Communication security protection system based on multilayer access control

Abstract

The invention provides a communication security protection system based on multilayer access control, which belongs to the technical field of communication security, and comprises a first configuration module used for configuring firewall rules according to a communication protocol between communication main bodies; the second configuration module is used for configuring an accessible service and an information list according to the business operation parameters of the communication main body; the third configuration module is used for configuring the control authority according to the terminal use condition of the communication main body; and the authentication module is used for monitoring the network access behavior of each terminal of the communication main body and carrying out communication and service authority authentication. The defects that a traditional communication security protection system uses a single technical means and mechanism, complex network security threats are difficult to deal with, meanwhile, many traditional communication security protection systems still depend on manual operation, so that the protection efficiency is low, errors are prone to occurring, and in addition, the traditional communication security protection systems are often low in response speed are overcome.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to a communication security protection system based on multi-layer access control. Background Art

[0002] With the rapid development of information technology, network security issues are becoming more and more serious.

[0003] Third, traditional communication security protection systems use a single technical means and mechanism, which makes it difficult to cope with complex network security threats. At the same time, many traditional communication security protection systems still rely on manual operations, such as setting rules and monitoring events, resulting in low protection efficiency and prone to errors, making it difficult to adapt to the rapidly developing network environment. In addition, traditional communication security protection systems often have a slow response speed and are difficult to cope with advanced persistent attacks. Once the attacker breaks through the first line of defense, he may complete a large number of malicious behaviors in a short period of time, making it difficult for the protection system to function.

[0004] Therefore, the present invention proposes a communication security protection system based on multi-layer access control. Summary of the invention

[0005] The present invention provides a communication security protection system based on multi-layer access control, which is used to solve the problem that the communication security protection system in the prior art uses a single technical means and mechanism, which is difficult to cope with complex network security threats. At the same time, many traditional communication security protection systems still rely on manual operation, resulting in low protection efficiency and prone to errors. In addition, traditional communication security protection systems often have the defect of slow response speed.

[0006] In one aspect, the present invention provides a communication security protection system based on multi-layer access control, comprising: The first configuration module is used to configure firewall rules according to the communication protocol between communication subjects; The second configuration module is used to configure the accessible service and information list according to the business operation parameters of the communication subject; The third configuration module is used to configure the control authority according to the terminal usage of the communication subject; Authentication module: used to monitor the network access behavior of each terminal of the communication subject and perform communication and service authority authentication.

[0007] According to a communication security protection system based on multi-layer access control provided by the present invention, the first configuration module includes: A first acquisition unit: acquires the communication requirements of the target communication subject, and acquires the corresponding communication protocol according to the communication requirements; A first determining unit: obtaining a protocol type of the communication protocol according to a protocol crawling tool, and determining a message structure and a transmission mode of the communication protocol according to the protocol type; Scanning unit: obtains the open port of the communication subject through network scanning; A second acquisition unit: acquiring characteristics of the communication protocol according to the message structure, transmission mode and open port; The first configuration unit is configured to configure firewall rules according to the characteristics of the communication protocol.

[0008] According to a communication security protection system based on multi-layer access control provided by the present invention, the scanning unit includes: The first acquisition subunit: determines the IP address and subnet mask of the target system, and obtains the correct network address range according to the IP address and subnet mask; Scanning subunit: performing port scanning on the communication security protection system of multi-layer access control based on the network address range based on the network scanning tool to obtain the TCP / UDP ports opened on the public Internet; The second acquisition subunit: analyzes the service type and service name of each open port to obtain the operation status of the multi-layer access control communication security protection system.

[0009] According to a communication security protection system based on multi-layer access control provided by the present invention, the second configuration module includes: The third acquisition unit is used to acquire the identity and business scope of the communication subject, and acquire the business operation parameter information related to the communication subject based on the parameter database according to the identity and business scope; A fourth acquisition unit: parsing the business operation parameter information to obtain publicly available information and non-publicly available information; A first allocation unit: obtaining user information and role permissions, and allocating specific service permissions and access levels to the user according to the publicly available information and non-publicly available information; Screening unit: obtaining multiple business types accessible to the user according to the service authority and access level, and dynamically screening and presenting a related information list; A second configuration unit: configuring the accessible services and the information list according to the information list.

