Security plane architecture system, data processing method, equipment and medium

Abstract

The invention provides a security surface architecture system, a data processing method, equipment and a medium. The system comprises an intelligent engine and a plurality of functional security surfaces, each safety surface comprises a safety capability pool, each safety capability pool comprises an enabling unit, and each enabling unit is used for realizing corresponding safety capability; the intelligent engine is used for receiving statistical information; generating a corresponding security policy based on the plurality of pieces of statistical information; and controlling at least one target function security surface in the plurality of function security surfaces to call at least one enabling unit corresponding to the security policy so as to realize the security capability corresponding to the at least one enabling unit, and the source of the statistical information comprises at least one of a plurality of domains of the communication system and the plurality of function security surfaces, the plurality of domains include a terminal domain, an air interface domain, a core domain, and a traffic domain. According to the embodiment of the invention, the security problem is solved by monitoring and analyzing various information types and combining the enabling unit in the security surface based on the analysis result.

Description

Technical Field

[0001] The present application belongs to the technical field of mobile communications, and specifically relates to a security plane architecture system, a data processing method, a device and a medium. Background Art

[0002] With the development of technology, mobile communication networks will evolve to the 6G stage, which will be a major leap in network technology. The 6G network will realize the true interconnection of all things, support multiple heterogeneous networks including satellite networks, industry networks, body area networks, and massive terminals, and ultimately achieve seamless coverage around the world. This new network architecture will bring unprecedented application scenarios and service models, but it will also put forward higher requirements for network security.

[0003] At present, the security issues of 6G networks are mainly solved through "plug-in" security means. This method is usually a post-remediation rather than a pre-consideration, and can only achieve a gradually enhanced security effect, that is, security can only be improved slightly and gradually for specific security issues, but cannot achieve a qualitative leap. This security architecture is difficult to solve the security issues caused by cross-domain heterogeneity. Summary of the invention

[0004] The present application proposes a data processing method, device, equipment and storage medium, which can solve technical problems that cannot be solved by the security issues caused by the cross-domain heterogeneity of the current 6G network.

[0005] The first embodiment of the present application provides a security plane architecture system, including: Smart engine and multiple functional safety aspects; Each security plane includes a security capability pool, each security capability pool includes an enabling unit, and each enabling unit is used to implement a corresponding security capability; The intelligent engine is used to receive statistical information; generate corresponding security policies based on multiple statistical information; control at least one target functional safety plane among the multiple functional safety planes to call at least one enabling unit corresponding to the security policy, so as to implement the security capabilities corresponding to each of the at least one enabling unit, and the sources of the statistical information include: multiple domains of the communication system and at least one of the multiple functional safety planes, and the multiple domains include a terminal domain, an air interface domain, a core domain and a service domain.

[0006] The second aspect of the present application provides a data processing method, including: Receive statistics; Generate a corresponding security policy based on a plurality of said statistical information; Control at least one target functional safety plane among multiple functional safety planes to call at least one enabling unit corresponding to the security policy to implement the security capabilities corresponding to each of the at least one enabling unit, and sources of the statistical information include: multiple domains of the communication system and at least one of the multiple functional safety planes, the multiple domains including a terminal domain, an air interface domain, a core domain, and a service domain.

[0007] An embodiment of a third aspect of the present application provides a data processing device, including: A receiving module, used for receiving statistical information; A generation module, used for generating corresponding security policies based on a plurality of said statistical information; A control module is used to control at least one target functional safety plane among multiple functional safety planes to call at least one enabling unit corresponding to the security policy to implement the security capabilities corresponding to each of the at least one enabling unit, and the sources of the statistical information include: multiple domains of the communication system and at least one of the multiple functional safety planes, the multiple domains include a terminal domain, an air interface domain, a core domain and a service domain.

[0008] An embodiment of the fourth aspect of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the second aspect above.

[0009] An embodiment of the fifth aspect of the present application provides a computer-readable storage medium on which a computer program is stored, and the program is executed by a processor to implement the method described in the second aspect above.

