Network physical security assessment method, system and equipment based on network structure and service application classification, and medium
Through the evaluation method based on network structure and business application classification, using graph database technology to perform path search and security assessment in the machine room, the shortcomings of evaluation in complex network scenarios in the existing technology are solved, and fast and accurate network physical security assessment and System performance improvement.
Patent Information
- Application Number
- CN202411356947.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-27
- Publication Date
- 2025-01-03
AI Technical Summary
The existing network physical security assessment methods lack differentiated evaluation in complex network scenarios, incomplete evaluation elements, unclear scope of management and control, single evaluation algorithms and low query efficiency, and cannot effectively deal with complex scenarios containing more than two links.
Using evaluation methods based on network structure and business application classification, using graph database technology to search paths in the machine room, find splicable paths through synchronous search of dual-end machine room, build compliant network routes, and improve through personalized security evaluation algorithms Query efficiency, transfer calculation-intensive tasks to the application service layer.
It realizes fast and accurate network physical security assessment, provides differentiated physical security requirements, covers multi-level evaluation dimensions, improves the overall efficiency, stability and scalability of the system, and significantly improves query efficiency.
Smart Images
Figure CN119254680A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network physical security assessment, and in particular to a network physical security assessment method, system, device and medium based on network structure and business application classification. Background Art
[0002] Currently, the field of cyber-physical security assessment mainly relies on assessment methods based on dual-link systems. This type of method can meet the needs of simple network scenarios to a certain extent, but when faced with complex network structures containing more than two links, its assessment capabilities are insufficient and lack effective assessment methods and multi-level comprehensive considerations.
[0003] Specifically, existing assessment methods often focus on the physical security of a single or dual link, but fail to fully consider the differentiated physical security requirements under different network structures, business scenarios, and security levels. At the same time, these methods often ignore factors such as pipeline physical security and logical resource physical security when comprehensively considering the physical security of business circuits.
[0004] Its defects are as follows: 1. Lack of differentiated assessment: Existing assessment methods fail to propose differentiated physical security requirements for different network structures and business scenarios, resulting in a lack of pertinence and accuracy in assessment results.
[0005] 2. Incomplete assessment factors: When assessing the physical security of business circuits, existing methods often only focus on a single physical link, while ignoring key factors such as pipeline physical security and logical resource physical security, thus failing to fully reflect the physical security status of the network.
[0006] 3. Unclear definition of control scope: Existing methods lack clear definitions and effective evaluation methods for the physical security control scope in different business scenarios, which makes it difficult to determine reasonable security strategies in practical applications.
[0007] 4. Single evaluation algorithm: Existing methods often use a single evaluation algorithm and fail to design different evaluation strategies according to different security levels, resulting in limited flexibility and accuracy of the evaluation results.
[0008] 5. Low query efficiency: When faced with complex network scenarios involving multiple links, the query efficiency of existing methods is often low and cannot meet the needs of fast and accurate network physical security assessment.
[0009] In summary, existing cyber-physical security assessment methods have obvious defects and deficiencies in many aspects and cannot effectively cope with the physical security assessment challenges in complex network scenarios. Currently, most security assessment methods are mainly based on dual-link systems, and there is still a lack of effective assessment methods for complex scenarios involving more than two links. Therefore, a new, more comprehensive and effective cyber-physical security assessment method is urgently needed to fill this gap. Summary of the invention
[0010] The present invention aims at the problem that the existing security assessment methods cannot handle complex scenarios involving more than two links, and proposes a network physical security assessment method, system, device and medium based on network structure and business application classification; using graph database technology, path search is performed in the computer room to determine the security level; through the synchronous search of the dual-end computer room, a splicable path is found according to the preset rules to build a compliant network route. Since there are multiple route search results in the dual-end computer room in the network topology, a personalized security assessment algorithm is implemented by comparing the search results two by two, which greatly improves the query efficiency from minutes to seconds. The computationally intensive tasks are transferred to the application service layer, thereby reducing the consumption of database resources and improving the overall performance, stability and scalability of the system.