[0010] According to a communication security protection system based on multi-layer access control provided by the present invention, the fourth acquisition unit includes: Preprocessing subunit: performing parameter preprocessing on the business operation parameter information; Decomposition of sub-units: Decompose the preprocessed parameters into multiple vocabulary units according to the word segmentation algorithm, and perform part-of-speech tagging on each vocabulary unit; Convert sub-units: convert vocabulary units into numerical vectors according to the word vector model to obtain the semantic similarity and correlation between multiple vocabulary units; The third acquisition subunit is to acquire publicly available information and non-public available information based on the preset disclosure rules according to the semantic similarity and association.

[0011] According to a communication security protection system based on multi-layer access control provided by the present invention, the third configuration module includes: The fifth acquisition unit: monitors the terminal device and user behavior in real time based on the integrated sensor and tracking technology, and obtains the terminal usage based on the monitoring results; A second allocation unit: creating VLANs on a switch or a router according to the usage conditions, and allocating different user groups to different VLANs; Authorization unit: Enables encryption and authentication mechanisms, and authorizes different users and devices based on the encryption and authentication mechanisms; Audit Unit: Configure the security of network devices and routers to catch unauthorized access attempts and conduct audits; The third configuration unit: configures the control authority strategy according to the authorization results and audit results.

[0012] According to a communication security protection system based on multi-layer access control provided by the present invention, the authentication module includes: The sixth acquisition unit: acquires the monitoring target of the communication subject, and acquires the corresponding automatic monitoring tool according to the monitoring target; Log recording unit: obtains all network access behaviors of each terminal of the communication subject in real time according to the automatic monitoring tool, and records them in logs; A second determination unit: analyzing the log records, obtaining the business needs and security requirements of the communication subject, and determining corresponding security rules and thresholds according to the business needs and security requirements; Authentication unit: authenticating the communication and service authority of network access behavior according to the security rules and thresholds; Activation unit: Activate security audit and incident response plans based on certification results to restore systems and services affected by abnormal access behavior.

[0013] According to a communication security protection system based on multi-layer access control provided by the present invention, the second configuration unit includes: Fourth acquisition subunit: acquiring structured information metadata according to the information list, and acquiring business entity related information according to the structured information metadata; A first determining subunit: determining a business object and a description file of the business object based on relevant information of the business entity; The second determination subunit: determines the service operation parameters according to the description file of the business object, and determines the data service type according to the service operation parameters; The third determination subunit: determines the service modular structure based on the data service type, and determines the timing constraint parameters of each service process and the configuration constraint parameters between the service components according to the service modular structure; Fourth determination subunit: determining whether the service can be performed synchronously or asynchronously according to the timing constraint parameters and the configuration constraint parameters; The fifth acquisition subunit: respectively acquires the control thread of each service in the synchronous service and the asynchronous service; A sixth acquisition subunit: determining a process active object and a process passive object of each service according to the control thread, and acquiring object attributes of the process active object and the process passive object; The fifth determination subunit: determines the service index of each service based on the object attributes, and determines the service overlap and service latency of each service with other services according to the service index; The sixth determination subunit: determines the service compatibility of each service with other services according to the service overlap and service latency; Screening subunit: Screening out retained services and discarded services based on service compatibility; The seventh determining subunit: obtains the service inclusion information attribute of the reserved service, and determines the service information of the reserved service according to the service inclusion information attribute.

[0014] Compared with the prior art, the present invention has the following beneficial effects: By configuring firewall rules, accessible service and information lists, and control permissions for communication entities, communication and service permission authentication is performed on terminal access behaviors. Multi-layer technical means and mechanisms can be used to respond to complex network security threats. At the same time, there is no need to rely on manual operations, which improves protection efficiency and is less prone to errors. In addition, it can respond to advanced persistent attacks, allowing the protection system to take effect quickly and ensure communication security. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 It is a structural diagram of a communication security protection system based on multi-layer access control provided by an embodiment of the present invention; Figure 2 It is a structural diagram of a first configuration module provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] Embodiment 1: The embodiment of the present invention provides a communication security protection system based on multi-layer access control, such as Figure 1 As shown, the system mainly includes the following modules: The first configuration module is used to configure firewall rules according to the communication protocol between communication subjects; The second configuration module is used to configure the accessible service and information list according to the business operation parameters of the communication subject; The third configuration module is used to configure the control authority according to the terminal usage of the communication subject; Authentication module: used to monitor the network access behavior of each terminal of the communication subject and perform communication and service authority authentication.

