Border network security protection method and device, computer equipment and storage medium

Abstract

The invention relates to a border network security protection method and device, computer equipment and a storage medium. The method comprises the following steps: when a security service acquisition request sent by user equipment is received, determining an application scene corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a security service set associated with the application scene; and providing the target security service to the user equipment. Through the security protection platform, unified management and scheduling of resources such as networks, data, security applications and the like are realized, the resource utilization efficiency is improved, the management cost is reduced, at least one security service is determined through the application scene corresponding to the security service acquisition request, the security service determination efficiency is improved, and the user experience is improved. Therefore, the efficiency of providing the security service is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, computer equipment and storage medium for protecting a border network. Background Art

[0002] With the advancement of global industrial digitalization and the widespread application and development of the Internet of Things, the integration of information technology (IT) and operational technology (OT) is becoming increasingly close, and the corresponding open IT Internet security risks will be brought into the closed OT environment. In addition, IT / OT integration scenarios are usually critical information infrastructure, so the impact of cybersecurity incidents is huge.

[0003] Traditional IT / OT border network protection technology mainly achieves multiple deep security defense effects by purchasing independent industrial control firewalls, industrial control security monitoring and auditing, industrial control intrusion detection, industrial control operation and maintenance bastion machines, VPNs and other security equipment, and deploying them in series, parallel or mirrored manner at the border.

[0004] However, traditional IT / OT boundary network protection technology has the problem of poor protection effect. Summary of the invention

[0005] Based on this, it is necessary to provide a security protection method, device, computer equipment and storage medium for the border network that can improve the protection effect in response to the above technical problems.

[0006] In a first aspect, the present application provides a border network security protection method, which is applied to a security protection platform, and the method includes:

[0007] Upon receiving a security service acquisition request sent by a user device, determining an application scenario corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario;

[0008] Provide targeted security services to user devices.

[0009] In one embodiment, providing a target security service to a user device includes:

[0010] Obtain relevant resources corresponding to the target security service, and map the relevant resources to resource pools to generate a mapping relationship between virtual resource pools and physical resource pools; the virtual resource pool is in the security protection platform, and the physical resource pool is in the user device;

[0011] Provide target security services to user devices based on mapping relationships and related resources.

[0012] In one embodiment, the relevant resources include security resources, data protection resources, and security monitoring resources, and obtaining the relevant resources corresponding to the target security service includes:

[0013] The security application resource engine in the security protection platform is called to obtain security resources, the security application data protection engine in the security protection platform is called to obtain data protection resources, and the security application management engine in the security protection platform is called to obtain security monitoring resources.

[0014] In one embodiment, providing a target security service to a user device according to the mapping relationship and the related resources includes:

[0015] Package related resources and mapping relationships to generate resource packages;

[0016] The resource package is sent to the user device; the resource package is used to instruct the user device to map the relevant resources of the target security service to the physical resource pool.

[0017] In one embodiment, the method further comprises:

[0018] A physical resource pool of the user device is virtualized to determine a virtual resource pool.

[0019] In one embodiment, the method further comprises:

[0020] If the application scenario corresponding to the security service acquisition request is an invalid scenario, the application management module in the security protection platform is called to determine the target security service corresponding to the security service acquisition request, and execute the step of providing the target security service to the user device.

[0021] In one embodiment, the method further comprises:

[0022] The security application orchestration engine in the security protection platform is called to obtain multiple security services, and the application scenarios corresponding to each security service are determined according to the service objects of each security service.

[0023] In a second aspect, the present application also provides a security protection device for a border network, including:

[0024] A determination module, configured to, upon receiving a security service acquisition request sent by a user device, determine an application scenario corresponding to the security service acquisition request, and determine a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario;

[0025] The service module is used to provide target security services to user equipment.

[0026] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0027] Upon receiving a security service acquisition request sent by a user device, determining an application scenario corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario;

[0028] Provide targeted security services to user devices.

[0029] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0030] Upon receiving a security service acquisition request sent by a user device, determining an application scenario corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario;

[0031] Provide targeted security services to user devices.

[0032] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0033] Upon receiving a security service acquisition request sent by a user device, determining an application scenario corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario;

[0034] Provide targeted security services to user devices.