[0011] The specific implementation contents of the present invention are as follows: A network physical security assessment method based on network structure and business application classification specifically includes the following steps: Step S1: Taking the starting computer room and the ending computer room as starting points, respectively, searching for the first route and the second route; The starting room and the ending room are respectively used as the starting points, wherein the room may contain any one or more of optical division (GF) equipment, optical cross-connection (GJ) equipment and ODF equipment, or may not contain any one or more of them. The present invention only discusses the existing situation. When any of the above equipment exists in the room, it can be called any one or more of an optical division room, an optical cross-connection room or an ODF room, and the first route and the second route are searched to obtain, wherein the first route includes the route from any one or more of the optical division room, the optical cross-connection room or the ODF room, and the second route includes the route from any one or more of the optical division room, the optical cross-connection room or the ODF room; Step S2: retrieve the first route to obtain the third route and the fourth route; retrieve the second route to obtain the fifth route and the sixth route; the third route is the route including the termination room in the first route; the fourth route is the route not including the termination room in the first route; the fifth route is the route including the starting room in the second route; the sixth route is the route not including the starting room in the second route; The first route is retrieved to obtain the third route and the fourth route; the second route is retrieved to obtain the fifth route and the sixth route; the third route is the route including the termination room in the first route; the fourth route is the route not including the termination room in the first route; the fifth route is the route including the starting room in the second route; the sixth route is the route not including the starting room in the second route; Step S3: Clip the fourth route and the sixth route, and splice the clipped fourth route and the clipped sixth route in opposite directions. If the splicing is successful, the spliced route is added to the result set; if the splicing fails, the ODF computer room at the end of the route at both ends is used as an input parameter, the shortest path is searched and clipped, and the search result is obtained by filtering according to the set constraints; Step S4: According to the set security level, filter again from the search results to obtain the final evaluation result.
[0012] In order to better implement the present invention, further, the step S1 specifically includes the following steps: Step S11: starting from the starting machine room, searching for the intermediate machine room connected to the distribution optical cable within three sections; starting from the intermediate machine room, searching for the ODF machine room connected to the trunk optical cable or the contact optical cable within two sections; starting from the ODF machine room, searching for the ODF machine room connected to the office optical cable or the relay optical cable within one section; merging to obtain the first route; Starting from the optical splitter room, search for the optical cross-connection room connected to the distribution optical cable within three sections; starting from the optical cross-connection room, search for the ODF room connected to the trunk optical cable or the contact optical cable within two sections; starting from the ODF room, search for the ODF room connected to the office optical cable or the relay optical cable within one section; merge to get the first route starting from the optical splitter in the room; Step S12: starting from the terminating machine room, searching for the intermediate machine room connected to the distribution optical cable within three sections; starting from the intermediate machine room; searching for the ODF machine room connected to the trunk optical cable or the communication optical cable within two sections; starting from the ODF machine room, searching for the ODF machine room connected to the office optical cable or the relay optical cable within one section; merging to obtain the second route.
[0013] Starting from the optical exchange room, search for ODF rooms connected to the trunk optical cable or the contact optical cable within two sections; starting from the ODF room, search for ODF rooms connected to the office optical cable or the relay optical cable within one section; merge to obtain the first route starting from the optical exchange equipment in the room; Step S13: starting from the ODF room, searching for ODF rooms connected to the office optical cable or the relay optical cable within a section; merging to obtain a first route starting from the ODF equipment in the room.
[0014] In order to better implement the present invention, further, the step S2 specifically includes the following steps: Step S21: retrieve the first route to obtain the third route and the fourth route, and add the third route to the result set; Step S22: Retrieve the second route to obtain the fifth route and the sixth route, and add the fifth route to the result set.
[0015] In order to better implement the present invention, further, the step S3 specifically includes the following steps: Step S31: obtaining the fourth route and the sixth route after cutting according to the set constraint conditions; Step S32: splicing the pruned fourth route and the pruned sixth route in opposite directions. If the splicing is successful, the spliced route is added to the result set; if the splicing fails, the machine rooms at the ends of the routes at both ends are used as input parameters to search for the shortest path; the shortest path is a path that must be connected between the machine rooms by a relay optical cable; Step S33: clipping the shortest path, splicing the clipped shortest path with the starting end in phase and then splicing it with the terminating end in opposite directions to obtain a spliced route; Step S34: cutting and splicing routes according to set constraints to obtain search results.
[0016] In order to better implement the present invention, further, the set constraints are: primary grouping according to the starting fiber core bundle, secondary grouping according to the ending fiber core bundle, tertiary grouping according to the length, and selecting a route from the primary grouping, secondary grouping, and tertiary grouping respectively.