[0019] In this embodiment, the communication protocol is a standardized communication format used to describe how devices exchange data on the network. The communication protocol defines the structured rules, syntax and semantics that should be followed during data transmission, such as: Hypertext Transfer Protocol, File Transfer Protocol, Transmission Control Protocol / Internet interconnection.

[0020] In this embodiment, firewall rules are a network security tool used to monitor and control network traffic in and out of an enterprise.

[0021] In this embodiment, the business operation parameter information includes: communication subject name, communication mode, data transmission rate, router configuration, bandwidth allocation, and network topology.

[0022] In this embodiment, an accessible service means that a product or service can be accessed and used in different devices, operating systems, browsers, and other environments.

[0023] The beneficial effects of the above technical solution are: by configuring firewall rules, accessible service and information lists, and control permissions for communication subjects, communication and service permission authentication is performed on the terminal's access behavior, and multi-layer technical means and mechanisms can be used to deal with complex network security threats. At the same time, there is no need to rely on manual operations, which improves protection efficiency and is less prone to errors. In addition, it can deal with advanced persistent attacks, allowing the protection system to take effect quickly and ensure communication security.

[0024] Embodiment 2: Based on Example 1, the first configuration module of the embodiment of the present invention includes: A first acquisition unit: acquires the communication requirements of the target communication subject, and acquires the corresponding communication protocol according to the communication requirements; A first determining unit: obtaining a protocol type of the communication protocol according to a protocol crawling tool, and determining a message structure and a transmission mode of the communication protocol according to the protocol type; Scanning unit: obtains the open port of the communication subject through network scanning; A second acquisition unit: acquiring characteristics of the communication protocol according to the message structure, transmission mode and open port; The first configuration unit is configured to configure firewall rules according to the characteristics of the communication protocol.

[0025] In this embodiment, the communication needs of the communication subject may be: information sharing, collaborative work, task allocation and progress tracking. In this embodiment, the communication protocol is a standardized communication format used to describe how devices exchange data on the network. The communication protocol defines the structured rules, syntax and semantics that should be followed during data transmission, such as: Hypertext Transfer Protocol, File Transfer Protocol, Transmission Control Protocol / Internet interconnection.

[0026] In this embodiment, the protocol capture tool is a software tool for monitoring and recording the communication process on a computer network, which can help users monitor network traffic, analyze data packet content and communication protocols, identify potential security vulnerabilities and other issues, such as: Wireshark, tcpdump.

[0027] In this embodiment, the message structure of the communication protocol refers to the basic format of the message, which is used to transmit information between communication systems. The message structure usually includes two parts: the header and the body. The header is the first half of the message, specifies a part of the subsequent body, and defines some meta information of the message, such as the source address and the destination address; Body: It is the second half of the message, used to actually transmit useful information.

[0028] In this embodiment, the transmission modes of the communication protocol mainly include: point-to-point transmission and multipoint transmission.

[0029] In this embodiment, the open ports of the communication subject refer to the open ports on the network. These ports are opened by the system or service process, allowing external users to access the functions of the system or process, such as: TCP port 21, UDP port 22, Telnet port 330.

[0030] In this embodiment, the characteristics of the communication protocol refer to a series of functions and specifications of the communication protocol designed for a specific purpose to ensure secure and reliable information exchange between different devices, such as: encryption and security mechanisms, identity authentication and authorization mechanisms, error handling and recovery mechanisms.

[0031] In this embodiment, firewall rules are a network security tool used to monitor and control network traffic in and out of an enterprise.

[0032] The beneficial effects of the above technical solution are: obtaining the communication protocol according to the communication needs of the communication subject, determining the characteristics of the communication protocol, and configuring the firewall rules, which can improve network security and flexibility, thereby protecting the enterprise from the risks of network attacks and data leakage.

[0033] Embodiment 3: Based on the second embodiment, the scanning unit of the embodiment of the present invention includes: The first acquisition subunit: determines the IP address and subnet mask of the target system, and obtains the correct network address range according to the IP address and subnet mask; Scanning subunit: performing port scanning on the communication security protection system of multi-layer access control based on the network address range based on the network scanning tool to obtain the TCP / UDP ports opened on the public Internet; The second acquisition subunit: analyzes the service type and service name of each open port to obtain the operation status of the multi-layer access control communication security protection system.

