Position-based security policy check method and device, and computer equipment

Abstract

The invention discloses a position-based security policy checking method and device, computer equipment, a storage medium and a computer program product. The position-based security policy checking method comprises the following steps: acquiring a first position of an asset coupled with communication equipment, and recording the first position and a first time when the first position is acquired; obtaining a second position of the asset from the configuration data of the network traffic of the asset at a second time; comparing the second position of the asset with the first position of the asset, and judging whether the position of the asset is changed or not; a security policy check is made in response to a change in the location of the asset.

Description

Method, device, and computer equipment for location-based security policy inspection Technical Field

[0001] The present application relates to the field of network security technology, and in particular, to a method, apparatus, computer device, storage medium, and computer program product for location-based security policy checking. Background Art

[0002] Today, industrial networks involve numerous assets, such as personal computers and engineering workstations. A security issue with one asset can impact the normal operation of other assets. Furthermore, network assets can change locations depending on the application scenario. In these situations, unknown risks could compromise these assets.

[0003] Summary of the Invention

[0004] This summary is provided to introduce some selected concepts in a simplified form, which will be further described in the detailed description below. This summary is not intended to identify any key features or essential features of the claimed subject matter, nor is it intended to be used to help determine the scope of the claimed subject matter.

[0005] Based on this, the present application provides a location-based security policy checking method, including obtaining a first location of an asset coupled to a communication device, and recording the first location and the first time of obtaining the first location; at a second time, obtaining the second location of the asset from the configuration data of the network traffic of the asset; comparing the second location of the asset with the first location of the asset to determine whether the location of the asset has changed; and performing a security policy check in response to the change in the location of the asset.

[0006] In this way, assets in the network can be more secure.

[0007] In one embodiment, the method further includes creating an alias for the asset coupled to the communication device based at least on the region where the asset is located and / or the number of the assets; and obtaining the first location and / or the second location of the asset based at least on the created alias for the asset coupled to the communication device.

[0008] In one embodiment, the method further includes dividing the area where the asset is located into multiple sub-areas, and recording the sub-areas where the asset is located; creating an alias for the asset coupled to the communication device at least based on the sub-areas; and obtaining the first position and / or the second position of the asset at least based on the created alias for the asset coupled to the communication device.

[0009] In one embodiment, the method further includes checking the location of the asset at predetermined intervals; recording the time corresponding to the location change in response to a change in the location; checking that no other time information is recorded between the first time and the second time, comparing the second location of the asset with the first location of the asset, and determining whether the location of the asset has changed.

[0010] In one embodiment, the method further includes the security check comprising at least one of a vulnerability check, a security status check, and a security configuration check.

[0011] In one embodiment, in response to the change in the location of the asset, performing a security policy check includes: performing a security policy check according to predefined security policies corresponding to different locations based on the location of the asset.

[0012] In one embodiment, in response to the change in the location of the asset, performing a security policy check includes: when the location of the asset changes at a predefined time, performing a security policy check according to a predefined security policy for abnormal situations in which the location changes at the predefined time.

[0013] The present application also proposes a location-based security policy checking device, including: a first location acquisition module, used to obtain a first location of an asset coupled to a communication device, and record the first location and the first time of obtaining the first location; a second location acquisition module, used to obtain the second location of the asset from the configuration data of the network traffic of the asset at a second time; a comparison module, used to compare the second location of the asset with the first location of the asset to determine whether the location of the asset has changed; and a security policy checking module, used to perform a security policy check in response to a change in the location of the asset.

[0014] The present application also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and wherein the processor implements the above method when executing the computer program.

[0015] The present application also provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the above method when executed by a processor.

[0016] The present application also provides a computer program product, comprising: a machine-readable medium having executable instructions stored thereon, wherein the executable instructions, when executed, enable a machine to perform the above method. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Implementations of the present disclosure are illustrated by way of example and not limitation in the figures of the accompanying drawings in which like references indicate the same or similar parts.

[0018] FIG1 is a schematic diagram of an OT system according to an embodiment of the present application.

[0019] FIG2 is a flowchart of a method for location-based security policy checking according to an embodiment of the present application.

[0020] FIG3 is a schematic diagram of a device for location-based security policy checking according to an embodiment of the present application.

[0021] FIG4 is a schematic diagram of a computer device for location-based security policy checking according to an embodiment of the present application.