[0017] In order to better implement the present invention, further, the step S4 specifically includes the following steps: Step S41: remove duplicates and sort the search results; Step S42: Determine the security level of the sorted search results. If the security level is none, do not filter and directly feed back the sorted results as the final search results to the result set. If the security level is cable splitting, compare multiple sorted search results two by two, use a multi-threaded search to obtain the final search results and feed back to the result set. If the security level is pipeline splitting, calculate the first and last segments of the optical cable pipelines in the route of the sorted search results, use a multi-threaded search to obtain the final search results and feed back to the result set.
[0018] Based on the above-mentioned network physical security assessment method based on network structure and business application classification, in order to better realize the present invention, further, a network physical security assessment system based on network structure and business application classification is proposed, which is used to execute the above-mentioned network physical security assessment method based on network structure and business application classification; it includes a search unit, a retrieval unit, a clipping unit, and an assessment unit; The search unit is used to search for the first route and the second route using the starting computer room and the ending computer room as starting points respectively; The retrieval unit is used to retrieve the first route to obtain the third route and the fourth route; retrieve the second route to obtain the fifth route and the sixth route; the third route is the route including the termination room in the first route; the fourth route is the route not including the termination room in the first route; the fifth route is the route including the starting room in the second route; the sixth route is the route not including the starting room in the second route; The clipping unit is used to clip the fourth route and the sixth route, splice the clipped fourth route and the clipped sixth route in opposite directions, and if the splicing is successful, add the spliced route to the result set; if the splicing fails, use the computer rooms at the ends of the routes at both ends as input parameters, search for the shortest path and clip it, and filter the search results according to the set constraints; The evaluation unit is used to screen the search results again according to the set security level to obtain a final evaluation result.
[0019] Based on the above-mentioned network physical security assessment method based on network structure and business application classification, in order to better realize the present invention, further, an electronic device is proposed, including a memory and a processor; a computer program is stored on the processor; when the computer program is executed on the processor, the above-mentioned network physical security assessment method based on network structure and business application classification is implemented.
[0020] Based on the above-mentioned network physical security assessment method based on network structure and business application classification, in order to better realize the present invention, further, a computer-readable storage medium is proposed, on which computer instructions are stored; when the computer instructions are executed on the above-mentioned electronic device, the above-mentioned network physical security assessment method based on network structure and business application classification is implemented.
[0021] The present invention has the following beneficial effects: (1) The present invention provides a complete network physical security assessment system for communication operators, which can standardize the physical security assessment algorithms under different network structures, business scenarios and security levels, and realize fast and accurate network physical security assessment. Through comprehensive modeling of key network elements such as network nodes, boards, ports, physical optical paths, pipelines, etc., it can apply judgment rules at multiple levels, thereby achieving the goal of completing network physical security assessment efficiently and accurately. (2) The present invention proposes differentiated physical security requirements for different network structures, making the security assessment more in line with the actual network situation; different security assessment algorithms are designed for different security levels, improving the accuracy and flexibility of the assessment. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] Figure 1 The present invention provides a schematic block diagram of the overall process. DETAILED DESCRIPTION
[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. It should be understood that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and therefore should not be regarded as limiting the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technical personnel in this field without making creative work are within the scope of protection of the present invention.
[0024] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "disposed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.
[0025] The professional terms and explanations involved in the embodiments of this application are as follows: Equipment: The physical device that connects to the optical cable; Optical splitter equipment: equipment belonging to the optical splitter box; Optical cross-connection equipment: equipment belonging to the optical cross-connection box; ODF device: a device belonging to ODF; Computer room: a site containing multiple devices; Optical splitter room: a room containing optical splitter equipment; Optical exchange room; a room containing optical exchange equipment; ODF room: a room containing ODF equipment; Distribution optical cable: optical cable connecting optical splitter devices or optical splitter devices to optical cross-connection devices; Trunk optical cable: optical cable connecting optical cross-connection equipment or optical cross-connection equipment and ODF equipment; Communication optical cable: optical cable used to connect optical exchange equipment; Office optical cable: an optical cable used to connect ODF devices to each other; Relay optical cable: An optical cable used to connect ODF devices to each other.