[0034] In this embodiment, the IP address of the system refers to the Internet Protocol address, which is a digital identifier used to uniquely identify a computer or device on the Internet. Each computer connected to the Internet requires an IP address in order to send and receive data packets to each other on the network. An IP address is usually composed of three decimal numbers, each of which ranges from 0 to 255, such as 129.65.31.217.

[0035] In this embodiment, the subnet mask is a method for dividing an IP address, and can be used to divide an IP address into multiple subnets.

[0036] In this embodiment, the network address range refers to a part of the IP address, which is used to specify different areas in the network. The IP address can be divided into five types of addresses: A, B, C, D, and E. Each type of address has a different prefix length and network address range. The prefix length of the Class A address is the longest, and it can be used to divide the entire Internet into network address ranges. The prefix length of the Class B address is slightly shorter, and it can only be used to connect to large enterprise internal networks or city-level networks.

[0037] In this embodiment, the network scanning tool is a software used to detect accessible services, loopholes and weaknesses on the network.

[0038] In this embodiment, port scanning refers to the process of using a network scanning tool to check open or listening ports running on the target computer. By checking the ports, the network scanning tool can identify which services are running, which services have known vulnerabilities, and other vulnerabilities and security issues in the network.

[0039] In this embodiment, the TCP and UDP ports are a logical channel on a computer, used to transmit computer network protocols and data packets in a network.

[0040] In this embodiment, the service type corresponding to the open port may be: file server, remote management, data warehouse.

[0041] The beneficial effects of the above technical solution are: the network address range is obtained through the system's IP address and subnet mask, and by dividing the IP address range into smaller subnets and assigning them to different devices or users, network access rights and security can be better controlled. Furthermore, port scanning is performed to obtain open ports, and the service type and name of the port are analyzed to obtain the system's operating status. By checking the service type, name, and open and closed status of the port, malicious attacks can be quickly detected to ensure the security of the system.

[0042] Embodiment 4: Based on the third embodiment, the second configuration module of the embodiment of the present invention includes: The third acquisition unit is used to acquire the identity and business scope of the communication subject, and acquire the business operation parameter information related to the communication subject based on the parameter database according to the identity and business scope; A fourth acquisition unit: parsing the business operation parameter information to obtain publicly available information and non-publicly available information; A first allocation unit: obtaining user information and role permissions, and allocating specific service permissions and access levels to the user according to the publicly available information and non-publicly available information; Screening unit: obtaining multiple business types accessible to the user according to the service authority and access level, and dynamically screening and presenting a related information list; A second configuration unit: configuring the accessible services and the information list according to the information list.

[0043] In this embodiment, the communication subject identity refers to the identity and role of an individual or organization involved in the communication process.

[0044] In this embodiment, the communication business scope refers to the content of products and services provided by an organization or individual, including the types and quantities of various communication technologies and services such as hardware, software, networks, mobile applications, etc. that the organization or individual can provide. For example, the business scope of a telecommunications company may include mobile phone charges, broadband Internet access, digital television and other services.

[0045] In this embodiment, the business operation parameter information includes: communication subject name, communication mode, data transmission rate, router configuration, bandwidth allocation, and network topology.

[0046] The beneficial effects of the above technical solution are: obtaining business operation parameter information related to the communication subject through the identity and business scope of the communication subject, obtaining public information and non-public information to assign specific service permissions and access levels to users, obtaining multiple business types accessible to users to dynamically filter and present related information lists, which can enhance information security and prevent unauthorized access. At the same time, by configuring accessible services and information lists according to the business operation parameters of the communication subject, it can ensure that the right information is provided to the right people at the right time, promote collaboration and cooperation, and improve workflow efficiency.

[0047] Embodiment 5: Based on the fourth embodiment, the fourth acquisition unit of the embodiment of the present invention includes: Preprocessing subunit: performing parameter preprocessing on the business operation parameter information; Decomposition of sub-units: Decompose the preprocessed parameters into multiple vocabulary units according to the word segmentation algorithm, and perform part-of-speech tagging on each vocabulary unit; Convert sub-units: convert vocabulary units into numerical vectors according to the word vector model to obtain the semantic similarity and correlation between multiple vocabulary units; The third acquisition subunit is to acquire publicly available information and non-public available information based on the preset disclosure rules according to the semantic similarity and association.

