Terminal switching and security assessment system based on dual-mode communication

Abstract

The present invention discloses a terminal switching and security assessment system based on dual-mode communication. The present invention relates to the field of communication technology and solves the technical problem that there is a one-sided judgment on the switching of dual-mode communication terminals and there is a lack of a unified evaluation standard, which affects the overall security assessment. The present invention can scientifically judge the stability of the communication mode by calculating the signal fluctuation value, the network load value and the data transmission speed value, and switch to a better communication mode in time, which can effectively reduce signal interference, reduce network congestion, and improve the stability and reliability of data transmission. It can comprehensively detect the security status of the communication system by evaluating from multiple dimensions such as key length, authentication complexity and network security, and combine communication mode switching and security assessment to form a complete system. On the one hand, it improves the communication efficiency and quality, and on the other hand, it enhances the security of the system and optimizes the comprehensive performance of the dual-mode communication system as a whole.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a terminal switching and security assessment system based on dual-mode communication. Background Art

[0002] With the continuous advancement of science and technology, dual-mode communication has been widely used in many fields, such as power systems, industrial automation, etc. The combination of carrier communication and wireless communication provides more possibilities and flexibility for data transmission, but it also faces many challenges. In a complex communication environment, problems such as signal interference, unbalanced network load, and unstable data transmission speed often occur.

[0003] According to the publication number CN102421159A, a switching method and system of a dual-mode communication terminal is disclosed to achieve the switching without releasing the IP address, the session is continued, and the user is not aware of it. The first mode and the second mode of the dual-mode communication terminal adopt a master-slave universal serial bus USB drive structure, and the method includes: the host triggers the dual-mode communication terminal to initiate the access to the second network; the host maintains the occupation of the IP address in the first network by the dual-mode communication terminal, and obtains the Internet Protocol IP address of the dual-mode communication terminal in the second network; if the IP address in the second network is the same as the current IP address of the dual-mode communication terminal in the first network, the host uses the IP address in the second network.

[0004] However, some existing methods are rather one-sided when making terminal switching judgments, and fail to comprehensively consider factors such as signal fluctuations, network load, and data transmission speed, which may cause errors in judgment. Secondly, when evaluating terminal security, there is a lack of unified evaluation criteria, which will affect the security assessment. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides a terminal switching and security assessment system based on dual-mode communication, which solves the problem that the switching of dual-mode communication terminals has one-sided judgment and lacks a unified evaluation standard, which affects the overall security assessment.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a terminal switching and security assessment system based on dual-mode communication, comprising:

[0007] A communication mode information collection unit, used to collect basic information of different communication modes and transmit the collected basic information to the mode switching analysis unit;

[0008] A mode switching analysis unit, used to calculate the communication value of the communication mode according to the acquired basic information, and determine whether the communication mode needs to be switched based on the size of the communication value, and generate a switching judgment result, and transmit the switching judgment result to the evaluation information output unit and the security evaluation analysis unit;

[0009] A security assessment analysis unit, configured to analyze the acquired switching judgment result, and for a normal communication signal in the switching judgment result, calculate a security assessment value of the communication mode according to a key length value, an authentication complexity value, and a network security value of the corresponding communication mode, and perform a corresponding security assessment based on the security assessment value to generate assessment information, and transmit the generated assessment information to an assessment information output unit;

[0010] The evaluation information output unit is used to display the acquired switching judgment result and evaluation information to the corresponding operator.

[0011] As a further solution of the present invention: the security assessment analysis unit also includes a key length value analysis module, an authentication complexity value analysis module and a network security value analysis module;

[0012] A key length value analysis module is used to calculate the key length value of the communication mode;

[0013] An authentication complexity value analysis module, used to calculate the authentication complexity value of the communication mode;

[0014] The network security value analysis module is used to calculate the network security value of the communication mode.

[0015] As a further solution of the present invention: the basic information of the communication mode includes signal fluctuation, network load and data transmission speed.

