230] The operational process for the third stage:

[0231] Step 12: Obtain the federated security policy from the final global model and download it to the security policy library cache;

[0232] Step 13: The security policy download record is stored on the blockchain;

[0233] Step 14: The security policy manager obtains security collaboration policies (i.e., security policy invocation) from the security policy library to provide security policy references for manual handling and optimal policies for automated handling;

[0234] Step 15: The strategy catalog is maintained on the blockchain;

[0235] Step 16: Distribute the corresponding industrial security policies to industrial security equipment;

[0236] Step 17: Record the issued strategy in the blockchain.

[0237] In one embodiment, the security policy for the new security event data is formulated collaboratively by the multiple security policy devices, specifically including:

[0238] The new security event data is processed into debug data;

[0239] The debugging data is sent to the multiple security vendor devices so that the multiple security vendor devices can obtain the first phase of the initial local model results based on the debugging data.

[0240] The following steps are executed iteratively multiple times: receiving the local model results of the first phase sent by the multiple security vendor devices, aggregating the multiple local model results of the first phase to obtain the global model results of the first phase, and sending the next initial model of the first phase to the multiple security vendor devices according to the next initial model of the first phase, so that the multiple security vendor devices can obtain the next local model results of the first phase according to the next initial model of the first phase.

[0241] Until the result of a certain global model in the first stage meets the second preset condition, the final global model of the first stage is obtained based on the result of a certain global model in the first stage.

[0242] The initial model for the second stage is obtained based on the final global model of the first stage.

[0243] The debugging data and the second-stage initial model are sent to the plurality of industrial control systems so that the plurality of industrial control systems can obtain the second-stage initial local model results based on the debugging data and the second-stage initial model.

[0244] The following steps are executed iteratively multiple times: receiving the local model results of the second stage sent by the multiple industrial control systems, aggregating the multiple local model results of the second stage to obtain the global model results of the second stage, and sending the next initial model of the second stage to the multiple industrial control systems according to the next initial model of the second stage, so that the multiple industrial control systems can obtain the next local model results of the second stage according to the next initial model of the second stage.

[0245] Until the result of a certain global model in the second stage meets the third preset condition, the final global model of the second stage is obtained based on the result of a certain global model in the second stage.

[0246] Based on the final global model of the second phase, a security strategy for the new security event data is formulated.

[0247] In this embodiment, as Figure 4 As shown, this framework is similar to... Figure 2 The biggest difference in the framework shown is that the industrial control system participates in contract execution in this framework. This is because other parts of this framework differ from... Figure 2 As shown, the first and third phases of the collaborative management process for industrial network security strategies, involving multiple parties such as industrial control systems and security vendors, are identical to those in Scheme 1. Therefore, we will only introduce the second phase here. Since the steps before Step 9 in both the first and second phases are the same... Figure 2 As shown, this section will begin with the second stage, Step 10, as follows:

[0248] ...

[0249] Step 10: The operation domain server sends contract invitations to the relevant industrial control systems that are affected by security issues;

[0250] Step 11: The industrial control system accepts the contract invitation and participates in the execution of the contract;

[0251] Step 12: After the industrial control system obtains debugging data and information such as the global model obtained by the security vendors, it develops a local model for training and sends the trained model to the industrial security equipment vendors to continue training the local model. This process is repeated iteratively.

[0252] Step 13: Record the models generated during the iteration process to the blockchain;

[0253] Step 14: After the iteration is complete or convergence is achieved, the final global model is obtained, and the security policy is generated;

[0254] ...

[0255] This example involves the industrial control system in the contract, designed after the security vendor is involved, for the following reasons:

[0256] Industrial control systems have a higher priority. After the security vendor completes the initial global model, the industrial control system will then decide whether to join the contract to carry out model training. This can protect the existing systems and management methods of industrial production management as much as possible and ensure that the rhythm of industrial production is not easily disrupted.

[0257] Industrial control systems often have limited computing power. Placing the industrial control system's participation in the contract after the security vendor can reduce the number of iterations and improve efficiency.