[0026] Embodiment 1: This embodiment proposes a network physical security assessment method based on network structure and service application classification, which specifically includes the following steps: Step S1: Taking the starting computer room and the ending computer room as starting points respectively, searching for the first route and the second route.
[0027] The step S1 specifically includes the following steps: Step S11: starting from the starting machine room, searching for the intermediate machine room connected to the distribution optical cable within three sections; starting from the intermediate machine room, searching for the ODF machine room connected to the trunk optical cable or the contact optical cable within two sections; starting from the ODF machine room, searching for the ODF machine room connected to the office optical cable or the relay optical cable within one section; merging to obtain the first route; Step S12: starting from the terminating machine room, search for the intermediate machine room connected to the distribution optical cable within three sections; starting from the intermediate machine room, search for the ODF machine room connected to the trunk optical cable or the communication optical cable within two sections; starting from the ODF machine room, search for the ODF machine room connected to the office optical cable or the relay optical cable within one section; merge to obtain the second route.
[0028] Step S2: retrieve the first route to obtain the third route and the fourth route; retrieve the second route to obtain the fifth route and the sixth route; the third route is the route including the termination computer room in the first route; the fourth route is the route not including the termination computer room in the first route; the fifth route is the route including the starting computer room in the second route; the sixth route is the route not including the starting computer room in the second route.
[0029] Furthermore, the step S2 specifically includes the following steps: Step S21: retrieve the first route to obtain the third route and the fourth route, and add the third route to the result set; Step S22: Retrieve the second route to obtain the fifth route and the sixth route, and add the fifth route to the result set.
[0030] Step S3: Clip the fourth route and the sixth route, and splice the clipped fourth route and the clipped sixth route in opposite directions. If the splicing is successful, the spliced route is added to the result set; if the splicing fails, the computer rooms at the ends of the routes at both ends are used as input parameters, the shortest path is searched and clipped, and the search results are obtained by filtering according to the set constraints.
[0031] The step S3 specifically comprises the following steps: Step S31: obtaining the fourth route and the sixth route after cutting according to the set constraint conditions; Step S32: splicing the pruned fourth route and the pruned sixth route in opposite directions. If the splicing is successful, the spliced route is added to the result set; if the splicing fails, the ODF computer rooms at the end of the route at both ends are used as input parameters to search for the shortest path; the shortest path is a path that must be connected between computer rooms by a relay optical cable; Step S33: clipping the shortest path, splicing the clipped shortest path with the starting end in phase and then splicing it with the terminating end in opposite directions to obtain a spliced route; Step S34: cutting and splicing routes according to set constraints to obtain search results.
[0032] Furthermore, the set constraints are: primary grouping according to the starting fiber core bundle, secondary grouping according to the ending fiber core bundle, tertiary grouping according to the length, and selecting a route from the primary grouping, the secondary grouping, and the tertiary grouping respectively.
[0033] Step S4: According to the set security level, filter again from the search results to obtain the final evaluation result.
[0034] Furthermore, the step S4 specifically includes the following steps: Step S41: remove duplicates and sort the search results; Step S42: Determine the security level of the sorted search results. If the security level is none, do not filter and directly feed back the sorted results as the final search results to the result set. If the security level is cable splitting, compare multiple sorted search results two by two, use a multi-threaded search to obtain the final search results and feed back to the result set. If the security level is pipeline splitting, calculate the first and last segments of the optical cable pipelines in the route of the sorted search results, use a multi-threaded search to obtain the final search results and feed back to the result set.
[0035] Working principle: This embodiment first takes the starting computer room and the ending computer room as the starting point, respectively, to search for the first route and the second route; secondly, retrieves the first route to obtain the third route and the fourth route; retrieves the second route to obtain the fifth route and the sixth route; then clips the fourth route and the sixth route, and splices the clipped fourth route and the clipped sixth route in opposite directions. If the splicing is successful, the spliced route is added to the result set; if the splicing fails, the computer rooms at the ends of the routes at both ends are used as input parameters, the shortest path is searched and clipped, and the search results are obtained by filtering according to the set constraints; finally, according to the set security level, the search results are filtered again to obtain the final evaluation result; the query efficiency is greatly improved, the database resource consumption is reduced, and the overall performance, stability and scalability of the system are improved.