[0016] As a further solution of the present invention: the specific manner in which the mode switching analysis unit generates the switching judgment result is:

[0017] The current communication mode is obtained and recorded as the analysis object, and then the remaining communication modes are obtained and recorded as the objects to be analyzed. At the same time, the basic information corresponding to the analysis object and the objects to be analyzed are respectively obtained, and the signal fluctuation, network load and data transmission speed in the basic information are respectively calculated to obtain the signal fluctuation value, network load value and data transmission value;

[0018] Obtain the signal fluctuation of the analysis object within time t, and simultaneously obtain the corresponding standard signal value under normal conditions, and calculate the difference between the signal fluctuation and the standard signal, and simultaneously calculate the mean of the difference, and use the calculated mean as the signal fluctuation value;

[0019] Obtain the network utilization of the analysis object within time t, calculate the mean value of the network utilization within time t, and use the calculated change mean value as the network load value;

[0020] Obtaining the data transmission speed of the analysis object within time t, and calculating the average value of the data transmission speed within time t, and using the calculated average value as the data transmission speed value;

[0021] The communication value is obtained by performing a comprehensive calculation based on the calculated signal fluctuation value, network load value and data transmission value.

[0022] As a further solution of the present invention: the specific method in which the mode switching analysis unit calculates the communication value is:

[0023] Substitute the calculated signal fluctuation value, network load value, and data transmission speed value into the formula The communication value Q of the analyzed object is calculated, where P represents the signal fluctuation value, F represents the network load value, V represents the data transmission speed value, and a 1 、a 2 and a 3 are the corresponding weight coefficients respectively. Similarly, the communication value of the object to be analyzed is calculated by the above formula and recorded as Q1. Then, the communication value Q of the object to be analyzed is compared with the communication value Q1 of the object to be analyzed.

[0024] If the communication value Q is greater than the communication value Q1, a normal communication signal is generated, and if the communication value Q is less than the communication value Q1, a change mode signal is generated.

[0025] As a further solution of the present invention: the specific method of the security assessment analysis unit for the key length value and the authentication complexity value according to the switching judgment result is:

[0026] Obtain the current communication mode and the corresponding key length, then perform different value assignments based on different key lengths, and record the obtained values ​​as the key length value C;

[0027] Get the current communication mode, determine the authentication method corresponding to the current communication mode, calculate the password space of the current communication mode, where the password space refers to the number of all possible password combinations, and then substitute the number of password combinations into the formula The authentication complexity value B is calculated, where U represents the number of password combinations, E represents the type of password, and R represents the corresponding number of password digits.

[0028] As a further solution of the present invention: the specific calculation method of the safety value by the safety assessment analysis unit is:

[0029] Obtain the number and type of vulnerabilities in the current communication mode, assign values ​​to the vulnerabilities based on different vulnerability types, and calculate the mean value of all the vulnerabilities, and use the calculated mean value as the vulnerability value;

[0030] Then, different values ​​are assigned to the IDS validity of the current communication mode, and the obtained values ​​are recorded as IDS values;

[0031] Finally, the emergency response value of the current communication mode is assigned to obtain the emergency response value;

[0032] Substitute the obtained vulnerability value, IDS value and emergency response value into the formula The network security value W is calculated, where L is the vulnerability value, D is the IDS value, Y is the emergency response value, and b 1 、b 2 and b 3 are the corresponding weight coefficients respectively.

[0033] As a further solution of the present invention: the specific manner in which the safety assessment analysis unit generates the assessment information is:

[0034] Substitute the calculated key length value C, authentication complexity value B, and network security value W into the formula The safety assessment value S is calculated, where , and They represent the weight coefficients of the key length value C, the authentication complexity value B and the network security value W respectively;

[0035] And based on the security assessment value, a corresponding security assessment is performed to generate assessment information. The specific generation method is: the security assessment value is matched with the assessment interval, and the assessment information is generated according to the security level of the corresponding assessment interval that matches.

[0036] Beneficial Effects

[0037] The present invention provides a terminal switching and security assessment system based on dual-mode communication. Compared with the prior art, it has the following beneficial effects:

[0038] The present invention can scientifically judge the stability of the communication mode by calculating the signal fluctuation value, the network load value and the data transmission speed value, and switch to a more optimal communication mode in time, which can effectively reduce signal interference, reduce network congestion, and improve the stability and reliability of data transmission. It can conduct multi-dimensional evaluation from the perspectives of key length, authentication complexity and network security, and can comprehensively detect the security status of the communication system. It combines communication mode switching with security evaluation to form a complete system, which improves the communication efficiency and quality on the one hand, and enhances the security of the system on the other hand, thus optimizing the comprehensive performance of the dual-mode communication system as a whole. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a block diagram of the system principle of the present invention;

[0040] Figure 2 It is a functional module diagram of the safety assessment and analysis unit of the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] For example, see Figure 1 and Figure 2 The present application provides a terminal switching and security assessment system based on dual-mode communication, including: a communication mode information acquisition unit, a mode switching analysis unit, a security assessment analysis unit and an assessment information output unit, and in combination with the attached Figure 1 It can be known that all the above functional units are connected by unidirectional wires, and at the same time, Figure 2 It can be known that the security assessment unit includes multiple functional modules, specifically including a key length value analysis module, an authentication complexity value analysis module and a network security value analysis module.

