Security protection system, method, device, equipment, storage medium and program product

Abstract

The invention discloses a security protection system, method and device, equipment, a storage medium and a program product, relates to the technical field of communication, and is used for guaranteeing the security when terminal equipment accesses a service system. The system comprises terminal equipment, a first access management module and a service system, the first access management module is connected between the terminal equipment and the service system; the first access management module is used for authenticating an access request message from the terminal equipment and determining whether the terminal equipment is allowed to access the service system or not based on the state parameter of the terminal equipment under the condition that the authentication is successful; the state parameters comprise at least one of a health state, a network position and a network environment. The method and the device are applied to a scene of performing security protection on access of the terminal equipment to the service system.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a security protection system, method, device, equipment, storage medium and program product. Background Art

[0002] With the widespread application of Internet of Things technology, more and more terminal devices (such as sensors, smart home devices, logistics equipment, etc.) are connected to the business system (also called business platform) on the Internet to achieve remote control, data interaction and intelligent services.

[0003] However, there are potential security risks when terminal devices access business systems. Therefore, it is urgent to solve the problem of security risks when terminal devices access business systems. Summary of the invention

[0004] The present application provides a security protection system, method, apparatus, equipment, storage medium and program product for solving the technical problem of potential security risks when a terminal device accesses a business system.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, a security protection system is provided, which includes: a terminal device, a first access management module and a business system; the first access management module is connected between the terminal device and the business system; the first access management module is used to authenticate an access request message from the terminal device, and if the authentication is successful, determine whether to allow the terminal device to access the business system based on the status parameters of the terminal device; the status parameters include at least one of the following: health status, network location, network environment.

[0007] In a possible implementation, the first access management module is further configured to, when authentication fails, determine that the terminal device is not allowed to access the service system.

[0008] In one possible implementation, the terminal device is used to generate a first private key and a first public key based on a key algorithm, and the business system is used to generate a second private key and a second public key based on the key algorithm; the terminal device is used to encrypt data packets sent to the business system based on the first private key when the terminal device is connected to the business system, and to decrypt data packets from the business system based on the second public key; the business system is used to decrypt data packets from the terminal device based on the first public key when the terminal device is connected to the business system, and to encrypt data packets returned to the terminal device based on the second private key.

[0009] In a possible implementation, the system also includes: a key management module; the key management module is connected between the terminal device and the business system; the key management module is used to generate the public public key and public private key of the terminal device and the business system respectively based on the respective identity identifications of the terminal device and the business system through a key algorithm, and issue the respective public public key and public private key to the terminal device and the business system; the terminal device is used to generate a first public key based on the public public key of the terminal device and the local private public key of the terminal device, and to generate a first private key based on the public private key of the terminal device and the local private key of the terminal device; the business system is used to generate a second public key based on the public public key of the business system and the local private public key of the business system, and to generate a second private key based on the public private key of the business system and the local private key of the business system.

[0010] In a possible implementation, the identity is generated based on physically unclonable PUF technology.

[0011] In a possible implementation, the system further includes: a cryptographic module; the cryptographic module is used to provide a key algorithm for generating a key.

[0012] In one possible implementation, the system also includes: a data transmission module; the data transmission module is used to establish a communication tunnel between the terminal device and the business system based on the transport layer security protocol TLS when allowing the terminal device to access the business system, so that the terminal device can access the business system.

[0013] In a possible implementation manner, the first access management module is further configured to determine whether to disconnect the communication tunnel based on a state parameter when the terminal device accesses the service system.

[0014] In a possible implementation, the system also includes: a second access management module; the second management module is connected between the terminal device and the first access management module; the second management module is used to send an access request message from the terminal device to the first access management module, and obtain status parameters of the terminal device.

[0015] In a possible implementation, the system further includes: a probe module; the probe module is connected between the terminal device and the second access management module; the probe module is used to collect state parameters from the terminal device and send the state parameters to the first access management module.

[0016] On the second aspect, a security protection method is provided, which includes: authenticating an access request message from a terminal device, and if the authentication is successful, determining whether to allow the terminal device to access the business system based on the status parameters of the terminal device; the status parameters include at least one of the following: health status, network location, and network environment.

[0017] In a possible implementation manner, the method further includes: in case of authentication failure, determining not to allow the terminal device to access the service system.

[0018] In one possible implementation, the method also includes: generating a first private key and a first public key based on a key algorithm, and generating a second private key and a second public key based on the key algorithm; when the terminal device accesses the service system, encrypting the data packet sent by the terminal device to the service system based on the first private key, and decrypting the data packet returned by the service system to the terminal device based on the second public key; when the terminal device accesses the service system, decrypting the data packet returned by the terminal device to the service system based on the first public key, and encrypting the data packet sent by the service system to the terminal device based on the second private key.

[0019] In a possible implementation, the method also includes: generating a public key and a public private key of the terminal device and the business system respectively through a key algorithm based on the respective identity identifiers of the terminal device and the business system; generating a first public key based on the public public key of the terminal device and the local private public key of the terminal device, and generating a first private key based on the public private key of the terminal device and the local private key of the terminal device; generating a second public key based on the public public key of the business system and the local private public key of the business system, and generating a second private key based on the public private key of the business system and the local private key of the business system.

[0020] In a possible implementation, the identity is generated based on physically unclonable PUF technology.

[0021] In a possible implementation, the method further includes: when allowing the terminal device to access the service system, establishing a communication tunnel between the terminal device and the service system based on the transport layer security protocol TLS, so that the terminal device can access the service system.

[0022] In a possible implementation manner, the method further includes: when the terminal device accesses the service system, determining whether to disconnect the communication tunnel based on the state parameter.

[0023] In a possible implementation manner, before authenticating the access request message from the terminal device, the method further includes: receiving the access request message from the terminal device, and acquiring a state parameter of the terminal device.

[0024] On the third aspect, a security protection device is provided, which includes: a processing unit; a processing unit, used to authenticate an access request message from a terminal device, and if the authentication is successful, determine whether to allow the terminal device to access the business system based on the status parameters of the terminal device; the status parameters include at least one of the following: health status, network location, network environment.

[0025] In a possible implementation, the processing unit is further configured to, when the authentication fails, determine that the terminal device is not allowed to access the service system.

[0026] In one possible implementation, the processing unit is further used to generate a first private key and a first public key based on a key algorithm, and to generate a second private key and a second public key based on the key algorithm; the processing unit is further used to, when the terminal device accesses the service system, encrypt data packets sent by the terminal device to the service system based on the first private key, and to decrypt data packets returned by the service system to the terminal device based on the second public key; the processing unit is further used to, when the terminal device accesses the service system, decrypt data packets returned by the terminal device to the service system based on the first public key, and to encrypt data packets sent by the service system to the terminal device based on the second private key.

[0027] In a possible implementation, the processing unit is further used to generate a public public key and a public private key for the terminal device and the business system respectively through a key algorithm based on the respective identity identifiers of the terminal device and the business system; the processing unit is further used to generate a first public key based on the public public key of the terminal device and the local private public key of the terminal device, and to generate a first private key based on the public private key of the terminal device and the local private key of the terminal device; the processing unit is further used to generate a second public key based on the public public key of the business system and the local private public key of the business system, and to generate a second private key based on the public private key of the business system and the local private key of the business system.

[0028] In a possible implementation, the identity is generated based on physically unclonable PUF technology.