[0258] In one embodiment, the security policy for acquiring the new security event data is collaboratively formulated by a security platform and multiple security policy devices, specifically including:

[0259] In response to obtaining approximate security event data with a similarity greater than a preset threshold by querying the blockchain, the security policy of the approximate security event data is obtained as the security policy of the new security event data. The security policy of the approximate security event data is pre-formulated collaboratively by the security platform and multiple security policy devices based on the approximate security event data.

[0260] In this embodiment, as Figure 3 As shown, this framework is mainly designed for situations where security data has appeared in the past and security vendors have generated security collaboration policies. When new security data is the same as or extremely similar to historical security data, the security collaboration policy is obtained by querying the data catalog through the blockchain, thereby improving the response speed of industrial network security.

[0261] This framework mainly consists of IT / CT / OT network security terminal devices, data filtering, trusted encrypted storage, security policy library, and security policy management. Its functions are similar to... Figure 2 The same applies as shown. Since privacy computing and smart contracts are not involved, this framework does not include modules for trusted production environments, debugging environments, or security equipment vendors. The collaborative management process for industrial network security policies based on historical security data can be divided into two stages: the first stage is data collection, filtering, and querying; the second stage is the selection, processing, and distribution of collaborative security policies.

[0262] The operation process for the first phase is as follows:

[0263] Step 1: Industrial network security data collected by industrial IT / CT / OT network security equipment is uploaded to the data filter after being encrypted;

[0264] Step 2: The data filter filters the data collected by industrial IT / CT / OT network security equipment, removes impurities and duplicate data, and uploads it to the storage cluster server after encryption;

[0265] Step 3: Historical data query. First, the original data of the security incident is encrypted and stored in the storage environment. Then, a multi-dimensional data comparison method is used to determine whether similar security incidents have occurred in the past.

[0266] Step 4: Provide feedback on the query results and obtain data on several security incidents with similar phenomena;

[0267] Step 5: Record the data query in the blockchain;

[0268] Step 6: Based on the blockchain data catalog, query the corresponding security collaboration policy in the security policy library.

[0269] The operation process for the second phase is as follows:

[0270] Step 7: The security policy manager obtains security collaboration policies from the security policy library to provide security policy references for manual handling and optimal policies for automated handling;

[0271] Step 8: Distribute the corresponding industrial security policy to the industrial security equipment and record the distributed policy on the blockchain.

[0272] Step 9: Record the issued strategy in the blockchain.

[0273] In one embodiment, the security policy is sent to the terminal security device, specifically including:

[0274] The security policy is stored in a security policy repository, and the security policy directory of the security policy repository is recorded in the blockchain;

[0275] The system receives security policy usage requests and distributes the security policies to terminal security devices according to these requests, while also recording the distributed security policy information on the blockchain.

[0276] In this embodiment, as Figure 2-4 As shown, the processes for security policy management (mainly distributing security policies to endpoint security devices) are similar in all three frameworks. Figure 2 For example, including:

[0277] Step 12: Download the federated security policy obtained from the final global model to the security policy library cache;

[0278] Step 13: The security policy download record is stored on the blockchain;

[0279] Step 14: The security policy manager retrieves security collaboration policies (security policy invocation) from the security policy library to provide security policy references for manual handling and optimal policies for automated handling;

[0280] Step 15: The strategy catalog is maintained on the blockchain;

[0281] Step 16: Distribute the corresponding industrial security policies to industrial security equipment;

[0282] Step 17: Record the issued strategy in the blockchain.

[0283] The advantages of this embodiment 1 include:

[0284] For industrial enterprises, fully utilize the industrial network security capabilities of various security vendors, especially the ability to train security defense models, to effectively improve the comprehensive security defense capabilities of enterprises without significantly increasing security investment;

[0285] For security vendors, this can effectively lower the barriers to collaboration among them, provided that their core technologies are guaranteed, and promote the development of secure cloud service models in the industrial internet field.

[0286] For the Industrial Internet, the security protection capabilities of security vendors can be fully utilized, and the protective value of existing network security equipment can be maximized. Under the premise of ensuring that security incident data does not leave the domain / data center, joint prevention and control of security equipment across the entire network, domain, and chain can be achieved, providing a solid network security protection technology for the development of the Industrial Internet.

