Network security protection method and equipment

Abstract

The invention discloses a network security protection method and equipment, and relates to the technical field of communication. Efficient network security protection can be realized, and the network security of IoT equipment is improved. The method comprises: a network device obtaining a network control rule corresponding to an IoT device, the network control rule being used for constraining a network behavior of the IoT device; wherein the network control rule is determined based on at least one of a network manufacturer instruction MUD of the IoT device, a network MUD of an application program installed by the IoT device, and a network control rule configured for the IoT device by a user; and then the network device manages the network behavior of the IoT device according to the network control rule.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to network security protection methods and equipment. Background Art

[0002] With the rapid development of smart homes, more and more users are installing Internet of Things (IoT) devices in places such as homes or offices, and even installing IoT devices throughout the house to make the whole house smart. Users can experience the convenient user experience brought by IoT devices.

[0003] However, some IoT devices have limited resources and do not have software or hardware for network security protection, such as but not limited to firewalls, antivirus software, security hardware, etc. Therefore, these IoT devices are prone to become the entry point for external intrusion and attacks, making network security protection face huge challenges. Summary of the invention

[0004] The present application provides a network security protection method and device, which can achieve efficient network security protection and improve the network security of IoT devices.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, a network security protection method is provided, which is applied to a first network device, and the method includes: obtaining a first network control rule corresponding to a first Internet of Things (IoT) device, the first network control rule being used to constrain the network behavior of the first IoT device; wherein the first network control rule is determined based on at least one of the network manufacturer's user manual MUD of the first IoT device, the network MUD of the application installed by the first IoT device, and the network control rule configured by the user for the first IoT device; and managing the network behavior of the first IoT device according to the first network control rule. The network MUD may refer to the description of the network in the MUD.

[0007] Based on the above technical solution, for each IoT device, the network device can manage the network behavior of the IoT device according to the network control rules corresponding to the IoT device. The network control rules of each IoT device are determined according to the network MUD of the IoT device, the network MUD of the application of the IoT device, and at least one of the network control rules configured by the user for the IoT device. In this way, each IoT device has its own network control rules, which can achieve the management of single device and single rule, can more accurately identify the abnormal behavior of the device, achieve more efficient and detailed network security protection, and improve the network security of IoT devices. It can be understood that the first network device itself can also be an IoT device.

[0008] In one possible design, the first network control rule specifies at least one of the devices and / or external websites that the first IoT device is allowed to access, the devices and / or external websites that the first IoT device is allowed to access, the frequency at which the first IoT device is allowed to send data packets and / or the frequency at which it receives data packets, and the control strategy of the first IoT device against network attacks. Based on this design, the network control rules of the IoT device specify the devices and external websites that the IoT device is allowed to access, the devices and external websites that are not allowed to access the IoT device, the frequency at which the IoT device sends and receives data packets, and the control strategy of the IoT device against network attacks, so that when the network behavior of the IoT device is managed based on the network control rules corresponding to the IoT device, it is possible to defend against attacks and illegal access from the external network, defend against attacks and illegal access between devices within the local area network, prevent devices from attacking external networks, etc., and provide network security protection for the device.

[0009] In one possible design, the network MUD of the first IoT device specifies the devices and / or external websites that the first IoT device is allowed to access, the devices and / or external websites that the first IoT device is allowed to access, the frequency at which the first IoT device is allowed to send data packets and / or the frequency at which it receives data packets, and at least one of the management and control strategies of the first IoT device against network attacks; and / or, the network MUD of the application specifies the devices and / or external websites that the application is allowed to access, the devices and / or external websites that the application is allowed to access, the frequency at which the application is allowed to send data packets and / or the frequency at which it receives data packets, and at least one of the management and control strategies of the application against network attacks.

[0010] Based on this design, the network MUD of the IoT device specifies the devices and external websites that the IoT device is allowed to access, the devices and external websites that are not allowed to access the IoT device, the frequency of the IoT device sending and receiving data packets, the IoT device's control strategy for network attacks, etc. The network MUD of the application specifies the devices and external websites that the application is allowed to access, the devices and external websites that are not allowed to access the application, the frequency of the application sending and receiving data packets, the application's control strategy for network attacks, etc., so that when the network control rules of the IoT device are determined according to the network MUD of the IoT device and the network MUD of the application, it is possible to determine the devices and external websites that the IoT device is allowed to access, the devices and external websites that are not allowed to access the IoT device, the frequency of the IoT device sending and receiving data packets, the IoT device's control strategy for network attacks, etc., and then when the network behavior of the IoT device is managed, it is possible to defend against attacks and illegal access from the external network, defend against attacks and illegal access between devices within the local area network, prevent devices from attacking external networks, etc., and perform network security protection for the device.

[0011] In one possible design, the method further includes: obtaining a second network control rule corresponding to the second IoT device, the second network control rule being used to constrain the network behavior of the second IoT device, the second network control rule being different from the first network control rule; and managing the network behavior of the second IoT device according to the second network control rule. Based on this design, different IoT devices have different network control rules, and managing IoT devices according to their respective network control rules can more accurately identify abnormal behaviors of devices, achieve more efficient and detailed network security protection, and improve the network security of IoT devices.

[0012] In one possible design, the first network control rule stipulates that the first IoT device is allowed to access external websites and / or that external websites are allowed to access the first IoT device, and the second network control rule stipulates that the second IoT device is not allowed to access external websites and that external websites are not allowed to access the second IoT device. Based on this design, different IoT devices have different permissions to access external websites. For example, for smart speakers, external websites can be accessed and / or external websites are allowed to access smart speakers, which can meet the needs of smart speakers for downloading services. However, for smart door locks that do not have downloading service needs, external websites cannot be accessed or accessed by external websites. In this way, the functions of IoT devices can be used normally while achieving more efficient and detailed network security protection.

[0013] In one possible design, the second IoT device and the first IoT device have the same application installed, and the control strategy of the second IoT device for the application based on the second network control rule is different from the control strategy of the first IoT device for the application based on the first network control rule. Based on this design, IoT devices with the same application installed have different network control rules, and different IoT devices have different control strategies for the same application based on their own network control rules. In this way, when the same application is installed on different IoT devices, more efficient and detailed network security protection can be achieved, which can improve the network security of IoT devices.

[0014] In one possible design, a first application and a second application are installed on the first IoT device, and the first IoT device has different control strategies for the first application and the second application based on the first network control rule. Based on this design, for the same IoT device, when different applications are installed, the control strategies for different applications based on the network control rules of the IoT device are different. In this way, for the same IoT device, when different applications are installed, more efficient and detailed network security protection can be achieved, which can improve the network security of the IoT device.

[0015] In one possible design, after managing the network behavior of the first IoT device according to the first network control rule, the method further includes: obtaining an updated first network control rule; and managing the network behavior of the first IoT device according to the updated first network control rule. Based on this design, the network control rules of the IoT device can be updated, so that managing the network behavior of the IoT device according to the updated network control rules can further ensure the network security of the IoT device.

[0016] In one possible design, the obtaining of the updated first network control rule includes: obtaining the updated first network control rule when the application installed on the first IoT device changes, or when the network control rule configured by the user for the first IoT device changes. Based on this design, when the application installed on the IoT device or the network rule configured by the user for the IoT device changes, the network control rule of the IoT device may change, so further obtaining the updated network control rule can further ensure the network security of the IoT device.

[0017] In one possible design, the management of the network behavior of the first IoT device according to the first network control rule includes: obtaining a data packet carrying a destination address; forwarding the data packet to the destination address when the first network control rule stipulates that the first IoT device is allowed to access the device and / or the address of the external website includes the destination address; or intercepting the data packet when the first network control rule stipulates that the first IoT device is allowed to access the device and / or the address of the external website does not include the destination address. Based on this design, it is determined whether to intercept or forward the data packet based on the address of the device and / or the external website allowed to be accessed by the IoT device contained in the network control rule of the IoT device and the destination address of the data packet, thereby achieving management and control of the network behavior of the IoT device.

[0018] In one possible design, the management of the network behavior of the first IoT device according to the first network control rule includes: receiving a data packet carrying a source address; forwarding the data packet to the first IoT device, or parsing the data packet, when the first network control rule stipulates that the address of the device and / or external website that allows the first IoT device to be accessed includes the source address; or intercepting the data packet, when the first network control rule stipulates that the address of the device and / or external website that allows the first IoT device to be accessed does not include the source address. Based on this design, it is determined whether to intercept or forward the data packet based on the address of the device and / or external website that is allowed to access the IoT device and the source address of the data packet contained in the network control rule of the IoT device, thereby achieving management and control of the network behavior of the IoT device.

[0019] In one possible design, the method further includes: receiving a data packet, the data packet carrying a source address and a destination address; when the source address and the destination address do not belong to the address of the IoT device, forwarding the data packet to the destination address. Based on this design, when the source address and the destination address of the data packet do not belong to the address of the IoT device, it means that the data packet is a data packet corresponding to a non-IoT device, and the data packet is directly forwarded. In this way, data packets corresponding to non-IoT devices are not intercepted and managed, which will not affect the user's network bandwidth and can ensure the user's Internet experience.

[0020] In a possible design, the management of the network behavior of the first IoT device according to the first network control rule includes: using a fast data path XDP and managing the network behavior of the first IoT device according to the first network control rule. Based on this design, XDP is used to manage the network behavior of the IoT device according to the network control rule of the IoT device, and the decision can be made at the exit of the network card and the entrance of the operating system kernel. There is almost no need for the CPU of the network device to process, and the packet loss can be performed as quickly as possible, thereby improving the packet loss rate, saving CPU occupancy and memory resources, and improving traffic forwarding performance. In addition, the increase in packet loss rate can enable network devices to manage more IoT devices.

[0021] In one possible design, the first network device is a router.

[0022] In a second aspect, a network security protection method is provided, which is applied to a second network device, and the method includes: obtaining a network MUD of a first IoT device, a network MUD of an application installed on the first IoT device, and at least one of a network control rule configured by a user for the first IoT device; determining a first network control rule corresponding to the first IoT device based on the network MUD of the first IoT device, the network MUD of the application, and at least one of the network control rules configured by the user for the first IoT device, wherein the first network control rule is used to constrain the network behavior of the first IoT device; and sending the first network control rule to the first network device.

[0023] In one possible design, the first network control rule specifies the devices and / or external websites that the first IoT device is allowed to access, the devices and / or external websites that the first IoT device is allowed to access, the frequency at which the first IoT device is allowed to send data packets and / or the frequency at which it is allowed to receive data packets, and at least one of the management and control strategies of the first IoT device against network attacks.

[0024] In one possible design, the network MUD of the first IoT device specifies the devices and / or external websites that the first IoT device is allowed to access, the devices and / or external websites that the first IoT device is allowed to access, the frequency at which the first IoT device is allowed to send data packets and / or the frequency at which it receives data packets, and at least one of the management and control strategies of the first IoT device against network attacks; and / or, the network MUD of the application specifies the devices and / or external websites that the application is allowed to access, the devices and / or external websites that the application is allowed to access, the frequency at which the application is allowed to send data packets and / or the frequency at which it receives data packets, and at least one of the management and control strategies of the application against network attacks.

