Security protection method based on gateway side, computer equipment

Abstract

The embodiments of the present application relate to the field of security protection, and specifically to a gateway-based security protection method and computer equipment. A specific implementation of the method includes: collecting device traffic information sets corresponding to each gateway-side device; obtaining user information of a target user terminal; inputting the device traffic information set into a pre-trained security layering model to obtain a traffic layering information group set; encrypting the traffic layering information group set to generate a traffic encryption information group set; in response to determining that the user identity information and the user request information meet a preset user request condition, determining each traffic encryption information corresponding to the user request information in the traffic encryption information group set as a target traffic encryption information set; determining the user information and the target traffic encryption information set as target user traffic information; and sending the target user traffic information to the target user terminal. This implementation can improve the security of device traffic information.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of security protection, and specifically to a gateway-based security protection method and computer equipment. Background Art

[0002] In order to make the domestically produced self-controlled platform more secure and stable, we need to introduce a security system for security protection. At present, when performing security protection, the usual method is to select device traffic information that meets user needs from the device traffic information set through a binary classification model, then encrypt the device traffic information using a symmetric encryption algorithm, and finally send the encrypted device traffic information to the user terminal.

[0003] However, in practice, it is found that when the above methods are used for security protection, the following technical problems often occur:

[0004] Since the binary classification model only considers whether the device traffic information meets user needs, but does not subdivide the device traffic information, the device traffic information identified by the binary classification model includes more information that does not meet user needs. When the device traffic information is sent to the user terminal, it will lead to a waste of transmission resources. The symmetric encryption algorithm has a fast encryption speed and is easy to implement, but the encrypted files are easy to decipher and have low security. Summary of the invention

[0005] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0006] Some embodiments of the present application propose a gateway-side security protection method and computer equipment to solve one or more of the technical problems mentioned in the above background technology section.

[0007] In the first aspect, some embodiments of the present application provide a gateway-side security protection method, the method comprising: collecting a device traffic information set corresponding to each gateway-side device; obtaining user information of a target user terminal, wherein the user information comprises: user identity information and user request information; inputting the device traffic information set into a pre-trained security layering model to obtain a traffic layering information group set; encrypting the traffic layering information group set to generate a traffic encryption information group set, and storing the traffic encryption information group set in a database; in response to determining that the user identity information and the user request information meet a preset user request condition, determining each traffic encryption information corresponding to the user request information in the traffic encryption information group set as a target traffic encryption information set; determining the user information and the target traffic encryption information set as target user traffic information; sending the target user traffic information to the target user terminal, and storing the target user traffic information in a database.

[0008] In a second aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method described in any implementation of the first aspect is implemented.

[0009] In a third aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0010] The above-mentioned embodiments of the present application have the following beneficial effects: through the gateway-side security protection method of some embodiments of the present application, the security of device flow information can be improved. Specifically, the reason for the low security of device flow information is that: because the binary classification model only considers whether the device flow information meets the user's needs, but does not subdivide the device flow information, the device flow information identified by the binary classification model includes more information that does not meet the user's needs. When the device flow information is sent to the user terminal, it will lead to a waste of transmission resources, and the symmetric encryption algorithm has a fast encryption speed and is easy to implement, but the encrypted file is easy to be deciphered, and the security is low. Based on this, the gateway-side security protection method of some embodiments of the present application first collects the device flow information set corresponding to each gateway-side device. Thus, the device flow information set can be collected so that the device flow information set can be encrypted later. Secondly, the user information of the target user terminal is obtained, wherein the above-mentioned user information includes: user identity information and user request information. Thus, the user information can be obtained so that the encrypted device flow information can be sent to the user terminal according to the user information later. Then, the above-mentioned device flow information set is input into the pre-trained security layered model to obtain the flow layered information group set. Thus, the flow information set can be layered according to the security layering model, so that the flow layering information that is more in line with the user's needs can be sent to the user terminal later, thereby reducing the waste of transmission resources. Then, the above-mentioned flow layering information set is encrypted to generate a flow encryption information set, and the above-mentioned flow encryption information set is stored in a database. Thus, the flow layering information set can be encrypted by two encryption methods, hardware encryption and software encryption, to ensure the security of the flow layering information set during transmission. Then, in response to determining that the above-mentioned user identity information and the above-mentioned user request information meet the preset user request conditions, each flow encryption information corresponding to the above-mentioned user request information in the above-mentioned flow encryption information set is determined as a target flow encryption information set. Thus, a target flow encryption information set that meets the user's needs can be selected from the encrypted flow encryption information set. Afterwards, the above-mentioned user information and the above-mentioned target flow encryption information set are determined as target user flow information. Finally, the above-mentioned target user flow information is sent to the above-mentioned target user terminal, and the above-mentioned target user flow information is stored in a database. Thus, the encrypted target user flow information that meets the user's needs can be sent to the user terminal. Therefore, both hardware encryption and software encryption are considered, which improves the security of device traffic information compared to symmetric encryption algorithms. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0012] Figure 1 It is a flowchart of some embodiments of the gateway-based security protection method according to the present application;