[0010] The technical solution provided in the embodiments of the present application has at least the following technical effects or advantages: The present application proposes a security plane architecture system, data processing method, device and medium, the system includes: an intelligent engine and multiple functional safety planes; each security plane includes a security capability pool, each security capability pool includes an enabling unit, and each enabling unit is used to implement a corresponding security capability; the intelligent engine is used to receive statistical information; generate a corresponding security policy based on multiple statistical information; control at least one target functional safety plane among the multiple functional safety planes to call at least one enabling unit corresponding to the security policy to implement the security capability corresponding to each of the at least one enabling unit, and the source of the statistical information includes: multiple domains of the communication system and at least one of the multiple functional safety planes, and the multiple domains include a terminal domain, an air interface domain, a core domain and a service domain. The embodiments of the present application solve security problems by monitoring and analyzing multiple types of information, and combining the enabling units within the security plane based on the analysis results.

[0011] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings: Figure 1 A schematic diagram of the structure of a security plane architecture system provided by an embodiment of the present application is shown; Figure 2 A schematic diagram of the structure of a security plane architecture system provided by an embodiment of the present application is shown; Figure 3 A schematic diagram of the structure of a security plane architecture system provided by an embodiment of the present application is shown; Figure 4 A flow chart of a data processing method provided by an embodiment of the present application is shown; Figure 5 A schematic diagram showing the structure of a data processing device provided by an embodiment of the present application is shown; Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present application is shown; Figure 7 A schematic diagram of a storage medium provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0013] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0014] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0015] The current security architecture mostly relies on static, fixed security policies, lacks intelligence and dynamic adjustment capabilities, and often requires a large number of management and maintenance personnel to make judgments and management (according to a survey jointly launched by Nokia and GlobalData in November 2022, most current 5G operators have irregular network operation and maintenance, high intensity of manual operation and maintenance work, etc.), and it is difficult to adapt to the rapidly changing network environment and security threats.

[0016] At present, when 6G networks have security problems, due to the limitations of 6G networks in solving security problems, they cannot solve all security problems that occur. For example, 6G networks can use physical layer security (PLS) technology to provide additional security protection at the physical level, but the PLS method also has its limitations. For example, although terahertz communication is highly directional, it can still be eavesdropped.

[0017] Therefore, additional security measures are needed to supplement PLS to ensure the security of communications. That is, using "external" security measures to solve the security problems of 6G networks is usually a post-remediation rather than a pre-consideration, and can only achieve a gradually enhanced security effect. Especially for security issues involving multiple domains, only a certain domain can be solved through "external" security measures, that is, only part of the security problem is solved, and the security problem cannot be fundamentally solved.

[0018] Based on this, the present application proposes a security plane architecture system, data processing method, device and medium, the system includes: an intelligent engine and multiple functional safety planes; each security plane includes a security capability pool, each security capability pool includes an enabling unit, and each enabling unit is used to implement the corresponding security capability; the intelligent engine is used to receive statistical information; generate corresponding security policies based on multiple statistical information; control at least one target functional safety plane among the multiple functional safety planes to call at least one enabling unit corresponding to the security policy to implement the security capability corresponding to each of the at least one enabling unit, and the source of the statistical information includes: multiple domains of the communication system and at least one of the multiple functional safety planes, and the multiple domains include terminal domains, air interface domains, core domains and business domains. The embodiments of the present application solve security problems by monitoring and analyzing multiple types of information, and combining the enabling units within the security plane based on the analysis results.

[0019] A security plane architecture system proposed according to an embodiment of the present application is described below in conjunction with the accompanying drawings.

[0020] See also Figure 1 ,The system includes: an intelligent engine and multiple functional safety surfaces; Each functional safety plane includes a safety capability pool, each safety capability pool includes an enabling unit, and each enabling unit is used to implement a corresponding safety capability; The intelligent engine is used to receive statistical information; generate corresponding security policies based on multiple statistical information; control at least one target functional safety plane among multiple functional safety planes to call at least one enabling unit corresponding to the security policy, so as to realize the security capabilities corresponding to each of the at least one enabling unit, and the sources of the statistical information include: multiple domains of the communication system and at least one of the multiple functional safety planes, and the multiple domains include a terminal domain, an air interface domain, a core domain and a service domain.