[0025] In one possible design, the method also includes: obtaining at least one of a network MUD of a second IoT device, a network MUD of an application installed on the second IoT device, and a network control rule configured by a user for the second IoT device; determining a second network control rule corresponding to the second IoT device based on the network MUD of the second IoT device, the network MUD of an application installed on the second IoT device, and at least one of the network control rules configured by the user for the second IoT device, wherein the second network control rule is used to constrain the network behavior of the second IoT device, and the second network control rule is different from the first network control rule; and sending the second network control rule to the first network device.

[0026] In one possible design, the first network control rule stipulates that the first IoT device is allowed to access external websites and / or external websites are allowed to access the first IoT device, and the second network control rule stipulates that the second IoT device is not allowed to access external websites and external websites are not allowed to access the second IoT device.

[0027] In one possible design, the second IoT device and the first IoT device have the same application installed, and the control strategy of the second IoT device for the application based on the second network control rule is different from the control strategy of the first IoT device for the application based on the first network control rule.

[0028] In one possible design, a first application and a second application are installed in the first IoT device, and the first IoT device has different control strategies for the first application and the second application based on the first network control rule.

[0029] In one possible design, the method also includes: updating the first network control rule.

[0030] In one possible design, the updating of the first network control rule includes: updating the first network control rule when an application installed on the first IoT device changes, or when the network control rule configured by the user for the first IoT device changes.

[0031] In one possible design, the second network device is a server.

[0032] In a third aspect, a device is provided, which has the function of implementing the method described in the first aspect or the second aspect and any one of the designs thereof. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0033] In a fourth aspect, a device is provided, comprising: a processor and a memory, the memory being coupled to the processor, the memory being used to store program code, the program code comprising instructions, the processor reading the instructions from the memory so that the device executes the method as described in the first aspect and any one of the designs thereof, or so that the device executes the method as described in the second aspect and any one of the designs thereof. Optionally, the memory may be coupled to the processor, or may be independent of the processor.

[0034] In one possible design, the device further includes a communication interface, which can be used for the device to communicate with other devices. Exemplarily, the communication interface can be a transceiver, an input / output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit, etc.

[0035] In a fifth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a computer program. When the computer program runs on a device, the device executes the method described in the first aspect or the second aspect and any design thereof.

[0036] In a sixth aspect, a computer program product is provided, the computer program product comprising: a computer program or instructions, when the computer program or instructions are run on a computer, the computer executes the method described in the first aspect or the second aspect and any design thereof.

[0037] In the seventh aspect, a chip system is provided, comprising at least one processor and at least one interface circuit, wherein the at least one interface circuit is used to perform transceiver functions and send instructions to at least one processor, and when the at least one processor executes the instructions, the at least one processor executes the method described in the first aspect or the second aspect and any design thereof.

[0038] In an eighth aspect, the present application provides a communication system, including a first network device and a second network device, wherein the first network device and the second network device cooperate to implement the method described in any design of any of the above aspects.

[0039] It should be noted that the technical effects brought about by any design in the above-mentioned second to eighth aspects can refer to the technical effects brought about by the corresponding design in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of a whole-house smart scene provided in an embodiment of the present application;

[0041] Figure 2A schematic diagram of the position of iptables in the OSI reference model provided in an embodiment of the present application;

[0042] Figure 3 A schematic diagram of the architecture of a communication system provided in an embodiment of the present application;

[0043] Figure 4 A schematic diagram of the structure of a network device provided in an embodiment of the present application;

[0044] Figure 5 A schematic diagram of the hardware structure of an IoT device provided in an embodiment of the present application;

[0045] Figure 6 A functional module diagram of a network device and a server provided in an embodiment of the present application;

[0046] Figure 7 A schematic diagram of a process flow of a network security protection method provided in an embodiment of the present application;

[0047] Figure 8 Interface diagram provided for the embodiment of the present application Figure 1 ;

[0048] Fig. 9 Interface diagram provided for the embodiment of the present application Figure 2 ;

[0049] Fig.10 A schematic diagram of the position of an efficient network monitoring module in the OSI reference model provided in an embodiment of the present application;

[0050] Fig.11 Interface diagram provided for the embodiment of the present application Figure 3 ;

[0051] Fig.12 A schematic diagram of the structure of a device provided in an embodiment of the present application;

[0052] Fig.13 A schematic diagram of the structure of a chip system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The technical solution provided by the embodiments of the present application is described in detail below in conjunction with the accompanying drawings.

[0054] In the description of this application, unless otherwise specified, " / " indicates that the objects associated with each other are in an "or" relationship, for example, A / B can represent A or B; "and / or" in this application is merely a description of the association relationship between associated objects, indicating that three relationships may exist, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.

[0055] In the description of this application, unless otherwise specified, "plurality" means two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, a and b, a and c, b and c, a and b and c, where a, b, and c can be single or multiple.

[0056] In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference.

[0057] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way for easy understanding.

[0058] The features, structures or characteristics in this application may be combined in one or more embodiments in any suitable manner. In various embodiments of this application, the size of the sequence number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0059] Some optional features in the embodiments of the present application may be implemented independently in some scenarios without relying on other features to solve corresponding technical problems and achieve corresponding effects. They may also be combined with other features in some scenarios as needed.

[0060] In this application, unless otherwise specified, the same or similar parts between the various embodiments can refer to each other. In each embodiment of this application, if there is no special description and logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships. The implementation methods of this application do not constitute a limitation on the scope of protection of this application.

[0061] In addition, the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0062] At present, various IoT devices have entered people's lives, and the concept of smart home has been proposed for the use of IoT devices in households. With the installation of more and more IoT devices in smart home scenarios, and even the installation of IoT devices throughout the house, the concept of whole-house intelligence has emerged. Whole-house intelligence uses the house as a platform, and integrates facilities related to home life using various technologies such as integrated wiring technology, network communication technology, security technology, automatic control technology, audio and video technology, etc. By building an efficient management system for residential facilities and family schedule affairs, it improves the experience of home safety, convenience, comfort and other aspects.

[0063] For example, Figure 1 The schematic diagram of the whole house intelligence scenario provided by the embodiment of the present application is shown. Figure 1 As shown, the whole house includes an entrance corridor, kitchen, dining room, living room, balcony, master bedroom, second bedroom, bathroom, etc. There are multiple IoT devices in the whole house. Specifically, the kitchen is equipped with rice cookers or electric pressure cookers, gas equipment, etc.; the living room is equipped with speakers (such as smart speakers), TVs (such as smart TVs, also called smart screens, large screens, etc.), routing devices, etc.; the balcony is equipped with clothes drying racks (such as smart clothes drying racks, etc.); the dining room is equipped with sweeping robots, etc.; the master bedroom is equipped with TVs (such as smart TVs), speakers (such as smart speakers), floor lamps (such as smart floor lamps), routing devices, etc.; the second bedroom is equipped with table lamps (such as smart table lamps), speakers (such as smart speakers), etc.; the bathroom is equipped with body fat scales, etc.

[0064] Among them, the IoT devices in the whole house smart scene can be connected by wired communication or wireless communication. Exemplarily, the wired communication method may include but is not limited to power line communication (PLC), etc. The wireless communication method may include but is not limited to near field communication (NFC), Bluetooth (BT) (for example, traditional Bluetooth or low energy (BLE) Bluetooth), wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) network), Zigbee, frequency modulation (FM), infrared (IR), etc.

[0065] In some embodiments, some IoT devices such as those in the whole-house smart scene have limited resources and relatively single capabilities. These IoT devices with limited resources and relatively single capabilities can be called IoT thin devices. Of course, these IoT devices with limited resources can also have other names, which are not limited to the embodiments of the present application. Exemplarily, these IoT devices can include but are not limited to various sensors, sweepers, smart lights, smart door locks, etc.

[0066] These IoT devices do not contain software or hardware for network security protection, such as: but not limited to firewalls, antivirus software, security hardware (such as but not limited to hardware for secure boot, hardware for generating secure random numbers, trusted execution environment (TEE), etc.). Therefore, these IoT devices are prone to become the entry point for external intrusion and attack, which makes network security protection face huge challenges. Exemplarily, common attacks may include but are not limited to one or more of port scanning, malicious control, remote attack, denial of service (DOS), etc. Among them, port scanning may refer to scanning the ports of other IoT devices in the local area network to find other devices that can be exploited and invaded. Malicious control may refer to impersonating an identity to maliciously control other legitimate devices, such as illegally opening a door. Remote attack may refer to remote control or implantation of Trojan software by taking advantage of the unclosed debugging interface or vulnerability of the IoT device. DOS attack may refer to a DOS attack on other devices in the local area network, causing other devices to be unable to be used normally.

[0067] In the relevant scheme, the network firewall is mainly opened by the router to isolate the internal and external networks of the whole house, so that the IoT devices in the whole house can only run in the internal LAN to achieve network security protection of IoT devices. It can be understood that the firewall can include a host firewall and a network firewall. The host firewall can protect a single host. The network firewall can be at the entrance or edge of the network, protecting the network entrance and serving the local LAN behind the firewall. It can also be understood that the intranet (or local area network (LAN)), that is, the internal network can refer to a network composed of multiple computers and network devices in a certain area, such as: campus network, company network, whole house network in the whole house smart scene, etc. The extranet (or wide area network, public network), that is, the external network is a communication network that connects computers in different regional LANs to communicate.

[0068] In this related solution, opening the network firewall will reduce the network bandwidth, affect the user's Internet experience, and make some device functions that require cross-network (such as device upgrades, etc.) unusable, affecting the linkage between IoT devices and the linkage between IoT devices and the cloud. In addition, because the router directly isolates the internal and external networks, it does not consider the network requirements of different IoT devices and cannot provide more detailed network security protection.

[0069] In addition, in the relevant solution, when it is specifically implemented, the router will use iptables to determine whether a data packet is allowed to access a certain network. Among them, iptables is a native capability of the Linux system and is also a commonly used firewall solution in the industry. It provides a large number of network monitoring capabilities. For example, Figure 2 FIG. 1 is a schematic diagram showing the position of iptables in the International Organization for Standardization (OSI) reference model provided by an embodiment of the present application. Figure 2 As shown in the figure, since the network card works at the data link layer and the router works at the network layer, iptables is located in the middle of the network layer. Therefore, the data packets sent from the network card will be transmitted to the network layer via the data link layer. It can be understood that the network card (or network adapter) is a device that enables a computer (such as a router) to connect to the network (such as a local area network). The network card can be inserted into the motherboard slot of a computer (such as a router) and is responsible for converting the data that the user wants to transmit into a format that can be recognized by other devices on the network and transmitted through the network medium.