[0013] Figure 2 is a schematic diagram of a computer device suitable for implementing some embodiments of the present application;

[0014] Figure 3 It is a schematic diagram of an application scenario of the gateway-side security protection method according to the present application. DETAILED DESCRIPTION

[0015] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0016] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0017] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0018] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0019] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0020] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0021] Figure 1The process 100 of some embodiments of the gateway-side security protection method according to the present application is shown. The gateway-side security protection method includes the following steps:

[0022] Step 101: Collect device flow information sets corresponding to each gateway-side device.

[0023] In some embodiments, the execution entity of the gateway-side security protection method may collect device flow information sets corresponding to each gateway-side device.

[0024] In practice, the above execution entity can collect the device flow information set corresponding to each gateway side device through the following steps:

[0025] The first step is to collect the initial device flow information of each gateway-side device to obtain an initial device flow information set. In practice, the above-mentioned execution entity can collect the initial device flow information of each gateway-side device from the storage terminal to obtain an initial device flow information set. Among them, the initial device flow information in the initial device flow information set may include but is not limited to at least one of the following: device information, device user information. Among them, the device information may include but is not limited to at least one of the following: device identification, device size. The device identification can uniquely identify a gateway-side device (for example, power equipment, gateway equipment, etc.). The device size can characterize the length, width and height of the gateway-side device. The device user information may include but is not limited to at least one device user identification. The device user identification can uniquely identify a user terminal using the gateway-side device.

[0026] The second step is to obtain the device association information of each gateway side device.

[0027] In practice, the execution subject may obtain the device association information of each gateway-side device from the terminal device through a wired connection or a wireless connection, wherein the device association information may represent the association relationship between each gateway-side device.

[0028] It should be noted that the above wireless connection methods may include but are not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0029] The third step is to preprocess each initial device flow information in the initial device flow information set to generate device flow preprocessing information and obtain a device flow preprocessing information set. In practice, the execution subject may preprocess each initial device flow information in the initial device flow information set by a preprocessing algorithm to generate device flow preprocessing information and obtain a device flow preprocessing information set. For example, the preprocessing algorithm may be: deleting information representing empty space from the initial device flow information.

[0030] In the fourth step, for each piece of device flow preprocessing information in the device flow preprocessing information set, the device flow preprocessing information and the device association information are determined as device flow information.

[0031] In the fifth step, the determined device flow information is determined as a device flow information set, wherein the device flow information in the device flow information set may include but is not limited to at least one of the following: device information, device user information, and device association information.

[0032] Step 102: Acquire user information of the target user terminal.

[0033] In some embodiments, the execution subject may obtain user information of the target user terminal. The user information may include but is not limited to: user identity information and user request information. The target user terminal may be a user terminal that wants to obtain device traffic information of a gateway-side device. The user identity information may include but is not limited to: a user identity identifier. The user identity identifier may uniquely identify a user terminal. The user request information may represent the device traffic information of a specified gateway-side device that the target user terminal wants to obtain.

[0034] Step 103, input the device traffic information set into a pre-trained security layering model to obtain a traffic layering information group set.

[0035] In some embodiments, the execution subject may input the device traffic information set into a pre-trained security layering model to obtain a traffic layering information set. The pre-trained security layering model may be a pre-trained neural network model that takes the device traffic information set as input and the traffic layering information set as output.

[0036] Optionally, before inputting the device traffic information set into a pre-trained security layering model to obtain a traffic layering information set, the method further includes:

[0037] The first step is to obtain the training sample set.

[0038] In practice, the execution subject may obtain the training sample set from the terminal device through a wired connection or a wireless connection. The training samples in the training sample set include: a sample device flow information set and a sample flow layer information group set.

[0039] The second step is to determine the initial security layering model.

[0040] In practice, the above-mentioned execution subject may determine an initial security hierarchical model. The initial security hierarchical model may be a neural network model that takes a sample device traffic information set as input and a sample traffic hierarchical information set as output. Here, the initial security hierarchical model may include: an initial fusion model, an initial special score model, an initial classification model, and an initial anomaly score model.

[0041] Here, the initial fusion model may be a model that takes the sample device traffic information set as input and takes the initial traffic fusion matrix information as output. The initial traffic fusion matrix information may represent a matrix. For example, the initial fusion model may be a matrix generation model. For example, the initial fusion model may be used to: use each sample device traffic information in the sample device traffic information set as a row of a matrix represented by the initial traffic fusion matrix information, and use each information included in the sample device traffic information as a column of a matrix represented by the initial traffic fusion matrix information.