[0022] The accompanying drawings are numerals as follows:

[0023] Steps S201-S204

[0024] 300: Location-based security policy inspection device

[0025] 301: First position acquisition module

[0026] 302: Second position acquisition module

[0027] 303: Comparison module

[0028] 304: Security policy check module

[0029] 400: Computer equipment

[0030] 402: Processor

[0031] 404: Memory DETAILED DESCRIPTION

[0032] In the following description, for the purpose of explanation, a large number of specific details are set forth. However, it is understood that the present invention can be implemented without these specific details. In other examples, well-known circuits, structures, and technologies are not shown in detail so as not to affect the understanding of the description.

[0033] References throughout this specification to "an implementation," "an implementation," "an exemplary implementation," "some implementations," "various implementations," etc., indicate that the implementations of the invention being described may include particular features, structures, or characteristics. However, it does not imply that every implementation must include those particular features, structures, or characteristics. Furthermore, some implementations may have some, all, or none of the features described for other implementations.

[0034] In the following description, the terms "coupled" and "connected" and their derivatives may be used. It should be understood that these terms are not intended to be synonymous with each other. Rather, in certain implementations, "connected" is used to indicate that two or more components are in direct physical or electrical contact with each other, while "coupled" is used to indicate that two or more components cooperate or interact with each other, but they may or may not be in direct physical or electrical contact. FIG1 is a flowchart of a method for location-based security policy checking according to an embodiment of the present application.

[0035] FIG1 is a schematic diagram of an OT system according to an embodiment of the present application. An OT system, also known as an industrial control system, is configured to implement automatic control of industrial processes. OT systems can be applied to wind power systems, vehicle manufacturing plants, pharmaceutical plants, municipal sewage treatment systems, and the like. OT systems can be implemented as management control and data acquisition systems, distributed control systems, and computer digital control systems. Specifically, OT systems use hardware and software to implement management by monitoring and / or controlling physical devices and events in an enterprise. OT systems use computers to monitor or change the physical state of equipment, such as the state of OT assets. An OT system 10 can be composed of multiple OT assets. OT assets can be industrial controllers 101, field devices 102, industrial hosts 103, security devices 104, and communication devices 105, among others.

[0036] In one implementation, the industrial controller may be a programmable logic controller or a programmable automation controller. In one implementation, the industrial controller may be coupled to a field device. In another implementation, the industrial controller may be coupled to an industrial host or may be coupled to the industrial host via a communication device. Here, the communication device may be a router, a switch, or other device that can transmit information. For example, the communication device may be an industrial router or an industrial switch. In one implementation, the field device may be a sensor or an engine. Here, the sensor may obtain field data, such as temperature, humidity, pressure, and liquid flow rate. The engine may drive the industrial controller. In one implementation, the industrial host may include an engineer station, an operator station, a human-machine interface station, a database server, an application server, etc. In one implementation, security devices may include firewalls, servers, etc. for intrusion detection.

[0037] FIG2 is a flow chart of a method for checking a security policy based on location according to an embodiment of the present application. A method 200 for checking a security policy based on location begins at step 201 .

[0038] In step 201, a first location of an asset coupled to a communication device is obtained, and the first location and the first time the first location was obtained are recorded. Here, the communication device may be a router, a switch, or other device capable of transmitting information. For example, it may be an industrial router or an industrial switch.

[0039] In one implementation, a first location of an asset coupled to a switch can be obtained from the switch. There are many implementations for obtaining the first location of the asset, which will be described in detail in the following sections.

[0040] To meet application requirements, the location of assets within the network may change. For example, an operator station may move from Building A to Building B. Or, an operator station may move from the 1st floor of Building A to the 10th floor. This location change poses a potential security risk to the OT network. When this occurs, a security check can be performed on the asset.

[0041] In one implementation, a first location of an asset and a first time corresponding to the first location may be recorded. Here, the first time may be the time corresponding to when the asset is physically located at the first location. Alternatively, the first time may be the time corresponding to when the first location of the asset is obtained.

[0042] The method proceeds to step 202. At step 202, at a second time, a second location of the asset is obtained from configuration data of network traffic of the asset.

[0043] The difference here from step 201 is that, whereas step 201 obtains the asset's location information from the communication device, step 202 transmits and receives the information from the asset. Furthermore, step 201 is performed when the asset is connected to the communication device, while step 202 is performed when the asset is operating. There are many ways to specifically obtain the asset's first location, which will be described in detail later.