[0070] Specifically, when a data packet is sent from the network card, after the router receives the data packet, it will first allocate a socket buffer (skb) to save the data packet, and then the router's operating system kernel will match each network rule preset in the router through iptables according to the source Internet Protocol (IP) address, destination IP address, source port, destination port and other network layer information of the data packet. It can be understood that the source IP address can be used to characterize the sender of the data packet, which refers to the address of the sender of the data packet. The destination IP address can be used to characterize the receiver of the data packet, which refers to the address of the receiver of the data packet. The source port can refer to the port used by the sender to send the data packet, and the destination port can refer to the port used by the receiver to receive the data packet.

[0071] Among them, the preset network rules can refer to the rules pre-set by the user for network monitoring of IoT devices, such as: device A cannot access the external network, device B can only access a certain address, etc. Only when all the preset network rules are traversed and it is determined that the data packet meets the forwarding requirements, the data packet can be released. However, when more and more network rules are configured for different IoT devices, the matching process will occupy more (central processing unit, CPU) resources and memory resources due to the need to traverse the network rules for matching, and the matching efficiency will be low, which will reduce the traffic forwarding performance.

[0072] Based on this, the embodiment of the present application provides a network security protection method, which can achieve efficient and more detailed network security protection. While improving the network security of IoT devices, it can meet the different network demands of different IoT devices, so that the device functions that need to cross the network can be used, and will not affect the linkage between IoT devices, and the linkage between IoT devices and the cloud, etc. In addition, it can also improve the packet loss rate and efficiency, reduce the CPU resources and memory resources occupied by the router, and improve the traffic forwarding performance.

[0073] For example, Figure 3 The schematic diagram of the architecture of a communication system to which a network security protection method is applied according to an embodiment of the present application is shown. Figure 3 As shown, the communication system 30 includes a network device 300 (which may be referred to as a first network device) and at least one IoT device 310 ( Figure 3 Only 6 are shown).

[0074] The network device 300 may be a dedicated device for managing the network access of the IoT device 310, or a device including the function of managing the network access of the IoT device 310. In some embodiments, the network device 300 may manage the network behavior of the IoT device 310 based on the network control rules corresponding to the IoT device 310, so as to realize the network security protection of the IoT device 310. For the introduction of the network control rules, please refer to the detailed introduction below.

[0075] It can be understood that in the embodiment of the present application, the network behavior of the IoT device 310 may include but is not limited to access to websites, devices, etc., the frequency of sending and / or receiving data packets, control strategies for network attacks, etc.

[0076] In some embodiments, the network device 300 can deploy an edge cloud (or edge cloud computing). It is understood that in the embodiments of the present application, the edge cloud is a cloud computing center distributed at the edge of the network side, providing real-time data processing, analysis and decision-making. The network device 310 can implement functions such as the domain name system (DNS) through the deployed edge cloud. It is understood that the DNS can resolve domain names that are easy for users to remember into IP addresses that can be recognized by computers. In some embodiments, since the websites included in the network control rules corresponding to the IoT device 310 (such as but not limited to websites that the IoT device 310 is allowed to access, websites that the IoT device is not allowed to access, etc.) are identified by domain names, the network device 300 can implement the function of domain name resolution by deploying an edge cloud.

[0077] In other embodiments, the edge cloud may also be deployed on other devices besides the network device 300, for example, the edge cloud may be deployed on a dedicated device 10, and the domain name resolution function may be implemented through the dedicated device 10. Figure 3 The communication system 30 shown may also include a device dedicated to implementing the domain name resolution function, namely, a dedicated device 10 ( Figure 3 not shown).

[0078] Of course, in other embodiments, the network device 300 or the dedicated device 10 may also implement the domain name resolution function by deploying other computing platforms, which is not limited in the embodiments of the present application.

[0079] In some embodiments, the network device 300 can also be used to implement connections between multiple networks, such as one or more of the following: connections between intranets and intranets, connections between intranets and extranets, etc., and use specific protocols to select and set paths for sending data packets.

[0080] Exemplarily, the network device 300 may include but is not limited to routers, gateways, and other devices with network interconnection functions or device interconnection functions. Figure 3 In the figure, the network device 300 is shown as a router.

[0081] Optionally, the IoT device 310 may be, for example, a speaker 311, a large screen device 312, a desk lamp 313, a smart light 314, a camera 315, an air purifier 316, smart curtains, a smart air conditioner, a smart door lock, or other IoT devices. In some embodiments, when the IoT device 310 accesses the network, it may be controlled by the network device 300 to achieve network security protection.

[0082] Optionally, the operating system installed in the network device 300 and / or IoT device 310 includes but is not limited to: Or other operating systems. Of course, the network device 300 and / or the IoT device 310 may not have an operating system installed. In some embodiments, the network device 300 and / or the IoT device 310 may be a fixed device or a portable device. This application does not limit the specific type of the network device 300 and / or the IoT device 310, whether an operating system is installed, and the operating system installed when an operating system is installed.

[0083] In some embodiments, different IoT devices 310 can be connected to the network device 300 , and the network device 300 can implement forwarding communication between different IoT devices 310 .

[0084] In other embodiments, the IoT devices 310 may establish wireless communication connections through cellular networks, the Internet, etc. For example, one IoT device 310 may access the Internet (i.e., an external network) through the network device 300, and another IoT device 310 may access the Internet through a cellular network, and then wireless communication connections may be established between different IoT devices 310.

[0085] Optionally, the network device 300 and the IoT device 310 may be connected via a wired communication method and / or a wireless communication method. Exemplarily, the wireless communication method may include, but is not limited to, establishing a connection via a wireless local area network (WLAN) (such as a wireless fidelity (Wi-Fi) network).

[0086] In some embodiments, Figure 3The communication system 30 shown may also include a server 320 (which may be referred to as a second network device). The server 320 may be used to store and manage network control rules corresponding to one or more IoT devices 310. Optionally, the server 320 may be a device or network device with computing functions such as a cloud server or a network server. The server 320 may be a single server, a server cluster consisting of multiple servers, or a cloud computing service center.

[0087] It can be understood that in this embodiment, a dedicated device (such as server 320) is used as an example to store and manage the network control rules corresponding to IoT device 310. In other embodiments, the storage and management of the network control rules corresponding to IoT device 310 can also be achieved through IoT device 310, etc.

[0088] In some embodiments, Figure 3 The communication system 30 shown may also include one or more management devices 330. The management device 330 may be used to implement management of the IoT device 310, such as: including but not limited to installing applications for the IoT device 310, configuring the network for the IoT device 310, checking the status of the IoT device 310 and other management operations. For example, the management device 330 may include but is not limited to a mobile phone ( Figure 3 terminal devices such as personal digital assistants (PDA), personal computers (PC), laptop computers (Laptop), wearable devices, and artificial intelligence (AI) devices.

[0089] Optional, Figure 3 Any two devices shown, such as but not limited to the server 320 and the management device 330, and the management device 330 and the IoT device 310, can establish a connection through a wired communication method and / or a wireless communication method. Exemplarily, the wireless communication method may include but is not limited to near field communication (NFC), Bluetooth (BT) (e.g., traditional Bluetooth or Bluetooth low energy (BLE)), wireless local area networks (WLAN) (e.g., wireless fidelity (Wi-Fi) networks), Zigbee, frequency modulation (FM), infrared (IR), etc.

[0090] Optional, Figure 3 The simplified schematic diagram is provided for ease of understanding. In actual applications, the above system may further include other devices which are not shown in the figure.

[0091] Optionally, the network device 300 in the embodiment of the present application may be implemented by different devices. Figure 4 This can be achieved by using the devices in the Figure 4 The hardware structure diagram of the network device 300 provided in the embodiment of the present application is shown. The network device 300 includes at least one processor 401, a communication line 402, a memory 403 and at least one communication interface 404.

[0092] Processor 401 can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application. In some embodiments of the present application, processor 401 can be used to resolve domain names into IP addresses. In some other embodiments of the present application, processor 401 can also be used to control the network behavior of IoT devices according to the network control rules corresponding to the IoT devices. In some other embodiments of the present application, processor 401 can also be used to generate network reports.

[0093] The communication link 402 may include a pathway to transmit information between the above-mentioned components.

[0094] Communication interface 404 is used to communicate with other devices (such as but not limited to Figure 3 The communication interface 404 may be used to communicate with the IoT device 310, server 320, etc. shown in the figure). In an embodiment of the present application, the communication interface may be a module, a circuit, a bus, an interface, a transceiver or other device capable of realizing a communication function, for communicating with other devices. Optionally, when the communication interface is a transceiver, the transceiver may be an independently arranged transmitter, which may be used to send information to other devices, or the transceiver may be an independently arranged receiver, for receiving information from other devices. The transceiver may also be a component that integrates the functions of sending and receiving information, and the embodiments of the present application do not limit the specific implementation of the transceiver. In some embodiments of the present application, the communication interface 404 may be used to receive network control rules corresponding to the IoT device from the server 320. In other embodiments of the present application, the communication interface 404 may also be used to receive and / or send data packets transmitted in the network. In still other embodiments of the present application, the communication interface 404 may also be used to send data packets to devices such as Figure 3 Management device 330 is shown sending a network report.

[0095] The memory 403 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 403 may exist independently and be connected to the processor 401 via the communication line 402. The memory 403 may also be integrated with the processor 401.

[0096] The memory 403 is used to store computer-executable instructions for implementing the solution of the present application, and the execution is controlled by the processor 401. The processor 401 is used to execute the computer-executable instructions stored in the memory 403, thereby implementing the method provided in the following embodiments of the present application.

[0097] Optionally, the computer-executable instructions in the embodiments of the present application may also be referred to as application code, instructions, computer program or other names, which are not specifically limited in the embodiments of the present application.

[0098] In some embodiments of the present application, the memory 403 may be used to store network control rules corresponding to IoT devices.

[0099] In a specific implementation, as an embodiment, the processor 401 may include one or more CPUs, such as Figure 4 CPU0 and CPU1 in.

[0100] In a specific implementation, as an embodiment, the network device 300 may include multiple processors, such as Figure 4 401 and processor 405 in FIG. Each of these processors may be a single-CPU processor or a multi-CPU processor. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0101] The network device 300 may be a general device or a dedicated device, and the embodiment of the present application does not limit the type of the network device 300. The network device 300 may be a device having Figure 4 Devices of similar structure.

[0102] It is understandable that the structure shown in the embodiment of the present application does not constitute a specific limitation on the network device 300. In other embodiments of the present application, the network device 300 may include Figure 4 More or fewer components are shown, or some components are combined, or some components are separated, or different component arrangements are arranged. The components shown can be implemented in hardware, software, or a combination of software and hardware.

[0103] For example, Figure 5 A schematic diagram of the hardware structure of an IoT device 310 provided in an embodiment of the present application is shown.

[0104] like Figure 5 As shown, the IoT device 310 may include a processor 510, a memory 520, a universal serial bus (USB) interface 530, a charging management module 540, a power management module 541, a battery 542, an antenna, a wireless communication module 550, and the like.