[0048] In this embodiment, parameter preprocessing is an operation of processing input parameters, such as data verification, data conversion, and data cleaning.

[0049] In this embodiment, the word segmentation algorithm is a natural language processing technology used to segment continuous natural language text into meaningful words or phrases.

[0050] In this embodiment, the vocabulary unit refers to the smallest unit segmented in the word segmentation algorithm, that is, an independent word or phrase.

[0051] In this embodiment, part-of-speech tagging refers to tagging the part of speech of each word in the text, and usually a pre-defined part-of-speech tag dictionary is used to indicate the part of speech of each word, such as noun, verb, and adjective.

[0052] In this embodiment, the word vector model is a technology for mapping words to a high-dimensional space, and can represent words as high-dimensional numerical vectors, where the size of the dimension is usually thousands of times the length of the word vector.

[0053] In this embodiment, a numerical vector is a mathematical structure consisting of a group of numbers and can be used to represent the properties of any entity or object, such as position, speed, and color.

[0054] In this embodiment, semantic similarity refers to the degree of semantic proximity between two words or phrases.

[0055] In this embodiment, publicly available information refers to information that can be accessed and obtained by anyone, such as communication methods and data transmission rates.

[0056] In this embodiment, non-public information refers to information that cannot be accessed or obtained by anyone, such as router configuration.

[0057] The beneficial effects of the above technical solution are: preprocessing business operation parameters and decomposing them into multiple vocabulary units for part-of-speech tagging, obtaining semantic similarities and correlations between multiple vocabulary units, and obtaining publicly available information and non-public information based on preset disclosure rules, which can prevent sensitive business information from being obtained and used by people with bad intentions, and help protect the security of the system.

[0058] Embodiment 6: Based on Example 5, the third configuration module of the embodiment of the present invention includes: The fifth acquisition unit: monitors the terminal device and user behavior in real time based on the integrated sensor and tracking technology, and obtains the terminal usage based on the monitoring results; A second allocation unit: creating VLANs on a switch or a router according to the usage conditions, and allocating different user groups to different VLANs; Authorization unit: Enables encryption and authentication mechanisms, and authorizes different users and devices based on the encryption and authentication mechanisms; Audit Unit: Configure the security of network devices and routers to catch unauthorized access attempts and conduct audits; The third configuration unit: configures the control authority strategy according to the authorization results and audit results.

[0059] In this embodiment, the integrated sensor refers to integrating the functions of multiple sensors into one system.

[0060] In this embodiment, tracking technology is a technology that tracks and monitors terminal devices and user behaviors through computers or mobile devices.

[0061] In this embodiment, the terminal device refers to a hardware device in a computer network that is responsible for receiving, sending and processing data, including: a server, a workstation, a mobile phone, and a tablet computer.

[0062] In this embodiment, the usage conditions include: terminal device type, usage time, usage location, usage frequency, and usage duration.

[0063] In this embodiment, a switch is a network device that can forward data packets between multiple connected network nodes.

[0064] In this embodiment, creating a VLAN is to organize physically dispersed devices into a logical network.

[0065] In this embodiment, enabling encryption and authentication mechanisms may be using SSL / TLS encryption to protect Web services and using IPsec encryption to protect point-to-point connections.

[0066] In this embodiment, configuring the security of the network device and the router may include: enabling the access control list and configuring the firewall.

[0067] In this embodiment, the permission control policy refers to a method of using rules and algorithms in a computer system and network environment to restrict the access of users, services and processes to resources, such as autonomous access control and mandatory access control.

[0068] The beneficial effects of the above technical solution are: obtaining terminal usage through integrated sensors and tracking technology, enabling encryption and authentication mechanisms to authorize different users and devices, capturing unauthorized access attempts, and configuring permission policies, which can help the system better manage and protect data and applications, and at the same time, help prevent unauthorized users from accessing sensitive information or damaging the system.