[0043] The communication mode information acquisition unit is used to collect basic information of different communication modes and transmit the collected basic information to the mode switching analysis unit, wherein the basic information obtained includes: signal fluctuation, network load and data transmission speed.

[0044] A mode switching analysis unit is used to calculate the communication value of the communication mode according to the acquired basic information, and judge whether the communication mode needs to be switched based on the size of the communication value, and generate a switching judgment result, and transmit the switching judgment result to the evaluation information output unit.

[0045] Specifically, the current communication mode is obtained and recorded as the analysis object, and then the remaining communication modes are obtained and recorded as the objects to be analyzed, and the dual-mode communication here is represented by the combination of carrier communication and wireless communication. At the same time, the basic information corresponding to the analysis object and the object to be analyzed is obtained respectively, and the signal fluctuation, network load and data transmission speed in the basic information are calculated respectively to obtain the signal fluctuation value, network load value and data transmission value;

[0046] The specific calculation method of the signal fluctuation value is as follows:

[0047] The signal fluctuation of the analysis object within the time t is obtained, and the corresponding standard signal value under normal conditions is obtained, and the normal condition here means the rated signal value of the analysis object, and the specific value is set by the operator, and the difference between the signal fluctuation and the standard signal is calculated, and the mean of the difference is calculated, and the calculated mean is used as the signal fluctuation value;

[0048] The specific calculation method of the network load value is as follows:

[0049] Get the network utilization of the analysis object within time t, calculate the corresponding mean of the network utilization within time t, and use the calculated change mean as the network load value. Specifically, for example, the corresponding network utilization within time t is 80%, 82%, 79%, and 78%, respectively. Sum all network utilizations and calculate the average to obtain the network load value.

[0050] The specific calculation method for data transmission speed value is:

[0051] Obtaining the data transmission speed of the analysis object within time t, and calculating the average value of the data transmission speed within time t, and using the calculated average value as the data transmission speed value;

[0052] Substitute the calculated signal fluctuation value, network load value, and data transmission speed value into the formula The communication value Q of the analyzed object is calculated, where P represents the signal fluctuation value, F represents the network load value, V represents the data transmission speed value, and a 1 、a 2 and a 3 are the corresponding weight coefficients respectively. Similarly, the communication value of the object to be analyzed is calculated by the above formula and recorded as Q1. Then, the communication value Q of the object to be analyzed is compared with the communication value Q1 of the object to be analyzed.

[0053] If the communication value Q is greater than the communication value Q1, it means that the communication mode of the analysis object is more stable than the communication mode of the object to be analyzed, and a normal communication signal is generated. If the communication value Q is less than the communication value Q1, it means that the communication mode of the analysis object is worse than the communication mode of the object to be analyzed, and a change mode signal is generated. The generated normal communication signal and the change mode signal are then transmitted to the evaluation information output unit.

[0054] An evaluation information output unit is used to display the obtained switching judgment result to the corresponding operator.

[0055] Embodiment 2, as Embodiment 2 of the present invention, is implemented on the basis of Embodiment 1, and the difference from Embodiment 1 is as follows:

[0056] The mode switching analysis unit transmits the generated switching judgment result to the security assessment analysis unit, and the security assessment analysis unit performs a security assessment on the communication mode.

[0057] The security assessment analysis unit is used to analyze the obtained switching judgment result. For the normal communication signal in the switching judgment result, the security assessment value of the communication mode is calculated according to the key length value, authentication complexity value and network security value of the corresponding communication mode. Specifically, the key length value of the communication mode is calculated by the key length value analysis module in the security assessment analysis unit, and the specific calculation method is as follows:

[0058] The current communication mode is obtained, and the corresponding key bit number is obtained at the same time. Then different value assignments are performed based on different key bit numbers, and the obtained value is recorded as the key length value C. Specifically, the corresponding key bit number is obtained by analyzing the encryption algorithm, and the AES encryption algorithm is used in this application. Under normal circumstances, the corresponding key bit numbers are 128, 192 and 256. With the increase of the key length, the corresponding cracking difficulty will also increase accordingly. The value is assigned based on different cracking difficulties. For example, 128 is assigned to 1, 192 is assigned to 2, and 256 is assigned to 3.