[0035] The above-mentioned border network security protection method, device, computer equipment and storage medium, when receiving a security service acquisition request sent by a user device, determines the application scenario corresponding to the security service acquisition request, and determines the target security service corresponding to the security service acquisition request from the security service set associated with the application scenario; and provides the target security service to the user device. The security protection platform realizes the unified management and scheduling of resources such as networks, data, and security applications, improves resource utilization efficiency, reduces management costs, and determines at least one security service through the application scenario corresponding to the security service acquisition request, thereby improving the efficiency of determining security services and thus improving the efficiency of providing security services. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 A diagram of an application environment of a method for protecting a border network security in an embodiment;

[0038] Figure 2 A schematic diagram of a flow chart of a method for protecting the security of a border network in one embodiment;

[0039] Figure 3 is a schematic diagram of a security protection platform in one embodiment;

[0040] Figure 4 A schematic diagram of a flow chart of a border network security protection method in another embodiment;

[0041] Figure 5 A schematic diagram of a flow chart of a border network security protection method in another embodiment;

[0042] Figure 6 A schematic diagram of a flow chart of a border network security protection method in another embodiment;

[0043] Figure 7 A schematic diagram of a flow chart of a border network security protection method in another embodiment;

[0044] Figure 8 A schematic diagram of a flow chart of a border network security protection method in another embodiment;

[0045] Fig. 9 A schematic diagram of a flow chart of a border network security protection method in another embodiment;

[0046] Fig.10 A structural block diagram of a security protection device for a border network in one embodiment;

[0047] Fig.11 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] Existing IT / OT border network protection technology mainly achieves multiple deep security defense effects by purchasing independent industrial control firewalls, industrial control security monitoring and auditing, industrial control intrusion detection, industrial control operation and maintenance bastion machines, VPNs and other security equipment, and deploying them in series, parallel or mirrored manner at the border.

[0050] However, with the expansion of cross-domain and cross-border business scope and the interconnection of production systems, traditional security defense strategies and means are difficult to cover all branch edge boundaries, resulting in the security defense boundary being forced to extend outward, increasing the complexity and difficulty of management and monitoring; branch edge endpoints are often deployed in restricted and unattended environments, which may lack the necessary physical and network security measures, making the endpoints vulnerable to security risks such as physical damage and illegal access; branch edge networks usually have the characteristics of small traffic but a wide variety of devices. Traditional security detection methods based on large traffic have limited effects in this scenario and are difficult to effectively identify and defend against potential threats; in industrial scenarios such as new energy, the deep integration of IT and OT systems has brought unprecedented convenience, but at the same time it has also increased security risks; with the expansion of business, the digital assets of enterprises are becoming more and more dispersed, which poses a huge challenge to the security management of critical infrastructure. It is easier to find and exploit the vulnerabilities of these dispersed assets to attack, such as implanting Trojans and launching ransomware attacks, thereby causing significant losses.

[0051] The border network security protection method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the user device 102 communicates with the security protection platform 104 through the network. The data storage system can store the data that the security protection platform 104 needs to process. The data storage system can be integrated on the security protection platform 104, or it can be placed on the cloud or other network servers. When the security protection platform 104 receives the security service acquisition request sent by the user device 102, it determines the target security service corresponding to the security service acquisition request, thereby providing the target security service to the user device 102. The security protection platform 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0052] In one embodiment, Figure 2 As shown, a border network security protection method is provided, which is applied to Figure 1 The security protection platform in the example is used to illustrate, including:

[0053] S201, upon receiving a security service acquisition request sent by a user equipment, determining an application scenario corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a security service set associated with the application scenario.

[0054] The application scenarios may include password security, network security, host security, data security or security management. The target security service is one or more security services.

[0055] In the embodiment of the present application, the security protection platform encapsulates the security service into multiple security service sets according to the application scenario. When receiving the security service acquisition request sent by the user device, the security service return request is parsed to determine the application scenario corresponding to the security service acquisition request. For example, the application scenario corresponding to the security service acquisition request can be determined according to the scenario identifier included in the security service return request. Further, the security service set associated with the application scenario is determined according to the application scenario, and the security service included in the security service set is determined as the target security service corresponding to the security service acquisition request.

[0056] Optionally, the security protection platform can be built based on fully autonomous hardware and software to ensure supply chain security, adapt to unattended environments, provide stable and reliable resource support, and encapsulate computing resources, storage resources, and network resources into an independent virtual environment through virtualization technology to achieve flexible scheduling and efficient use of resources.

[0057] Optionally, the security protection platform can generate multiple security service sets according to a preset plan, or the security protection platform can determine the security services corresponding to each application scenario based on the characteristic information of the application scenario, and encapsulate the security services corresponding to each application scenario into a security service set corresponding to each security scenario.