[0044] The method proceeds to step 203. At step 203, the second position of the asset is compared with the first position of the asset to determine whether the position of the asset has changed.

[0045] In one implementation, the first location and / or the second location may be stored in a database or other storage medium to enable location comparison. In determining whether the locations have changed, consideration may be given to whether other location information has been recorded between the times corresponding to the two locations. This will be described in detail in the following sections.

[0046] The method proceeds to step 204. In step 204, in response to the change in the location of the asset, a security policy check is performed. In one implementation, the security check may include at least one of a vulnerability check, a security status check, and a security configuration check.

[0047] Security checks are not limited to the above. They can also include backdoor checks, including those for Trojan horses. In the computer field, a Trojan horse refers to a backdoor program that hackers use to steal other users' personal information or even remotely control their electronic devices. These programs are encrypted and then distributed or tricked into executing by the target, aiming to steal passwords and other data. Similar to viruses, Trojan programs are highly stealthy and launch when the operating system boots. Backdoor checks can eliminate this security risk.

[0048] Security checks can also include malware checks. Malware, also known as "rogue software," generally refers to software that is spread through networks, portable storage devices, and other channels, and intentionally causes privacy or confidential information leakage, system damage (including but not limited to system crashes, etc.), data loss, and other unexpected failures and information security issues to personal computers, servers, smart devices, computer networks, etc., and attempts to prevent users from removing them in various ways. Malware comes in the form of binary executable files, scripts, active content, etc. By definition, computer viruses, computer worms, Trojan horses, ransomware, spyware, scareware, software that exploits vulnerabilities, and even some adware are also included in the classification of malware. Malware checks can eliminate this security risk.

[0049] Security checks can also include checking for ransomware. Ransomware is a specialized type of malware, also categorized as a "denial of access attack." It differs from other viruses primarily in its methods and delivery methods. One type of ransomware simply locks the victim's computer, while another systematically encrypts the files on the victim's hard drive. All ransomware demands a ransom to regain control of the computer or to retrieve a decryption key, which the victim cannot obtain on their own. Ransomware is often spread through Trojans, disguised as seemingly harmless files. It often uses social engineering tactics like fake emails to trick victims into clicking download links. However, like many other worms, it can also exploit software vulnerabilities to spread between networked computers. Ransomware can eliminate this security risk.

[0050] The security check can also include a spyware check. Spyware is software designed to collect personal information about users without their knowledge or permission. This information can range from the websites a user visits to personal information such as usernames and passwords. The spyware check can eliminate this security risk.

[0051] Security checks can also include code injection checks. For example, code injection is a program error caused by processing invalid data. Code injection can be used by attackers to insert code into a specific computer program to change its execution process or purpose. Code injection checks can eliminate this security risk.

[0052] Security checks can also include logic bomb checks. Logic bombs are malicious code embedded in legitimate software that executes under specific circumstances. These circumstances can include file modifications, specific program input sequences, or specific times or dates. Malicious code can delete files, crash the computer, or cause other damage. The name "logic bomb" stems from the malicious behavior it exhibits when it launches. Logic bomb checks can eliminate this security risk.

[0053] Security checks can also include cross-site scripting checks. Cross-site scripting is a security vulnerability attack on website applications and a type of code injection. It allows malicious users to inject code into web pages, which will affect other users when they view the web pages. This type of attack usually involves HTML and user-side scripting languages. Cross-site scripting attacks usually refer to exploiting vulnerabilities left during web page development and using clever methods to inject malicious instruction code into the web page, causing users to load and execute web programs maliciously created by the attacker. These malicious web programs are usually JavaScript, but in fact they can also include Java, VBScript, ActiveX, Flash or even ordinary HTML. After the attack is successful, the attacker may obtain higher permissions (such as executing certain operations), private web content, sessions, cookies, and other content. Cross-site scripting checks can eliminate this security risk.

[0054] The following describes how to obtain the first location of an asset. In one implementation, an alias for the asset coupled to the communication device is created based at least on the region where the asset is located and / or the number of the assets. The first location and / or the second location of the asset are obtained based at least on the created alias for the asset coupled to the communication device.