[0059] The authentication complexity value is calculated by the authentication complexity value analysis module in the security assessment analysis unit, and the specific calculation method is as follows:

[0060] Get the current communication mode and calculate the password space of the current communication mode, where the password space refers to the number of all possible password combinations. For example, for an 8-digit pure numeric password, the password space is (Because each digit has 10 possibilities, i.e. 0-9), for a 12-digit password containing numbers, uppercase and lowercase letters, and special characters, the password space is much larger. Assuming there are a total of 62 possible characters (26 uppercase letters, 26 lowercase letters, 10 numbers, and some special characters), the password space is , then substitute the number of password combinations into the formula The authentication complexity value B is calculated, where U represents the number of password combinations, E represents the type of password, and R represents the number of digits in the corresponding password. For example, if the corresponding authentication method consists of a 12-digit password containing numbers, uppercase and lowercase letters, and special characters, the corresponding E value is 3 and the corresponding R value is 12.

[0061] The network security value is calculated by the network security value analysis module in the security assessment analysis unit, and the specific calculation method is as follows:

[0062] Get the number and type of vulnerabilities in the current communication mode, assign values ​​to the vulnerabilities based on different vulnerability types, and calculate the mean value of all vulnerabilities. Use the calculated mean value as the vulnerability value. The specific number of vulnerabilities can be obtained through automatic scanning by the system. At the same time, the type of vulnerability is judged. For example, vulnerabilities can be classified into low-risk vulnerabilities, medium-risk vulnerabilities, and high-risk vulnerabilities. At the same time, the three types of vulnerabilities are assigned values. The value of high-risk vulnerabilities can be set to 3, medium-risk vulnerabilities to 2, and low-risk vulnerabilities to 1. Assuming that 5 low-risk vulnerabilities, 3 medium-risk vulnerabilities, and 1 high-risk vulnerability are scanned, the score of the number of vulnerabilities can be calculated as 14. Further calculation of the overall mean value is 1.5, and 1.5 is used as the vulnerability value.

[0063] Then, different values ​​are assigned to the IDS effectiveness of the current communication mode, and the obtained values ​​are recorded as IDS values. For example, excellent is assigned as 4, good is assigned as 3, medium is assigned as 2, and poor is assigned as 1. Specifically, the effectiveness of IDS is evaluated through simulated attacks and actual tests.

[0064] Finally, the emergency response value of the current communication mode is assigned. The stronger the emergency response capability, the higher the safety value. Different levels of scores can be set, such as 4 for fast and effective response, 3 for relatively fast response, 2 for general response, and 1 for slow response.

[0065] Substitute the obtained vulnerability value, IDS value and emergency response value into the formula The network security value W is calculated, where L is the vulnerability value, D is the IDS value, Y is the emergency response value, and b 1 、b 2 and b 3 are the corresponding weight coefficients respectively.

[0066] Substitute the calculated key length value C, authentication complexity value B, and network security value W into the formula The safety assessment value S is calculated, where , and They represent the weight coefficients of the key length value C, the authentication complexity value B and the network security value W respectively;

[0067] And based on the security assessment value, a corresponding security assessment is performed to generate assessment information. Different specific security assessment levels will correspond to a security assessment interval. By matching the calculated security assessment value with the security assessment interval, the corresponding security assessment level is obtained.

[0068] For the change mode signal in the switching result, the communication mode is changed, and the corresponding safety assessment value is calculated in the same way as the above calculation method, and the safety assessment is performed to generate assessment information, and then the generated assessment information is transmitted to the assessment information output unit. For example, the safety assessment value of 0-30 belongs to the low level range, and the corresponding safety assessment level is "dangerous", the safety assessment value of 31-70 is the medium level range, corresponding to the "caution" level, and the safety assessment value of 71-100 is the high level range, and the corresponding safety assessment level is "safe".

[0069] An evaluation information output unit is used to transmit the acquired evaluation information to a corresponding operator.

[0070] Embodiment 3, as the embodiment 3 of the present invention, focuses on combining the implementation processes of embodiment 1 and embodiment 2 for implementation.