[0058] Optionally, the security service set associated with the password security scenario is used to ensure that all data transmitted through the boundary is encrypted to prevent the data from being stolen or tampered with during transmission. The security service set includes security services such as the use of strong encryption algorithms, key management and identity authentication mechanisms; the security service set associated with the network security scenario is used to monitor and filter network traffic in and out of the boundary through network security devices and technologies such as firewalls, intrusion detection / prevention systems (IDS / IPS), and Web application firewalls (WAF) to prevent malicious attacks and unauthorized access; the security service set associated with the host security scenario is used to perform security reinforcement and monitoring on servers and terminal devices on the boundary to ensure that the service Servers and terminal devices are not harmed by viruses, Trojans and other malicious software. The security service set includes security services such as operating system security reinforcement, vulnerability management, and security auditing. The security service set associated with the data security scenario is used to protect the security and integrity of sensitive data stored inside and outside the boundary. The security service set includes security services such as data encryption, data desensitization, and data access control, which can prevent data leakage and illegal access. The security service set associated with the security management scenario is used to centrally manage and monitor the boundary security capability layer through a unified security management platform. The security service set includes security services such as the formulation, execution and auditing of security policies, the response and disposal of security incidents, and the generation and analysis of security reports.

[0059] S202: Provide target security services to user equipment.

[0060] In an embodiment of the present application, a component corresponding to a target security service is determined in a security protection platform, and the component corresponding to the target security service is called to provide the target security service for the user device. Optionally, a service package corresponding to the target security service may be determined, and the service package may be sent to the user device so that the user device can secure the application corresponding to the target security service according to the service package; or, a security service policy corresponding to the target security service may be determined, and the user device may be instructed to perform security operations according to the security service policy.

[0061] Optionally, the security protection platform can be Figure 3As shown, the security protection platform includes: a confidential computing security resource pool, a boundary security resource scheduling layer, a boundary security application management layer and a boundary security capability layer; the computing security resource pool includes a confidential computing module, a processor virtualization module, a memory virtualization module and a storage resource pool module; the boundary security resource scheduling layer includes: a security management node election module, a security resource registration module, a security application registration module, a security resource allocation module, a security application portal navigation module, an emergency response and recovery module and a security host monitoring module; the boundary security application management layer includes a security application management module, a security application resource management module, a security application data protection module, a security application management module and a security application orchestration module; the boundary security capability layer includes: cryptographic security scenarios, network security scenarios, host security scenarios, data security scenarios and security management scenarios.

[0062] In the above-mentioned security protection method for the border network, when receiving a security service acquisition request sent by a user device, the application scenario corresponding to the security service acquisition request is determined, and the target security service corresponding to the security service acquisition request is determined from the security service set associated with the application scenario; and the target security service is provided to the user device. The unified management and scheduling of resources such as networks, data, and security applications is achieved through the security protection platform, which improves resource utilization efficiency and reduces management costs. At least one security service is determined through the application scenario corresponding to the security service acquisition request, which improves the efficiency of determining security services, thereby improving the efficiency of providing security services.

[0063] In one embodiment, an implementation of the above S202 is provided, such as Figure 4 As shown, the above-mentioned “providing target security services to user equipment” includes:

[0064] S301, obtain relevant resources corresponding to the target security service, and map the relevant resources to resource pools to generate a mapping relationship between a virtual resource pool and a physical resource pool; the virtual resource pool is in the security protection platform, and the physical resource pool is in the user device.

[0065] The related resources corresponding to the target security service may include installation resources of the target security service.

[0066] In an embodiment of the present application, the virtual resource pool is a resource pool obtained by virtualizing the physical resource pool, and the relevant resources corresponding to the target security service are determined from the storage space of the security protection platform, and the installation location of the target security service in the physical resource pool is determined, the target security service program is installed in the physical resource pool, and the target security service program is installed in the virtual resource pool, and a mapping relationship between the target security service in the virtual resource pool and the target security service in the physical resource pool is established.

[0067] S302: Provide target security services to the user equipment according to the mapping relationship and related resources.

[0068] In an embodiment of the present application, the user device runs the target security service program in the physical resource pool. The target security service program runs the target security service program in the virtual resource pool through a mapping relationship with the virtual resource pool. The target security service program in the virtual resource pool provides the target security service to the user device by calling the hardware components corresponding to the target security service in the security protection platform.

[0069] In the above-mentioned application embodiment, target security services are provided to user devices through the mapping relationship between virtual resource pools and physical resource pools, which reduces the time and cost of building hardware corresponding to the target security services in user devices, and enables the security services that user devices can obtain without being restricted by hardware, thereby improving the security protection effect.