[0287] Example 2:

[0288] like Figure 5 As shown, Embodiment 2 of this disclosure provides a security platform, the security platform comprising:

[0289] Data processing module 11 is used to acquire new security event data from the terminal security device;

[0290] The policy acquisition module 12 is connected to the data processing module 11 and is used to acquire the security policy of the new security event data. The security policy is jointly formulated by the security platform and multiple security policy devices and is used to collaboratively defend against the security events corresponding to the new security event data.

[0291] The policy management module 13, connected to the policy acquisition module 12, is used to send the security policy to the terminal security device.

[0292] In one embodiment, the security platform further includes an information recording module, connected to the data processing module 11, the policy acquisition module 12, and the policy management module 13, for:

[0293] The information of the new security incident data will be recorded in the blockchain;

[0294] Information on collaboratively developing security strategies will be recorded on the blockchain;

[0295] The information regarding the security policy is recorded on the blockchain.

[0296] In one embodiment, the data processing module 11 specifically includes:

[0297] A data filter is used to receive raw security event data from terminal security devices, filter out new security event data from the raw security event data by querying the blockchain, and record the new security event data to the blockchain.

[0298] A trusted storage device, connected to a data filter, is used to acquire the new security event data from security vendors, store the new security event data in a trusted manner corresponding to the security vendors, and record the updated security event data storage directory to the blockchain.

[0299] In one embodiment, the strategy acquisition module 12 is specifically a strategy formulation module, including:

[0300] An operational domain server is configured to select smart contracts recorded on the blockchain based on the new security event data; and

[0301] Multiple security policy devices used to determine collaboratively formulated security policies based on the smart contract;

[0302] The computing cluster server, connected to the operation domain server, is used to collaboratively formulate security policies for the new security event data in conjunction with the multiple security policy devices.

[0303] In one embodiment, the operating domain server specifically includes:

[0304] The first transceiver unit is used to send the smart contract to multiple security vendor devices and / or industrial control systems, so that the multiple security vendor devices and / or industrial control systems fill in their own information on participating in the formulation of security policies into the smart contract, and receive the smart contract after each of the multiple security vendor devices and / or industrial control systems has filled in its own information.

[0305] The second transceiver unit, connected to the first transceiver unit, is used to send the smart contract with the information filled in to the contract approver, receive the approval instruction from the contract approver, and determine multiple security vendor devices and / or industrial control systems that will collaboratively formulate security strategies based on the approval instruction.

[0306] In one embodiment, the computing cluster server specifically includes:

[0307] The data debugging unit is used to process the new security event data into debugging data;

[0308] A model training unit, connected to a data debugging unit, is used to send the debugging data to the plurality of security vendor devices, so that the plurality of security vendor devices can obtain initial local model results based on the debugging data; and...

[0309] The process is used to iteratively execute the following steps multiple times: receiving the current local model results sent by the multiple security vendor devices; aggregating the multiple current local model results to obtain the current global model result; and sending the next initial model to the multiple security vendor devices based on the current global model result, so that the multiple security vendor devices can obtain the next local model result based on the next initial model; and...

[0310] Used to obtain the final global model based on the global model result until a certain global model result meets the first preset condition;

[0311] The policy generation unit, connected to the model training unit, is used to formulate a security policy for the new security event data based on the final global model.

[0312] In one embodiment, the computing cluster server specifically includes:

[0313] The data debugging unit is used to process the new security event data into debugging data;

[0314] The first-stage model training unit, connected to the data debugging unit, is used to send the debugging data to the multiple security vendor devices, so that the multiple security vendor devices can obtain the first-stage initial local model results based on the debugging data; and...

[0315] The process iteratively executes the following steps multiple times: receiving the first-stage local model results sent by the multiple security vendor devices; aggregating the multiple first-stage local model results to obtain the first-stage global model result; and sending the first-stage next initial model to the multiple security vendor devices based on the first-stage next initial model, so that the multiple security vendor devices can obtain the first-stage next local model result based on the first-stage next initial model; and

[0316] Used to obtain the final global model of the first stage based on the global model result of the first stage until the result of a certain global model in the first stage meets the second preset condition;

[0317] The second-stage model training unit, connected to the first-stage model training unit, is used to obtain the initial model for the second stage based on the final global model from the first stage; and...