[0105] The processor 510 may include one or more processing units, for example, the processor 510 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0106] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0107] The processor 510 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 510 is a cache memory. The memory may store instructions or data that the processor 510 has just used or cyclically used. If the processor 510 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 510, and thus improves the efficiency of the system.

[0108] In some embodiments, the processor 510 may include one or more interfaces, such as a universal serial bus (USB) interface.

[0109] The charging management module 540 is used to receive charging input from a charger, where the charger can be a wireless charger or a wired charger.

[0110] The power management module 541 is used to connect the battery 542, the charging management module 540 and the processor 510. The power management module 541 receives input from the battery 542 and / or the charging management module 540 to supply power to the processor 510, the memory 520, and the wireless communication module 550.

[0111] The wireless communication function of the IoT device 310 can be implemented through an antenna, a wireless communication module 550, a modem processor, and a baseband processor.

[0112] The antenna is used to transmit and receive electromagnetic wave signals. Each antenna in the IoT device 310 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of the antenna. For example, the antenna can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0113] The wireless communication module 550 can provide wireless communication solutions for application in the IoT device 310, including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication technology (NFC), infrared technology (IR), etc.

[0114] In some embodiments, the antenna of the IoT device 310 is coupled to the wireless communication module 550, so that the IoT device 310 can communicate with the network and other devices (such as but not limited to) through wireless communication technology. Figure 3 The network device 300, management device 330, etc. shown in the figure may communicate with one or more of them.

[0115] The memory 520 can be used to store computer executable program codes, which include instructions. The memory 520 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function), etc. The data storage area may store data (such as audio data) created during the use of the IoT device 310, etc. In addition, the memory 520 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash memory, etc. The processor 510 executes various functional applications and data processing of the IoT device 310 by running instructions stored in the memory 520 and / or instructions stored in a memory provided in the processor.

[0116] The above is merely an example of the structure of the IoT device 310 in the embodiment of the present application, but does not constitute a limitation on the structure and form of the IoT device 310. The embodiment of the present application does not limit the structure and form of the IoT device 310. For example, the structure of the IoT device 310 may also be such as Figure 4 The form of the network device 300 is shown, but the present application is not limited thereto.

[0117] In some other embodiments of the present application, the IoT device 310 may include Figure 5 More or fewer components are shown, for example, the IoT device 310 may also include one or more of an audio module, a sensor module, a button, a motor, an indicator, a camera, a display screen, etc. Or some components may be combined, or some components may be separated, or some components may be replaced, or different component arrangements may be used. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0118] about Figure 3 The structure of the server 320 and / or the management device 330 shown can be referred to Figure 4 The network device 300 and Figure 5 310. Optionally, the server 320 and / or the management device 330 may include: Figure 4 The network device 300 and Figure 5The IoT device 310 shown may have more or fewer components, or combine some components, or split some components, or replace some components, or arrange the components differently. The components shown may be implemented in hardware, software, or a combination of software and hardware.

[0119] In some embodiments, the network device 300 and the server 320 may be divided into functional modules, such as dividing each functional module corresponding to each function, or integrating two or more functions into one processing unit. The above integrated unit may be implemented in the form of hardware or software functions.

[0120] As a way of dividing Figure 6 A functional module diagram of a network device 300 and a server 320 provided in an embodiment of the present application is shown.

[0121] like Figure 6 As shown, the network device 300 may include a device management hub module 601 and an efficient network monitoring module 602. Among them, the device management hub module 601 can be used to manage one or more IoT devices and record (or store) the identification of the one or more IoT devices. Exemplarily, the identification of the IoT device may include but is not limited to the address of the IoT device, other identifications of the IoT device, etc. For example, the address of the IoT device may include but is not limited to an IP address, a media access control (MAC) address, etc. The device management hub module 601 can also be used to receive network control rules corresponding to the IoT device, and send the network control rules corresponding to the IoT device to the efficient network monitoring module 602.

[0122] The efficient network monitoring module 602 may be used to receive network control rules corresponding to one or more IoT devices from the device management hub module 601. The efficient network monitoring module 602 may also be used to manage the network behavior of the IoT device based on the network control rules corresponding to the IoT device. In some embodiments, the efficient network monitoring module 602 may also be used to generate network reports, etc.

[0123] The server 320 may include the MUD management module 611. The MUD management module 611 may be used to store and manage network control rules corresponding to one or more IoT devices. In some embodiments, the MUD management module 611 may also be used to send network control rules corresponding to one or more IoT devices to the network device 300.

[0124] Understandably, Figure 6 The division method shown is only schematic and is only used as a logical function division. There may be other division methods in actual implementation.

[0125] The technical solutions involved in the following embodiments can all be implemented in Figure 4 , Figure 5 , Figure 6 The device of the structure shown, and Figure 3 The system is implemented in the system with the architecture shown.

[0126] It can be understood that in the following embodiments, the network device 300 is a network device, the IoT device 310 is an IoT device, the server 320 is a server, and the management device 330 is a management device for description. The network device, and / or the IoT device, and / or the server, and / or the management device can perform some or all of the steps in the embodiments of the present application. These steps or operations are only examples. The embodiments of the present application can also perform other operations or variations of various operations. In addition, the various steps can be performed in different orders presented in the embodiments of the present application, and it is possible that not all operations in the embodiments of the present application need to be performed.

[0127] For example, Figure 7 A schematic diagram of a network security protection method provided by an embodiment of the present application is shown. Figure 7 As shown, the method comprises the following steps:

[0128] S701. The server obtains the network control rules corresponding to the IoT device.

[0129] Among them, the network control rules corresponding to the IoT device can be used to constrain the network behavior of the IoT device. The network control rules specify the networks that the IoT device is allowed to access (such as but not limited to websites, devices, etc.), the networks that are allowed to be accessed, the networks that are not allowed to be accessed, the networks that are not allowed to be accessed, the frequencies of allowing data packets to be sent, the frequencies of receiving data packets, and the control strategies for network attacks. It can be understood that the networks that the IoT device is allowed to access can refer to which networks are allowed to access the IoT device. Similarly, the networks that the IoT device is not allowed to access can refer to which networks are not allowed to access the IoT device. In this way, the network control rules corresponding to the IoT device specify the networks that the IoT device is allowed to access, the networks that are allowed to be accessed, the networks that are not allowed to be accessed, and the networks that are not allowed to be accessed. At least one of the above, so that when the network behavior of the IoT device is managed based on the network control rules corresponding to the IoT device, it can defend against attacks and illegal access from external networks, defend against attacks and illegal access between devices within the local area network, prevent devices from attacking external networks, etc., and perform network security protection for the device.

[0130] Optionally, the network control rules corresponding to the IoT device reflect the network access requirements of the IoT device, and different IoT devices may have different network access requirements. In other words, the network control rules corresponding to different IoT devices may be different. For example, the network control rules corresponding to the smart speaker stipulate that the speaker can access external websites or be accessed by external websites; while the network control rules corresponding to the smart door lock stipulate that the smart door lock cannot access external websites or be accessed by external websites.

[0131] It can be understood that in the embodiments of the present application, the existence of corresponding network control rules for IoT devices is taken as an example. In some embodiments, corresponding network control rules may also exist for applications installed in the same IoT device. Optionally, the corresponding network control rules may be different for different applications installed in the same IoT device. For the implementation of generating network control rules corresponding to applications installed in IoT devices, reference may be made to the implementation of generating network control rules for IoT devices described below.

[0132] In some embodiments, the server can generate (or determine) a network MUD corresponding to the IoT device based on at least one of the network MUD of the IoT device, the network MUD of the application installed on the IoT device, and the network permissions (or network control rules) configured by users (such as but not limited to consumers, installation and maintenance personnel, etc.) for the IoT device and / or the application installed in the IoT device.

[0133] It can be understood that in the embodiments of the present application, the network MUD of the IoT device may refer to the description of the network part in the MUD of the IoT device. The MUD of the IoT device may be a file provided by the provider of the IoT device (such as but not limited to the manufacturer, etc.), which is configured to constrain the IoT device and contains information describing the device type of the IoT device, network access rights, etc.

[0134] Optionally, in an embodiment of the present application, the generated network control rules corresponding to the IoT device can be saved in the MUD file of the IoT device, or can be stored in a new file, and the embodiment of the present application does not impose any restrictions on this.

[0135] In some embodiments, the network MUD of the IoT device specifies at least one of the following: websites and / or devices that the IoT device can access (or websites and / or devices that the IoT device is allowed to access), websites and / or devices that the IoT device can access (or websites and / or devices that the IoT device is allowed to access), the frequency of sending data packets that the IoT device can accept (or the frequency at which the IoT device is allowed to send data packets), the frequency of receiving data packets that the IoT device can accept (or the frequency at which the IoT device is allowed to receive data packets), and the IoT device's management and control strategies for network attacks.

[0136] In the embodiment of the present application, the control strategy for network attacks may include but is not limited to limiting the frequency of sending and / or receiving data packets, limiting the networks (such as websites, devices) that are allowed or permitted to be accessed, etc.

[0137] It can be understood that the frequency of sending data packets that the IoT device can accept can refer to the frequency range within which the IoT device can send data packets, such as: how many data packets can be sent at most in 1 second. Similarly, the frequency of receiving data packets that the IoT device can accept can refer to the frequency range within which the IoT device can receive data packets, such as: how many data packets can be received at most in 1 second.

[0138] Optionally, the network MUD of the IoT device may be different for different IoT devices, for example, including but not limited to the websites and / or devices that the IoT device can access, the websites and / or devices that the IoT device can access, the frequency of sending data packets that the IoT device can accept, the frequency of receiving data packets that the IoT device can accept, and the control strategy of the IoT device against network attacks.

[0139] In some implementations, the network MUD of an IoT device may be determined based on one or more of the device type, the device security level, etc. For example, the network MUD of an IoT device with a higher security level may specify that access to the external network is allowed and / or that the external network is allowed to access the IoT device. The network MUD of an IoT device with a lower security level may specify that access to the external network is not allowed and / or that the external network is not allowed to access the IoT device.

[0140] For another example: For some IoT devices with richer functions (such as smart speakers and other music devices), the network MUD can stipulate that access to the external network and / or access to the IoT device is allowed. For some IoT devices with simpler functions (such as smart door locks, etc.), the network MUD can stipulate that access to the manufacturer's upgrade website, edge cloud servers, etc. is allowed, but access to devices with external network access permissions (such as the aforementioned smart speakers and other music devices), cloud servers, etc. is not allowed. In this way, the network MUD of different IoT devices can be set according to the device type, security level, etc., so that an IoT device can have its own network MUD, and then an IoT device can have its own corresponding network control rules, so that the IoT device can be managed according to the network control rules corresponding to each IoT device, and more detailed network security protection can be achieved.