[0070] In one embodiment, an implementation scheme of the above-mentioned S301 is provided, and the relevant resources include security resources, data protection resources and security monitoring resources. The above-mentioned "obtaining relevant resources corresponding to the target security service" includes: calling the security application resource engine in the security protection platform to obtain security resources, calling the security application data protection engine in the security protection platform to obtain data protection resources, and calling the security application management engine in the security protection platform to obtain security monitoring resources.

[0071] Among them, security resources can be used to install security applications corresponding to the target security service, data protection resources can be used to protect data generated by the target security service, and security monitoring resources can be used to monitor the status of the target security service.

[0072] In the embodiments of the present application, Figure 3 As shown, the security protection platform includes a border security application management layer, which includes a security application resource engine, a security application data protection engine, and a security application management engine. The security protection platform first calls the security application resource engine in the security protection platform to obtain security resources, further calls the application data protection engine in the security protection platform to obtain data protection resources, and finally calls the application management engine in the security protection platform to obtain security monitoring resources.

[0073] Optionally, calling a security application resource engine in the security protection platform to obtain security resources may include: calling a security resource allocation and guidance module to determine an installation address and an installation data package corresponding to a target security service.

[0074] Optionally, the security application resource engine can provide resource customization services and resource optimization services. The resource customization service is a custom function for CPU, memory and storage. Network security managers can flexibly allocate resources according to the actual load and performance requirements of the application to ensure that the security application can run efficiently and meet the computing resource requirements of different security services; through intelligent resource scheduling and optimization algorithms, the resource engine can ensure efficient use of resources, avoid resource waste and conflicts, and dynamically adjust resource allocation according to the real-time status of the system to improve the overall performance and stability of the system. The security application data protection engine is based on advanced data access control mechanisms. The security application data protection engine can ensure the security of sensitive data during storage, processing and transmission. By implementing data encryption, access permission control and other measures, it can effectively prevent data leakage and illegal access, and ensure the confidentiality, integrity and availability of data. The security application management engine can provide full life cycle management, confidential computing adaptation and flexible architecture. Among them, the full life cycle management includes operations such as creation, snapshot, suspension, startup, shutdown, etc. of security applications to achieve precise control of application status, and supports monitoring and logging functions of security applications to help network security managers promptly discover and deal with potential security issues; confidential computing adaptation provides a higher level of security protection for security applications through hardware-level security isolation and encryption technology, and enables security applications to run stably in more complex and harsh environments; flexible architecture can flexibly respond to different security needs and application scenarios. Network security managers can choose appropriate modules for combination and configuration according to actual needs to build security solutions that meet their own business characteristics.

[0075] In the above-mentioned application embodiment, the security application resource engine, security application data protection engine, and security application management engine in the security protection platform are called to obtain relevant resources for the target security service, thereby ensuring the integrity of the relevant resources and making the relevant resources more comprehensive, thereby providing more comprehensive security services for user devices and improving the security protection effect on user devices.

[0076] In one embodiment, an implementation of the above S301 is provided, such as Figure 5 As shown, the above-mentioned “providing target security services to user equipment according to the mapping relationship and related resources” includes:

[0077] S401, packaging related resources and mapping relationships to generate a resource package.

[0078] In an embodiment of the present application, relevant resources may include security resources, data protection resources and security monitoring resources. The mapping relationship corresponding to the security resources is a first mapping relationship, the mapping relationship corresponding to the data protection resources is a second mapping relationship, and the mapping relationship corresponding to the security monitoring resources is a third mapping relationship. The security resources can be first packaged with the first mapping relationship to obtain a first initial resource package, the data protection resources can be packaged with the second mapping relationship to obtain a second initial resource package, the security monitoring resources can be packaged with the third mapping relationship to obtain a third initial resource package, and further, the first initial resource package, the second initial resource package and the third initial resource package can be packaged to generate a resource package.

[0079] S402, sending a resource package to a user device; the resource package is used to instruct the user device to map related resources of the target security service to a physical resource pool.

[0080] In an embodiment of the present application, a resource package is sent to a user device, and the user device parses the resource package to obtain relevant resources and mapping relationships. Optionally, the user device may map security resources to a physical resource pool according to a first mapping relationship, and further, the user device may map data protection resources to a physical resource pool according to a second mapping relationship, and map security monitoring resources to a physical resource pool according to a third mapping relationship.

[0081] In the above application embodiment, a resource package of relevant resources and mapping relationships is sent to a user device, so that the user device can map the relevant resources to a physical resource pool according to the resource package, and thereby obtain target security services from the security protection platform according to the relevant resources and mapping relationships in the physical resource pool.