[0029] In a possible implementation, the processing unit is further configured to establish a communication tunnel between the terminal device and the business system based on the transport layer security protocol TLS when allowing the terminal device to access the business system, so that the terminal device can access the business system.

[0030] In a possible implementation, the processing unit is further configured to determine whether to disconnect the communication tunnel based on the state parameter when the terminal device accesses the service system.

[0031] In a possible implementation, the security protection device includes: a transmission unit; the transmission unit is used to receive an access request message from a terminal device and obtain a state parameter of the terminal device.

[0032] In a fourth aspect, an electronic device comprises: a processor and a memory; wherein the memory is used to store one or more programs, and the one or more programs include computer execution instructions. When the electronic device is running, the processor executes the computer execution instructions stored in the memory to enable the electronic device to execute a security protection system as in the first aspect.

[0033] In a fifth aspect, a computer-readable storage medium storing one or more programs is provided. The one or more programs include instructions. When the instructions are executed by a computer, the computer executes a security protection system as in the first aspect.

[0034] In a sixth aspect, a computer program product is provided. When the computer instructions are executed on an electronic device, the electronic device executes a security protection system as in the first aspect.

[0035] The present application provides a security protection system, method, apparatus, equipment, storage medium and program product, which are applied in security protection scenarios. The system includes: a terminal device, a first access management module and a business system; the first access management module is connected between the terminal device and the business system. The first access management module included in the security protection system can authenticate the access request message from the terminal device, and if the authentication is successful, it is determined whether the terminal device is allowed to access the business system based on the state parameters of the terminal device including at least one of the health status, network location, and network environment. That is, when the state parameters of the terminal device are abnormal, the terminal device may be subject to security threats. At this time, the access of the terminal device to the business system will cause security risks. Therefore, when the access request of the terminal device is verified, it is further determined whether the terminal device is allowed to access the business system based on the state parameters of the terminal device, so as to avoid this security risk.

[0036] Through the above method, when the access request message from the terminal device is successfully authenticated, it can be further determined whether to allow the terminal device to access the service system according to the status parameters of the terminal device. Thus, the technical problem of potential security risks when the terminal device accesses the service system is solved, and the security of the terminal device accessing the service system is guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A structural diagram of a safety protection system provided in an embodiment of the present application Figure 1 ;

[0038] Figure 2 A structural diagram of a safety protection system provided in an embodiment of the present application Figure 2 ;

[0039] Figure 3 A schematic diagram of a safety protection method provided in an embodiment of the present application Figure 1 ;

[0040] Figure 4 A schematic diagram of a safety protection method provided in an embodiment of the present application Figure 2 ;

[0041] Figure 5 A schematic diagram of a safety protection method provided in an embodiment of the present application Figure 3 ;

[0042] Figure 6 A schematic diagram of a safety protection method provided in an embodiment of the present application Figure 4 ;

[0043] Figure 7 A schematic diagram of a safety protection method provided in an embodiment of the present application Figure 5 ;

[0044] Figure 8 A schematic diagram of a safety protection method provided in an embodiment of the present application Figure 6 ;

[0045] Fig. 9 A schematic diagram of a safety protection method provided in an embodiment of the present application Figure 7 ;

[0046] Fig.10 A schematic diagram of the structure of a safety protection device provided in an embodiment of the present application;

[0047] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0049] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" and "plurality" refer to two or more. The words "first", "second", etc. do not limit the quantity and execution order, and the words "first", "second", etc. do not limit them to be different.

[0050] With the widespread application of IoT technology, more and more terminal devices (also called IoT devices or IoT terminals) are connected to business systems on the Internet to achieve remote control, data interaction and intelligent services. However, there are many potential security risks in the process of these terminal devices accessing the corresponding business systems or communicating with the Internet. Traditional security protection methods often focus on a single level of security protection and fail to provide comprehensive protection in multiple dimensions. At the same time, the protection methods are relatively static and difficult to cope with the ever-changing threat environment and future challenges such as quantum computing attacks, making it difficult to effectively deal with security risks.

[0051] At the same time, due to the variety of IoT devices and the limited computing power and small storage space of most IoT devices, traditional network security measures are difficult to apply directly, resulting in significant security risks in identity authentication, data transmission and access control. To solve these problems, it is imperative to build a security protection system with terminal devices as security objects.

[0052] To solve the above problems, based on an in-depth analysis of relevant technologies, this application provides a security protection system, which is a security protection framework with terminal devices as the core, and is designed to provide full life cycle security protection for terminal devices when accessing business systems, and to achieve full-dimensional security protection from four aspects: identity security, data security, transmission security, and access security. By introducing dynamic identity authentication mechanisms, end-to-end encryption technology, and fact-authenticated access control strategies, the security of terminal devices in complex application environments is effectively improved, ensuring the continuous protection capabilities of terminal devices in multiple dimensions. At the same time, by introducing relevant management platforms, key operations such as identity authentication, data encryption, and access permission adjustment throughout the device's life cycle can be completed in a reliable and secure environment, thereby improving the overall security and reliability of IoT devices.

[0053] Specifically, the system is modularly designed, based on Physical Unclonable Functions (PUF) technology, and combined with Certificateless Public Key Infrastructure (CLA) to generate secure public and private key pairs to ensure identity security. The Software Defined Perimeter (SDP) access management system is used to dynamically authenticate terminal devices and determine the legitimacy of the terminal device identity in order to establish a secure communication tunnel. The state parameters of the terminal device are detected through a lightweight Endpoint Detection and Response (EDR) probe, and the state parameters of the terminal device are reported in real time to ensure access security. The dynamic protection mechanism can adapt to complex and changing security scenarios and improve the overall security protection capabilities, especially to cope with future quantum computing threats. Based on the lightweight Transport Layer Security (TLS) protocol, data transmission security is guaranteed. At the same time, the cryptographic module is used to provide national secret algorithms (also known as cryptographic algorithms) support to ensure data security throughout the entire process.

[0054] An embodiment of the present application provides a safety protection system. Figure 1 Shows a schematic diagram of the structure of a safety protection system Figure 1 The security protection system 10 includes: a terminal device 11 , a first access management module 12 and a business system 13 .

[0055] The first access management module 12 is used to authenticate the access request message from the terminal device 11 , and if the authentication is successful, determine whether to allow the terminal device to access the service system 13 based on the state parameters of the terminal device 11 .

[0056] The terminal device 11 may be a sensor, a smart terminal, a surveillance camera, a smart home device, a logistics device, etc. These devices can realize the functions of sensing the environment and controlling objects by collecting information and receiving instructions. The business system 13 may be a device for processing various business activities and data related to the Internet of Things, and is the final access object of the terminal device 11.

[0057] Figure 2 Shows a schematic diagram of the structure of a safety protection system Figure 2 .like Figure 2 As shown, the security protection system 20 includes: a terminal device 21 (i.e. Figure 1 The terminal device 11 in the first access management module 22 (i.e. Figure 1The first access management module 12 in the SDP access management system or SDP controller), the second access management module 23 (also called the SDP client), the key management module 24 (also called the key management platform), the cryptographic module 25, the data transmission module 26 (also called the lightweight TLS protocol module), the probe module 27 (also called the lightweight EDR probe module), the business system 28 (that is, Figure 1 Business system in 13).

[0058] The terminal device 21 is used to interact with the business system 28 through multiple modules in the security protection system 20 to ensure the security of the terminal device 21 when accessing the business system 28 and to ensure the safe operation of the Internet of Things system.