[0036] Embodiment 2: This embodiment is based on the above embodiment 1. Figure 1As shown, a detailed description is given by taking the optical branch room as the starting room and the optical exchange room as the terminating room as an example.
[0037] This embodiment implements security assessment of the physical pipe layer and circuit domain by building a risk sharing link group based on network structure and business application classification. A risk sharing link group is defined as a set of links that provide the same capabilities or meet the requirements of specific business scenarios. Its design ensures that when any resource fails, no more than half of the members in the group will be blocked, thereby ensuring the continued effectiveness of business capabilities.
[0038] Currently, most security assessment methods are mainly based on dual-link systems, and there is still a lack of effective assessment methods for complex scenarios involving more than two links. The network physical security assessment method of this embodiment solves the following technical problems: 1. Propose differentiated physical security requirements for different network structures; 2. Comprehensively consider the physical security of business circuits, including pipeline physical security and logical resource physical security factors; 3. Define the scope of physical security control based on different business scenarios; 4. Design different security assessment algorithms for different security levels.
[0039] The core of this embodiment is to use graph database technology to perform path search in the computer room to determine the security level. Through synchronous search in the dual-end computer room, a splicable path is found according to preset rules to build a compliant network route. Since there are multiple route search results in the dual-end computer room in the network topology, a personalized security assessment algorithm is implemented by comparing the search results two by two. Compared with the limitations of the Neo4j graph database, especially the performance limitation when the number of computer room hops exceeds 5, this embodiment uses new technology to greatly improve query efficiency from minutes to seconds. At the same time, the technical architecture is optimized, and computing-intensive tasks are transferred to the application service layer, thereby reducing database resource consumption and improving the overall performance, stability and scalability of the system.
[0040] The algorithm of this embodiment is modeled based on the network physical model. In the graph database, the computer room is used as a node in the graph database, and the fiber core bundle is used as a relationship in the graph database. The attributes of the computer room include the area ID (areaId), the creation date (createdDate), the unique identifier (id), the computer room name (name), the equipment type list (nodeTypeIds) included in the computer room, the computer room site (parentLocationId) and the version number (version). The attributes of the optical cable include the starting computer room ID (aLocationId), the starting equipment name (anodename), the starting equipment type (aNodeTypeId), the sending and receiving rules (assocRule), and the fiber core bundle ID (circuitId). d) Contains the conduit section information list (conduits), creation date (createdDate), whether it is an exit site (crossLocation), whether dual-fiber is available (doubleStatus), fiber mode (fiberMode), cable status (flag), fiber core bundle length (length), cable ID (networkId), cable name (networkName), cable type (networkSubtype), whether dual-fiber is available (singleStatus), version number (version), termination room ID (zLocationId), termination device name (znodename) and termination device type (zNodeTypeId).
[0041] Algorithm input parameters: The main input parameters include the starting computer room, the ending computer room, the security level, the maximum number of segments, etc. Input parameters that are not necessary for the search but play a role in constraining the search, including the list of computer rooms, the list of excluded computer rooms, the list of included optical cables, the list of excluded optical cables, whether the route search is in the same area, whether dual fibers are available, and the algorithm mode; Preset rule: The search method of the starting and ending computer rooms is the same. This embodiment takes the starting computer room as an example, assumes the starting computer room to be an optical branch computer room, and searches for the route from the optical branch computer room to the ODF computer room.
[0042] Step S1: First, starting from the optical branch room, find the optical cross-connection room connected by distribution optical cables within 3 sections (including 3 sections). Second, starting from the optical cross-connection room, find the ODF room connected by trunk optical cables or contact optical cables within 2 sections (including 2 sections). According to the definition, within 2 sections, the last section must be the trunk optical cable. Third, starting from the ODF room, find the ODF room connected by local optical cables or relay optical cables within 1 section (including 1 section). At this point, the search for the starting room is completed; the search method of the starting and ending rooms is the same, and the ending room obtains the qualified route in the same search method; Step S2: Search the obtained routes to find the route that contains the other end computer room and add it to the result set in advance.
[0043] Step S3: Prune the routes except those in step S2. The pruning logic can be summarized as “selecting representatives”, that is, performing the first-level grouping by the starting fiber core bundle, the second-level grouping by the ending fiber core bundle, and the third-level grouping by the length. One route is taken from each group. The purpose of pruning is to help reduce the number of result sets, thereby reducing the amount of calculation when comparing security levels pairwise.