[0021] The functional safety plane may include: functional safety plane 1, functional safety plane 2, ... functional safety plane n. Each functional safety plane includes enabling unit 1, enabling unit 2, ... enabling unit n.

[0022] It is understandable that the current 6G communication system is divided into four domains, namely the terminal domain, air interface domain, core domain and service domain. Therefore, corresponding security functions can be set according to the needs of the terminal domain, air interface domain, core domain and service domain to solve security problems that may arise in each domain.

[0023] In order to quickly respond to security issues, the security functions can be divided, that is, the security plane is divided into multiple functional safety planes, each security capability pool includes an enabling unit, and each enabling unit is used to implement a corresponding security function. That is, a corresponding security function is set in each functional safety plane, so that when the intelligent engine determines a security issue, the corresponding enabling unit can be called to implement the corresponding security capability to solve the security issue.

[0024] Since security issues may be cross-domain, that is, the security issue is generated in the process of data interaction between multiple domains, this type of security issue cannot be solved by only using external security measures. For cross-domain security issues, statistical information of each domain can be collected, and corresponding security policies can be generated based on the statistical information. Since the security policy is generated based on the statistical information of multiple domains, the security policy can solve cross-domain problems, thereby solving security problems through monitoring and analysis of various types of information, and combining the enabling units within the security plane based on the analysis results.

[0025] In some embodiments, controlling at least one target functional safety plane among multiple functional safety planes to call at least one enabling unit corresponding to a security policy may be implemented by sending control information to each functional safety plane, where the control information includes the security policy.

[0026] Furthermore, the corresponding security policy can be determined by combining the internal security plane, that is, the statistical information issued by multiple functional safety planes, so as to more accurately solve cross-domain security problems.

[0027] The present application proposes a security plane architecture system, which includes: an intelligent engine and multiple functional safety planes; each security plane includes a security capability pool, each security capability pool includes an enabling unit, and each enabling unit is used to implement a corresponding security capability; the intelligent engine is used to receive statistical information; generate a corresponding security policy based on multiple statistical information; control at least one target functional safety plane among the multiple functional safety planes to call at least one enabling unit corresponding to the security policy to implement the security capability corresponding to each of the at least one enabling unit, and the source of the statistical information includes: multiple domains of the communication system and at least one of the multiple functional safety planes, and the multiple domains include a terminal domain, an air interface domain, a core domain, and a business domain. The embodiments of the present application solve security problems by monitoring and analyzing multiple types of information, and combining the enabling units within the security plane based on the analysis results.

[0028] In some embodiments, Figure 2 As shown, the above system also includes: an all-dimensional perception channel, used to receive first statistical information sent by multiple domains of the communication system; and send the first statistical information to the intelligent engine.

[0029] The information source of the first statistical information is multiple domains. In some embodiments, corresponding sensors can be respectively set in the multiple domains to collect data in the network and generate corresponding statistical information based on the data.

[0030] The first statistical information may include network traffic information, key performance indicator information, network element log information, user behavior information, and the like.

[0031] Network traffic information can be used to monitor data traffic in the network in real time and analyze traffic characteristics, such as traffic size, transmission rate, access frequency, etc., to identify abnormal traffic and potential security threats.

[0032] Key performance indicator information may include throughput, latency, packet loss rate, etc. By analyzing key performance indicators, the operation status of the network can be evaluated and abnormal phenomena can be discovered in a timely manner.

[0033] Analysis: Monitor and analyze user behavior in the network, such as login behavior, data access behavior, etc., to identify malicious users and abnormal behavior network element log information, such as system errors, access failures, etc., to discover potential security risks.

[0034] The full-dimensional perception channel provides multimodal information to the situation awareness engine by collecting network information in different dimensions, thereby realizing the identification and alarm of abnormal conditions.