[0059] The first access management module 22 is responsible for centralized management and distribution of access policies to ensure secure communication and access control. The second access management module 23 is responsible for interacting with the terminal device 21 and the first access management module 22, providing multi-level identity authentication and device status monitoring functions. The key management module 24 can generate, manage and store keys. The password module 25 can provide national secret algorithm support to ensure data security throughout the entire process and ensure the security and integrity of the data. The data transmission module 26 can ensure the security of transmitted data during the communication process. The probe module 27 is located on the terminal device 21 side, which can effectively detect the status of the terminal device 21 and provide the SDP client with the data information source of the terminal device 21.

[0060] As a possible implementation, Figure 1 As shown, the first access management module 12 is used to authenticate the access request message from the terminal device 11, and if the authentication is successful, determines whether to allow the terminal device 11 to access the business system 13 based on the status parameters of the terminal device 11; the status parameters include at least one of the following: health status, network location, network environment.

[0061] Optionally, when the terminal device 11 needs to access the service system 13, the terminal device 11 may send an access request message to the first access management module 12. The access request information may include a device identifier and a password of the terminal device 11, and the device identifier may be an account number generated when the terminal device is registered. For example, the device identifier may be a serial number of the terminal device 11, or a device model of the terminal device 11 + a serial number, and other characters used to represent the device identity.

[0062] The first access management module 12 may include an identity authentication module, a device authentication and trust evaluation module, an access policy management module, a security configuration module, a private domain name system (Domain Name System, DNS) management module, and an application and network resource management module.

[0063] The identity authentication module of the first access management module 12 can authenticate the terminal device 11 according to the access request message, and if the device identification and password of the terminal device 11 are consistent with the device identification and password of the terminal device 11 stored in the first access management module 12, the authentication is successful. If the device identification and password of the terminal device 11 are inconsistent with the device identification and password of the terminal device 11 stored in the first access management module 12, the authentication fails.

[0064] Optionally, when the device identifier and password are consistent (i.e., the user identity authentication is successful), the identity authentication module of the first access management module 12 can further confirm whether the terminal device 11 has accessed the business system 13. If it is confirmed that the terminal device 11 has not accessed the business system 13, the identity authentication module of the first access management module 12 can further perform user device authentication on the terminal device. For example, an auxiliary authentication message is sent to the terminal device 11 to notify the terminal device 11 to request other terminal devices to perform auxiliary authentication on the terminal device 11, and if the auxiliary authentication passes, the authentication is confirmed to be successful. If it is confirmed that the terminal device 11 has accessed the business system 13, the authentication is directly confirmed to be successful.

[0065] Further, in the case of successful authentication, the device authentication and trust evaluation module of the first access management module 12 can determine whether to allow the terminal device 11 to access the service system 13 based on the status parameters of the terminal device 11. The health status can be the operating system version, patch (such as security patch, vulnerability patch) update status and running status of the terminal device 11. The network location can be the Internet Protocol (IP) address of the terminal device 11. The network environment can be the network environment where the terminal device 11 is located (such as a wireless broadband network environment, a mobile data traffic network, etc.).

[0066] For example, the lower the operating system version of the terminal device 11, the longer the patch update time and / or the worse the operating status, the worse the health status of the terminal device 11. In the case of a poor health status, the terminal device 11 is not allowed to access the business system 13.

[0067] It should be noted that if a terminal device 11 wants to access the business system 13, the terminal device 11 needs to be registered in the business system 13 in advance, the business system 13 needs to store the device identification and password of the terminal device 11, and send the device identification and password of the terminal device 11 to the first access management module 12. That is, the first access management module 12 can store the device identification and passwords of multiple registered terminal devices 11.

[0068] Optionally, the access policy management module of the first access management module 12 can dynamically allocate access rights according to the authentication result (authentication success or authentication failure) and status parameters of the terminal device 11, and send the corresponding access control policy to the SDP gateway, and then send the corresponding access control policy to the business system 13 through the SDP gateway to ensure minimum authorization. For example, if the terminal device 11 is successfully authenticated, but the health status of the terminal device 11 is average, then the access control policy of the terminal device 11 can be a small number of applications that allow the terminal device 11 to access the business system 13.

[0069] Optionally, the security configuration module of the first access management module 12 can access an external threat intelligence system, update security protection policies in real time, and perform system-level security configuration management. The security protection policy is a policy for determining access control policies based on authentication results and status parameters.

[0070] Optionally, the private DNS management module of the first access management module 12 can ensure that the domain name resolution request in the network communication is performed through a secure private DNS to avoid external DNS resolution attacks. The application and network resource management module of the first access management module 12 can manage the internal network resources and application access rights of the business system 13 to ensure that the internal network resources are only accessed by the verified terminal device 11.

[0071] This application can ensure the access rights of legitimate devices and users by authenticating the terminal devices. Ensure that the connected devices are in a safe state based on the health status of the terminal devices. Determine whether there are suspicious activities based on the network location and network environment of the terminal devices to ensure the legitimacy of the terminal devices accessing the business system. By using two-factor authentication (i.e. user identity authentication + user device authentication) during authentication, this multiple verification method can prevent unauthorized access and increase the security level.

[0072] As a possible implementation manner, the first access management module is further configured to, when authentication fails, determine that the terminal device is not allowed to access the service system.

[0073] Optionally, when the terminal device 11 fails authentication, the first access management module 12 may determine that the terminal device 11 is not allowed to access the business system 13, and discard the access request information and the status parameters of the terminal device 11 to prevent the terminal device 11 that fails authentication from accessing the business system 13, thereby failing to ensure access security.

[0074] As a possible implementation, Figure 2 As shown, the data transmission module is used to establish a communication tunnel between the terminal device and the business system based on the transport layer security protocol TLS when the terminal device is allowed to access the business system, so that the terminal device can access the business system.

[0075] Optionally, when the terminal device 21 is allowed to access the business system 28, the data transmission module 26 can establish a communication tunnel between the terminal device 21 and the business system 28 based on TLS. In this way, when the terminal device 21 and the business system 28 subsequently transmit data through the communication tunnel established by TLS, TLS communication protocol encryption can be used to ensure data transmission security.

[0076] It should be noted that, since the terminal device 21 usually has limited computing power and resources, and the traditional transport layer security protocol has high computational complexity and large resource consumption, it is difficult to effectively run on the resource-constrained terminal device 21. In addition, it is impossible to use complex encryption algorithms, resulting in the data in transmission being easily intercepted or tampered with. Therefore, the security protection of the transmission protocol is insufficient, and the loopholes in the protocol layer may be exploited, affecting the transmission security.

[0077] The lightweight TLS protocol has been optimized and adjusted to address the resource constraints of terminal devices 21, which can improve the security and efficiency of data transmission. The protocol optimizes and integrates the protocol signaling process, and performs load-lightweight tailoring and transformation of the TLS handshake, which can reduce the use of communication bandwidth while ensuring secure communication between devices, and reduce computing and communication overhead. This end-to-end encryption method can ensure that data transmission is not stolen or tampered with during the transmission process, and ensure that low-power devices can also achieve efficient and secure transmission.

[0078] As a possible implementation manner, the first access management module is further configured to determine whether to disconnect the communication tunnel based on a state parameter when the terminal device accesses the service system.

[0079] Alternatively, if Figure 1 As shown, after the communication tunnel is established, the first access management module 12 can determine whether to disconnect the communication tunnel in real time based on the state parameters when the terminal device 11 accesses the service system 13. In addition, when it is determined that the communication tunnel is not disconnected, the first access management module 12 can determine whether to adjust the access rights based on the state parameters, and then adjust the access control policy.