[0042] The initial special score model may be a model that takes the initial traffic fusion row information as input and takes the initial special score value as output. For example, the initial special score model may be an Experts Grading Method model.

[0043] The initial classification model may be a neural network model that takes the initial special score value group and the initial traffic fusion row information group as input and takes the initial traffic partition sub-information group set as output. For example, the initial classification model may be, but is not limited to: a decision tree model, a support vector machine model, a random forest model, and a naive Bayes model.

[0044] The initial anomaly score model may be a model that takes each initial special score value corresponding to the initial traffic partition sub-information group as input and takes the initial anomaly score value as output. For example, the initial anomaly score model may be, but is not limited to: a binomial test model, a chi-square test model.

[0045] The third step is to select target training samples from the above training sample set.

[0046] In some embodiments, the execution entity may select a target training sample from the training sample set. In practice, the execution entity may randomly select a training sample from the training sample set as the target training sample.

[0047] In the fourth step, the sample device flow information set included in the selected target training sample is input into the initial fusion model to obtain the initial flow fusion matrix information.

[0048] In some embodiments, the execution subject may input the sample device flow information set included in the selected target training sample into the initial fusion model to obtain initial flow fusion matrix information. The initial flow fusion matrix information includes: an initial flow fusion row information group.

[0049] In the fifth step, each initial traffic fusion row information in the initial traffic fusion row information group is input into the initial special score model to generate an initial special score value, thereby obtaining an initial special score value group.

[0050] In practice, the above-mentioned execution entity may input each initial traffic fusion row information in the initial traffic fusion row information group into the initial special score model to generate an initial special score value and obtain an initial special score value group.

[0051] In the sixth step, the initial special score value group and the initial traffic fusion row information group are input into the initial classification model to obtain the initial traffic partition sub-information group set.

[0052] In practice, the above-mentioned execution entity may input the initial special score value group and the initial traffic fusion row information group into the initial classification model to obtain the initial traffic division sub-information group set.

[0053] In the seventh step, for each initial traffic partition sub-information group in the initial traffic partition sub-information group set, each initial special score value corresponding to the initial traffic partition sub-information group is input into the initial anomaly score model to generate an initial anomaly score value.

[0054] In practice, for each initial traffic partition sub-information group in the initial traffic partition sub-information group set, the execution entity may input each initial special score value corresponding to the initial traffic partition sub-information group into the initial anomaly score model to generate an initial anomaly score value.

[0055] In the eighth step, the generated initial anomaly score values ​​are determined as an initial anomaly score value set.

[0056] In practice, the above execution entity may determine the generated initial anomaly score values ​​as an initial anomaly score value set.

[0057] In the ninth step, for each initial traffic division sub-information in the initial traffic division sub-information group set, the initial abnormality score value corresponding to the initial traffic division sub-information in the initial abnormality score value set and the initial traffic division sub-information are determined as initial traffic stratification information.

[0058] In practice, for each initial traffic partition sub-information in the initial traffic partition sub-information group set, the execution entity may determine the initial abnormality score value corresponding to the initial traffic partition sub-information in the initial abnormality score value set and the initial traffic partition sub-information as the initial traffic stratification information.

[0059] In the tenth step, each of the obtained initial traffic stratification information is determined as an initial traffic stratification information set.

[0060] In some embodiments, the execution entity may determine the obtained individual initial traffic stratification information as an initial traffic stratification information group set.

[0061] In the eleventh step, based on a preset loss function, a difference value between the initial flow stratification information set and the sample flow stratification information set included in the target training sample is determined.

[0062] In practice, the above-mentioned execution subject can determine the difference value between the initial flow stratification information set and the sample flow stratification information set included in the target training sample based on a preset loss function. The preset loss function can be, but is not limited to: mean square error loss function (MSE), hinge loss function, cross entropy loss function (CrossEntropy), 0-1 loss function, absolute value loss function, log loss function, square loss function, exponential loss function, etc.

[0063] In step 12, in response to determining that the difference value is greater than or equal to a preset difference value, adjusting parameters of the initial security hierarchical model.

[0064] In some embodiments, the execution subject may adjust the parameters of the initial security hierarchical model in response to determining that the difference value is greater than or equal to the preset difference value. For example, the difference value and the preset difference value may be calculated. On this basis, the parameters of the initial malicious code attack chain identification model are adjusted using methods such as back propagation and gradient descent. There is no limitation on the setting of the preset difference value, for example, the preset difference value may be 0.1.

[0065] Optionally, in response to determining that the difference value is less than a preset difference value, the initial security layered model is determined as the security layered model.