[0071] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0072] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A terminal switching and security assessment system based on dual-mode communication, characterized in that: include: A communication mode information collection unit, used to collect basic information of different communication modes and transmit the collected basic information to the mode switching analysis unit; A mode switching analysis unit, used to calculate the communication value of the communication mode according to the acquired basic information, and determine whether the communication mode needs to be switched based on the size of the communication value, and generate a switching judgment result, and transmit the switching judgment result to the evaluation information output unit and the security evaluation analysis unit; The security assessment analysis unit is used to analyze the obtained switching judgment result, and for the normal communication signal in the switching judgment result, the security assessment value of the communication mode is calculated according to the key length value, authentication complexity value and network security value of the corresponding communication mode, and the corresponding security assessment is performed based on the security assessment value to generate assessment information, and the generated assessment information is transmitted to the assessment information output unit, and the specific processing method is: Obtain the current communication mode and the corresponding number of key bits, then perform different value assignments based on different number of key bits, and record the obtained values ​​as the key length value C; Get the current communication mode, determine the authentication method corresponding to the current communication mode, calculate the password space of the current communication mode, where the password space refers to the number of all possible password combinations, and then substitute the number of password combinations into the formula The authentication complexity value B is calculated, where U represents the number of password combinations, E represents the type of password, and R represents the number of digits of the corresponding password; Obtain the number and type of vulnerabilities in the current communication mode, assign values ​​to the vulnerabilities based on different vulnerability types, and calculate the mean value of all the vulnerabilities, and use the calculated mean value as the vulnerability value; Then, different values ​​are assigned to the IDS validity of the current communication mode, and the obtained values ​​are recorded as IDS values; Finally, the emergency response value of the current communication mode is assigned to obtain the emergency response value; Substitute the obtained vulnerability value, IDS value and emergency response value into the formula The network security value W is calculated, where L is the vulnerability value, D is the IDS value, Y is the emergency response value, and b1, b2 and b3 are the corresponding weight coefficients respectively; Substitute the calculated key length value C, authentication complexity value B, and network security value W into the formula The safety assessment value S is calculated, where , and They represent the weight coefficients of the key length value C, the authentication complexity value B and the network security value W respectively; And based on the security assessment value, a corresponding security assessment is performed to generate assessment information. The specific generation method is: matching the security assessment value with the assessment interval, and generating assessment information according to the security level of the corresponding assessment interval that matches; The evaluation information output unit is used to display the acquired switching judgment result and evaluation information to the corresponding operator.

2. The terminal switching and security assessment system based on dual-mode communication according to claim 1 is characterized in that: The security assessment analysis unit also includes a key length value analysis module, an authentication complexity value analysis module and a network security value analysis module; A key length value analysis module is used to calculate the key length value of the communication mode; An authentication complexity value analysis module, used to calculate the authentication complexity value of the communication mode; The network security value analysis module is used to calculate the network security value of the communication mode.

3. The terminal switching and security assessment system based on dual-mode communication according to claim 1 is characterized in that: The basic information of the communication mode includes signal fluctuation, network load and data transmission speed.

4. The terminal switching and security assessment system based on dual-mode communication according to claim 1 is characterized in that: The specific method of generating the switching judgment result by the mode switching analysis unit is as follows: The current communication mode is obtained and recorded as the analysis object, and then the remaining communication modes are obtained and recorded as the objects to be analyzed. At the same time, the basic information corresponding to the analysis object and the objects to be analyzed are respectively obtained, and the signal fluctuation, network load and data transmission speed in the basic information are respectively calculated to obtain the signal fluctuation value, network load value and data transmission value; Obtain the signal fluctuation of the analysis object within time t, and simultaneously obtain the corresponding standard signal value under normal conditions, and calculate the difference between the signal fluctuation and the standard signal, and simultaneously calculate the mean of the difference, and use the calculated mean as the signal fluctuation value; Obtain the network utilization of the analysis object within time t, calculate the mean value of the network utilization within time t, and use the calculated change mean value as the network load value; Obtaining the data transmission speed of the analysis object within time t, and calculating the average value of the data transmission speed within time t, and using the calculated average value as the data transmission speed value; The communication value is obtained by performing a comprehensive calculation based on the calculated signal fluctuation value, network load value and data transmission value.

5. The terminal switching and security assessment system based on dual-mode communication according to claim 4 is characterized in that: The specific method in which the mode switching analysis unit calculates the communication value is: Substitute the calculated signal fluctuation value, network load value, and data transmission speed value into the formula The communication value Q of the object to be analyzed is calculated, where P represents the signal fluctuation value, F represents the network load value, V represents the data transmission speed value, and a1, a2 and a3 are the corresponding weight coefficients. Similarly, the communication value Q of the object to be analyzed is calculated by the above formula and recorded as Q1. Then, the communication value Q of the object to be analyzed is compared with the communication value Q1 of the object to be analyzed. If the communication value Q is greater than the communication value Q1, a normal communication signal is generated, and if the communication value Q is less than the communication value Q1, a change mode signal is generated.

Images