[0080] Exemplarily, if the health status of the terminal device 11 is poor, the communication tunnel may be disconnected. If the health status of the terminal device 11 is good, the communication tunnel may not be disconnected, and the access rights may be adjusted to allow the terminal device 11 to access most applications of the business system 13.

[0081] This application can prevent lateral attacks by malicious users and achieve access security for business systems by dynamically managing the communication tunnels for terminal devices to access business systems in real time according to status parameters, and adjusting access permissions. The access control mechanisms in related technologies are mostly based on static rules, and are unable to adjust permissions according to device status or real-time environment, causing the system to appear passive in the face of complex attacks. Once breached, attackers may obtain long-term illegal access permissions. This application combines the real-time status of terminal devices and dynamic identity authentication results to flexibly control access permissions. Strategies can be dynamically adjusted according to environmental changes to prevent continuous penetration attacks and ensure the flexibility and effectiveness of access control.

[0082] As a possible implementation, Figure 2 As shown, the probe module is connected between the terminal device and the second access management module; the probe module is used to collect state parameters from the terminal device and send the state parameters to the first access management module.

[0083] Optionally, the probe module 27 can collect state parameters from the terminal device 21 in real time and send the state parameters to the first access management module 22. The probe module monitors and detects malicious activities and security events of the terminal device 21 in real time to collect the state parameters of the terminal device 21, so as to facilitate subsequent dynamic protection according to the state parameters, thereby achieving all-round intrusion detection and protection, combined with real-time response and lightweight design, which can effectively respond to complex security threats in the Internet of Things environment and provide solid protection for the safe operation of Internet of Things devices.

[0084] As a possible implementation, Figure 2 As shown, the second management module is connected between the terminal device and the first access management module; the second management module is used to send an access request message from the terminal device to the first access management module, and to obtain the status parameters of the terminal device.

[0085] Optionally, the second access management module 23 is used to receive the state parameters of the terminal device 21 from the probe module 27, and the access request message from the terminal device 21. Further, the first access management module 22 can process the state parameters of the terminal device 21, filter out the health status, network location, network environment and other state parameters that can be used for security assessment, and send these filtered state parameters and the access request message to the first access management module 22. In addition, the first access management module 22 can analyze the state parameters of the terminal device 21 to determine the abnormal situation of the terminal device 21.

[0086] Optionally, the dynamic reporting and alarm module of the second access management module 23 can feed back the abnormal situation of the terminal device 21 to the first access management module 22 in real time, and start the early warning mechanism when the terminal device 21 sends an abnormality.

[0087] As a possible implementation method, the terminal device is used to generate a first private key and a first public key based on a key algorithm, and the business system is used to generate a second private key and a second public key based on the key algorithm; the terminal device is used to encrypt data packets sent to the business system based on the first private key when the terminal device is connected to the business system, and to decrypt data packets from the business system based on the second public key; the business system is used to decrypt data packets from the terminal device based on the first public key when the terminal device is connected to the business system, and to encrypt data packets returned to the terminal device based on the second private key.

[0088] Optionally, during the handshake phase of establishing a communication tunnel, a public key exchange can be performed between the terminal device and the service platform (i.e., the terminal device sends a first public key to the service platform, or the service platform sends a second public key to the terminal device). After the key exchange is completed, the terminal device accesses the service system and data transmission can be performed. When the terminal device needs to send a data packet to the service system, the terminal device can encrypt or sign the data packet sent to the service system based on the first private key. Furthermore, when the service system can receive the encrypted or signed data packet sent by the terminal device, the encrypted or signed data packet can be decrypted or verified based on the first public key.

[0089] When the business system needs to send a data packet to the terminal device, the business system can encrypt or sign the data packet sent to the terminal device based on the second private key. Furthermore, when the terminal device receives the encrypted or signed data packet sent by the business system, it can decrypt or verify the encrypted or signed data packet based on the second public key.

[0090] This application uses one side's own private key to sign or encrypt the data to be sent, and uses the exchanged public key on the other side to verify the signature or decrypt, and decrypts to obtain the final data, which can further confirm the sender's identity and prevent data tampering.

[0091] As a possible implementation, Figure 2 As shown, the key management module is connected between the terminal device and the business system; the key management module is used to generate the public public key and public private key of the terminal device and the business system respectively based on their respective identity identifications, through the key algorithm, and issue the respective public public key and public private key to the terminal device and the business system; the terminal device is used to generate a first public key based on the public public key of the terminal device and the local private public key of the terminal device, and to generate a first private key based on the public private key of the terminal device and the local private key of the terminal device; the business system is used to generate a second public key based on the public public key of the business system and the local private public key of the business system, and to generate a second private key based on the public private key of the business system and the local private key of the business system.

[0092] As a possible implementation method, the identity is generated based on the physically unclonable PUF technology.

[0093] Optionally, in the initial stage, the terminal device 21 can generate a unique identity fingerprint (i.e., PUF fingerprint identification) of the terminal device 21 based on PUF technology, and generate a unique identification (Identity document, ID) of the device (i.e., the identity identification of the terminal device 21 in this application) in combination with the device identification code of the terminal device 21 (e.g., the serial number (SerialNumber, SN) in this application). The terminal device 21 can generate the identity identification of the terminal device 21 based on the PUF fingerprint identification and / or the serial number.

[0094] The terminal device 21 can generate a first private key (i.e., the local private key of the terminal device) and a first private public key (i.e., the local private public key of the terminal device) based on the unique identification of the device and the national secret algorithm provided by the password module 25. In addition, the business system 28 can generate a device unique identification (i.e., the identity identification of the business system 28 in this application) based on the PUF technology. The business system 28 can generate a second private key (i.e., the local private key of the business system) and a second private public key (i.e., the local private public key of the business system) based on the unique identification of the device and the national secret algorithm provided by the password module 25. The device identification code of the terminal device 21 is a unique code composed of numbers, letters or special characters, which is used to identify the uniqueness of the device.

[0095] The terminal device 21 and / or the business system 28 can send their own unique device IDs to the key management module 24 respectively. The key management module 24 can generate the public key and public private key of the terminal device 21 and the business system 28 respectively according to the unique device IDs of the terminal device 21 and the business system 28 and the random number generated by the key management module 24, and generate the public key and public private key of the terminal device 21 and the business system 28 respectively through the national secret algorithm provided by the password module 25. And send the public key and public private key of the terminal device 21 and the business system 28 respectively to the terminal device 21 and the business system 28. Further, the terminal device 21 can generate a first public key according to the public key and the first private key of the terminal device 21, and generate a first private key according to the public key and the first private key of the terminal device 21. The business system 28 can generate a second public key according to the public key and the second private key of the business system 28, and generate a second private key according to the public key and the second private key of the business system 28, so as to prepare resources for subsequent communications.

[0096] It should be noted that PUF technology can extract the unique identity fingerprint of the device from the terminal device 21 and the business system 28, and generate a private key, a public key, a unique ID, a secure random number, etc. based on the unique identity fingerprint and provide it to the application for digital signature verification, identity authentication, encryption and decryption and other functions. Then delete the unique identity fingerprint and private key traces of the device, do not store the unique identity fingerprint and private key of the device, generate it now, and the time window is extremely short. It is an excellent internal self-generation method of the key. Its application in the Internet of Things can ensure the uniqueness of the device and prevent the intrusion of malicious devices.