[0066] In some embodiments, the execution entity may determine the initial security layered model as the security layered model in response to determining that the difference value is less than a preset difference value.

[0067] Thus, firstly, the sample device flow information set can be converted into the initial flow fusion matrix information of the characterization matrix through the initial fusion model. Secondly, the initial special score value of each row in the matrix can be obtained through the initial special score model, so as to be classified according to the initial special score value later. Then, the initial flow fusion row information group can be classified according to the initial special score value group through the initial classification model. After that, the initial abnormal score value of each category after classification can be obtained through the initial abnormal score model. Then, the parameters of the initial security stratification model can be continuously adjusted based on the initial flow stratification information group set including the initial abnormal score value and the sample flow stratification information group set through the preset loss function, so as to obtain more accurate classification information. Therefore, a more accurate security stratification model can be obtained by training the initial security stratification model including the initial fusion model, the initial special score model, the initial classification model, and the initial abnormal score model, so that a more accurate classified flow stratification information group set can be obtained through the more accurate security stratification model. Thus, information that is more in line with user needs can be screened out from the more accurately classified flow stratification information group set, so that information that is more in line with user needs can be sent to the user terminal, which can reduce the waste of transmission resources.

[0068] Step 104: encrypt the traffic layering information set to generate a traffic encryption information set, and store the traffic encryption information set in a database.

[0069] In some embodiments, the execution entity may encrypt the traffic layering information set to generate a traffic encryption information set, and store the traffic encryption information set in a database.

[0070] In practice, the execution subject may encrypt the traffic layering information set through the following steps to generate a traffic encryption information set:

[0071] In the first step, the encryption chip is scheduled to perform hardware encryption processing on the above-mentioned traffic layer information set to generate a traffic hardware encryption information set. The encryption chip can be an encryption chip that encrypts the traffic layer information set. For example, the encryption chip can be an EQD CC120 series password card.

[0072] In the second step, each flow hardware encryption information in the above-mentioned flow hardware encryption information set is securely encrypted to generate flow encryption information and obtain a flow encryption information set.

[0073] Therefore, the traffic layering information set can be encrypted by hardware encryption and software encryption, thereby improving the security of the traffic layering information set during transmission.

[0074] In practice, the execution subject may perform secure encryption processing on each flow hardware encryption information in the flow hardware encryption information group set through the following steps to generate flow encryption information:

[0075] The first step is to determine the first key based on the traffic hardware encryption information. In practice, the execution subject may randomly determine the first key of a preset key length. For example, the preset key length may be 16.

[0076] The second step is to divide the traffic hardware encryption information to generate a traffic block information sequence. In practice, the execution subject can divide the traffic hardware encryption information by a preset division algorithm to generate a traffic block information sequence. For example, the preset division algorithm can be: divide the traffic hardware encryption information according to a preset division length. For example, the preset division length can be 16.

[0077] In the third step, based on the first key, each traffic block information in the traffic block information sequence is first encrypted to generate traffic block encrypted information and obtain a traffic block encrypted information sequence. In practice, the execution subject can perform a first encryption process on each traffic block information in the traffic block information sequence based on the first key through a first preset encryption algorithm to generate traffic block encrypted information and obtain a traffic block encrypted information sequence. For example, the first preset encryption algorithm can be an AES (Advanced Encryption Standard) algorithm.

[0078] The fourth step is to splice the individual traffic block encryption information in the above traffic block encryption information sequence to generate the first traffic encryption information. In practice, the above execution entity can splice the individual traffic block encryption information in the above traffic block encryption information sequence in order from left to right to generate the first traffic encryption information.

[0079] The fifth step is to perform a second encryption process on the first key to generate a first encryption key, a first encryption public key and a first encryption private key, and store the first encryption key, the first encryption public key and the first encryption private key in a database.

[0080] Step 6: Generate second encrypted information based on a preset encryption curve. The second encrypted information may include: a second public key, a second private key, and a hash value. The preset encryption curve may be an elliptic curve (e.g., a prime field 256-bit elliptic curve). In practice, the execution subject may generate the second encrypted information through the following sub-steps:

[0081] In the first sub-step, two points that meet a preset selection condition are randomly selected from a preset encryption curve as a second public key and a second private key. The preset selection condition may be: the second public key is equal to the product of a preset base point and the second private key. Here, the preset base point may be a base point of a preset encryption curve.

[0082] The second sub-step is to perform a hash transformation on the second public key, the second private key and the parameters in the preset encryption curve based on a preset hash algorithm to generate a hash value. For example, the preset hash algorithm may be an SM3 (domestic hash) algorithm.

[0083] The seventh step is to perform a third encryption process on the first traffic encryption information based on the second encryption information to generate traffic encryption information.