[0069] Embodiment 7: Based on Example 6, the authentication module of this embodiment of the present invention includes: The sixth acquisition unit: acquires the monitoring target of the communication subject, and acquires the corresponding automatic monitoring tool according to the monitoring target; Log recording unit: obtains all network access behaviors of each terminal of the communication subject in real time according to the automatic monitoring tool, and records them in logs; A second determination unit: analyzing the log records, obtaining the business needs and security requirements of the communication subject, and determining corresponding security rules and thresholds according to the business needs and security requirements; Authentication unit: authenticating the communication and service authority of network access behavior according to the security rules and thresholds; Activation unit: Activate security audit and incident response plans based on certification results to restore systems and services affected by abnormal access behavior.

[0070] In this embodiment, the monitoring targets of the communication subject include: Security: Monitoring communications to detect possible threats or security breaches.

[0071] Compliance: Ensure that all communications comply with relevant legal and policy requirements. Efficiency: Monitoring communications can help organizations improve efficiency.

[0072] In this embodiment, the automated monitoring tool may be: a project management tool, a time management tool, or a customer service software.

[0073] In this embodiment, network access behavior refers to various activities performed on the Internet, such as searching, uploading and downloading, and social interaction.

[0074] In this embodiment, the log record includes: the visitor's IP address, port number, content, time and status of the request and response.

[0075] In this embodiment, log analysis refers to trends, patterns, and anomalies in log records.

[0076] In this embodiment, the business requirements of the communication subject refer to the requirements that need to be met during the communication process, such as: fast response, security and reliability, and efficient collaboration.

[0077] In this embodiment, security auditing is a method of monitoring and recording communication activities to prevent malicious behavior and identify potential security vulnerabilities.

[0078] In this embodiment, the incident response plan is an effective method to prevent and respond to emergencies, which is designed to ensure that the organization can respond quickly and resume normal operations when faced with an emergency.

[0079] The beneficial effects of the above technical solution are: the automated monitoring tool obtained according to the communication subject monitoring target obtains the terminal's network access behavior, obtains the communication subject's business needs and security requirements for authority authentication, and activates security audits and incident response plans, which can help the system to promptly discover and repair vulnerabilities and prevent potential network attacks and data leaks. At the same time, security audits and incident response plans can help the system quickly respond and restore affected services to ensure the efficient operation of the system.

[0080] Embodiment 8: Based on Embodiment 7, the second configuration unit of the embodiment of the present invention includes: Fourth acquisition subunit: acquiring structured information metadata according to the information list, and acquiring business entity related information according to the structured information metadata; A first determining subunit: determining a business object and a description file of the business object based on relevant information of the business entity; The second determination subunit: determines the service operation parameters according to the description file of the business object, and determines the data service type according to the service operation parameters; The third determination subunit: determines the service modular structure based on the data service type, and determines the timing constraint parameters of each service process and the configuration constraint parameters between the service components according to the service modular structure; Fourth determination subunit: determining whether the service can be performed synchronously or asynchronously according to the timing constraint parameters and the configuration constraint parameters; The fifth acquisition subunit: respectively acquires the control thread of each service in the synchronous service and the asynchronous service; A sixth acquisition subunit: determining a process active object and a process passive object of each service according to the control thread, and acquiring object attributes of the process active object and the process passive object; The fifth determination subunit: determines the service index of each service based on the object attributes, and determines the service overlap and service latency of each service with other services according to the service index; The sixth determination subunit: determines the service compatibility of each service with other services according to the service overlap and service latency; Screening subunit: Screening out retained services and discarded services based on service compatibility; The seventh determining subunit: obtains the service inclusion information attribute of the reserved service, and determines the service information of the reserved service according to the service inclusion information attribute.

[0081] In this embodiment, the information list is a tool for organizing and managing information, which can help users quickly find and browse related content. This list usually contains multiple items or entries, and each entry can contain some related information, such as title, description, and link.

[0082] In this embodiment, structured information metadata refers to information describing the structure and attributes of data, which can be used to define the format, meaning and usage of the data.

[0083] In this embodiment, the business entity related information generally refers to information describing the attributes or characteristics of the business entity. For example, in an e-commerce platform, the business entity may refer to a product, and the product related information may include: the product name.

[0084] In this embodiment, the description file of the business object is a readable text file containing detailed information about the business object, and is generally used to record and manage the attributes, behaviors and states of the business object.

[0085] In this embodiment, the service operation parameters are various parameter values ​​that need to be input or called during the service operation process, such as configuration parameters and request parameters.

[0086] In this embodiment, the data service type refers to different types of services provided in data management and services, such as: data collection service, data storage service, data analysis service.