[0097] Most of the technologies related to this application rely on static keys or certificates for identity authentication. Once this static method is leaked or hacked, the device identity is easily forged, and there is a risk of device identity authentication failure and impersonation, making it difficult to ensure the uniqueness and non-tamperability of the device identity. Among several methods of internal self-generation of keys, PUF technology has six major characteristics: randomness, uniqueness, stability, non-tamperability, physical non-cloning, and mathematical non-cloning. It is suitable for physical fingerprint identification of devices and the key generation function derived from it. Therefore, this application generates a unique fingerprint of the device through PUF technology to ensure the uniqueness and non-tamperability of the device identity.

[0098] At the same time, PUF technology is combined with the CLA certificateless public key cryptography system to generate corresponding public and private key pairs in the local communication device (i.e., terminal device and business platform) and the cloud (i.e., key management module), realizing key segmentation storage and two-party joint computing technology, thereby realizing the generation, management and use of user keys. In this way, the local and cloud sides do not know each other's key components, and neither side can infer the other's components, which can effectively prevent the key from being obtained by a third party, ensure the security of the user's identity, and improve the simplicity of authentication under the premise of ensuring identity security.

[0099] As a possible implementation, Figure 2 As shown, the cryptographic module is used to provide a key algorithm for generating a key.

[0100] Optionally, the cryptographic module 25 may provide a key algorithm for generating a key. The key algorithm may be a widely verified cryptographic algorithm, such as a national secret algorithm, an asymmetric encryption (RSA) algorithm, a symmetric encryption (Advanced Encryption Standard, AES) algorithm, and the like. In terms of data encryption and decryption, the communication information and storage information of the terminal device are encrypted and decrypted using a cryptographic algorithm to prevent the information from being illegally leaked, deciphered, and tampered with.

[0101] Most of the related technologies ignore the protection of data storage and processing, which can easily lead to tampering or leakage of sensitive data inside the device. Data security protection outside the life cycle has not been taken seriously, and the overall protection is not perfect. This application can provide comprehensive encryption protection from data storage, transmission to processing through key algorithms to ensure the security of data throughout the entire life cycle. In particular, hardware encryption mechanisms are used during storage and processing to prevent data leakage and tampering.

[0102] The following describes a security protection method provided by an embodiment of the present application in conjunction with the accompanying drawings. Figure 3 As shown, a security protection method provided in an embodiment of the present application includes S201-S202:

[0103] S201. Authenticate an access request message from a terminal device.

[0104] S202: When the authentication is successful, determine whether to allow the terminal device to access the service system based on the status parameters of the terminal device.

[0105] Among them, the status parameters include at least one of the following: health status, network location, and network environment.

[0106] Alternatively, if Figure 1 As shown, when the terminal device needs to access the service system, the terminal device can send an access request message to the first access management module. The access request information can include the device identification and password of the terminal device. The device identification can be the serial number of the terminal device, or the device model + serial number of the terminal device, etc., which are used to represent the device identity.

[0107] The first access management module may include an identity authentication module, a device authentication and trust evaluation module, an access policy management module, a security configuration module, a DNS management module, and an application and network resource management module.

[0108] The identity authentication module of the first access management module can authenticate the terminal device according to the access request message, and if the device identification and password of the terminal device are consistent with the device identification and password of the terminal device stored in the first access management module, the authentication is successful. If the device identification and password of the terminal device are inconsistent with the device identification and password of the terminal device stored in the first access management module, the authentication fails.

[0109] Optionally, when the device identification and password are consistent (i.e., the user identity authentication is successful), the identity authentication module of the first access management module can further confirm whether the terminal device has accessed the service system. If it is confirmed that the terminal device has not accessed the service system, the identity authentication module of the first access management module can further perform user device authentication on the terminal device. For example, an auxiliary authentication message is sent to the terminal device to notify the terminal device to request other terminal devices to perform auxiliary authentication on the terminal device, and if the auxiliary authentication passes, the authentication is confirmed to be successful. If it is confirmed that the terminal device has accessed the service system, the authentication is directly confirmed to be successful.

[0110] Further, in the case of successful authentication, the device authentication and trust evaluation module of the first access management module can determine whether to allow the terminal device to access the service system based on the status parameters of the terminal device. The health status can be the operating system version, patch update status and running status of the terminal device. The network location can be the IP address of the terminal device. The network environment can be the network environment where the terminal device is located (for example, a wireless broadband network environment, a mobile data traffic network, etc.).

[0111] For example, the lower the operating system version of the terminal device, the longer the patch update time and / or the worse the running status, the worse the health status of the terminal device. In the case of a poor health status, the terminal device is not allowed to access the business system.

[0112] It should be noted that if a terminal device wants to access the service system, the terminal device needs to be registered in the service system in advance, and the service system needs to store the device identification and password of the terminal device and send the device identification and password of the terminal device to the first access management module. That is, the first access management module can store the device identification and passwords of multiple registered terminal devices.

[0113] Optionally, the access policy management module of the first access management module can dynamically allocate access rights according to the authentication result (authentication success or authentication failure) and status parameters of the terminal device, and send the corresponding access control policy to the SDP gateway, and then send the corresponding access control policy to the business system through the SDP gateway to ensure minimum authorization. For example, if the terminal device is successfully authenticated, but the health status of the terminal device is average, then the access control policy of the terminal device can be a small number of applications that allow the terminal device to access the business system.

[0114] Optionally, the security configuration module of the first access management module can access an external threat intelligence system, update security protection policies in real time, and perform system-level security configuration management. The security protection policy is a policy for determining access control policies based on authentication results and status parameters.

[0115] Optionally, the private DNS management module of the first access management module can ensure that domain name resolution requests in network communications are performed through a secure private DNS to avoid external DNS resolution attacks. The application and network resource management module of the first access management module can manage the internal network resources and application access rights of the business system to ensure that internal network resources are only accessed by authenticated terminal devices.

[0116] This application can ensure the access rights of legitimate devices and users by authenticating the terminal devices. Ensure that the connected devices are in a safe state based on the health status of the terminal devices. Determine whether there are suspicious activities based on the network location and network environment of the terminal devices to ensure the legitimacy of the terminal devices accessing the business system. By using two-factor authentication (i.e. user identity authentication + user device authentication) during authentication, this multiple verification method can prevent unauthorized access and increase the security level.

[0117] In one design, Figure 4 As shown, a security protection method provided in an embodiment of the present application, before the above step S201, the method further includes S301:

[0118] S301: Receive an access request message from a terminal device, and obtain a status parameter of the terminal device.

[0119] Alternatively, if Figure 2 As shown, the second access management module is used to receive the status parameters of the terminal device from the probe module, as well as the access request message from the terminal device. Furthermore, the first access management module can process the status parameters of the terminal device, filter out the health status, network location, network environment and other status parameters that can be used for security assessment, and send these filtered status parameters and access request message to the first access management module. In addition, the first access management module can analyze the status parameters of the terminal device to determine the abnormal situation of the terminal device.

[0120] Optionally, the dynamic reporting and alarm module of the second access management module may feed back abnormal conditions of the terminal device to the first access management module in real time, and start an early warning mechanism when the terminal device sends an abnormality.

[0121] In one design, Figure 5 As shown, a security protection method provided in an embodiment of the present application, after the above step S201, the method further includes S401:

[0122] S401: In case of authentication failure, determine that the terminal device is not allowed to access the service system.