[0318] Used to send the debugging data and the second-stage initial model to the plurality of industrial control systems, so that the plurality of industrial control systems can obtain the second-stage initial local model results based on the debugging data and the second-stage initial model; and

[0319] The system iteratively executes the following steps multiple times: receiving the second-stage local model results sent by the multiple industrial control systems; aggregating the multiple second-stage local model results to obtain the second-stage global model result; and sending the second-stage next initial model to the multiple industrial control systems based on the second-stage next initial model, so that the multiple industrial control systems can obtain the second-stage next local model result based on the second-stage next initial model; and...

[0320] Used until the result of a certain global model in the second stage meets the third preset condition, and then the final global model of the second stage is obtained based on the result of a certain global model in the second stage;

[0321] The policy generation unit, connected to the second-stage model training, is used to formulate security policies for the new security event data based on the final global model of the second stage.

[0322] In one embodiment, the policy acquisition module 12 is specifically a policy query module, used for:

[0323] In response to obtaining approximate security event data with a similarity greater than a preset threshold by querying the blockchain, the security policy of the approximate security event data is obtained as the security policy of the new security event data. The security policy of the approximate security event data is pre-formulated collaboratively by the security platform and multiple security policy devices based on the approximate security event data.

[0324] In one embodiment, the policy management module 13 specifically includes:

[0325] A security policy library is used to store the security policies and record the security policy directory of the security policy library to the blockchain.

[0326] The policy invocation device is connected to the security policy library and is used to issue the security policy to the terminal security device according to the security policy usage requirements, and record the information of the security policy issuance to the blockchain.

[0327] This embodiment corresponds to Embodiment 1. For detailed description, please refer to Embodiment 1, which will not be repeated here.

[0328] Example 3:

[0329] like Figure 6 As shown, Embodiment 3 of this disclosure provides a terminal security device, the terminal security device comprising:

[0330] Data sending module 21 is used to upload its own security event data to the security platform so that the security platform can obtain new security event data;

[0331] The policy receiving module 22, connected to the data sending module 21, is used to receive the security policy of the new security event data from the security platform. The security policy is jointly formulated by the security platform and multiple security policy devices and is used to collaboratively defend against the security events corresponding to the new security event data.

[0332] This embodiment corresponds to Embodiment 1. The terminal security device can specifically be a network security device deployed in an industrial site. It may be provided by a security vendor and connected to an industrial security control system in the industrial site. The security policies it receives can instruct the terminal security device to upgrade its own protection capabilities or redirect risky traffic to other designated defense devices, etc.

[0333] Example 4:

[0334] like Figure 7 As shown, Embodiment 4 of this disclosure provides a security policy device, the security policy device comprising:

[0335] The collaboration module 31 is used to collaborate with several other security policy devices to formulate security policies under the joint action of the security platform. The security policies are used to collaboratively defend against security events corresponding to new security event data. The new security event data is uploaded to the security platform by the terminal security device, and the security policies are issued to the terminal security device by the security platform.

[0336] This embodiment corresponds to Embodiment 1. Specifically, the security policy device can be multiple security vendor devices and / or industrial control systems. More specifically, it is used to join the process of collaboratively formulating security policies based on smart contracts, including:

[0337] Fill in the information about your participation in formulating the security strategy into the smart contract;

[0338] The smart contract, after the information of the user is filled in, is sent to the security platform so that the security platform can identify multiple security vendor devices and / or industrial control systems that will collaboratively formulate security strategies based on the smart contract.

[0339] The specific methods for collaboratively developing security strategies include collaborating with multiple security vendors' equipment to develop security strategies, or collaborating with multiple security vendors' equipment and industrial control systems to develop security strategies. For the specific process of collaboratively developing security strategies, please refer to Example 1.