[0082] In one embodiment, Figure 6 As shown, the above-mentioned border network security protection method also includes:

[0083] S303: Virtualize the physical resource pool of the user equipment to determine a virtual resource pool.

[0084] In the embodiment of the present application, before the user device obtains the target security service, the physical resource pool of the user device is virtualized by calling the virtualization function in the security protection platform, and the virtual resource pool corresponding to the physical resource pool is determined in the security protection platform. Figure 3 As shown, the security protection platform includes a confidential computing security resource pool, and the physical resource pool of the user device is virtualized by calling the virtualization function in the confidential computing security resource pool.

[0085] Optionally, the virtualization function includes a CPU virtualization function, a memory virtualization function, and a storage resource pool, wherein:

[0086] (1) The CPU virtualization function achieves effective isolation and efficient utilization of CPU resources through software simulation or hardware assistance, and realizes CPU affinity and multiple virtualization modes. CPU affinity refers to binding the CPU scheduling policy of a virtual machine instance to a specific physical CPU or CPU core to reduce the overhead of CPU context switching and improve the stability and efficiency of virtual machine operation. By setting CPU affinity, it can ensure that the virtual machine instance runs on the specified CPU to avoid unnecessary resource competition and performance fluctuations. The system supports multiple CPU virtualization modes, including QEMU and KVM. QEMU is an open source virtualization software that can simulate a complete computer hardware environment in user mode and support multiple operating system virtual machines. KVM (Kernel-based Virtual Machine) is a virtualization technology based on the Linux kernel. It uses certain functions of the Linux kernel to achieve CPU and memory virtualization, with higher performance and lower overhead.

[0087] (2) Memory virtualization is an extension of CPU virtualization. It allows virtual machine instances to have independent memory space and map the memory space to physical memory. Through software or hardware, it achieves effective isolation and efficient use of memory resources. Furthermore, NUMA binding is performed on each node to distribute the memory on multiple nodes. Each node has its own CPU and memory. In CPU virtualization, NUMA binding technology can ensure that virtual machine instances run on CPUs that are as close to their memory locations as possible, thereby reducing the latency of cross-node memory access and improving computing performance. The system uses the national encryption SM4 technology to encrypt virtual machine data. Each CSV virtual machine uses a different key for encryption and decryption, which can ensure the security of virtual machine data in memory. Even if the physical memory is stolen or leaked, the attacker cannot directly obtain the plaintext data. Memory virtualization also includes resource isolation. Each CSV virtual machine uses isolated hardware resources to achieve resource isolation between the CSV virtual machine and the host. This can prevent resource competition and interference between virtual machines and ensure the stability and security of virtual machine operation.

[0088] (3) The storage resource pool uses disk encryption technology to protect data on virtual machine disks, ensuring the security of data at the physical level. Through secure boot and key injection mechanisms, it ensures that only authorized applications can access encrypted data. It also uses a distributed file system to provide unified storage capabilities and adopts a multi-copy, multi-node storage strategy to meet disaster recovery requirements and improve the security and reliability of system data.

[0089] Optionally, the confidential computing security resource pool can also provide confidential computing services by building the Virto paravirtualization architecture and CSV trusted execution environment and using resource isolation and encryption methods to implement the service, including:

[0090] (1) Virto paravirtualization architecture: Combining paravirtualization and full virtualization technologies, it provides an efficient virtual machine operating environment and rich IO virtualization support, such as device pass-through, SR-IOV, DPDK / SPDK, etc., to reduce computing cost investment and enhance system performance.

[0091] (2) CSV Trusted Execution Environment: A data encryption and isolation mechanism based on the CPU and implemented using a national secret algorithm to ensure the security of the CSV virtual machine in terms of computing resources, startup process, and identity authentication. Each CSV virtual machine uses an independent key to achieve secure storage and access to virtualized resource data.

[0092] (3) Resource isolation and encryption: CSV virtual machines use isolated hardware resources and protect the security of virtualized resource data through hardware-level memory encryption solutions.

[0093] Optional, such as Figure 3 As shown, the border security resource scheduling layer includes security management node election function, security resource registration function, emergency response and recovery function and security host monitoring function. The security protection platform manages and maintains the corresponding processing resources of the security protection platform through the above functions, among which:

[0094] (1) The security management node election function includes the election of management nodes through the Paxos algorithm to ensure the authority and consistency of management nodes in a distributed environment. The decentralized nature of the Paxos algorithm enables a new leader node to be quickly and automatically elected when the leader node fails, thereby ensuring business continuity and system robustness. By building a decentralized architecture, there is no single central point to control the entire system. All nodes are peers and work together to maintain the status of the security protection platform, making the system more flexible, easy to expand, and improving tolerance to single point failures. The distributed consensus algorithm is used to manage the status of grouped nodes to achieve consistency. It works through three main stages: Prepare, Propose, and Learn. Paxos can ensure that in a distributed system, even if there are uncertain factors such as network delays and node failures, only one proposal is selected, and all non-faulty nodes will eventually learn the selected proposal.