[0087] In this embodiment, the service modular structure refers to splitting a large application into many reusable and independent modules.

[0088] In this embodiment, the timing constraint parameters of the service process refer to a set of parameters that affect the sequential relationship between events or activities in the service process, such as: start time, end time, priority, and dependency.

[0089] In this embodiment, the configuration constraint parameters between service components are the rules and restrictions that must be followed when guiding the interaction between specific service components, such as: Interface specification: describes the data structure and message format requirements between service components to ensure the consistency of data exchange. For example, the interface specification of a RESTful API may include request methods, URL paths, HTTP status codes, etc.

[0090] Dependency: describes the order of dependency between service components. For example, if one service depends on the implementation of another service, then there is a dependency relationship between the two services.

[0091] Performance constraints: describe the workload limits between service components. For example, a queue service should be able to handle a certain number of concurrent requests while ensuring a certain response time range.

[0092] In this embodiment, synchronous service is a software design pattern, which emphasizes that the collaboration process between service components should be synchronized.

[0093] In this embodiment, asynchronous service is a software design pattern that allows service components to use a non-blocking approach when processing certain tasks, thereby avoiding thread blocking due to waiting for a certain resource.

[0094] In this embodiment, control thread refers to the technology and method for managing, scheduling and synchronizing threads in a multi-threaded environment, which can ensure that threads are executed in the expected order and prevent deadlock, race conditions and data competition errors, such as: mutex locks, semaphores, conditional variables.

[0095] In this embodiment, the service process active object refers to an object dynamically created as needed during the service process, such as a database connection pool, a session manager, and an authentication processor.

[0096] In this embodiment, a process passive object refers to an object that is not actively accessed or created during program execution, but is called or triggered by other objects under specific conditions, such as an event handler or a thread pool.

[0097] In this embodiment, the object attributes of the process passive object may be: Event Queue: One of the properties of a process passive object may be an event queue, which stores events to be processed. When an event occurs, it is placed in the event queue and processed by other objects at the appropriate time.

[0098] Listeners: A process passive object may have a list of listeners. A listener is an object that is configured to notify related passive objects to take appropriate actions when a specific event is triggered.

[0099] In this embodiment, the service indicators may be: response time, network delay time, and computing resources required to process the request.

[0100] In this embodiment, service overlap refers to two or more services providing the same value or function to users at the same time.

[0101] In this embodiment, service compatibility refers to the ability of a service to work in conjunction with other related services.

[0102] In this embodiment, the service includes information describing the operating environment of the service, including which resources and services need to participate in the service.

[0103] The beneficial effects of the above technical solution are: determining the service compatibility of each service with other services through service overlap and service latency can help the system ensure that the service can operate normally at all times and reduce the occurrence of failures and service degradation, thereby improving service reliability and availability. Furthermore, by screening out retained services and eliminated services, and obtaining the service inclusion information attributes of the retained services, the service information of the retained services can be determined, which can ensure the accuracy and completeness of the service information and help to better understand and maintain the services.

[0104] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A communication security protection system based on multi-layer access control, characterized in that: include: The first configuration module is used to configure firewall rules according to the communication protocol between communication subjects; The second configuration module is used to configure the accessible service and information list according to the business operation parameters of the communication subject; The third configuration module is used to configure the control authority according to the terminal usage of the communication subject; Authentication module: used to monitor the network access behavior of each terminal of the communication subject and perform communication and service authority authentication.

2. The communication security protection system based on multi-layer access control according to claim 1 is characterized in that: The first configuration module includes: A first acquisition unit: acquires the communication requirements of the target communication subject, and acquires the corresponding communication protocol according to the communication requirements; A first determining unit: obtaining a protocol type of the communication protocol according to a protocol crawling tool, and determining a message structure and a transmission mode of the communication protocol according to the protocol type; Scanning unit: obtains the open port of the communication subject through network scanning; A second acquisition unit: acquiring characteristics of the communication protocol according to the message structure, transmission mode and open port; The first configuration unit is configured to configure firewall rules according to the characteristics of the communication protocol.

3. The communication security protection system based on multi-layer access control according to claim 2 is characterized in that: Scanning unit, comprising: The first acquisition subunit: determines the IP address and subnet mask of the target system, and obtains the correct network address range according to the IP address and subnet mask; Scanning subunit: performing port scanning on the communication security protection system of multi-layer access control based on the network address range based on the network scanning tool to obtain the TCP / UDP ports opened on the public Internet; The second acquisition subunit: analyzes the service type and service name of each open port to obtain the operation status of the multi-layer access control communication security protection system.