[0055] For example, if the first switch is located on the third floor of Building A, the asset alias associated with this switch can be created as A-003-001. Here, the asset's location can be the third floor of Building A, and the number of assets can refer to the total number of switches. For example, the total number of switches can be 10, and the switches can be numbered sequentially.

[0056] In one implementation, the area where the asset is located can be divided into multiple sub-areas, and the sub-areas where the asset is located can be recorded; at least based on the sub-areas, an alias for the asset coupled to the communication device can be created; at least based on the created alias for the asset coupled to the communication device, the first location and / or the second location of the asset can be obtained.

[0057] For example, the area where the asset is located can be divided. For example, Building A might consist of several floors, each corresponding to a sub-area. Or, alternatively, multiple floors can correspond to a sub-area. This allows the precise location of the communication device. With precise location, security policy checks can be applied more targetedly.

[0058] In one implementation, the location of the asset can be checked at predetermined intervals; in response to a change in the location, the time corresponding to the location change can be recorded; it can be checked that no other time information is recorded between the first time and the second time, and the second location of the asset can be compared with the first location of the asset to determine whether the location of the asset has changed.

[0059] For example, you can check whether other location information was recorded between 10:00 AM and 3:00 PM. If other location information was recorded at 12:00 PM, you can compare that location information with the first location information to perform a security policy check. For example, if the location has not changed, you can perform a basic security check. If the location has changed, you can perform additional security checks.

[0060] Preferably, different security policies can be pre-defined for different scenarios to conduct security policy checks. For example, different security policies can be defined for different asset locations. For assets that experience abnormal movement, such as movement at pre-defined times when movement is not expected (e.g., at night or during special production periods), corresponding security policies can be defined for changes in location during pre-defined times. In this way, different security policy types (at least one of vulnerability checks, security status checks, and security configuration checks) can be used for different scenarios, and each security policy type may have different security policy check items, which will not be detailed here.

[0061] It should be understood that although the various steps in the flowchart of FIG1 are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in FIG1 may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0062] FIG3 provides an apparatus 300 for location-based security policy checking. The apparatus 300 includes: a first location acquisition module 301 for acquiring a first location of an asset coupled to a communication device and recording the first location and a first time at which the first location was acquired; a second location acquisition module 302 for acquiring a second location of the asset from network traffic configuration data of the asset at a second time; a comparison module 303 for comparing the second location of the asset with the first location of the asset to determine whether the asset's location has changed; and a security policy checking module 304 for performing a security policy check in response to a change in the asset's location.

[0063] It should be noted that the apparatus may include more or fewer modules to implement the described functionality. For example, at least one module in FIG. 3 may be further divided into a plurality of different submodules, each of which is configured to perform at least a portion of the operations described herein in conjunction with the corresponding module. Furthermore, in some examples, the apparatus 300 may further include additional modules for performing other operations already described in the specification. Furthermore, those skilled in the art will appreciate that the exemplary apparatus 300 may be implemented using software, hardware, firmware, or any combination thereof.

[0064] Figure 4 provides a computer device for location-based security policy checking. According to one embodiment, the computer device 400 may include a processor 402 that executes a computer program stored in a memory 404. When the computer program is executed by the processor, a method for location-based security policy checking is implemented.

[0065] Those skilled in the art will understand that the structure shown in Figure 4 is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0066] Those skilled in the art will appreciate that all or part of the processes in the methods for implementing the above embodiments can be accomplished by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0067] The present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the above steps when executed by a processor.

[0068] Some implementations of the present disclosure may include articles of manufacture. Articles of manufacture may include storage media for storing logic. Examples of storage media may include one or more types of computer-readable storage media capable of storing electronic data, including volatile or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writable or rewritable memory, and the like. Examples of logic may include various software units, such as software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, processes, software interfaces, application program interfaces (APIs), instruction sets, computing codes, computer codes, code segments, computer code segments, words, values, symbols, or any combination thereof. In some implementations, for example, articles of manufacture may store executable computer program instructions that, when executed by a processor, cause the processor to perform the methods and / or operations described herein. Executable computer program instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, and the like. Executable computer program instructions can be implemented according to a predefined computer language, method or syntax for commanding a computer to perform a specific function. The instructions can be implemented using any appropriate high-level, low-level, object-oriented, visual, compiled and / or interpreted programming language.