[0084] In practice, the execution subject may perform the second encryption process on the first key through the following steps to generate the first encryption key, the first encryption public key and the first encryption private key:

[0085] The first step is to determine the encryption prime array. In practice, the execution subject can randomly generate the encryption prime array. The encryption prime numbers in the encryption prime array can be prime numbers. For example, the number of encryption prime numbers in the encryption prime array can be 4. The length of the encryption prime numbers in the encryption prime array can be 1024.

[0086] In the second step, the product of each encrypted prime number in the above encrypted prime array is determined as the encryption modulus.

[0087] In the third step, for each encrypted prime number in the encrypted prime array, the difference between the encrypted prime number and a preset value is determined as the encrypted prime number difference. For example, the preset value may be 1.

[0088] In the fourth step, the product of the obtained encrypted prime number differences is determined as the encryption function value.

[0089] Step 5: Determine the encryption exponent value based on the preset encryption function and the encryption function value. For example, the preset encryption function may be such that the greatest common divisor of the encryption exponent value and the encryption function value is 1.

[0090] Step 6: Determine the decryption exponent value based on the encryption exponent value and the encryption function value. In practice, the execution subject may determine the decryption exponent value by a preset exponent condition. For example, the preset exponent condition may be: the remainder obtained by multiplying the encryption exponent value by the decryption exponent value by the encryption function value is 1.

[0091] The seventh step is to determine the encryption exponent value and the encryption modulus as the first encryption public key.

[0092] In the eighth step, the decryption exponent value and the encryption modulus are determined as the first encryption private key.

[0093] In the ninth step, based on the first encryption public key, the first key is encrypted to generate the first encryption key. In practice, the execution subject can encrypt the first key based on the first encryption public key to generate the first encryption key through the following steps: First, the power of the encryption exponent value of the first key is determined as the first key encryption transit value. Then, the first key encryption transit value is modulo the encryption modulus to obtain the first encryption key.

[0094] Therefore, since the encryption and decryption keys in the first encryption process are the same, the first key in the first encryption process can be subjected to a second encryption process to encrypt the first key, thereby ensuring the security of the first key and further ensuring the security of the device traffic information.

[0095] In practice, the execution subject may perform a third encryption process on the first traffic encryption information based on the second encryption information through the following steps to generate traffic encryption information:

[0096] In the first step, based on the second public key, the first traffic encryption information is encrypted to generate the second traffic encryption information. In practice, based on the second public key, the execution subject can encrypt the first traffic encryption information to generate the second traffic encryption information through the following sub-steps:

[0097] The first sub-step is to determine the encryption random number and the encryption multiplication point. In practice, first, the execution subject may randomly determine the encryption random number within a preset encryption random interval. For example, the preset encryption random interval may be (1, n-1). Here, n may be the order of the preset encryption curve. Then, the product of the encryption random number and the preset base point is determined as the encryption multiplication point.

[0098] The second sub-step is to determine the product of the co-factor of the preset encryption curve and the second public key as the first transit curve point.

[0099] In a third sub-step, in response to determining that the first transit curve point satisfies a preset curve point condition, the product of the encrypted random number and the second public key is determined as a second transit curve point. The second transit curve point includes: a second transit horizontal coordinate and a second transit vertical coordinate. The preset curve point condition may be: the first transit curve point is not an infinite point.

[0100] The fourth sub-step is to perform a logical OR process on the second transfer horizontal coordinate and the second transfer vertical coordinate to generate a first transfer logical value.

[0101] The fifth sub-step is to randomly generate the first transit logic value and the length of the first traffic encryption information based on a preset key derivation function to generate a transit logic generation value. For example, the preset key derivation function may be an SM3 (domestic hash) function.

[0102] The sixth sub-step is to perform XOR processing on the first traffic encryption information and the transit logic generated value to generate transit encryption information.

[0103] The seventh sub-step is to perform logical OR processing on the second transfer horizontal coordinate, the first traffic encryption information and the second transfer vertical coordinate to generate a second transfer logical value.

[0104] In the eighth sub-step, the second transfer logic value is input into a preset hash function to obtain a transfer hash value. For example, the preset hash function may be an SM3 (domestic hash) function.

[0105] A ninth sub-step is to determine the first transfer curve point, the second transfer logic value and the transfer hash value as the second traffic encryption information.

[0106] The second step is to determine the traffic encryption hash information based on the first traffic encryption information and the hash value. In practice, the first traffic encryption information and the hash value are logically processed to generate the traffic encryption hash information.

[0107] The third step is to input the traffic encrypted hash information into a preset hash function to obtain traffic hash information. For example, the preset hash function may be an SM3 (domestic hash) function.