[0123] Alternatively, if Figure 1As shown, the first access management module can determine that the terminal device is not allowed to access the business system when the terminal device authentication fails, and discard the access request information and the status parameters of the terminal device to prevent the terminal device that fails the authentication from accessing the business system, thereby failing to ensure access security.

[0124] In one design, Figure 6 As shown, a security protection method provided in an embodiment of the present application, after the above step S202, the method further includes S501:

[0125] S501. When a terminal device is allowed to access a service system, a communication tunnel between the terminal device and the service system is established based on the transport layer security protocol TLS, so that the terminal device can access the service system.

[0126] Alternatively, if Figure 2 As shown, when the terminal device is allowed to access the business system, the data transmission module can establish a communication tunnel between the terminal device and the business system based on TLS. In this way, when the terminal device and the business system subsequently transmit data through the communication tunnel established by TLS, TLS communication protocol encryption can be used to ensure data transmission security.

[0127] It should be noted that, since terminal devices usually have limited computing power and resources, and traditional transport layer security protocols have high computational complexity and high resource consumption, they are difficult to run effectively on resource-constrained terminal devices. In addition, complex encryption algorithms cannot be used, making data in transit easily intercepted or tampered with. Therefore, the security of the transmission protocol is insufficient, and protocol layer vulnerabilities may be exploited, affecting transmission security.

[0128] The lightweight TLS protocol has been optimized to improve the security and efficiency of data transmission in response to the resource constraints of terminal devices. The protocol optimizes and integrates the protocol signaling process, and performs load-lightweight tailoring on the TLS handshake, which can reduce communication bandwidth usage and computing and communication overhead while ensuring secure communication between devices. This end-to-end encryption method can ensure that data transmission is not stolen or tampered with, and ensures that low-power devices can also achieve efficient and secure transmission.

[0129] In one design, Figure 7 As shown, a security protection method provided in an embodiment of the present application, after the above step S501, the method further includes S601:

[0130] S601: When a terminal device accesses a service system, determine whether to disconnect a communication tunnel based on a state parameter.

[0131] like Figure 1As shown, after the communication tunnel is established, the first access management module can determine whether to disconnect the communication tunnel in real time based on the state parameters when the terminal device accesses the service system. In addition, if it is determined that the communication tunnel is not disconnected, the first access management module can determine whether to adjust the access rights based on the state parameters, and then adjust the access control policy.

[0132] For example, if the health status of the terminal device is poor, the communication tunnel may be disconnected. If the health status of the terminal device is good, the communication tunnel may not be disconnected, and the access rights may be adjusted to allow the terminal device to access most applications of the business system.

[0133] This application can prevent lateral attacks by malicious users and achieve access security for business systems by dynamically managing the communication tunnels for terminal devices to access business systems in real time according to status parameters, and adjusting access permissions. The access control mechanisms in related technologies are mostly based on static rules, and are unable to adjust permissions according to device status or real-time environment, causing the system to appear passive in the face of complex attacks. Once breached, attackers may obtain long-term illegal access permissions. This application combines the real-time status of terminal devices and dynamic identity authentication results to flexibly control access permissions. Strategies can be dynamically adjusted according to environmental changes to prevent continuous penetration attacks and ensure the flexibility and effectiveness of access control.

[0134] In one design, Figure 8 As shown, a security protection method provided by an embodiment of the present application, before the above step S201, the method further includes S701-S703:

[0135] S701. Generate a first private key and a first public key based on a key algorithm, and generate a second private key and a second public key based on the key algorithm.

[0136] S702: When the terminal device accesses the service system, encrypt the data packet sent by the terminal device to the service system based on the first private key, and decrypt the data packet returned by the service system to the terminal device based on the second public key.

[0137] S703: When the terminal device accesses the service system, the data packet returned by the terminal device to the service system is decrypted based on the first public key, and the data packet sent by the service system to the terminal device is encrypted based on the second private key.

[0138] Optionally, during the handshake phase of establishing a communication tunnel, a public key exchange can be performed between the terminal device and the service platform (i.e., the terminal device sends a first public key to the service platform, or the service platform sends a second public key to the terminal device). After the key exchange is completed, the terminal device accesses the service system and data transmission can be performed. When the terminal device needs to send a data packet to the service system, the terminal device can encrypt or sign the data packet sent to the service system based on the first private key. Furthermore, when the service system can receive the encrypted or signed data packet sent by the terminal device, the encrypted or signed data packet can be decrypted or verified based on the first public key.

[0139] When the business system needs to send a data packet to the terminal device, the business system can encrypt or sign the data packet sent to the terminal device based on the second private key. Furthermore, when the terminal device receives the encrypted or signed data packet sent by the business system, it can decrypt or verify the encrypted or signed data packet based on the second public key.

[0140] This application uses one side's own private key to sign or encrypt the data to be sent, and uses the exchanged public key on the other side to verify the signature or decrypt, and decrypts to obtain the final data, which can further confirm the sender's identity and prevent data tampering.

[0141] In one design, Fig. 9 As shown, a security protection method provided by an embodiment of the present application, before the above step S701, the method further includes S801 and S802, and, before the above step S702, the method further includes S801 and S803:

[0142] S801. Generate a public key and a private key for the terminal device and the business system based on their respective identities through a key algorithm.

[0143] S802: Generate a first public key based on the public key of the terminal device and the local private key of the terminal device, and generate a first private key based on the public key of the terminal device and the local private key of the terminal device.

[0144] S803: Generate a second public key based on the public key of the business system and the local private key of the business system, and generate a second private key based on the public key of the business system and the local private key of the business system.

[0145] As a possible implementation method, the identity is generated based on the physically unclonable PUF technology.

[0146] Alternatively, if Figure 2As shown, in the initial stage, the terminal device can generate a unique identity fingerprint of the terminal device (i.e., PUF fingerprint identification) based on the PUF technology, and generate a unique ID of the device (i.e., the identity identification of the terminal device in this application) in combination with the device identification code of the terminal device (e.g., the serial number in this application). The terminal device can generate the identity identification of the terminal device based on the PUF fingerprint identification and / or the serial number.

[0147] The terminal device can generate a first private key (i.e., the local private key of the terminal device) and a first private public key (i.e., the local private public key of the terminal device) based on the unique identifier of the device and the national secret algorithm provided by the password module. In addition, the service platform can generate a device unique identifier (i.e., the identity identifier of the service platform in this application) based on PUF technology. The service platform can generate a second private key (i.e., the local private key of the service system) and a second private public key (i.e., the local private public key of the service system) based on the unique identifier of the device and the national secret algorithm provided by the password module. The device identification code of the terminal device is a unique code composed of numbers, letters or special characters, which is used to identify the uniqueness of the device.

[0148] The terminal device and / or the service platform can send their respective device unique IDs to the key management module respectively. The key management module can generate the public key and public private key of the terminal device and the service platform respectively according to the device unique ID of the terminal device and the service platform and the random number generated by the key management module, through the national secret algorithm provided by the cryptographic module. And send the public key and public private key of the terminal device and the service platform respectively to the terminal device and the service system. Further, the terminal device can generate a first public key according to the public public key of the terminal device and the first private public key, and generate a first private key according to the public private key of the terminal device and the first private private key. The service platform can generate a second public key according to the public public key and the second private public key of the service platform, and generate a second private key according to the public private key and the second private private key of the service platform, so as to prepare resources for subsequent communications.