[0069] An embodiment of the present invention further provides a computer program product, including a machine-readable medium on which executable instructions are stored. When the executable instructions are executed, the machine is enabled to perform the operations included in the method 200 .

[0070] What has been described above includes examples of the disclosed architecture. It is, of course, not possible to describe every conceivable combination of components and / or methodologies, but those skilled in the art will appreciate that many other combinations and permutations are possible. Therefore, the novel architecture is intended to embrace all such alternatives, modifications, and variations that fall within the spirit and scope of the appended claims.

Claims

1. A location-based security policy checking method, comprising: obtaining a first location of an asset coupled to a communication device, and recording the first location and a first time at which the first location is obtained; At a second time, obtaining a second location of the asset from configuration data of the network traffic of the asset; comparing the second position of the asset with the first position of the asset to determine whether the position of the asset has changed; Responsive to the change in the location of the asset, a security policy check is performed.

2. The method according to claim 1, further comprising: creating an alias for an asset coupled to the communication device based at least on a region where the asset is located and / or a quantity of the asset; The first location and / or the second location of the asset is obtained based at least on the created alias of the asset coupled to the communication device.

3. The method according to claim 2, further comprising: Divide the area where the asset is located into multiple sub-areas, and record the sub-areas where the asset is located; creating an alias for an asset coupled to the communication device based at least on the sub-region; The first location and / or the second location of the asset is obtained based at least on the created alias of the asset coupled to the communication device.

4. The method according to claim 1, further comprising: At predetermined intervals, inspecting the location of the asset; In response to the change in the position, recording a time corresponding to the position change; Check that no other time information is recorded between the first time and the second time, compare the second position of the asset with the first position of the asset, and determine whether the position of the asset has changed.

5. The method according to claim 1, wherein The security policy check includes at least one of a vulnerability check, a security status check, and a security configuration check.

6. The method according to any one of claims 1 to 5, wherein: In response to the change in the location of the asset, performing a security policy check includes: performing a security policy check according to predefined security policies corresponding to different locations based on the location of the asset.

7. The method according to any one of claims 1 to 5, wherein: In response to the change in the location of the asset, performing a security policy check includes: when the location of the asset changes at a predefined time, performing a security policy check according to a predefined security policy for abnormal situations in which the location changes at the predefined time.

8. A location-based security policy checking device (200), comprising: A first position obtaining module (201) is used to obtain a first position of an asset coupled to a communication device, and record the first position and a first time when the first position is obtained; A second location obtaining module (202) is configured to obtain a second location of the asset from the configuration data of the network traffic of the asset at a second time; a comparison module (203), configured to compare the second position of the asset with the first position of the asset to determine whether the position of the asset has changed; A security policy checking module (204) is configured to perform a security policy check in response to a change in the location of the asset.

9. The apparatus according to claim 8, further comprising: an alias module for creating an alias for an asset coupled to the communication device based at least on a region where the asset is located and / or a quantity of the asset; The first location and / or the second location of the asset is obtained based at least on the created alias of the asset coupled to the communication device.

10. The device according to claim 9, wherein The alias module is further configured to divide the area where the asset is located into multiple sub-areas, record the sub-areas where the asset is located; and create an alias for the asset coupled to the communication device based at least on the sub-areas; The first location and / or the second location of the asset is obtained based at least on the created alias of the asset coupled to the communication device.

11. The apparatus according to claim 8, further comprising: A time information checking module, configured to check the location of the asset at predetermined intervals; and in response to a change in the location, record a time corresponding to the location change; Check that no other time information is recorded between the first time and the second time, compare the second position of the asset with the first position of the asset, and determine whether the position of the asset has changed.

12. The device according to claim 8, wherein The security policy checking module is further configured to perform at least one of vulnerability checking, security status checking, and security configuration checking.

13. The device according to any one of claims 8 to 12, wherein: The security policy checking module (204) is further configured to: perform security policy checking according to the location of the asset and the predefined security policies corresponding to different locations.

14. The device according to any one of claims 8 to 12, wherein: The security policy checking module (204) is further configured to: when the location of the asset changes at a predefined time, perform a security policy check according to a predefined security policy for abnormal situations where the location changes at the predefined time.

15. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

17. A computer program product comprising: A machine-readable medium having executable instructions stored thereon, wherein when the executable instructions are executed, the machine is caused to perform the steps of the method according to any one of claims 1 to 7.

Images