[0108] Step 4: Based on the second private key and the traffic hash information, perform the following determination steps:

[0109] The first determination step is to determine the random number and the preset multiple point. In practice, first, the execution subject may randomly determine the random number within the preset random interval. For example, the preset random interval may be (1, n-1). Here, n may be the order of the preset encryption curve. Then, the product of the random number and the preset base point is determined as the preset multiple point. Here, the preset multiple point may include a preset multiple point horizontal coordinate and a preset multiple point vertical coordinate.

[0110] The second determination step is to determine the first initial encrypted information based on the random number, the preset multiple point and the traffic hash information. In practice, first, the execution subject may determine the sum of the numerical value represented by the traffic hash information and the preset multiple point horizontal coordinate included in the preset multiple point as the hash multiple point transfer value. Then, the execution subject may perform a modulo operation on the hash multiple point transfer value and the order of the preset encryption curve to obtain the first initial encrypted information.

[0111] The third determination step, in response to determining that the first initial encrypted information satisfies the first preset encryption condition, determines the second initial encrypted information based on the second private key, the random number, and the first initial encrypted information. The first preset encryption condition may be: the first initial encrypted information is not 0 or the sum of the value represented by the first initial encrypted information and the random number is not equal to the order of the above-mentioned preset encryption curve. In practice, based on the second private key, the random number, and the first initial encrypted information, the above-mentioned execution subject may determine the second initial encrypted information through the following sub-steps:

[0112] In the first sub-step, the sum of the second private key and the first preset value is determined as the private key sum value. For example, the first preset value may be 1.

[0113] The second sub-step is to determine the private key and the value raised to a second preset power as the private key power value. For example, the second preset value may be -1.

[0114] In the third sub-step, the product of the random number and the numerical value represented by the first initial encryption information is determined as the first transit encryption value.

[0115] The fourth sub-step is to determine the difference between the random number and the first transit encryption value as the second transit encryption value.

[0116] The fifth sub-step is to determine the product of the private key power value and the second transit encryption value as the third transit encryption value.

[0117] The sixth sub-step is to perform a modulo operation on the third transit encryption value and the order of the preset encryption curve to obtain the second initial encryption information.

[0118] The fourth determination step is to determine the first initial encrypted information and the second initial encrypted information as digital signature information in response to determining that the second initial encrypted information satisfies a second preset encryption condition, wherein the second preset encryption condition may be that the second initial encrypted information is not zero.

[0119] The fifth step is to determine the second traffic encryption information and the digital signature information as traffic encryption information.

[0120] Optionally, the above method further includes:

[0121] In the first step, in response to determining that the first initial encrypted information does not satisfy the first preset encryption condition, the determination step is performed again.

[0122] In the second step, in response to determining that the second initial encrypted information does not satisfy the second preset encryption condition, the determination step is performed again.

[0123] Therefore, the third encryption is performed on the basis of the first encryption of the traffic hardware encryption information and the second encryption of the first key, which further improves the security of the traffic hardware encryption information, thereby improving the security of the device traffic information during transmission.

[0124] Step 105 , in response to determining that the user identity information and the user request information meet the preset user request condition, each traffic encryption information corresponding to the user request information in the traffic encryption information group set is determined as a target traffic encryption information set.

[0125] In some embodiments, the execution subject may determine, in response to determining that the user identity information and the user request information satisfy a preset user request condition, each of the traffic encryption information corresponding to the user request information in the traffic encryption information set as a target traffic encryption information set. The preset user request condition may be: at least one device user identifier included in the device user information corresponding to the gateway side device corresponding to the user request information, including the user identity identifier included in the user identity information.

[0126] Step 106: determine the user information and the target traffic encryption information set as the target user traffic information.

[0127] In some embodiments, the execution entity may determine the user information and the target traffic encryption information set as target user traffic information.

[0128] Step 107: Send the target user traffic information to the target user terminal, and store the target user traffic information in a database.

[0129] In some embodiments, the execution entity may send the target user traffic information to the target user terminal, and store the target user traffic information in a database.