[0035] In some embodiments, Figure 2As shown, the intelligent engine includes: a situation awareness engine, an intelligent decision center and a security resource pool; the situation awareness engine is used to receive statistical information; determine attack events in the statistical information; send the attack events to the intelligent decision center; the intelligent decision center is used to receive attack events; determine the event type and severity of the attack events; determine the security policy based on the event type and severity of the attack events; send the security policy to the security resource pool; the security resource pool is used to receive the security policy; determine at least one target security capability corresponding to the security policy from multiple security capabilities; determine the target enabling unit corresponding to at least one target security capability; determine the target functional safety plane corresponding to each target enabling unit; based on the target security capability corresponding to each target functional safety plane, generate call information for each target functional security plane; send each call information to the corresponding target functional safety plane, each call information is used to instruct the target functional safety plane to call the corresponding enabling unit to achieve the corresponding target security capability.

[0036] Among them, the situation awareness engine is used to receive statistical information sent by the full-dimensional perception channel and determine attack events in the statistical information.

[0037] In some embodiments, deep learning and other technologies can be used to extract and analyze network traffic, user behavior and other information to identify and classify known and unknown network threats. By analyzing network performance indicators, log information and other data, network operation risks are evaluated, and network perception reports are generated. Finally, the network perception reports are uploaded to the security intelligent decision engine to provide decision support for network security management.

[0038] The intelligent decision center is used to receive attack events; determine the event type and severity of the attack events; and determine security policies based on the event type and severity of the attack events.

[0039] In some embodiments, the intelligent decision center can select an appropriate strategy from preset response methods based on the type and severity of the attack event, evaluate the candidate security strategies by analyzing the security level, danger level and proxy coefficient of the strategy, and screen out the optimal strategy.

[0040] Among them, the security policy can correspond to at least one security capability, the resource security pool stores enabling units corresponding to multiple functional safety planes, and the security capabilities corresponding to each enabling unit. The resource security pool can determine at least one target security capability corresponding to the security policy; determine the target enabling unit corresponding to at least one target security capability; determine the target functional safety plane corresponding to each target enabling unit, thereby generating call information for each target functional security plane; send each call information to the corresponding target functional safety plane to call the corresponding enabling unit, realize the corresponding security capability, and solve the corresponding security problem.

[0041] In general, the intelligent engine is used to receive statistical information of multiple dimensions, and determine whether a security problem has occurred in the current communication system based on the statistical information. In the event of a security problem, a security policy corresponding to the security problem is determined from the preset security policies, and at least one security function corresponding to the security policy is determined, and an enabling unit corresponding to at least one security function and a functional safety plane to which the enabling unit belongs are determined from the security resource pool, so as to generate call information corresponding to each security function, and send it to the corresponding functional safety plane, so as to call the corresponding enabling unit, realize the corresponding security capability, and solve the corresponding security problem.

[0042] In some embodiments, Figure 2 As shown, each functional safety aspect includes a safety management unit, The security resource pool is used to send each call information to the corresponding target security management unit; Each security management unit is used to receive calling information, call at least one target enabling unit corresponding to the calling information, and respectively call the security capability corresponding to the at least one target enabling unit.

[0043] It can be understood that each functional safety plane includes a security management unit to receive call information sent by the security resource pool, and call at least one target enabling unit based on the call information, and the at least one target enabling unit respectively corresponds to a security capability.

[0044] Since the security plane is established to ensure the security of the communication system, the security of the communication system mainly includes the following aspects: the security of wireless communication links, the transmission security of user data, and the security of the network management and control layer.

[0045] Therefore, based on the above aspects, the security plane can be divided into the following functional safety planes: air interface security plane, data security plane and network security plane.

[0046] Among them, the air interface security aspect mainly focuses on the security of the wireless communication link, that is, the secure transmission of the wireless channel between the terminal and the base station. Since wireless signals are covered everywhere in space, illegal users can intercept them at will, so it is necessary to encrypt and protect the integrity of air interface data to prevent data leakage or tampering. This includes data encryption and integrity protection to ensure the security and reliability of wireless transmission.

[0047] The data security plane is responsible for the secure transmission and processing of user data. It includes security issues in the process of data encapsulation, transmission, routing and distribution, focusing on the efficient and secure transmission of data streams and ensuring the integrity and confidentiality of data. The data security plane needs to solve the problem of user data migration and systematically provide trusted data services.