[0340] Example 5:

[0341] like Figure 8 As shown in Embodiment 5 of this disclosure, a security policy collaborative management system is provided, the system comprising:

[0342] Security platform 1 as described in Example 2;

[0343] As described in Embodiment 3, the terminal security device 2 is connected to the security platform 1;

[0344] As described in Embodiment 4, the security policy device 3 is connected to the security platform 1.

[0345] This embodiment corresponds to Embodiment 1. The system and its components have been described in detail in Embodiment 1 and will not be repeated here.

[0346] Example 6:

[0347] Embodiment 6 of this disclosure provides a computer-readable storage medium storing a computer program. When the computer program is run by a processor, it implements the security policy collaborative management method as described in Embodiment 1, the security platform as described in Embodiment 2, the terminal security device as described in Embodiment 3, the security policy device as described in Embodiment 4, or the security policy collaborative management system as described in Embodiment 5.

[0348] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules, or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0349] In addition, this disclosure may also provide a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the security policy collaborative management method as described in Embodiment 1. The computer device may be a security platform as described in Embodiment 2, or a terminal security device as described in Embodiment 3, or a security policy device as described in Embodiment 4, or a security policy collaborative management system as described in Embodiment 5.

[0350] The memory is connected to the processor. The memory can be flash memory, read-only memory or other types of memory. The processor can be a central processing unit or a microcontroller.

[0351] Embodiments 1-6 of this disclosure provide a security policy collaborative management system, a security platform, an endpoint security device, a security policy device, a security policy collaborative management system, and a computer-readable storage medium. The security platform acquires new security event data from the endpoint security device and obtains security policies based on the new security event data. The security policies are formulated by mobilizing multiple security policy devices to participate collaboratively, thereby greatly improving the effectiveness of the security policies. At the same time, by managing security event data and security policies through the security platform, the endpoint security device can obtain targeted security policies for new security events, enabling new security events to be defended in a timely manner.

[0352] It is understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of this disclosure, and this disclosure is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of this disclosure, and these modifications and improvements are also considered to be within the scope of protection of this disclosure.

Claims

1. A method for collaborative management of security policies, characterized in that, The method is applied in the Industrial Internet, and the method includes: The security platform acquires new security event data from endpoint security devices, which are provided by security vendors and include industrial control terminal devices and network security devices. The security platform acquires the new security event data through a security policy. This security policy is collaboratively formulated by the security platform and multiple security policy devices, and is used to collaboratively defend against the security events corresponding to the new security event data. The security policy devices include security vendor devices for the terminal security device, and the multiple security policy devices establish a cooperative relationship through smart contracts. The security strategy is a collaborative security strategy for the industrial network obtained by initiating privacy computations, developing local model training, uploading, aggregating, and iterating the local model, and using multiple security strategy devices. Different security vendors have different equipment models. Business data is restored from network traffic data, and security detection models corresponding to business are set up in combination with industrial internet security scenarios. The security platform manages security policies and distributes these policies to the terminal security devices according to their usage requirements, thereby enabling joint prevention and control of security devices in the industrial internet.

2. The method according to claim 1, characterized in that, The method further includes: The security platform records the information of the new security incident data into the blockchain; The security platform records information on collaboratively developed security strategies onto the blockchain; The security platform records the security policy information on the blockchain.

3. The method according to claim 2, characterized in that, Acquire new security event data from endpoint security devices, specifically including: Receive raw security event data from terminal security devices, filter out new security event data from the raw security event data by querying the blockchain, and record the new security event data into the blockchain; The security vendor acquires the new security event data, stores the new security event data in a trusted manner corresponding to the security vendor, and records the updated security event data storage directory to the blockchain.

4. The method according to any one of claims 1-3, characterized in that, The security policy for the security platform to acquire the new security event data is formulated collaboratively by the security platform and multiple security policy devices, specifically including the security platform: Select smart contracts recorded on the blockchain based on the new security event data; The smart contract identifies multiple security strategy devices that collaboratively formulate security strategies. The security policy for the new security event data is formulated collaboratively by the multiple security policy devices.