[0130] The above-mentioned embodiments of the present application have the following beneficial effects: through the gateway-side security protection method of some embodiments of the present application, the security of device flow information can be improved. Specifically, the reason for the low security of device flow information is that: because the binary classification model only considers whether the device flow information meets the user's needs, but does not subdivide the device flow information, the device flow information identified by the binary classification model includes more information that does not meet the user's needs. When the device flow information is sent to the user terminal, it will lead to a waste of transmission resources, and the symmetric encryption algorithm has a fast encryption speed and is easy to implement, but the encrypted file is easy to be deciphered, and the security is low. Based on this, the gateway-side security protection method of some embodiments of the present application first collects the device flow information set corresponding to each gateway-side device. Thus, the device flow information set can be collected so that the device flow information set can be encrypted later. Secondly, the user information of the target user terminal is obtained, wherein the above-mentioned user information includes: user identity information and user request information. Thus, the user information can be obtained so that the encrypted device flow information can be sent to the user terminal according to the user information later. Then, the above-mentioned device flow information set is input into the pre-trained security layered model to obtain the flow layered information group set. Thus, the flow information set can be layered according to the security layering model, so that the flow layering information that is more in line with the user's needs can be sent to the user terminal later, thereby reducing the waste of transmission resources. Then, the above-mentioned flow layering information set is encrypted to generate a flow encryption information set, and the above-mentioned flow encryption information set is stored in a database. Thus, the flow layering information set can be encrypted by two encryption methods, hardware encryption and software encryption, to ensure the security of the flow layering information set during transmission. Then, in response to determining that the above-mentioned user identity information and the above-mentioned user request information meet the preset user request conditions, each flow encryption information corresponding to the above-mentioned user request information in the above-mentioned flow encryption information set is determined as a target flow encryption information set. Thus, a target flow encryption information set that meets the user's needs can be selected from the encrypted flow encryption information set. Afterwards, the above-mentioned user information and the above-mentioned target flow encryption information set are determined as target user flow information. Finally, the above-mentioned target user flow information is sent to the above-mentioned target user terminal, and the above-mentioned target user flow information is stored in a database. Thus, the encrypted target user flow information that meets the user's needs can be sent to the user terminal. Therefore, both hardware encryption and software encryption are considered, which improves the security of device traffic information compared to symmetric encryption algorithms.

[0131] The present application also provides a computer device 200. Figure 2As shown, the computer device 200 includes: a bus 201, a processor 202, a memory 203 and a communication interface 204. The processor 202, the memory 203 and the communication interface 204 communicate with each other through the bus 201. The computer device 200 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 200.

[0132] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 The bus 201 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 201 may include a path for transmitting information between various components of the computer device 200 (for example, the memory 203, the processor 202, and the communication interface 204).

[0133] The processor 202 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0134] The memory 203 may include a volatile memory, such as a random access memory (RAM). The memory 203 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0135] The memory 203 stores executable program codes, and the processor 202 executes the executable program codes to respectively implement the functions of the aforementioned acquisition module, sampling module, determination module, and mixing module, thereby implementing the aforementioned gateway-based security protection method. That is, the memory 203 stores instructions for executing the aforementioned gateway-based security protection.

[0136] The communication interface 204 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 200 and other devices or a communication network.

[0137] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute the above-mentioned gateway-side security protection method.

[0138] The embodiment of the present application also provides a computer-readable storage medium. The above-mentioned computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The above-mentioned available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk), etc. The computer-readable storage medium includes instructions, and the above-mentioned instructions instruct the computing device to execute the above-mentioned security protection method based on the gateway side.

[0139] Figure 3 It is a schematic diagram of an application scenario of the gateway-side security protection method according to the present application.

[0140] exist Figure 3In the application scenario, first, the electronic device 301 can collect the device traffic information set corresponding to each gateway side device. In this application scenario, the device traffic information 302 in the device traffic information set can be "device A, 220*150*200, user A, user B, device B". Secondly, the electronic device 301 can obtain the user information of the target user terminal. In this application scenario, the user information 303 can be "user A, device A". Then, the electronic device 301 can input the above device traffic information set into the pre-trained security layered model 304 to obtain a traffic layered information group set. In this application scenario, the traffic layered information 305 in the traffic layered information group set can be "device A, 220*150*200, user A, device B". Then, the electronic device 301 encrypts the above traffic layered information group set to generate a traffic encryption information group set, and stores the above traffic encryption information group set in the database. In this application scenario, the traffic encryption information 306 in the traffic encryption information group set can be "100011101010101". Then, in response to determining that the above-mentioned user identity information and the above-mentioned user request information meet the preset user request condition, the electronic device 301 determines the individual traffic encryption information corresponding to the above-mentioned user request information in the above-mentioned traffic encryption information group set as the target traffic encryption information set. In this application scenario, the target traffic encryption information 307 in the target traffic encryption information set may be "100011101010101". Afterwards, the electronic device 301 may determine the above-mentioned user information and the above-mentioned target traffic encryption information set as the target user traffic information. In this application scenario, the target user traffic information 308 may be "user A, device A, 100011101010101". Finally, the electronic device 301 may send the target user traffic information to the above-mentioned target user terminal, and store the above-mentioned target user traffic information in a database.