[0095] (2) In the security resource registration function, the border security computing node registers its own computing resources to the management node. The management node is responsible for incorporating these resources into the confidential computing resource pool to achieve centralized management and optimized scheduling of resources. The computing resources include CPU, memory, storage, etc.

[0096] (3) Emergency response and recovery functions include hot migration and automated recovery, including: 1) Hot migration monitors the status of each security application in real time, combined with unified storage capabilities. When an application status abnormality or computing node failure is found, the application can be quickly migrated from the failed node to the healthy node. During the migration process, the application's disk data, memory data and other key information will be completely preserved, and checkpoints will be added to ensure the integrity and consistency of data migration; After the migration is completed, the system will automatically restore the application status to ensure that business continuity and user experience are not affected.

[0097] (4) The security host monitoring function includes comprehensive monitoring and threshold judgment, among which: 1) Comprehensive monitoring uniformly collects the status information of each computing node, including CPU status, memory status, network communication status, data file usage status, etc. Through real-time monitoring and data analysis, potential performance bottlenecks and security risks can be discovered in a timely manner; 2) Threshold judgment combines a variety of preset threshold judgment rules to perform intelligent evaluation of the system operation status. When it is found that a certain indicator exceeds the threshold, the system will automatically trigger the corresponding alarm or emergency response mechanism to ensure the stability and security of the overall operation of the system.

[0098] In the above application embodiment, before the user device obtains the target security service, the physical resource pool of the user device is virtualized so that the user device can obtain the target security service according to the mapping relationship between the virtual resource pool and the physical resource pool.

[0099] In one embodiment, Figure 7 As shown, the above-mentioned border network security protection method also includes:

[0100] S203, if the application scenario corresponding to the security service acquisition request is an invalid scenario, call the application management module in the security protection platform to determine the target security service corresponding to the security service acquisition request, and perform the step of providing the target security service to the user device.

[0101] In the embodiment of the present application, if the application scenario corresponding to the security service acquisition request is different from the application scenario in the security protection platform, the application scenario corresponding to the security service acquisition request is determined to be an invalid scenario; or, if the security service acquisition request does not include an application scenario, the application scenario corresponding to the security service acquisition request is determined to be an invalid scenario. Further, the application management module in the security protection platform is called, the security service list in the module is read, the target security service corresponding to the security service acquisition request is determined from the security service list, and then the above step S202 is returned to execute.

[0102] Optionally, the security service list is determined based on the security applications uploaded to the security protection platform. Users can easily upload, edit and delete the IPC program files, basic configuration files, basic network requirement files and security application icons of the security APP through the security application management module. This intuitive operation method simplifies the creation and management process of security applications, allowing users to quickly deploy security applications that meet their needs. It also provides software-defined security. Through software-defined form, security policies and application rules can be customized according to actual needs, which enhances the defense capabilities of border security and enables security policies to be quickly adjusted as the business environment changes, ensuring that the system is always in the best security state.

[0103] Optional, such as Figure 3 As shown, the security application APP management is the security application management module. The security application management module can call the security application registration function, security resource allocation and guidance function, and security application portal navigation function in the boundary security resource scheduling layer to complete the upload of the security application, where:

[0104] (1) Security application registration: newly created security applications will be registered with the management node, and the management node of the security protection platform will perform unified registration management and access control, which simplifies the operation and maintenance process, improves operation and maintenance efficiency, and also facilitates unified policy deployment and updates for security applications.

[0105] (2) Security resource allocation and guidance include intelligent recommendation and scoring mechanisms, which score each node in the security protection platform and match computing nodes for each application through security resource allocation and guidance. Among them, 1) Intelligent recommendation includes: when creating a security application, the system will recommend suitable computing nodes through intelligent algorithms based on the resources required by the application and the configuration preferences combined with the actual CPU resources, memory resources, NUMA binding status of each resource computing node. The method for matching the most suitable computing node is: first, define the total CPU resources of the node as follows , the amount of CPU resources allocated and actually used on the node (considering 1.5 times the redundancy between the declared CPU resources and the actual used resources), total memory resources , memory resources used , NUMA binding situation ( ). Comprehensively consider all the above factors to score the node matching degree, and obtain the node matching degree in the form of weighted sum As shown in formula 1:

[0106] (Formula 1)

[0107] in, , and is the weight coefficient, which is used to adjust the importance of each factor; Indicates the available ratio of CPU resources of the node; Indicates the available ratio of memory resources of a node.