[0141] It is understood that in the embodiment of the present application, the network MUD of the application may refer to the description of the network part in the MUD of the application. The MUD of the application may also be a file provided by the provider of the application (such as but not limited to software developers, etc.), which is configured to constrain the application and contains information describing the type of application, network access rights, etc.

[0142] In some embodiments, the network MUD of the application installed on the IoT device specifies at least one of the following: the websites and / or devices that the application can access (or the websites and / or devices that the application is allowed to access), the websites and / or devices that the application can access (or the websites and / or devices that the application is allowed to access), the frequency of sending data packets that the application can accept (or the frequency at which the application is allowed to send data packets), the frequency of receiving data packets that the application can accept (or the frequency at which the application is allowed to receive data packets), and the application's control strategy for network attacks. It can be understood that the frequency of sending data packets that the application can accept can refer to the frequency within which the application can send data packets, such as: how many data packets can be sent at most in 1 second. Similarly, the frequency of receiving data packets that the application can accept can refer to the frequency within which the application can receive data packets, such as: how many data packets can be received at most in 1 second.

[0143] Optionally, for different applications, the network MUD of the application may also be different. For example, including but not limited to the websites and / or devices that the application can access, the websites and / or devices that the application can access, the frequency of sending data packets that the application can accept, the frequency of receiving data packets that the application can accept, and the control strategy of the application against network attacks.

[0144] It can also be understood that in the embodiments of the present application, the application installed by the IoT device, or in some scenarios, the plug-in, can refer to a computer program running inside the IoT device for completing one or more specific tasks. It can be presented in the form of an application with a human-computer interaction interface, such as displayed on the desktop of the IoT device, or it can be presented in the form of running inside the IoT device without a human-computer interaction interface.

[0145] In some embodiments, for the same IoT device, when the applications installed on the IoT device are different, the network control rules corresponding to the IoT device may be different. In other embodiments, for different applications installed on the same IoT device, the control strategies of the IoT device for different applications based on its own network control rules may be different, that is, the network control rules corresponding to different applications in the same IoT device may be different.

[0146] In some embodiments, for different IoT devices, when the applications installed on the IoT devices are the same, the network control rules corresponding to the different IoT devices may also be different. In other embodiments, for the same application installed on different IoT devices, the control strategies of different IoT devices for the same application based on their own network control rules may also be different, that is, the network control rules corresponding to the same application in different IoT devices may be different.

[0147] Optionally, the control policy of the IoT device for the application based on the network control rules may include but is not limited to the frequency with which the application is allowed to receive and / or send and / or receive data packets, the networks (such as websites, devices) that are allowed or permitted to be accessed, etc.

[0148] It can be understood that in the embodiment of the present application, the network permissions configured by the user for the IoT device also specify at least one of the websites and / or devices that the IoT device can access, the websites and / or devices that the IoT device can access, the frequencies of sending data packets that the IoT device can accept, the frequencies of receiving data packets that the IoT device can accept, and the control strategies of the IoT device against network attacks. The network permissions configured by the user for the application installed by the IoT device also specify at least one of the websites and / or devices that the application can access, the websites and / or devices that the application can access, the frequencies of sending data packets that the application can accept, the frequencies of receiving data packets that the application can accept, and the control strategies of the application against network attacks.

[0149] In some embodiments, the network permissions configured by the user for the IoT device can be determined based on the network permissions required by the functions configured by the user for the IoT device. For example, the network permissions configured by the user and the IoT device can be the same as the network permissions required by the functions configured by the user for the IoT device. For example, taking the whole house smart scene as an example, the user configures that when the owner enters the door and goes home through the smart door lock by entering the password, the smart door lock controls the smart lights, smart curtains, smart air conditioners, etc. to open. The smart door lock controls the smart lights, smart curtains, smart air conditioners, etc. to open, which requires the smart door lock to have permissions to access the smart lights, smart curtains, smart air conditioners, etc. Therefore, the network permissions configured by the user for the IoT device (i.e., smart door locks, smart lights, smart curtains, smart air conditioners, etc.) include: the devices that the smart door lock can access include: smart lights, smart curtains, smart air conditioners, etc.; the devices that can be accessed by smart lights, smart curtains, smart air conditioners, etc. include: smart lights.

[0150] Optionally, the user can configure one or more functions for the IoT device through various user operations. Exemplarily, the user operation may include but is not limited to various voice operations, key operations, gesture operations, etc. In some examples, the user operation may be directly received by the IoT device, and in other examples, the user operation may also be received by other devices other than the IoT device, such as including but not limited to management devices. Optionally, the IoT device and / or other devices may also be installed with an application for implementing the functional configuration of the IoT device, and the application may be used to receive the aforementioned user operations.

[0151] The following takes the management device as a mobile phone, in which an application for realizing the function configuration of the IoT device is installed, and the application is a smart life application as an example to introduce the process of users configuring functions for the IoT device.

[0152] In some embodiments, the mobile phone accesses a local area network (such as but not limited to Figure 3 After the local area network provided by the network device 300 shown in the figure is found, IoT devices connected to the same local area network and / or logged in to the same account can be found. Exemplarily, the account is used to represent the account of the IoT device management system that the device logs in to during the server registration process, for example: the account can be the account of the smart life application registered by the user.

[0153] like Figure 8 As shown in (1), the mobile phone displays a main interface 800 (or desktop 800), which includes one or more application icons, such as a calendar application icon, a weather application icon, etc., which are not described one by one here. The icons of different applications can be used to open the running interface of the corresponding application and implement the functions of the corresponding application. The one or more application icons include an icon 801 of a smart life application.

[0154] If the mobile phone detects a user clicking on the icon 801 of the smart life application, in response to the clicking operation, such as Figure 8 As shown in (2), the mobile phone displays the operation interface 810 of the smart life application. Among them, a scene control 811 is displayed in the operation interface 810, and the scene control 811 can be used to create one or more scenes.

[0155] Optionally, one or more cards of IoT devices that have been added to the smart life application are displayed in the operation interface 810, such as cards of TV, projector, speaker, oven, dishwasher, router, steamer, etc. Optionally, IoT devices can be added to the smart life application by scanning code, adding account, searching, etc., which is not limited in this application.

[0156] If the mobile phone detects that the user Figure 8 In response to the click operation of the scene control 811 shown in (2), as shown in FIG. Figure 8 As shown in (3), the mobile phone can display a scene recommendation interface 820. The scene recommendation interface 820 may include one or more scene cards recommended by smart life applications, and the user can select one or more scene cards according to actual needs to create a scene. If the mobile phone detects a user clicking on a warm home scene card 821, in response to the operation, Figure 8 As shown in (4), the mobile phone can display the creation interface 830 of the warm home scene. For example, the warm home scene can be used to realize that when the smart door lock opens the door from 6:00 pm to 7:00 am the next day, the smart light is turned on. This warm home scene can be used to realize the linkage between the smart door lock and the smart light. If the user executes the selection button 832 and clicks the add to my scene button 831, in response to the operation, the mobile phone creates the linkage function of the smart door lock and the smart light in the warm home scene. In other words, the user configures the function of turning on the smart light for the smart door lock. If the smart door lock wants to control the smart light to turn on, the smart door lock needs to have the permission to access the smart light. Therefore, it is equivalent to that the user configures the network permission for the smart door lock to allow access to the smart light, and configures the network permission for the smart light to allow access by the smart door lock.

[0157] Understandably, Figure 8 Only one method of implementing the IoT device configuration function (IoT device linkage function) by creating a scene is shown. You can also create scenes in other ways, such as: Figure 8 The function button 812 described in (2) Figure 8The function button 822 shown in (3) etc. realizes the creation of scenes, and then realizes the configuration function of IoT devices. For other methods of creating scenes through smart life, please refer to the implementation in the relevant technology. Alternatively, the function configuration of IoT devices can be realized by other methods besides creating scenes, and the embodiments of the present application do not limit this.

[0158] It can also be understood that the above embodiment is based on the example of a user configuring functions for an IoT device and then configuring network permissions for the IoT device. In other embodiments, the user can also directly configure network permissions for the IoT device, for example: the user can also configure the network permissions of the IoT device through various user operations, and the embodiments of the present application do not specifically limit this.

[0159] Optionally, the websites that can be accessed by the IoT device and / or the application installed in the IoT device may include, but are not limited to, websites included in the external network and websites included in the internal network. The websites that can be accessed by the IoT device and / or the application installed in the IoT device may include, but are not limited to, websites included in the external network and websites included in the internal network.

[0160] Optionally, the devices that can be accessed by the IoT device and / or the application installed on the IoT device may include but are not limited to the IoT devices included in the intranet, other devices other than the IoT device (such as: mobile phones), devices included in the extranet, etc. The devices that can be accessed by the IoT device and / or the application installed on the IoT device may include but are not limited to the IoT devices included in the intranet, other devices other than the IoT device (such as: mobile phones), devices included in the extranet, etc.

[0161] Taking the example that the devices that IoT can access or be accessed are devices in the intranet, in some embodiments, the network control rules corresponding to the IoT devices in the same home network stipulate that the IoT device cannot access other IoT devices in the home network, that is, the IoT devices in the home network cannot access each other. In this way, it can be prevented that an IoT device without external network access rights can access the external network through an IoT device with external network access rights. For example: the network control rules of the control panel stipulate that the control panel is allowed to access external websites, but other IoT devices are not allowed to access the control panel. In this way, it can be prevented that other IoT devices can access external websites through the control panel.

[0162] In other embodiments, IoT devices in the same home network can also access each other. For example, the network control rules corresponding to the IoT device specifically specify which IoT devices in the home network the IoT device can access, or which IoT devices in the home network can be accessed. As a specific embodiment, the server can summarize the network MUD of the IoT device, the network MUD of the application installed by the IoT device, the network permissions configured by the user for the IoT device and / or the application installed in the IoT device, etc., and take the union range of the above three to obtain the network control rules corresponding to the IoT device. It can be understood that the IoT device installs the application, which may be that the user wants to use the function of the application. If the application is to be successfully run, the IoT device that installs the application must have the network access permission of the application. In this way, taking the union range of the above three, the network permission of the IoT device can be expanded compared to the network MUD originally configured for the IoT device. The network access permission of the IoT device finally determined can include the network access permission configured by the application, which can ensure that the application installed in the IoT device can run normally and meet the user's experience. Similarly, the user configures the network permission for the IoT device and / or the application installed in the IoT device, which may also be that the user wants the IoT device, the application installed in the IoT device, etc. to have the network permission. In this way, by taking the union range of the above three, the network access rights of the IoT device finally determined can include the network rights configured by the user for the IoT device and / or the application installed in the IoT device, thereby satisfying the user experience.

[0163] For example, if the network MUD of an IoT device stipulates that the IP address of the network that the IoT device can access is 192.168.3.1, and the network MUD of the application installed on the IoT device stipulates that the IP address of the network that the IoT device can access is 192.168.3.*. Since the range of 192.168.3.* includes 192.168.3.1, taking the union can obtain the network control rule corresponding to the IoT device, which stipulates that the IP address of the network that the IoT device can access is 192.168.3.*.