[0149] It should be noted that PUF technology can extract the unique identity fingerprint of the device from the terminal device and business system, and generate private key, public key, unique ID, secure random number, etc. based on the unique identity fingerprint to provide to the application for digital signature verification, identity authentication, encryption and decryption and other functions. Then delete the unique identity fingerprint and private key traces of the device, do not store the unique identity fingerprint and private key of the device, generate them as needed, and the time window is extremely short. It is an excellent internal self-generation method of keys. Its application in the Internet of Things can ensure the uniqueness of the device and prevent the intrusion of malicious devices.

[0150] Most of the technologies related to this application rely on static keys or certificates for identity authentication. Once this static method is leaked or hacked, the device identity is easily forged, and there is a risk of device identity authentication failure and impersonation, making it difficult to ensure the uniqueness and non-tamperability of the device identity. Among several methods of internal self-generation of keys, PUF technology has six major characteristics: randomness, uniqueness, stability, non-tamperability, physical non-cloning, and mathematical non-cloning. It is suitable for physical fingerprint identification of devices and the key generation function derived from it. Therefore, this application generates a unique fingerprint of the device through PUF technology to ensure the uniqueness and non-tamperability of the device identity.

[0151] At the same time, PUF technology is combined with the CLA certificateless public key cryptography system to generate corresponding public and private key pairs in the local communication device (i.e., terminal device and business platform) and the cloud (i.e., key management module), realizing key segmentation storage and two-party joint computing technology, thereby realizing the generation, management and use of user keys. In this way, the local and cloud sides do not know each other's key components, and neither side can infer the other's components, which can effectively prevent the key from being obtained by a third party, ensure the security of the user's identity, and improve the simplicity of authentication under the premise of ensuring identity security.

[0152] In a possible implementation, the specific steps for protecting terminal devices from accessing the business system are as follows: 1. Initial stage: The IoT terminal (i.e., the terminal device in this application) and the business platform generate their own unique device IDs (i.e., the identity identifier in this application) based on PUF technology. On the one hand, the ID generates a private key (i.e., the first private key and the second private key in this application) and a private public key (i.e., the first private public key and the second private public key in this application) with the national secret algorithm provided by the password module.

[0153] On the other hand, it is combined with the random number generated by the cloud key management platform (i.e., the key management module in this application) to generate a public private key and a public public key, and the public key (i.e., the public private key and the public public key) is sent to the IoT terminal and the business platform. The public key and the key (i.e., the private private key and the private public key) generated by the device (i.e., the IoT terminal and the business platform) itself generate the final public key and private key, and prepare resources for subsequent communications.

[0154] 2. Access phase: After the terminal device is started, the lightweight EDR probe (i.e., the probe module in this application) monitors and detects malicious activities and security incidents in real time, and reports the relevant information (i.e., the status parameters of the terminal device in this application) to the SDP client (i.e., the second access management module in this application). The SDP client processes and analyzes the data. The SDP client sends the terminal identity information (i.e., the status parameters of the screened terminal device in this application) to the SDP controller (i.e., the first access management module in this application). The SDP controller determines whether the identity of the terminal device is legal (i.e., authenticates the terminal device). If it is a legal message (i.e., the authentication is successful), the corresponding access policy is issued to the SDP client and SDP gateway to establish a communication tunnel between the terminal device and the service platform, otherwise the information is discarded.

[0155] Furthermore, after the communication tunnel is established, the SDP client will continue to report the status parameters of the terminal device, and the SDP controller will dynamically manage it, adjust access rights, prevent lateral attacks by malicious users, and achieve access security for the business system. For the communication tunnel, the lightweight TLS protocol can be used for transmission. During the handshake phase, the public key exchange between the terminal device and the business platform is carried out. After the key exchange is completed, data transmission can be carried out. The terminal device uses its own private key to sign the data to be sent, and the exchanged public key is used on the business platform side to verify the signature, further confirm the identity of the sender, prevent data tampering, and decrypt to obtain the final data.

[0156] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the system. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0157] The embodiment of the present application can divide a security protection system into functional modules. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0158] Fig.10This is a schematic diagram of the structure of a safety protection device provided in an embodiment of the present application. Fig.10 As shown, a security protection device 90 is used to ensure the security of a terminal device when accessing a business system. The security protection device 90 includes: a processing unit 901.

[0159] Processing unit 901 is used to authenticate the access request message from the terminal device, and if the authentication is successful, determine whether to allow the terminal device to access the service system based on the status parameters of the terminal device; the status parameters include at least one of the following: health status, network location, and network environment.

[0160] In a possible implementation, the processing unit 901 is further configured to, when the authentication fails, determine that the terminal device is not allowed to access the service system.

[0161] In one possible implementation, the processing unit 901 is further used to generate a first private key and a first public key based on a key algorithm, and to generate a second private key and a second public key based on the key algorithm; the processing unit 901 is further used to, when the terminal device accesses the service system, encrypt data packets sent by the terminal device to the service system based on the first private key, and to decrypt data packets returned by the service system to the terminal device based on the second public key; the processing unit 901 is further used to, when the terminal device accesses the service system, decrypt data packets returned by the terminal device to the service system based on the first public key, and to encrypt data packets sent by the service system to the terminal device based on the second private key.

[0162] In a possible implementation, the processing unit 901 is further used to generate a public key and a public private key for the terminal device and the business system respectively through a key algorithm based on the respective identity identifiers of the terminal device and the business system; the processing unit 901 is further used to generate a first public key based on the public public key of the terminal device and the local private public key of the terminal device, and to generate a first private key based on the public private key of the terminal device and the local private key of the terminal device; the processing unit 901 is further used to generate a second public key based on the public public key of the business system and the local private public key of the business system, and to generate a second private key based on the public private key of the business system and the local private key of the business system.

[0163] In a possible implementation, the identity is generated based on physically unclonable PUF technology.

[0164] In a possible implementation, the processing unit 901 is further configured to establish a communication tunnel between the terminal device and the business system based on the transport layer security protocol TLS when allowing the terminal device to access the business system, so that the terminal device can access the business system.

[0165] In a possible implementation, the processing unit 901 is further configured to determine whether to disconnect the communication tunnel based on the state parameter when the terminal device accesses the service system.

[0166] In a possible implementation, the security protection device 90 includes: a transmission unit 902; the transmission unit 902 is used to receive an access request message from a terminal device and obtain a state parameter of the terminal device.

[0167] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiment of the present application provides a possible structural diagram of the electronic device involved in the above-mentioned embodiment. Fig.11 As shown, an electronic device 100 is used to ensure the security of a terminal device accessing a business system, for example, to perform Figure 3 A security protection method is shown. The electronic device 100 includes a processor 1001, a memory 1002 and a bus 1003. The processor 1001 and the memory 1002 can be connected via the bus 1003.

[0168] The processor 1001 is the control center of the communication device, which can be a processor or a general term for multiple processing elements. For example, the processor 1001 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0169] As an embodiment, the processor 1001 may include one or more CPUs, such as Fig.11 CPU 0 and CPU 1 are shown in .

[0170] The memory 1002 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0171] As a possible implementation, the memory 1002 can exist independently of the processor 1001, and the memory 1002 can be connected to the processor 1001 via the bus 1003 to store instructions or program codes. When the processor 1001 calls and executes the instructions or program codes stored in the memory 1002, a security protection system provided in an embodiment of the present application can be implemented.

[0172] In another possible implementation, the memory 1002 may also be integrated with the processor 1001 .