[0044] After cutting, the route from the starting room and the route from the ending room will be spliced in the opposite direction. If the splicing is successful, it will be directly added to the result set. If the splicing is not successful, the ODF room at the end of the route will be used as the input parameter to search for the shortest path. The rule for the shortest path search is that the rooms must be connected by relay optical cables. The searched routes need to be cut again. The cutting logic is as described above. After cutting, they are spliced again. The splicing order is to splice in the same direction as the starting end, and then splice in the opposite direction to the ending end. Cut again, and obtain the matching routes after screening according to the maximum number of segments and other constraint input parameters.
[0045] Step S4: After the above splicing, multiple search results that meet the conditions will be obtained and the results will be deduplicated and sorted.
[0046] The next round of screening of the results is screening that meets the security level. The security levels are divided into none, split cables, split pipes, and outbound split pipes. None is a normal search, and no screening is required; split cables are a comparison of multiple search results that meet the conditions, and the cables in the two routes are different cables; split pipes are based on split cables, and the pipes in the two routes are different; outbound split pipes allow the first and last cables in the route to be the same, and split pipes are calculated; due to the pairwise comparison, it is inevitable that intensive calculation tasks of Cartesian products will be generated. Because the algorithm uses multi-threaded search in the search process, 4 threads will be used in the algorithm, and the same For example, thread 1 will take the first route of the 100 routes in this set and compare it with the remaining 99 routes in pairs, thread 2 will take the second route of the 100 routes in this set and compare it with the remaining 98 routes in pairs, thread 3 will take the third route of the 100 routes in this set and compare it with the remaining 97 routes in pairs, and so on. The results are fed back to the result set in time. When the result set reaches the number required by the user, it will return immediately and end the redundant calculation tasks, so it can greatly reduce the search time and improve the search efficiency.
[0047] This embodiment provides a complete network physical security assessment system for communication operators, which can standardize physical security assessment algorithms under different network structures, business scenarios and security levels, and realize fast and accurate network physical security assessment; through comprehensive modeling of key network elements such as network nodes, boards, ports, physical optical paths, pipelines, etc., this embodiment can apply judgment rules at multiple levels, thereby achieving the goal of completing network physical security assessment efficiently and accurately.
[0048] This embodiment proposes differentiated physical security requirements for different network structures, so that the security assessment is more in line with the actual network situation; the physical security of the business circuit is comprehensively considered, not only the physical security of the pipeline is considered, but also the physical security elements of the logical resources are covered, thereby providing a more comprehensive security assessment; according to different business scenarios, this embodiment can define the scope of physical security control, so that the security strategy is more targeted and practical; for different security levels, the present invention designs different security assessment algorithms to improve the accuracy and flexibility of the assessment; greatly improves the query efficiency, from minutes to seconds, and significantly improves the assessment speed; optimizes the technical architecture, transfers computing-intensive tasks to the application service layer, reduces database resource consumption, and improves the overall performance, stability and scalability of the system; provides operators with a complete network physical security assessment system, which can standardize the physical security assessment algorithms under different network structures, business scenarios and security levels. Through the comprehensive modeling of key network elements such as network nodes, boards, ports, physical optical paths, and pipelines, the present invention can apply judgment rules at multiple levels, thereby achieving efficient and accurate network physical security assessment. The network physical security assessment method of this embodiment not only solves the difficulties in the prior art, but also brings significant beneficial effects and provides a new solution for network physical security assessment.
[0049] First, this embodiment proposes for the first time the concept of a risk-sharing link group, which is a set of links that provide the same capabilities or meet the needs of specific business scenarios. Its design ensures that when a resource fails at any point, no more than half of the members in the group will be blocked, thereby ensuring the continued effectiveness of business capabilities. Differentiated physical security requirements: For different network structures, the present invention proposes differentiated physical security requirements to make security assessments more in line with actual network conditions. Comprehensive consideration of the physical security of business circuits: The present invention not only considers the physical security of pipelines, but also covers the physical security elements of logical resources, thereby providing a more comprehensive security assessment.