[0164] In some embodiments, in the network MUD and / or the network permissions configured by the user, the websites and / or devices that can be accessed and / or accessed can be identified by domain names (or network domains). It can be understood that since the IP address used to identify the computer on the network is not easy for users to remember, the domain name can also be widely used to identify the computer. The domain name is the name of a computer or computer group on the Internet composed of a string of names separated by dots, which is used to locate the computer during data transmission. Exemplary, the domain name suffix may include but is not limited to ".com", ".cn", ".net", ".edu", etc. Among them, there is a corresponding relationship between the domain name and the IP address, and a domain name can correspond to one or more IP addresses. In this way, when the provider of the IoT device configures the network MUD of the IoT device, the provider of the application configures the network MUD of the application, and the user configures the network permissions of the IoT device, they can all use domain names that are easy for users to remember to identify websites, devices, etc., which can save the time and manpower costs of configuring the network MUD, configuring network permissions, etc.

[0165] For example, the network MUD of IoT device 1 stipulates that IoT device 1 can access "xxx1.cn" and "huawei.com", but cannot access "moe.gov.cn" etc.

[0166] In other embodiments, in the network MUD and / or user-configured network permissions, the specified websites and / or devices that can be accessed and / or visited can also be directly identified by identifiers that are easy for computers to recognize, such as IP addresses, media access control (MAC) addresses, etc., and the embodiments of the present application do not limit this.

[0167] For example, the network MUD of IoT device 2 stipulates that IoT device 2 can access "196.123.152.3", but cannot access "196.326.967.*", "156.189.126.7", etc.

[0168] In some other embodiments, the above two identification methods may also be used in combination. That is, in the network MUD and / or the network permissions configured by the user, the websites and / or devices that can be accessed and / or visited may be identified by domain name, IP address, MAC address, etc.

[0169] It can be understood that in this embodiment, the server generates the network control rules corresponding to the IoT device as an example. In other embodiments, the server can also obtain the network control rules corresponding to the IoT device from other devices. Optionally, other devices can also generate the network control rules corresponding to the IoT device in a manner such as that adopted by the server or in other manners, and the embodiments of the present application do not limit this.

[0170] In some embodiments, before generating network control rules corresponding to the IoT device, the server may also first obtain at least one of the network MUD of the IoT device, the network MUD of the application installed on the IoT device, the network permissions configured by the user for the IoT device and / or the application installed in the IoT device, etc.

[0171] Optionally, the network MUD of the IoT device, the network MUD of the application installed in the IoT device, and the network permissions configured by the user for the IoT device and / or the application installed in the IoT device may be obtained simultaneously or sequentially.

[0172] For example: the network MUD of the IoT device and the network MUD of the application can be provided to the server by the provider of the IoT device and stored in the server before the network control rules of the IoT device are configured, and the server can obtain them directly from the inside. Of course, the network MUD of the IoT device and the network MUD of the application can also be stored in other devices, and the server can obtain them from other devices. Optionally, the network MUD of the application can include the network MUD of one or more applications, and these applications can include applications installed on the IoT device. Optionally, these applications can also include applications that are not installed on the IoT device.

[0173] In some embodiments, the server and / or other devices can monitor whether an IoT device has an application installed, and which specific application is installed, and then the server and / or other devices can determine the network MUD of the application installed by the IoT device based on the application installed by the IoT device and the network MUD of the stored application. Optionally, the server and / or other devices can monitor the management device and / or IoT device of the IoT device, for example: the server and / or other devices can monitor the management device and / or IoT device of the IoT device by sending requests and responses. Of course, monitoring can also be achieved in other ways, and the embodiments of the present application do not impose any restrictions on this.

[0174] In some embodiments, the installation of an application in an IoT device can be implemented through a management device. For example, the management device can receive a user operation for installing an application in an IoT device, and in response to the user operation, the management device can implement the installation of the application in the IoT device. Exemplarily, the user operation can include but is not limited to various voice operations, key operations, gesture operations, etc.

[0175] In other embodiments, the application program may also be installed directly to the IoT device through the IoT device. In other words, the user operation for installing the application program in the IoT device may also be directly received by the IoT device, and the embodiments of the present application do not limit this.

[0176] The following takes an application installed in a management device to implement the installation of an application in an IoT device, where the application is a smart life application, as an example to introduce the process of installing the application in the IoT device.

[0177] Combination Figure 8 In the operation interface 810 of the smart life shown in (2), one or more cards of IoT devices that have been added to the smart life application are displayed in the operation interface 810. Users can install applications to one or more IoT devices according to actual needs. For example, taking the example of installing an application to a router, users can click on such as Figure 8 Card 813 (of the router shown in (2) Figure 8 The click operation is not shown in the figure), in response to the user's click operation, such as Fig. 9 As shown in (1), the mobile phone displays a router management interface 900. Among them, a router market control 901 is displayed in the router management interface 900, which can be used to download applications. Optionally, one or more other controls may also be displayed in the router management interface, such as including but not limited to an upgrade management control, a routing setting control, etc. For these controls, the embodiments of the present application will not be described in detail.

[0178] If the mobile phone detects a user clicking operation on the routing market control 901, in response to the operation, such as Fig. 9 As shown in (2), the mobile phone can display the router market operation interface 910. The router market interface 910 includes one or more applications, such as a router status application, a timed redial application, a restart plan application, etc. The user can select the corresponding application to download according to actual needs.

[0179] If the mobile phone detects an operation such as a user clicking on the download button 911 of the restart plan application, in response to the operation, the mobile phone can download the router restart plan application. After the download is complete, the mobile phone can display a message such as Fig. 9The installation interface 920 shown in (3) in the figure. The installation interface 920 may include an installation button 921. The mobile phone detects an operation such as a user clicking the installation button 921. In response to the operation, the mobile phone installs the restart plan application for the router. Optionally, some reminder messages may also be displayed in the installation interface 920, such as: permissions required by the application, etc.

[0180] Furthermore, after performing operations such as installing applications for IoT devices as described above, the server can monitor the applications installed on the IoT devices from the mobile phone and / or IoT device side, such as the restart plan application installed on the router.

[0181] In some embodiments, the server and / or other devices may also obtain the network permissions configured by the user for the IoT device and / or the application installed in the IoT device from the management device of the IoT device and / or the IoT device.

[0182] In some scenarios, since the timing of installing any application on an IoT device is uncertain, the timing of the server obtaining the network MUD of the application installed on the IoT device may also be uncertain. Similarly, the timing of the user configuring the network permissions for the IoT device and / or the application installed in the IoT device may also be uncertain. Therefore, the network permissions configured by the user for the IoT device and / or the application installed in the IoT device obtained by the server may also be uncertain. The network MUD of the IoT device can be directly provided to the server by the provider of the IoT device, so there may be a situation where the server only obtains the network MUD of the IoT device.

[0183] In this scenario, in some embodiments, when the server first obtains the network MUD of the IoT device, the server may also first generate the network control rules corresponding to the IoT device according to the network MUD of the IoT device. At this time, the network control rules corresponding to the IoT device may be the same as the network MUD of the IoT device.

[0184] Furthermore, when the server obtains at least one of the network MUD of the application installed by the IoT device, the network permissions configured by the user for the IoT device and / or the application installed in the IoT device, etc., the server may update the network control rules corresponding to the IoT device generated only based on the network MUD of the IoT device. For example: the network control rules corresponding to the IoT device are generated based on at least one of the network MUD of the application installed by the IoT device, the network permissions configured by the user for the IoT device and / or the application installed in the IoT device, etc., and the network MUD of the IoT device.

[0185] Furthermore, when the application installed on the IoT device changes, such as uninstalling or installing a new application, and / or the network permissions configured by the user for the IoT device and / or the application installed in the IoT device change, the server can continue to update the network control rules corresponding to the updated IoT device. For example, the server can update the network control rules corresponding to the IoT device based on one or more of the network MUD of the updated application, the network permissions newly configured by the user for the IoT device and / or the application installed in the IoT device, and the network MUD of the IoT device.

[0186] S702: The server sends the network control rules corresponding to the IoT device to the network device. Correspondingly, the network device receives the network control rules corresponding to the IoT device from the server.

[0187] In some embodiments, the server may directly send the network control rules corresponding to the IoT device to the network device.

[0188] In other embodiments, the server may also Figure 3 The dedicated device 10 forwards the network control rules corresponding to the IoT device to the network device.

[0189] Optionally, in the above embodiment, the network device may be a network device having an edge cloud function such as described above, or a network device not having an edge source function.

[0190] In some embodiments, when the websites and / or devices that can be accessed and / or accessed as specified in the network control rules corresponding to the IoT device are identified by domain names (or network domains), since the network device may only be able to recognize IP addresses, the network device and / or dedicated device 10 may also first convert the domain names of the websites and / or devices into corresponding IP addresses, so that the network device can manage the network behavior of the IoT device according to the IP address. Alternatively, the aforementioned operation of converting the domain name into an IP address may also be performed by the server, that is, the server may first convert the domain names of the websites and / or devices that can be accessed and / or accessed as specified in the network control rules corresponding to the IoT device into corresponding IP addresses, and then send the network control rules corresponding to the IoT device to the network device.

[0191] Optionally, the server may send one or more network control rules corresponding to IoT devices to the network device at the same time. For example, the server may directly send all the stored network control rules corresponding to IoT devices to the network device. It is understandable that in this example, since the server may update the network control rules corresponding to the IoT device, the server may also send one or more network control rules corresponding to the IoT device to the network device.

[0192] For another example, after receiving a data packet, the network device may request the server for the network control rules corresponding to the corresponding IoT device. Accordingly, after receiving the request from the network device, the server may only send the network control rules corresponding to the corresponding IoT device to the network device.

[0193] Optionally, the server may send one or more network control rules corresponding to the IoT devices to the network device after the network device receives the data packet and before executing step S703. It is also possible to send one or more network control rules corresponding to the IoT devices to the network device before receiving the data packet. It is understandable that the embodiment of the present application does not impose any restrictions on the timing of the server sending the network control rules corresponding to the IoT devices to the network device.

[0194] S703: The network device manages the network behavior of the IoT device according to the network control rules corresponding to the IoT device.

[0195] It is understandable that a data packet may correspond to an IoT device or a non-IoT device. It is understandable that a non-IoT device may refer to other devices other than IoT devices, such as: including but not limited to mobile phones, tablet computers and other devices.

[0196] Therefore, in some embodiments, after receiving a data packet, the network device can determine whether the data packet corresponds to an IoT device. If it corresponds to an IoT device, the IoT device to which the data packet corresponds can be determined. If it corresponds to a non-IoT device, the data packet can be directly forwarded. In this way, data packets corresponding to non-IoT devices are not intercepted and managed, which will not affect the user's network bandwidth and can ensure the user's Internet experience.