[0108] 2) The scoring mechanism includes: scoring candidate computing nodes and using an intelligent algorithm to assign a recommended score to each computing node. It can be determined by formula 2:

[0109] (Formula 2)

[0110] in, It is the resource matching score, which indicates the matching degree between node resources and application requirements. is the node stability score, which indicates the reliability and historical stability of the node. is the network latency score, which indicates the network communication latency between the node and the application. It is the memory usage score, which indicates the memory usage margin and utilization efficiency of the node. , , and is the weight coefficient, which is adjusted according to the importance of different factors. Suppose there is a set of computing nodes ,in Indicates the total number of nodes. The recommended score of each node is calculated based on , sort all computing nodes to get , Representation Node Finally, the top 10 computing nodes are selected as candidate nodes for user selection or automatic allocation by the system. It can be determined by formula 3:

[0111] (Formula 3)

[0112] in, Represents the Compute nodes, is the recommendation score of the node.

[0113] 3) Security application portal navigation includes: providing an intuitive and friendly user interaction interface to facilitate users to access and manage various security applications. Users can quickly locate the required applications through portal navigation and perform configuration and management operations.

[0114] In the above application embodiment, not only can security services in various security scenarios be provided to the user equipment, but also corresponding target security services can be provided to the user equipment according to the security service acquisition request.

[0115] In one embodiment, Figure 8 As shown, the above-mentioned border network security protection method also includes:

[0116] S204, calling the security application orchestration engine in the security protection platform to obtain multiple security services, and determining the application scenario corresponding to each security service according to the service object of each security service.

[0117] In an embodiment of the present application, the security application orchestration engine obtains historical data stored locally, or obtains historical data through big data, reads the service objects of each security service in the historical data, and further determines the application scenarios corresponding to each security service based on the application scenarios of each service object and the service objects of each security service.

[0118] Optional, such as Figure 3 As shown in the figure, the security application orchestration engine includes comprehensive orchestration capabilities and typical security solutions. The comprehensive orchestration capabilities include network orchestration, application orchestration, and solution orchestration. The engine can be used to quickly build and deploy complex security solutions to achieve comprehensive protection of networks, applications, and data; typical security solutions include: The security protection platform includes a variety of typical security solution templates, such as boundary protection, intrusion detection, data encryption, etc., which can be directly selected for rapid deployment, or customized orchestration can be performed according to actual needs, which improves the deployment efficiency of the solution and reduces the user's operation and maintenance costs.

[0119] Optionally, the security protection platform may execute the steps of calling the security application orchestration engine in the security protection platform to obtain multiple security services according to a preset update duration, and determining the application scenarios corresponding to each security service according to the service objects of each security service, thereby updating the application scenarios corresponding to each security service.

[0120] In the above application embodiment, an efficient and collaborative security system is formed by integrating multiple security technologies and applications. By introducing security application orchestration and network orchestration technologies, centralized management and flexible deployment of security capabilities are achieved, thereby effectively solving the problems of diverse equipment, scattered deployment, poor coordination, and low operation and maintenance efficiency in traditional border security protection.

[0121] In one embodiment, a complete border network security protection method is provided, such as Fig. 9 As shown, the above method includes:

[0122] S1, calling the security application orchestration engine in the security protection platform to obtain multiple security services, and determining the application scenario corresponding to each security service according to the service object of each security service.

[0123] S2, when receiving a security service acquisition request sent by a user device, determining an application scenario corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario.

[0124] S3, virtualizing the physical resource pool of the user device to determine a virtual resource pool.

[0125] S4, calling the security application resource engine in the security protection platform to obtain security resources, calling the security application data protection engine in the security protection platform to obtain data protection resources, and calling the security application management engine in the security protection platform to obtain security monitoring resources.

[0126] S5, mapping the relevant resources to resource pools, generating a mapping relationship between a virtual resource pool and a physical resource pool; the virtual resource pool is in the security protection platform, and the physical resource pool is in the user device.

[0127] S6, packaging related resources and mapping relationships to generate a resource package.

[0128] S7, sending the resource package to the user equipment; the resource package is used to instruct the user equipment to map the relevant resources of the target security service to the physical resource pool.