[0048] The network security aspect involves the security of the network management and control layer, including the allocation of network resources, route selection and network topology. It is responsible for the overall operation and maintenance of the network, ensuring the stability and reliability of the network, and also includes the protection of network infrastructure, such as physical equipment security, system reinforcement, data desensitization and other measures to protect the security of private data.

[0049] In the field of 6G communication technology, the use of advanced virtualization technology to integrate and abstract various security functions can build a flexible security function architecture at the server level. With the help of virtualization, these security functions can be created instantly, adjusted on demand, and deployed quickly. The overall architecture can adopt a centralized or distributed deployment mode, which can not only greatly improve the management efficiency of security capabilities, but also realize dynamic optimization and differentiated configuration of security functions, thereby ensuring the security and reliability of the 6G network environment. The addition of these two technologies provides greater flexibility and adaptability for network security, which helps to improve the overall security of the network.

[0050] In some embodiments, each security capability pool is used to obtain the execution result of the corresponding enabling unit to implement the corresponding security capability; send the execution result as the second statistical information to the full-dimensional perception channel; send the second statistical information to the full-dimensional perception channel; the full-dimensional perception channel is also used to receive the second statistical information sent by each security capability pool, and send the second statistical information to the intelligent engine.

[0051] It is understandable that the intelligent engine not only generates corresponding security policies based on the first statistical information sent by multiple domains, but also generates corresponding security policies based on the first statistical information sent by multiple domains and execution results, or generates corresponding security policies based on the execution results.

[0052] Therefore, the security management unit can send the received second statistical information to the intelligent engine through the full-dimensional perception channel.

[0053] In some embodiments, each functional safety plane further includes: a safety infrastructure management unit, Each enabling unit is used to call the corresponding security infrastructure management unit to implement the corresponding security capabilities. Figure 2 As shown, corresponding to the air interface security plane, data security plane and network security plane, the security infrastructure management unit is divided into an air interface security infrastructure management unit, a data security infrastructure management unit and a network security infrastructure management unit. Among them, each enabling unit is used to call the corresponding security infrastructure management unit to realize dynamic deployment of the network, so as to realize the function of automated security decision-making of the 6G network, which can improve the security of the 6G network while ensuring the availability and efficiency of network functions.

[0054] In some embodiments, the enabling unit includes a security enabling unit and a trust enabling unit.

[0055] The security capabilities in each security capability pool are divided into trust enabling units and security enabling units according to their functions, which respectively include the trust support capabilities and security support capabilities existing in each security plane.

[0056] The air interface security capability pool includes security enabling unit: high-speed key generation, trust enabling unit: low-latency authentication mechanism and group authentication mechanism; the network security capability pool includes security enabling unit: atomic protocol, trust enabling unit: AKA; the air interface security capability pool includes security enabling unit: location data privacy protection and privacy protection data integration, trust enabling unit: blockchain trust assessment and management.

[0057] In some embodiments, the above security plane architecture system can be divided vertically according to the functional safety plane, and can also be divided horizontally according to the security layer, such as Figure 3 As shown, the security plane architecture system includes: security and trust collaboration management layer, security and trust support capability layer, and security and trust infrastructure layer.

[0058] The security and trust coordination management layer provides security capability support and trustworthy system guarantee for the entire network through flexible orchestration of security capabilities and intelligent endogenous security policies. The endogenous security intelligence engine is a set of virtualized network security function services, supported by network hardware, software and algorithms, and interacts with network nodes and network function services through interface protocol specifications. The endogenous security intelligence engine consists of three parts: situation awareness engine, intelligent decision center and security resource pool. The situation awareness engine collects network information from the full-dimensional perception channel, performs intelligent analysis and generates security policies through the intelligent decision center, and uniformly hands them over to the security resource pool for policy distribution.

[0059] The security and trust support capability layer provides security capability support for the security and trust collaborative management layer. This layer is composed of a variety of security-critical enabling technologies that support various domains, and is scheduled and orchestrated by the security policies provided by the endogenous security intelligence engine. By atomizing and pooling security capabilities, it provides flexible, elastic, and orchestrated capability support for the overall security architecture.