5. The method according to claim 4, characterized in that, According to the smart contract, multiple security policy devices that collaboratively formulate security policies are identified, specifically including: The smart contract is sent to multiple security vendor devices and / or industrial control systems, so that the multiple security vendor devices and / or industrial control systems fill in information about their participation in the formulation of security policies into the smart contract; The system receives the smart contracts from the various security vendors' devices and / or industrial control systems, after each vendor has filled in its own information, and sends the smart contracts with the information to the contract approver. Receive approval instructions from the contract approver, and determine, based on the approval instructions, multiple security vendor devices and / or industrial control systems that will collaboratively develop a security strategy.

6. The method according to claim 5, characterized in that, The security policy for the new security event data is formulated collaboratively by the aforementioned multiple security policy devices, specifically including: The new security event data is processed into debug data; The debugging data is sent to the multiple security vendor devices so that the multiple security vendor devices can obtain the first local model result based on the debugging data; The following steps are executed iteratively multiple times: receiving the local model results sent by the multiple security vendor devices, aggregating the multiple local model results to obtain the global model result, and sending the next initial model to the multiple security vendor devices according to the global model result, so that the multiple security vendor devices can obtain the next local model result according to the next initial model. Until a certain global model result meets the first preset condition, the final global model is obtained based on the certain global model result; Based on the final global model, a security strategy for the new security event data is formulated.

7. The method according to claim 5, characterized in that, The security policy for the new security event data is formulated collaboratively by the aforementioned multiple security policy devices, specifically including: The new security event data is processed into debug data; The debugging data is sent to the multiple security vendor devices so that the multiple security vendor devices can obtain the first phase of the initial local model results based on the debugging data. The following steps are executed iteratively multiple times: receiving the local model results of the first phase sent by the multiple security vendor devices, aggregating the multiple local model results of the first phase to obtain the global model results of the first phase, and sending the next initial model of the first phase to the multiple security vendor devices according to the next initial model of the first phase, so that the multiple security vendor devices can obtain the next local model results of the first phase according to the next initial model of the first phase. Until the result of a certain global model in the first stage meets the second preset condition, the final global model of the first stage is obtained based on the result of a certain global model in the first stage. The initial model for the second stage is obtained based on the final global model of the first stage. The debugging data and the second-stage initial model are sent to the plurality of industrial control systems so that the plurality of industrial control systems can obtain the second-stage initial local model results based on the debugging data and the second-stage initial model. The following steps are executed iteratively multiple times: receiving the local model results of the second stage sent by the multiple industrial control systems, aggregating the multiple local model results of the second stage to obtain the global model results of the second stage, and sending the next initial model of the second stage to the multiple industrial control systems according to the next initial model of the second stage, so that the multiple industrial control systems can obtain the next local model results of the second stage according to the next initial model of the second stage. Until the result of a certain global model in the second stage meets the third preset condition, the final global model of the second stage is obtained based on the result of a certain global model in the second stage. Based on the final global model of the second phase, a security strategy for the new security event data is formulated.

8. The method according to claim 3, characterized in that, The security policy for acquiring the new security event data is formulated collaboratively by the security platform and multiple security policy devices, and specifically includes: In response to obtaining approximate security event data with a similarity greater than a preset threshold by querying the blockchain, the security policy of the approximate security event data is obtained as the security policy of the new security event data. The security policy of the approximate security event data is pre-formulated collaboratively by the security platform and multiple security policy devices based on the approximate security event data.

9. The method according to claim 2, characterized in that, The security policy is distributed to the terminal security device, specifically including: The security policy is stored in a security policy repository, and the security policy directory of the security policy repository is recorded in the blockchain; The system receives security policy usage requests and distributes the security policies to terminal security devices according to these requests, while also recording the distributed security policy information on the blockchain.

10. A security platform, characterized in that, In the context of industrial internet security, the security platform includes: The data processing module is used to acquire new security event data from the terminal security device, which is provided by a security vendor and includes industrial control terminal equipment and network security equipment. The policy acquisition module, connected to the data processing module, is used to acquire the security policy for the new security event data. This security policy is collaboratively formulated by the security platform and multiple security policy devices, and is used to collaboratively defend against the security events corresponding to the new security event data. The security policy devices include security vendor devices for the terminal security device, and the multiple security policy devices establish a cooperative relationship through smart contracts. The security strategy is a collaborative security strategy for the industrial network obtained by initiating privacy computations, developing local model training, uploading, aggregating, and iterating the local model, and using multiple security strategy devices. Different security vendors have different equipment models. By combining the business scenarios of industrial internet security, business data is restored from network traffic data, and security detection models are set. The policy management module, connected to the policy acquisition module, is used to manage security policies and distribute the security policies to the terminal security devices according to the usage requirements of the security policies, thereby realizing joint prevention and control of security devices in the industrial Internet.