4. The communication security protection system based on multi-layer access control according to claim 1 is characterized in that: The second configuration module includes: The third acquisition unit is used to acquire the identity and business scope of the communication subject, and acquire the business operation parameter information related to the communication subject based on the parameter database according to the identity and business scope; A fourth acquisition unit: parsing the business operation parameter information to obtain publicly available information and non-publicly available information; A first allocation unit: obtaining user information and role permissions, and allocating specific service permissions and access levels to the user according to the publicly available information and non-publicly available information; Screening unit: obtaining multiple business types accessible to the user according to the service authority and access level, and dynamically screening and presenting a related information list; A second configuration unit: configuring the accessible services and the information list according to the information list.

5. The communication security protection system based on multi-layer access control according to claim 4 is characterized in that: The fourth acquisition unit includes: Preprocessing subunit: performing parameter preprocessing on the business operation parameter information; Decomposition of sub-units: Decompose the preprocessed parameters into multiple vocabulary units according to the word segmentation algorithm, and perform part-of-speech tagging on each vocabulary unit; Convert sub-units: convert vocabulary units into numerical vectors according to the word vector model to obtain the semantic similarity and correlation between multiple vocabulary units; The third acquisition subunit is to acquire publicly available information and non-public available information based on the preset disclosure rules according to the semantic similarity and association.

6. The communication security protection system based on multi-layer access control according to claim 1 is characterized in that: The third configuration module includes: The fifth acquisition unit: monitors the terminal device and user behavior in real time based on the integrated sensor and tracking technology, and obtains the terminal usage based on the monitoring results; A second allocation unit: creating VLANs on a switch or a router according to the usage conditions, and allocating different user groups to different VLANs; Authorization unit: Enables encryption and authentication mechanisms, and authorizes different users and devices based on the encryption and authentication mechanisms; Audit Unit: Configure the security of network devices and routers to catch unauthorized access attempts and conduct audits; The third configuration unit: configures the control authority strategy according to the authorization results and audit results.

7. The communication security protection system based on multi-layer access control according to claim 1 is characterized in that: Certification modules, including: The sixth acquisition unit: acquires the monitoring target of the communication subject, and acquires the corresponding automatic monitoring tool according to the monitoring target; Log recording unit: obtains all network access behaviors of each terminal of the communication subject in real time according to the automatic monitoring tool, and records them in logs; A second determination unit: analyzing the log records, obtaining the business needs and security requirements of the communication subject, and determining corresponding security rules and thresholds according to the business needs and security requirements; Authentication unit: authenticating the communication and service authority of network access behavior according to the security rules and thresholds; Activation unit: Activate security audit and incident response plans based on certification results to restore systems and services affected by abnormal access behavior.

8. The communication security protection system based on multi-layer access control according to claim 4 is characterized in that: The second configuration unit includes: Fourth acquisition subunit: acquiring structured information metadata according to the information list, and acquiring business entity related information according to the structured information metadata; A first determining subunit: determining a business object and a description file of the business object based on relevant information of the business entity; The second determination subunit: determines the service operation parameters according to the description file of the business object, and determines the data service type according to the service operation parameters; The third determination subunit: determines the service modular structure based on the data service type, and determines the timing constraint parameters of each service process and the configuration constraint parameters between the service components according to the service modular structure; Fourth determination subunit: determining whether the service can be performed synchronously or asynchronously according to the timing constraint parameters and the configuration constraint parameters; The fifth acquisition subunit: respectively acquires the control thread of each service in the synchronous service and the asynchronous service; A sixth acquisition subunit: determining a process active object and a process passive object of each service according to the control thread, and acquiring object attributes of the process active object and the process passive object; The fifth determination subunit: determines the service index of each service based on the object attributes, and determines the service overlap and service latency of each service with other services according to the service index; The sixth determination subunit: determines the service compatibility of each service with other services according to the service overlap and service latency; Screening subunit: Screening out retained services and discarded services based on service compatibility; The seventh determining subunit: obtains the service inclusion information attribute of the reserved service, and determines the service information of the reserved service according to the service inclusion information attribute.

Images