[0060] The security and trusted infrastructure layer includes different network security entities such as data network, core network, access network and terminal. The user plane and control plane data of the 6G network are collected and processed by the full-dimensional situation awareness algorithm and transmitted to the endogenous security intelligence engine in real time, so as to realize the unified coordination and scheduling of security capabilities.

[0061] The following describes a data processing method proposed according to an embodiment of the present application in conjunction with the accompanying drawings. The execution subject of the method may be Figure 1The intelligent engine of the security surface architecture system shown.

[0062] like Figure 4 As shown, the method may include the following steps: S401: Receive statistical information.

[0063] S402: Generate a corresponding security policy based on multiple statistical information.

[0064] S403: Control at least one target functional safety plane among the multiple functional safety planes to call at least one enabling unit corresponding to the security policy, so as to implement the security capability corresponding to each of the at least one enabling unit.

[0065] Sources of the statistical information include: multiple domains of the communication system and at least one of multiple functional safety planes, the multiple domains including a terminal domain, an air interface domain, a core domain, and a service domain.

[0066] It is understandable that the current 6G communication system is divided into four domains, namely the terminal domain, air interface domain, core domain and service domain. Therefore, corresponding security functions can be set according to the needs of the terminal domain, air interface domain, core domain and service domain to solve security problems that may arise in each domain.

[0067] In order to quickly respond to security issues, the security functions can be divided, that is, the security plane is divided into multiple functional safety planes, each security capability pool includes an enabling unit, and each enabling unit is used to implement a corresponding security function. That is, a corresponding security function is set in each functional safety plane, so that when the intelligent engine determines a security issue, the corresponding enabling unit can be called to implement the corresponding security capability to solve the security issue.

[0068] Since security issues may be cross-domain, that is, the security issue is generated in the process of data interaction between multiple domains, this type of security issue cannot be solved by only using external security measures. For cross-domain security issues, statistical information of each domain can be collected, and corresponding security policies can be generated based on the statistical information. Since the security policy is generated based on the statistical information of multiple domains, the security policy can solve cross-domain problems, thereby solving security problems through monitoring and analysis of various types of information, and combining the enabling units within the security plane based on the analysis results.

[0069] Furthermore, the corresponding security policy can be determined by combining the internal security plane, that is, the statistical information issued by multiple functional safety planes, so as to more accurately solve cross-domain security problems.

[0070] The embodiments of the present application solve security problems by monitoring and analyzing various types of information and combining enabling units within the security plane based on the analysis results.

[0071] The present application also provides a data processing device, which is used to execute the data processing method provided in any of the above embodiments. Figure 5 As shown, the device includes: a receiving module 501, a generating module 502 and a control module 503.

[0072] A receiving module 501 is used to receive statistical information; A generating module 502, configured to generate a corresponding security policy based on a plurality of said statistical information; The control module 503 is used to control at least one target functional safety plane among the multiple functional safety planes to call at least one enabling unit corresponding to the security policy to implement the security capabilities corresponding to each of the at least one enabling unit. The sources of the statistical information include: multiple domains of the communication system and at least one of the multiple functional safety planes, and the multiple domains include a terminal domain, an air interface domain, a core domain and a service domain.

[0073] The present application also provides an electronic device to execute the above data processing method. Figure 6 It shows a schematic diagram of an electronic device provided by some embodiments of the present application. Figure 6 As shown, the electronic device 7 includes: a processor 700, a memory 701, a bus 702 and a communication interface 703. The processor 700, the communication interface 703 and the memory 701 are connected via the bus 702; the memory 701 stores a computer program that can be run on the processor 700, and when the processor 700 runs the computer program, it executes the data processing method provided in any of the aforementioned embodiments of the present application.

[0074] The memory 701 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The communication connection between the device network element and at least one other network element is realized through at least one communication interface 703 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0075] The bus 702 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 701 is used to store programs, and the processor 700 executes the program after receiving an execution instruction. The data processing method disclosed in any implementation of the aforementioned embodiment of the present application may be applied to the processor 700, or implemented by the processor 700.