11. The security platform according to claim 10, characterized in that, The security platform also includes an information recording module, connected to the data processing module, policy acquisition module, and policy management module, for the purpose of: The information of the new security incident data will be recorded in the blockchain; Information on collaboratively developing security strategies will be recorded on the blockchain; The information regarding the security policy is recorded on the blockchain.

12. The security platform according to claim 11, characterized in that, The data processing module specifically includes: A data filter is used to receive raw security event data from terminal security devices, filter out new security event data from the raw security event data by querying the blockchain, and record the new security event data to the blockchain. A trusted storage device, connected to a data filter, is used to acquire the new security event data from security vendors, store the new security event data in a trusted manner corresponding to the security vendors, and record the updated security event data storage directory to the blockchain.

13. The security platform according to any one of claims 10-12, characterized in that, The strategy acquisition module is specifically the strategy formulation module, which includes: An operational domain server is configured to select smart contracts recorded on the blockchain based on the new security event data; and Multiple security policy devices used to determine collaboratively formulated security policies based on the smart contract; The computing cluster server, connected to the operation domain server, is used to collaboratively formulate security policies for the new security event data in conjunction with the multiple security policy devices.

14. The security platform according to claim 13, characterized in that, The operation domain server specifically includes: The first transceiver unit is used to send the smart contract to multiple security vendor devices and / or industrial control systems, so that the multiple security vendor devices and / or industrial control systems fill in their own information on participating in the formulation of security policies into the smart contract, and receive the smart contract after each of the multiple security vendor devices and / or industrial control systems has filled in its own information. The second transceiver unit, connected to the first transceiver unit, is used to send the smart contract with the information filled in to the contract approver, receive the approval instruction from the contract approver, and determine multiple security vendor devices and / or industrial control systems that will collaboratively formulate security strategies based on the approval instruction.

15. The security platform according to claim 14, characterized in that, The computing cluster server specifically includes: The data debugging unit is used to process the new security event data into debugging data; A model training unit, connected to a data debugging unit, is used to send the debugging data to the plurality of security vendor devices, so that the plurality of security vendor devices can obtain initial local model results based on the debugging data; and... The process is used to iteratively execute the following steps multiple times: receiving the current local model results sent by the multiple security vendor devices; aggregating the multiple current local model results to obtain the current global model result; and sending the next initial model to the multiple security vendor devices based on the current global model result, so that the multiple security vendor devices can obtain the next local model result based on the next initial model; and... Used to obtain the final global model based on the global model result until a certain global model result meets the first preset condition; The policy generation unit, connected to the model training unit, is used to formulate a security policy for the new security event data based on the final global model.

16. The security platform according to claim 14, characterized in that, The computing cluster server specifically includes: The data debugging unit is used to process the new security event data into debugging data; The first-stage model training unit, connected to the data debugging unit, is used to send the debugging data to the multiple security vendor devices, so that the multiple security vendor devices can obtain the first-stage initial local model results based on the debugging data; and... The process iteratively executes the following steps multiple times: receiving the first-stage local model results sent by the multiple security vendor devices; aggregating the multiple first-stage local model results to obtain the first-stage global model result; and sending the first-stage next initial model to the multiple security vendor devices based on the first-stage next initial model, so that the multiple security vendor devices can obtain the first-stage next local model result based on the first-stage next initial model; and Used to obtain the final global model of the first stage based on the global model result of the first stage until the result of a certain global model in the first stage meets the second preset condition; The second-stage model training unit, connected to the first-stage model training unit, is used to obtain the initial model for the second stage based on the final global model from the first stage; and... Used to send the debugging data and the second-stage initial model to the plurality of industrial control systems, so that the plurality of industrial control systems can obtain the second-stage initial local model results based on the debugging data and the second-stage initial model; and The system iteratively executes the following steps multiple times: receiving the second-stage local model results sent by the multiple industrial control systems; aggregating the multiple second-stage local model results to obtain the second-stage global model result; and sending the second-stage next initial model to the multiple industrial control systems based on the second-stage next initial model, so that the multiple industrial control systems can obtain the second-stage next local model result based on the second-stage next initial model; and... Used until the result of a certain global model in the second stage meets the third preset condition, and then the final global model of the second stage is obtained based on the result of a certain global model in the second stage; The policy generation unit, connected to the second-stage model training, is used to formulate security policies for the new security event data based on the final global model of the second stage.