[0197] It can be understood that the IoT device corresponding to the data packet may mean that the data packet is sent by the IoT device or is sent to the IoT device. Similarly, the non-IoT device corresponding to the data packet may mean that the data packet is neither sent by the IoT device nor is sent to the IoT device.

[0198] In some embodiments, a data packet may carry device identification information, and the device (such as an IoT device, a non-IoT device, etc.) corresponding to the data packet may be determined based on the device identification information carried in the data packet. Exemplarily, the device identification information may include, but is not limited to, the address of the device, other identifications of the device, etc. Exemplarily, the address of the device may include, but is not limited to, one or more of an IP address, a MAC address, port information, etc.

[0199] In some implementations, the network device may obtain the identification information of the IoT device from local and / or other devices. Exemplarily, the identification information of the IoT device may also include, but is not limited to, the address of the IoT device, other identifications of the IoT device, etc. For example, the address of the IoT device may include, but is not limited to, the IP address, MAC address, etc. The network device may match the device identification information carried in the received data packet with the identification information of the IoT device to determine the IoT device corresponding to the data packet.

[0200] For example: In some examples, a data packet may carry a source address (such as a source IP address), a destination address (such as a destination IP address), etc. It can be understood that the source address may be the sending address of the data packet, that is, the address of the device that sends the data packet. The destination address may be the receiving address of the data packet, that is, the address of the device that receives the data packet. Optionally, one or more of the source port, destination port, etc. may also be carried. Taking the example that both the source address and the destination address are IP addresses, if the source IP address carried in the data packet is the same as the IP address of a certain IoT device, it can be determined that the data packet corresponds to the IoT device, and the data packet is specifically sent by the IoT device. For another example: If the destination IP address carried in the data packet is the same as the IP address of a certain IoT device, it can be determined that the data packet corresponds to the IoT device, and the data packet is specifically sent to the IoT device. For another example: If the source IP address, destination IP address, etc. carried in the data packet are not the same as the IP address of any IoT device, it can be determined that the data packet corresponds to a non-IoT device.

[0201] Of course, the network device can also obtain the identification information of the non-IoT device from the local and / or other devices. Exemplarily, the identification information of the non-IoT device may also include but is not limited to the address of the non-IoT device, other identifications of the non-IoT device, etc. For example, the address of the non-IoT device may include but is not limited to the IP address, MAC address, etc. The network device can match the device identification information carried in the received data packet with the identification information of the non-IoT device to determine whether the data packet corresponds to the non-IoT device. For example: Taking the source address and the destination address as an example, if the source IP address and the destination IP address carried in the data packet are respectively the same as the IP addresses of multiple non-IoT devices, it can be determined that the data packet corresponds to a non-IoT device. If any of the source IP address, destination IP address, etc. carried in the data packet is different from the IP address of the non-IoT device, it can be determined that the data packet does not correspond to the non-IoT device.

[0202] Furthermore, after the network device determines the IoT device corresponding to the data packet, it can control the network behavior of the IoT device according to the network control rules corresponding to the IoT device. In this way, the data packets corresponding to different IoT devices only need to be matched with the network control rules corresponding to the matching IoT devices, and do not need to be matched with the network control rules corresponding to all IoT devices, which can improve the matching efficiency and thus improve the traffic forwarding efficiency. In addition, the improvement of matching efficiency allows network devices to manage more IoT devices.

[0203] For example, if a data packet is sent (or obtained) by an IoT device and the address is an IP address, it can be determined whether to forward the data packet to the destination IP address based on the destination IP address carried in the data packet and the network control rules corresponding to the IoT device.

[0204] For example: if the network control rules corresponding to the IoT device stipulate that the IoT device can access the destination IP address, if the IP addresses allowed to be accessed by the IoT device included in the network control rules corresponding to the IoT device include the destination IP address, or if the IP addresses not allowed to be accessed by the IoT device included in the network control rules corresponding to the IoT device do not include the destination IP address, the network device determines that the data packet can be forwarded to the destination IP address, and then executes the forwarding of the data packet.

[0205] For another example: if the network control rules corresponding to the IoT device stipulate that the IoT device cannot access the destination IP address, if the IP addresses allowed to be accessed by the IoT device included in the network control rules corresponding to the IoT device do not include the destination IP address, or if the IP addresses not allowed to be accessed by the IoT device included in the network control rules corresponding to the IoT device include the destination IP address, then the network device can determine that the data packet cannot be forwarded to the destination IP address, and can then intercept the data packet, for example, by discarding the data packet.

[0206] For another example, if a data packet is sent to an IoT device and the address is an IP address, then it can be determined whether to forward the data packet to the IoT device or parse the data packet based on the source IP address carried in the data packet and the network control rules corresponding to the IoT device.

[0207] For example: If the network control rules corresponding to the IoT device stipulate that the IoT device can be accessed by the source IP address, and if the IP addresses allowed to access the IoT device included in the network control rules corresponding to the IoT device include the source IP address, then the network device determines that it can forward the data packet to the IoT device, and then executes forwarding of the data packet, or performs parsing of the data packet.

[0208] For another example: if the network control rules corresponding to the IoT device stipulate that the IoT device cannot be accessed by the source IP address, if the IP addresses allowed to access the IoT device included in the network control rules corresponding to the IoT device do not include the source IP address, or if the IP addresses not allowed to access the IoT device included in the network control rules corresponding to the IoT device include the source IP address, then the network device determines that the data packet cannot be forwarded to the IoT device, and can then intercept the data packet, such as by discarding the data packet.

[0209] In some embodiments, the network device can be connected through Figure 6 The high-efficiency network monitoring module shown implements the function of managing the network behavior of IoT devices according to the network control rules corresponding to the IoT devices. In some embodiments, the high-efficiency network monitoring module can be placed in the operating system kernel of the router to run through the express data path (XDP) based on the extended Berkeley packet filter (eBPF), so that the network monitoring module can work at the entrance from the data link layer to the network layer. Exemplary, Fig.10 FIG. 1 is a schematic diagram showing the position of an efficient network monitoring module provided in an embodiment of the present application in an OSI reference model. Fig.10 As shown, the efficient network monitoring module can be located at the entrance from the data link layer to the network layer.

[0210] It can be understood that eBPF is a technology that can run user-written programs in the operating system kernel without modifying the kernel code or loading kernel modules. XDP is a hook provided by the operating system kernel to process network data packets. It can process data packets before allocating skb buffers. Data packet processing can be completed at the entrance of the operating system kernel, such as: determining whether to intercept or forward data packets, and almost no processing is required by the router's CPU. For other introductions to eBPF technology and XDP technology, please refer to the detailed introduction in the related technology, and this application will not go into details.

[0211] For example, taking a router as an example, for the same router, when managing more than 100 IoT devices, the iptables solution makes the router CPU occupancy rate greater than 10%, and the user's network bandwidth reduction rate greater than 20%. However, the efficient network monitoring module solution provided by the embodiment of the present application makes the network bandwidth reduction rate of non-IoT devices less than 3%, the network bandwidth reduction rate of IoT devices less than 10%, and the CPU occupancy rate of the router less than 1%.

[0212] In this way, network devices manage the network behavior of IoT devices based on the network control rules corresponding to IoT devices through XDP technology. Decisions can be made at the exit of the network card and the entrance of the operating system kernel. There is almost no need for the CPU of the network device to process, and packets can be lost as quickly as possible to improve the packet loss rate. It can also save CPU occupancy and memory resources, and improve traffic forwarding performance. In addition, the increase in packet loss rate allows network devices to manage more IoT devices.

[0213] Based on the above technical solution, for each IoT device, the network device can manage the network behavior of the IoT device based on the network control rules corresponding to the IoT device. The network control rules corresponding to the IoT device stipulate the network access rights of the IoT device, which can realize the management of a single device and a single rule, can more accurately identify the abnormal behavior of the device, and realize more efficient and detailed network security protection. For example: it can be achieved that the smart speaker can access the external network and / or the external network can access the IoT device, while the smart door lock can only access the manufacturer's upgrade website and edge cloud, and cannot access the device and cloud server with access to the external network. In other words, the network device will release the behavior of the smart speaker to access the external network and intercept the behavior of the smart door lock to access the external network. Under the condition of ensuring network security, it will not affect the use of rich functions of the smart speaker. In other words, under the condition of improving the network security of IoT devices, different network demands of different IoT devices can be met, so that the device functions that need to cross the network can be used, and the linkage between IoT devices and the linkage between IoT devices and the cloud will not be affected.

[0214] In some embodiments, when the network device determines that the IoT device attacks other devices or is attacked by other devices, for example, if the IoT device accesses an IP address that is not allowed to access, or an IP address that is not allowed to access the IoT device accesses the IoT device. The network device can set network isolation for the IoT device to ensure the network security of other IoT devices. It can be understood that setting network isolation can mean not allowing the IoT device to access the intranet and the extranet, etc.

[0215] In some embodiments, the network device may also generate a network report for the IoT device, which may be used to indicate one or more of the devices and / or networks that the IoT device is accessing or has accessed, the devices and / or networks that are being accessed or have been accessed, etc. Optionally, the network device may generate a network report for the IoT device when network isolation is set for the IoT device. It may also generate a network report for the IoT device when network isolation is not set for the IoT device. The embodiments of the present application are not limited to this.

[0216] In some embodiments, the network device and / or other devices may also output a network report of the IoT device. For example, taking the other device as a mobile phone, and the mobile phone outputting a network report of the IoT device, Fig.11 FIG. 1 is a schematic diagram of a network report provided by an embodiment of the present application. Fig.11 As shown, the mobile phone can display the network report of the camera, wherein the content of the network report includes: the camera has two local access devices, such as smart door lock and smart storage. There are also two addresses of the accessed server, such as "smarthome.huawei.com" and "xxmi.com:80 / iot".

[0217] Optionally, the network report can also include information about ports opened by IoT devices, such as the number of ports, port numbers, etc. Fig.11 As shown, the number of ports opened by the camera is 3, the user datagram protocol (UDP) port number is: 887, 8080, the transmission control protocol (TCP) port number is: 7676, etc.

[0218] It is understood that the above embodiment takes the network device automatically setting network isolation for the IoT device as an example. In other embodiments, the user can also set network isolation for the IoT device. For example: when the network device determines that the IoT device attacks other devices or is attacked by other devices, the network device and / or other devices can output a reminder message to remind the user whether to set network isolation. Exemplarily, the reminder message can be presented in the form of the network report described above.

[0219] For example: Fig.11 The network report shown may also display a function button 1100 for restricting access to the Internet, and the user may implement network isolation for the camera by turning on the function button 1100 .

[0220] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. It is understandable that, in order to realize the above functions, the device includes a hardware structure and / or software module corresponding to the execution of each function. In combination with the units and algorithm steps of each example described in the embodiment disclosed in this application, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer-driven hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the technical solution of the embodiment of the present application.