[0050] Secondly, the technical advantages of this embodiment are: Efficient query performance: Compared with traditional graph database technology, the present invention adopts new technology to greatly improve query efficiency, from minutes to seconds. Optimized technical architecture: By transferring computationally intensive tasks to the application service layer, the present invention reduces database resource consumption and improves the overall performance, stability and scalability of the system. Personalized security assessment algorithm: This embodiment implements a personalized security assessment algorithm by comparing search results pairwise, thereby improving the accuracy and flexibility of the assessment.
[0051] Again, the improvements of this embodiment are: Expanded evaluation scope: This embodiment not only considers dual-link systems, but also effectively evaluates complex scenarios involving more than two links. Improved evaluation efficiency: By adopting new technologies and optimizing technical architecture, this embodiment significantly improves evaluation speed and reduces resource consumption. Increased evaluation dimensions: This embodiment comprehensively considers the physical security of business circuits, covering pipeline physical security and logical resource physical security elements, and provides a more comprehensive security assessment.
[0052] Finally, compared with other security assessment methods that are mainly based on dual-link systems, this embodiment has the following significant differences and advantages: Wider applicability: This embodiment is not only applicable to dual-link systems, but can also effectively evaluate complex scenarios involving more than two links. Higher assessment efficiency: By adopting new technologies and optimizing technical architecture, this embodiment significantly improves the assessment speed, reduces resource consumption, and makes the assessment more efficient. More comprehensive assessment dimensions: This embodiment comprehensively considers the physical security of the business circuit, covering the physical security elements of the pipeline and the physical security elements of logical resources, and provides a more comprehensive security assessment, making the assessment results more accurate and reliable.
[0053] The other parts of this embodiment are the same as those of the above-mentioned embodiment 1, and thus will not be described in detail.
[0054] Embodiment 3: Based on any one of the above-mentioned embodiments 1-2, this embodiment proposes a network physical security assessment system based on network structure and business application classification, which is used to execute the above-mentioned network physical security assessment method based on network structure and business application classification; it includes a search unit, a retrieval unit, a clipping unit, and an assessment unit; The search unit is used to search for the first route and the second route using the starting computer room and the ending computer room as starting points respectively; The retrieval unit is used to retrieve the first route to obtain the third route and the fourth route; retrieve the second route to obtain the fifth route and the sixth route; the third route is the route including the termination room in the first route; the fourth route is the route not including the termination room in the first route; the fifth route is the route including the starting room in the second route; the sixth route is the route not including the starting room in the second route; The clipping unit is used to clip the fourth route and the sixth route, splice the clipped fourth route and the clipped sixth route in opposite directions, and if the splicing is successful, add the spliced route to the result set; if the splicing fails, use the computer rooms at the ends of the routes at both ends as input parameters, search for the shortest path and clip it, and filter the search results according to the set constraint conditions; The evaluation unit is used to screen the search results again according to the set security level to obtain a final evaluation result.
[0055] This embodiment also proposes an electronic device, including a memory and a processor; a computer program is stored on the processor; when the computer program is executed on the processor, the above-mentioned network physical security assessment method based on network structure and business application classification is implemented.
[0056] This embodiment also proposes a computer-readable storage medium, on which computer instructions are stored; when the computer instructions are executed on the above-mentioned electronic device, the above-mentioned network physical security assessment method based on network structure and business application classification is implemented.
[0057] The other parts of this embodiment are the same as any one of the above-mentioned embodiments 1-2, so they will not be repeated here.
[0058] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.
Claims
1. A network physical security assessment method based on network structure and business application classification, characterized in that: The specific steps include: Step S1: Taking the starting computer room and the ending computer room as starting points, respectively, searching for the first route and the second route; Step S2: retrieve the first route to obtain the third route and the fourth route; retrieve the second route to obtain the fifth route and the sixth route; the third route is the route in the first route that includes the termination room; The fourth route is a route that does not include the terminating machine room in the first route; the fifth route is a route that includes the starting machine room in the second route; the sixth route is a route that does not include the starting machine room in the second route; Step S3: Clip the fourth route and the sixth route, and splice the clipped fourth route and the clipped sixth route in opposite directions. If the splicing is successful, the spliced route is added to the result set; if the splicing fails, the route terminal rooms at both ends are used as input parameters, the shortest path is searched and clipped, and the search results are obtained by filtering according to the set constraints; Step S4: According to the set security level, filter again from the search results to obtain the final evaluation result.