17. The security platform according to claim 12, characterized in that, The strategy acquisition module is specifically the strategy query module, used for: In response to obtaining approximate security event data with a similarity greater than a preset threshold by querying the blockchain, the security policy of the approximate security event data is obtained as the security policy of the new security event data. The security policy of the approximate security event data is pre-formulated collaboratively by the security platform and multiple security policy devices based on the approximate security event data.

18. The security platform according to claim 11, characterized in that, The strategy management module specifically includes: A security policy library is used to store the security policies and record the security policy directory of the security policy library to the blockchain. The policy invocation device is connected to the security policy library and is used to issue the security policy to the terminal security device according to the security policy usage requirements, and record the information of the security policy issuance to the blockchain.

19. A terminal security device, characterized in that, In industrial internet security scenarios, the terminal security device is provided by a security vendor. The terminal security device includes industrial control terminal equipment and network security equipment. The terminal security device includes: The data sending module is used to upload its own security event data to the security platform so that the security platform can obtain new security event data; A policy receiving module, connected to a data sending module, is used to receive security policies from the security platform for the new security event data. These security policies are collaboratively formulated by the security platform and multiple security policy devices, and are used to collaboratively defend against the security events corresponding to the new security event data. The security policy devices include security vendor devices for the terminal security device, and the multiple security policy devices establish a cooperative relationship through smart contracts. The security strategy is a collaborative security strategy for the industrial network obtained by initiating privacy computations, developing local model training, uploading, aggregating, and iterating the local model, and using multiple security strategy devices. Different security vendors use different equipment models. By combining these models with the business scenarios of industrial internet security, business data can be reconstructed from network traffic data, and security detection models can be set up. The security platform manages security policies and distributes these policies to the terminal security devices according to their usage requirements, thereby enabling joint prevention and control of security devices in the industrial internet.

20. A security strategy device, characterized in that, In industrial internet security scenarios, the security policy device includes: The collaboration module is used to collaboratively formulate security policies with several other security policy devices under the joint support of the security platform. These security policies are used to collaboratively defend against security events corresponding to new security event data. The new security event data is uploaded to the security platform by the terminal security device, and the security policy is issued to the terminal security device by the security platform. Specifically: The terminal security equipment is provided by a security vendor and includes industrial control terminal equipment and network security equipment. The security policy devices include security vendor devices for the terminal security device, and the multiple security policy devices establish a cooperative relationship through smart contracts. The security strategy is a collaborative security strategy for the industrial network obtained by initiating privacy computations, developing local model training, uploading, aggregating, and iterating the local model, and using multiple security strategy devices. Different security vendors use different equipment models. By combining these models with the business scenarios of industrial internet security, business data can be reconstructed from network traffic data, and security detection models can be set up. The security platform manages security policies and distributes these policies to the terminal security devices according to their usage requirements, thereby enabling joint prevention and control of security devices in the industrial internet.

21. A security policy collaborative management system, characterized in that, The system includes: The security platform as described in any one of claims 10-18; The terminal security device as described in claim 19 is connected to the security platform; The security policy device as described in claim 20 is connected to the security platform.

22. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the security policy collaborative management method as described in any one of claims 1-9, the security platform as described in any one of claims 10-18, the terminal security device as described in claim 19, the security policy device as described in claim 20, or the security policy collaborative management system as described in claim 21.

Images