[0173] The bus 1003 may be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.11 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0174] It should be pointed out that Fig.11 The structure shown does not constitute a limitation on the electronic device 100. Fig.11 In addition to the components shown, the electronic device 100 may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0175] Optional, such as Fig.11 As shown, the electronic device 100 provided in the embodiment of the present application may further include a communication interface 1004 .

[0176] The communication interface 1004 is used to connect with other devices through a communication network. The communication network may be Ethernet, wireless access network, wireless local area network (WLAN), etc. The communication interface 1004 may include a receiving unit for receiving data and a sending unit for sending data.

[0177] In one design, in the electronic device provided in the embodiment of the present application, the communication interface can also be integrated into the processor.

[0178] Through the description of the above implementation methods, those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above functional units is used as an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0179] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When a computer executes the instructions, the computer executes each step in the method flow shown in the above method embodiment.

[0180] An embodiment of the present application provides a computer program product. When a computer instruction is executed on an electronic device, the electronic device executes a security protection system in the above method embodiment.

[0181] Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk. Random access memory (random access memory, RAM), read-only memory (read-only memory, ROM), erasable programmable read only memory (erasable programmable read only memory, EPROM), registers, hard disks, optical fibers, portable compact disc read-only memory (compact disc read-only memory, CD-ROM), optical storage devices, magnetic storage devices, or the above in a suitable combination, or any other form of computer-readable storage medium known in the art.

[0182] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC).

[0183] In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0184] Since the electronic device, computer-readable storage medium, and computer program product in the embodiments of the present application can be applied to the above method, the technical effects that can be obtained can also refer to the above method embodiments, and the embodiments of the present application will not be repeated here.

[0185] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application.

Claims

1. A safety protection system, characterized in that: The system comprises: a terminal device, a first access management module and a business system; the first access management module is connected between the terminal device and the business system; The first access management module is used to authenticate the access request message from the terminal device, and if the authentication is successful, determine whether to allow the terminal device to access the business system based on the status parameters of the terminal device; the status parameters include at least one of the following: health status, network location, and network environment.

2. The system according to claim 1, characterized in that The first access management module is further configured to determine that the terminal device is not allowed to access the service system when authentication fails.

3. The system according to claim 1, characterized in that The terminal device is used to generate a first private key and a first public key based on a key algorithm, and the business system is used to generate a second private key and a second public key based on the key algorithm; the terminal device is used to encrypt a data packet sent to the business system based on the first private key, and decrypt a data packet from the business system based on the second public key when the terminal device is connected to the business system; The business system is used to decrypt data packets from the terminal device based on the first public key and to encrypt data packets returned to the terminal device based on the second private key when the terminal device accesses the business system.

4. The system according to claim 3, characterized in that The system further comprises: a key management module; the key management module is connected between the terminal device and the business system; The key management module is used to generate the public key and public private key of the terminal device and the business system respectively through the key algorithm based on the respective identity identifications of the terminal device and the business system, and issue the respective public key and public private key to the terminal device and the business system; the terminal device is used to generate the first public key based on the public public key of the terminal device and the local private public key of the terminal device, and to generate the first private key based on the public private key of the terminal device and the local private key of the terminal device; the business system is used to generate the second public key based on the public public key of the business system and the local private public key of the business system, and to generate the second private key based on the public private key of the business system and the local private key of the business system.

5. The system according to claim 4, characterized in that The identity identification is generated based on the physically unclonable PUF technology.

6. The system according to claim 3 or 4, characterized in that: The system further comprises: a password module; The cryptographic module is used to provide the key algorithm for generating a key.

7. The system according to claim 1, characterized in that The system further comprises: a data transmission module; The data transmission module is used to establish a communication tunnel between the terminal device and the business system based on the transport layer security protocol TLS when the terminal device is allowed to access the business system, so that the terminal device can access the business system.

8. The system according to claim 7, characterized in that The first access management module is further configured to determine whether to disconnect the communication tunnel based on the state parameter when the terminal device accesses the service system.

9. The system according to claim 1, characterized in that The system further includes: a second access management module; the second management module is connected between the terminal device and the first access management module; The second management module is used to send an access request message from the terminal device to the first access management module, and obtain a status parameter of the terminal device.

10. The system according to claim 9, characterized in that The system further comprises: a probe module; the probe module is connected between the terminal device and the second access management module; The probe module is used to collect the status parameters from the terminal device and send the status parameters to the first access management module.

11. A safety protection method, characterized in that: The method comprises: Authenticate the access request message from the terminal device, and if the authentication is successful, determine whether to allow the terminal device to access the service system based on the status parameters of the terminal device; the status parameters include at least one of the following: health status, network location, network environment.

12. The method according to claim 11, characterized in that The method further comprises: In the event of authentication failure, it is determined that the terminal device is not allowed to access the service system.

13. The method according to claim 11, characterized in that The method further comprises: Generate a first private key and a first public key based on a key algorithm, and generate a second private key and a second public key based on the key algorithm; When the terminal device accesses the service system, encrypting a data packet sent by the terminal device to the service system based on the first private key, and decrypting a data packet returned by the service system to the terminal device based on the second public key; When the terminal device accesses the business system, the data packet returned by the terminal device to the business system is decrypted based on the first public key, and the data packet sent by the business system to the terminal device is encrypted based on the second private key.

14. The method according to claim 13, characterized in that The method further comprises: Based on the respective identities of the terminal device and the business system, generate the respective public key and public private key of the terminal device and the business system through a key algorithm; Generate the first public key based on the public key of the terminal device and the local private public key of the terminal device, and generate the first private key based on the public private key of the terminal device and the local private key of the terminal device; The second public key is generated based on the public key of the business system and the local private key of the business system, and the second private key is generated based on the public key of the business system and the local private key of the business system.

15. The method according to claim 14, characterized in that The identity identification is generated based on the physically unclonable PUF technology.

16. The method according to claim 11, characterized in that The method further comprises: In the case where the terminal device is allowed to access the business system, a communication tunnel between the terminal device and the business system is established based on the transport layer security protocol TLS, so that the terminal device can access the business system.

17. The method according to claim 16, characterized in that The method further comprises: When the terminal device accesses the service system, it is determined whether to disconnect the communication tunnel based on the state parameter.

18. The method according to claim 11, characterized in that Before authenticating the access request message from the terminal device, the method further includes: Receive an access request message from the terminal device, and obtain the status parameters of the terminal device.

19. A safety protection device, characterized in that: The safety protection device comprises: a processing unit; The processing unit is used to authenticate the access request message from the terminal device, and if the authentication is successful, determine whether to allow the terminal device to access the service system based on the status parameters of the terminal device; the status parameters include at least one of the following: health status, network location, and network environment.

20. An electronic device, characterized in that: include: Processor and memory; Wherein, the memory is used to store one or more programs, and the one or more programs include computer-executable instructions. When the electronic device is running, the processor executes the computer-executable instructions stored in the memory to enable the electronic device to implement the system described in any one of claims 1-10, or execute the method described in any one of claims 11-18.

21. A computer-readable storage medium storing one or more programs, characterized in that: The one or more programs include instructions, which, when executed by a computer, enable the computer to implement the security protection system according to any one of claims 1 to 10, or to perform the method according to any one of claims 11 to 18.

22. A computer program product, characterized in that The computer program product includes computer instructions. When the computer instructions are executed on an electronic device, the electronic device implements the security protection system according to any one of claims 1 to 10, or executes the method according to any one of claims 11 to 18.

Images