[0221] As another possible division, Fig.12 1200 is a schematic diagram of a device provided in an embodiment of the present application. The device 1200 can be used to implement the methods described in the above method embodiments. Exemplarily, the device 1200 may include: a processing unit 1201 and a communication unit 1202.

[0222] As a possible example, taking the device 1200 as a network device, the processing unit 1201 is used to support the device 1200 to execute Figures 1 to 11 The communication unit 1202 is used to support the device 1200 to perform Figures 1 to 11 The communication function performed by any one of the network devices described above.

[0223] As another possible example, taking the device 1200 as a server, the processing unit 1201 is used to support the device 1200 to execute Figures 1 to 11 The communication unit 1202 is used to support the device 1200 to perform Figures 1 to 11 The communication function performed by any of the servers described above.

[0224] Optional, Fig.12 The device 1200 shown may also include a storage unit 1203, which stores a program or instruction. When the processing unit 1201 executes the program or instruction, Fig.12 The device 1200 shown can execute the method described in the above method embodiment.

[0225] Fig.12 The technical effects of the device 1200 shown can refer to the technical effects described in the above method embodiment, and will not be repeated here. Fig.12 The processing unit 1201 involved in the device 1200 shown may be implemented by a processor or a processor-related circuit component, and may be a processor or a processing module. The communication unit 1202 may be implemented by a transceiver or a transceiver-related circuit component, and may be a transceiver or a transceiver module.

[0226] The present application also provides a chip system, such as Fig.13As shown, the chip system includes at least one processor 1301 and at least one interface circuit 1302. The processor 1301 and the interface circuit 1302 can be interconnected via lines. For example, the interface circuit 1302 can be used to receive signals from other devices. For another example, the interface circuit 1302 can be used to send signals to other devices (such as processor 1301). Exemplarily, the interface circuit 1302 can read instructions stored in the memory and send the instructions to the processor 1301. When the instructions are executed by the processor 1301, the device can execute the various steps executed by the device in the above embodiment. Of course, the chip system can also include other discrete devices, which are not specifically limited in the embodiments of the present application.

[0227] Optionally, the processor in the chip system may be one or more. The processor may be implemented by hardware or by software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented by software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0228] Optionally, the memory in the chip system may be one or more. The memory may be integrated with the processor or may be separately provided with the processor, which is not limited in the present application. Exemplarily, the memory may be a non-transient processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip or may be provided on different chips. The present application does not specifically limit the type of memory and the arrangement of the memory and the processor.

[0229] Exemplarily, the chip system can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips.

[0230] It should be understood that each step in the above method embodiment can be completed by an integrated logic circuit of hardware in a processor or by instructions in the form of software. The method steps disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or by a combination of hardware and software modules in a processor.

[0231] An embodiment of the present application also provides a computer storage medium, in which computer instructions are stored. When the computer instructions are executed on a device, the device executes the method described in the above method embodiment.

[0232] An embodiment of the present application provides a computer program product, which includes: a computer program or instructions, when the computer program or instructions are executed on a computer, the computer executes the method described in the above method embodiment.

[0233] In addition, an embodiment of the present application also provides a device, which can specifically be a chip, component or module, and the device may include a connected processor and memory; wherein the memory is used to store computer-executable instructions, and when the device is running, the processor can execute the computer-executable instructions stored in the memory so that the device executes the methods in the above-mentioned method embodiments.

[0234] Among them, the equipment, computer storage medium, computer program product or chip provided in this embodiment is used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here.

[0235] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0236] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The various embodiments can be combined with each other or referenced to each other without conflict. The device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0237] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0238] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0239] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0240] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network security protection method, characterized in that: Applied to a first network device, the method comprises: Obtain a first network control rule corresponding to a first Internet of Things (IoT) device, where the first network control rule is used to constrain the network behavior of the first IoT device; wherein the first network control rule is determined based on at least one of a network manufacturer's user manual (MUD) of the first IoT device, a network MUD of an application installed on the first IoT device, and a network control rule configured by a user for the first IoT device; The network behavior of the first IoT device is managed according to the first network control rule.

2. The method according to claim 1, characterized in that The first network control rule stipulates at least one of the devices and / or external websites that the first IoT device is allowed to access, the devices and / or external websites that the first IoT device is allowed to access, the frequency at which the first IoT device is allowed to send data packets and / or the frequency at which it is allowed to receive data packets, and the first IoT device's control strategy for network attacks.

3. The method according to claim 1 or 2, characterized in that: The network MUD of the first IoT device specifies at least one of the devices and / or external websites that the first IoT device is allowed to be accessed by, the devices and / or external websites that the first IoT device is allowed to access, the frequency at which the first IoT device is allowed to send data packets and / or the frequency at which it is allowed to receive data packets, and the control strategy of the first IoT device against network attacks; And / or, the network MUD of the application specifies the devices and / or external websites that the application is allowed to access, the devices and / or external websites that the application is allowed to access, the frequency at which the application is allowed to send data packets and / or the frequency at which it is allowed to receive data packets, and at least one of the application's management and control strategies for network attacks.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Acquire a second network control rule corresponding to a second IoT device, where the second network control rule is used to constrain a network behavior of the second IoT device, and the second network control rule is different from the first network control rule; The network behavior of the second IoT device is managed according to the second network control rule.

5. The method according to claim 4, characterized in that The first network control rule stipulates that the first IoT device is allowed to access external websites and / or that external websites are allowed to access the first IoT device, and the second network control rule stipulates that the second IoT device is not allowed to access external websites and that external websites are not allowed to access the second IoT device.

6. The method according to claim 4, characterized in that The second IoT device and the first IoT device are installed with the same application, and a control strategy of the second IoT device on the application based on the second network control rule is different from a control strategy of the first IoT device on the application based on the first network control rule.

7. The method according to any one of claims 1 to 6, characterized in that: A first application and a second application are installed on the first IoT device, and the first IoT device has different control strategies for the first application and the second application based on the first network control rule.

8. The method according to any one of claims 1 to 7, characterized in that: After managing the network behavior of the first IoT device according to the first network control rule, the method further includes: Obtaining an updated first network control rule; The network behavior of the first IoT device is managed according to the updated first network control rule.

9. The method according to claim 8, characterized in that The obtaining of the updated first network control rule includes: When an application installed on the first IoT device changes, or when a network control rule configured by the user for the first IoT device changes, the updated first network control rule is obtained.

10. The method according to any one of claims 1 to 9, characterized in that: The managing the network behavior of the first IoT device according to the first network control rule includes: Obtaining a data packet, wherein the data packet carries a destination address; forwarding the data packet to the destination address when the first network control rule stipulates that the addresses of the devices and / or external websites that the first IoT device is allowed to access include the destination address; Or, when the first network control rule stipulates that the addresses of devices and / or external websites that the first IoT device is allowed to access do not include the destination address, the data packet is intercepted.

11. The method according to any one of claims 1 to 9, characterized in that The managing the network behavior of the first IoT device according to the first network control rule includes: receiving a data packet, wherein the data packet carries a source address; forwarding the data packet to the first IoT device, or parsing the data packet, when the first network control rule stipulates that the source address is included in the address of the device and / or external website that the first IoT device is allowed to access; Or, when the first network control rule stipulates that the source address is not included in the addresses of the devices and / or external websites that allow the first IoT device to be accessed, the data packet is intercepted.

12. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: Receiving a data packet, wherein the data packet carries a source address and a destination address; When neither the source address nor the destination address belongs to the address of the IoT device, the data packet is forwarded to the destination address.

13. The method according to any one of claims 1 to 12, characterized in that: The managing the network behavior of the first IoT device according to the first network control rule includes: A fast data path XDP is used to manage the network behavior of the first IoT device according to the first network control rule.

14. The method according to any one of claims 1 to 13, characterized in that: The first network device is a router.

15. A network security protection method, characterized in that: Applied to the second network device, the method comprises: Obtain at least one of a network MUD of a first IoT device, a network MUD of an application installed on the first IoT device, and a network control rule configured by a user for the first IoT device; Determine a first network control rule corresponding to the first IoT device based on at least one of a network MUD of the first IoT device, a network MUD of the application installed on the first IoT device, and a network control rule configured by a user for the first IoT device, wherein the first network control rule is used to constrain a network behavior of the first IoT device; The first network control rule is sent to the first network device.

16. The method according to claim 15, characterized in that The first network control rule stipulates at least one of the devices and / or external websites that the first IoT device is allowed to access, the devices and / or external websites that the first IoT device is allowed to access, the frequency at which the first IoT device is allowed to send data packets and / or the frequency at which it is allowed to receive data packets, and the first IoT device's control strategy for network attacks.

17. The method according to claim 15 or 16, characterized in that The network MUD of the first IoT device specifies at least one of the devices and / or external websites that the first IoT device is allowed to be accessed by, the devices and / or external websites that the first IoT device is allowed to access, the frequency at which the first IoT device is allowed to send data packets and / or the frequency at which it is allowed to receive data packets, and the control strategy of the first IoT device against network attacks; And / or, the network MUD of the application specifies the devices and / or external websites that the application is allowed to access, the devices and / or external websites that the application is allowed to access, the frequency at which the application is allowed to send data packets and / or the frequency at which it is allowed to receive data packets, and at least one of the application's management and control strategies for network attacks.

18. The method according to any one of claims 15 to 17, characterized in that: The method further comprises: Obtain at least one of a network MUD of a second IoT device, a network MUD of an application installed on the second IoT device, and a network control rule configured by a user for the second IoT device; Determine a second network control rule corresponding to the second IoT device based on at least one of a network MUD of the second IoT device, a network MUD of an application installed on the second IoT device, and a network control rule configured by a user for the second IoT device, wherein the second network control rule is used to constrain a network behavior of the second IoT device, and the second network control rule is different from the first network control rule; The second network control rule is sent to the first network device.

19. The method according to any one of claims 15 to 18, characterized in that: The method further comprises: The first network control rule is updated.

20. The method according to claim 19, characterized in that The updating of the first network control rule comprises: When an application installed on the first IoT device changes, or when a network control rule configured by the user for the first IoT device changes, the first network control rule is updated.

21. The method according to any one of claims 15 to 20, characterized in that: The second network device is a server.

22. A device, characterized in that The method comprises a module for executing each step of the method as claimed in any one of claims 1 to 14, or comprises a module for executing each step of the method as claimed in any one of claims 15 to 21.

23. A device, characterized in that include: A processor and a memory, the memory being coupled to the processor, the memory being used to store program code, the program code comprising instructions, the processor reading the instructions from the memory so that the device executes the method as described in any one of claims 1-14, or so that the device executes the method as described in any one of claims 15-21.

24. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises a computer program, and when the computer program is executed on a device, the device is caused to execute the method according to any one of claims 1 to 14, or the device is caused to execute the method according to any one of claims 15 to 21.

25. A computer program product, characterized in that The computer program product comprises: a computer program or instructions, which, when executed on a computer, enables the computer to execute the method according to any one of claims 1 to 14, or enables the computer to execute the method according to any one of claims 15 to 21.

Images