2. A network physical security assessment method based on network structure and business application classification according to claim 1, characterized in that: The step S1 specifically includes the following steps: Step S11: starting from the starting machine room, searching for the intermediate machine room connected to the distribution optical cable within three sections; starting from the intermediate machine room, searching for the ODF machine room connected to the trunk optical cable or the contact optical cable within two sections; starting from the ODF machine room, searching for the ODF machine room connected to the office optical cable or the relay optical cable within one section; merging to obtain the first route; Step S12: starting from the terminating machine room, search for the intermediate machine room connected to the distribution optical cable within three sections; starting from the intermediate machine room, search for the ODF machine room connected to the trunk optical cable or the communication optical cable within two sections; starting from the ODF machine room, search for the ODF machine room connected to the office optical cable or the relay optical cable within one section; merge to obtain the second route.
3. A network physical security assessment method based on network structure and business application classification according to claim 1, characterized in that: The step S2 specifically includes the following steps: Step S21: retrieve the first route to obtain the third route and the fourth route, and add the third route to the result set; Step S22: Retrieve the second route to obtain the fifth route and the sixth route, and add the fifth route to the result set.
4. A network physical security assessment method based on network structure and business application classification according to claim 1, characterized in that: The step S3 specifically comprises the following steps: Step S31: obtaining the fourth route and the sixth route after cutting according to the set constraint conditions; Step S32: splicing the pruned fourth route and the pruned sixth route in opposite directions. If the splicing is successful, the spliced route is added to the result set; if the splicing fails, the machine rooms at the ends of the routes at both ends are used as input parameters to search for the shortest path; the shortest path is a path between the machine rooms connected by a relay optical cable; Step S33: clipping the shortest path, splicing the clipped shortest path with the starting end in phase and then splicing it with the terminating end in opposite directions to obtain a spliced route; Step S34: cutting and splicing routes according to set constraints to obtain search results.
5. A network physical security assessment method based on network structure and business application classification according to claim 4, characterized in that: The set constraints are: primary grouping according to the starting fiber core bundle, secondary grouping according to the ending fiber core bundle, tertiary grouping according to the length, and selecting a route from the primary grouping, the secondary grouping, and the tertiary grouping respectively.
6. A network physical security assessment method based on network structure and business application classification according to claim 1, characterized in that: The step S4 specifically comprises the following steps: Step S41: remove duplicates and sort the search results; Step S42: Determine the security level of the sorted search results. If the security level is none, do not filter and directly feed back the sorted results as the final search results to the result set. If the security level is cable splitting, compare multiple sorted search results two by two, use a multi-threaded search to obtain the final search results and feed back to the result set. If the security level is pipeline splitting, calculate the first and last segments of the optical cable pipelines in the route of the sorted search results, use a multi-threaded search to obtain the final search results and feed back to the result set.
7. A network physical security assessment system based on network structure and business application classification, used to execute the network physical security assessment method based on network structure and business application classification as claimed in claim 1; characterized in that: It includes a search unit, a retrieval unit, a cutting unit, and an evaluation unit; The search unit is used to search for the first route and the second route using the starting computer room and the ending computer room as starting points respectively; The retrieval unit is used to retrieve the first route to obtain the third route and the fourth route; retrieve the second route to obtain the fifth route and the sixth route; the third route is the route in the first route that includes the termination room; The fourth route is a route that does not include the terminating machine room in the first route; the fifth route is a route that includes the starting machine room in the second route; the sixth route is a route that does not include the starting machine room in the second route; The clipping unit is used to clip the fourth route and the sixth route, splice the clipped fourth route and the clipped sixth route in opposite directions, and if the splicing is successful, add the spliced route to the result set; if the splicing fails, use the computer rooms at the ends of the routes at both ends as input parameters, search for the shortest path and clip it, and filter the search results according to the set constraints; The evaluation unit is used to screen the search results again according to the set security level to obtain a final evaluation result.
8. An electronic device, characterized in that: It comprises a memory and a processor; a computer program is stored on the processor; when the computer program is executed on the processor, the network physical security assessment method based on network structure and business application classification as described in any one of claims 1-6 is implemented.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device as described in claim 8, the network physical security assessment method based on network structure and business application classification as described in any one of claims 1-6 is implemented.