[0076] The processor 700 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 700. The above processor 700 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 701, and the processor 700 reads the information in the memory 701 and completes the steps of the above method in combination with its hardware.

[0077] The electronic device provided in the embodiment of the present application and the data processing method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented therein.

[0078] The present application also provides a computer-readable storage medium corresponding to the data processing method provided in the above embodiment. Figure 7 The computer-readable storage medium shown is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is run by a processor, it executes the data processing method provided by any of the aforementioned embodiments.

[0079] It should be noted that examples of computer-readable storage media may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0080] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the data processing method provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0081] It should be noted that: In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known structures and technologies are not shown in detail so as not to obscure the understanding of this description.

[0082] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present application and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0083] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A security plane architecture system, characterized in that: include: Smart engine and multiple functional safety aspects; Each functional safety plane includes a safety capability pool, each safety capability pool includes an enabling unit, and each enabling unit is used to implement a corresponding safety capability; The intelligent engine is used to receive statistical information; generate corresponding security policies based on multiple statistical information; Control at least one target functional safety plane among the multiple functional safety planes to call at least one enabling unit corresponding to the security policy to implement the security capabilities corresponding to each of the at least one enabling unit, and the sources of the statistical information include: multiple domains of the communication system and at least one of the multiple functional safety planes, the multiple domains including a terminal domain, an air interface domain, a core domain and a service domain.

2. The system according to claim 1, characterized in that The system further comprises: The full-dimensional perception channel is used to receive first statistical information sent by multiple domains of the communication system; and send the first statistical information to the intelligent engine.

3. The system according to claim 2, characterized in that The intelligent engine includes: a situation awareness engine, an intelligent decision-making center and a security resource pool; The situation awareness engine is used to receive statistical information; determine attack events in the statistical information; and send the attack events to the intelligent decision-making center; The intelligent decision center is used to receive the attack event; determine the event type and severity of the attack event; determine the security policy based on the event type and severity of the attack event; and send the security policy to the security resource pool; The security resource pool is used to receive security policies; determine at least one target security capability corresponding to the security policy from multiple security capabilities; determine the target enabling unit corresponding to each of the at least one target security capability; determine the target functional safety plane corresponding to each of the target enabling units; based on the target security capabilities corresponding to each of the target functional safety planes, generate call information for each of the target functional security planes; send each of the call information to the corresponding target functional safety plane, each of the call information is used to instruct the target functional safety plane to call the corresponding enabling unit to realize the corresponding target security capability.

4. The system according to claim 3, characterized in that Each functional safety plane includes a safety management unit, The security resource pool is used to send each of the call information to the corresponding target security management unit respectively; Each security management unit is used to receive calling information and call at least one target enabling unit corresponding to the calling information, so that the at least one target enabling unit implements the corresponding security capability.

5. The system according to any one of claims 2 to 4, characterized in that: Each security capability pool is used to obtain the execution result of the corresponding enabling unit to realize the corresponding security capability; and send the execution result as the second statistical information to the full-dimensional perception channel; The full-dimensional perception channel is also used to receive second statistical information sent by each security capability pool, and send the second statistical information to the intelligent engine.

6. The system according to claim 1, characterized in that Each functional safety plane also includes: a safety basic equipment management unit, Each enabling unit is used to call a corresponding security infrastructure management unit to implement a corresponding security capability.

7. The system according to claim 1, characterized in that The enabling unit includes a security enabling unit and a trust enabling unit.

8. A data processing method, characterized in that: include: Receive statistics; Generate a corresponding security policy based on a plurality of said statistical information; Control at least one target functional safety plane among multiple functional safety planes to call at least one enabling unit corresponding to the security policy to implement the security capabilities corresponding to each of the at least one enabling unit, and sources of the statistical information include: multiple domains of the communication system and at least one of the multiple functional safety planes, the multiple domains including a terminal domain, an air interface domain, a core domain, and a service domain.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The processor executes the computer program to implement the method according to claim 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method according to claim 8.

Images