[0141] It should be noted that the electronic device 301 can be hardware or software. When the electronic device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or it can be implemented as a single server or a single terminal device. When the electronic device is embodied as software, it can be installed in the hardware devices listed above. It can be implemented as multiple software or software modules for providing distributed services, for example, or it can be implemented as a single software or software module. No specific limitation is made here.

[0142] It should be understood that Figure 3 The number of electronic devices in the embodiment is only for illustration. Any number of electronic devices may be provided according to implementation requirements.

[0143] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0144] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A security protection method based on the gateway side, comprising: Collect the device traffic information set corresponding to each gateway-side device; Acquire user information of a target user terminal, wherein the user information includes: user identity information and user request information; Input the device traffic information set into a pre-trained security layering model to obtain a traffic layering information group set, wherein the pre-trained security layering model is obtained by training an initial security layering model using a training sample set, wherein the initial security layering model includes: an initial fusion model, an initial special score model, an initial classification model, and an initial anomaly score model, wherein the initial fusion model is a model that takes the sample device traffic information set as input and takes the initial traffic fusion matrix information as output, the initial special score model is a model that takes the initial traffic fusion row information as input and takes the initial special score value as output, the initial classification model is a neural network model that takes the initial special score value group and the initial traffic fusion row information group as input and takes the initial traffic partition sub-information group set as output, the initial anomaly score model is a model that takes each initial special score value corresponding to the initial traffic partition sub-information group as input and takes the initial anomaly score value as output, for each initial traffic partition sub-information in the initial traffic partition sub-information group set, the initial anomaly score value corresponding to the initial traffic partition sub-information in the initial anomaly score value set and the initial traffic partition sub-information are determined as initial traffic layering information, and each obtained initial traffic layering information is determined as an initial traffic layering information group set; Encrypting the traffic layering information set to generate a traffic encryption information set, and storing the traffic encryption information set in a database; In response to determining that the user identity information and the user request information meet a preset user request condition, determining each traffic encryption information corresponding to the user request information in the traffic encryption information set as a target traffic encryption information set; Determine the user information and the target traffic encryption information set as target user traffic information; Sending the target user traffic information to the target user terminal, and storing the target user traffic information in a database; The step of encrypting the traffic layering information set to generate a traffic encryption information set includes: Scheduling the encryption chip to perform hardware encryption processing on the traffic layer information set to generate a traffic hardware encryption information set; Each piece of traffic hardware encryption information in the traffic hardware encryption information set is securely encrypted to generate traffic encryption information, thereby obtaining a traffic encryption information set.

2. The gateway-based security protection method according to claim 1, wherein: The collecting of device flow information sets corresponding to each gateway side device includes: Collecting initial device flow information of each gateway-side device to obtain an initial device flow information set; Obtain device association information of each gateway-side device; Preprocessing each piece of initial device flow information in the initial device flow information set to generate device flow preprocessing information, thereby obtaining a device flow preprocessing information set; For each piece of device flow preprocessing information in the device flow preprocessing information set, determining the device flow preprocessing information and the device association information as device flow information; The determined individual device flow information is determined as a device flow information set.

3. The gateway-based security protection method according to claim 1, wherein: The step of performing secure encryption processing on each piece of traffic hardware encryption information in the traffic hardware encryption information group set to generate traffic encryption information includes: Determining a first key based on the traffic hardware encryption information; Dividing the traffic hardware encryption information to generate a traffic block information sequence; Based on the first key, perform a first encryption process on each flow block information in the flow block information sequence to generate flow block encrypted information, and obtain a flow block encrypted information sequence; Performing splicing processing on each traffic block encryption information in the traffic block encryption information sequence to generate first traffic encryption information; Performing a second encryption process on the first key to generate a first encryption key, a first encryption public key and a first encryption private key, and storing the first encryption key, the first encryption public key and the first encryption private key in a database; Generate second encrypted information based on a preset encryption curve; Based on the second encryption information, the first traffic encryption information is subjected to a third encryption process to generate traffic encryption information.

4. The gateway-based security protection method according to claim 3, wherein: The performing a second encryption process on the first key to generate a first encryption key, a first encryption public key and a first encryption private key includes: Determine the encrypted prime array; Determine the product of each encrypted prime number in the encrypted prime array as an encryption modulus; For each encrypted prime number in the encrypted prime number array, determining the difference between the encrypted prime number and a preset value as an encrypted prime number difference; The product of the obtained encryption prime number differences is determined as the encryption function value; Determining an encryption index value based on a preset encryption function and the encryption function value; Determining a decryption index value based on the encryption index value and the encryption function value; Determine the encryption exponent value and the encryption modulus as a first encryption public key; Determine the decryption exponent value and the encryption modulus as a first encryption private key; Based on the first encryption public key, the first key is encrypted to generate a first encryption key.

5. A computer device, wherein: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 4 are implemented.

6. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images