[0129] S8, if the application scenario corresponding to the security service acquisition request is an invalid scenario, call the application management module in the security protection platform to determine the target security service corresponding to the security service acquisition request, and execute the step of providing the target security service to the user device.

[0130] In the above-mentioned security protection method for the border network, when receiving a security service acquisition request sent by a user device, the application scenario corresponding to the security service acquisition request is determined, and the target security service corresponding to the security service acquisition request is determined from the security service set associated with the application scenario; and the target security service is provided to the user device. The unified management and scheduling of resources such as networks, data, and security applications is achieved through the security protection platform, which improves resource utilization efficiency and reduces management costs. At least one security service is determined through the application scenario corresponding to the security service acquisition request, which improves the efficiency of determining security services, thereby improving the efficiency of providing security services.

[0131] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0132] Based on the same inventive concept, the embodiment of the present application also provides a border network security protection device for implementing the border network security protection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more border network security protection devices provided below can refer to the limitations of the border network security protection method above, and will not be repeated here.

[0133] In one embodiment, Fig.10 As shown, a security protection device for a border network is provided, comprising: a determination module 10 and a service module 11, wherein:

[0134] The determination module 10 is used to determine the application scenario corresponding to the security service acquisition request when receiving the security service acquisition request sent by the user equipment, and determine the target security service corresponding to the security service acquisition request from the security service set associated with the application scenario.

[0135] The service module 11 is used to provide target security services to user equipment.

[0136] In one embodiment, the service module 11 includes: an acquisition unit and a service unit, wherein:

[0137] The acquisition unit is used to acquire the relevant resources corresponding to the target security service, and map the relevant resources to the resource pool to generate a mapping relationship between the virtual resource pool and the physical resource pool; the virtual resource pool is in the security protection platform, and the physical resource pool is in the user device.

[0138] The service unit is used to provide target security services to user equipment according to the mapping relationship and related resources.

[0139] In one embodiment, the relevant resources include security resources, data protection resources and security monitoring resources. The above-mentioned acquisition unit is specifically used to call the security application resource engine in the security protection platform to obtain security resources, call the security application data protection engine in the security protection platform to obtain data protection resources, and call the security application management engine in the security protection platform to obtain security monitoring resources.

[0140] In one embodiment, the above service unit is specifically used to package relevant resources and mapping relationships to generate a resource package; send the resource package to the user device; the resource package is used to instruct the user device to map relevant resources of the target security service to the physical resource pool.

[0141] In one embodiment, the above method also includes: a calling unit, which is used to call the application management module in the security protection platform to determine the target security service corresponding to the security service acquisition request when the application scenario corresponding to the security service acquisition request is an invalid scenario, and execute the step of providing the target security service to the user device.

[0142] In one embodiment, the security protection device of the above-mentioned border network also includes: a calling module, which is used to call the security application orchestration engine in the security protection platform to obtain multiple security services, and determine the application scenario corresponding to each security service according to the service object of each security service.

[0143] Each module in the above-mentioned security protection device of the border network can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0144] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.11As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store security protection data of the border network. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a security protection method for the border network is implemented.

[0145] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0146] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0147] Upon receiving a security service acquisition request sent by a user device, determining an application scenario corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario;

[0148] Provide targeted security services to user devices.

[0149] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0150] Obtain relevant resources corresponding to the target security service, and map the relevant resources to resource pools to generate a mapping relationship between virtual resource pools and physical resource pools; the virtual resource pool is in the security protection platform, and the physical resource pool is in the user device;

[0151] Provide target security services to user devices based on mapping relationships and related resources.

[0152] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0153] The security application resource engine in the security protection platform is called to obtain security resources, the security application data protection engine in the security protection platform is called to obtain data protection resources, and the security application management engine in the security protection platform is called to obtain security monitoring resources.

[0154] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0155] Package related resources and mapping relationships to generate resource packages;

[0156] The resource package is sent to the user device; the resource package is used to instruct the user device to map the relevant resources of the target security service to the physical resource pool.

[0157] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0158] A physical resource pool of the user device is virtualized to determine a virtual resource pool.

[0159] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0160] If the application scenario corresponding to the security service acquisition request is an invalid scenario, the application management module in the security protection platform is called to determine the target security service corresponding to the security service acquisition request, and execute the step of providing the target security service to the user device.

[0161] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0162] The security application orchestration engine in the security protection platform is called to obtain multiple security services, and the application scenarios corresponding to each security service are determined according to the service objects of each security service.

[0163] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0164] Upon receiving a security service acquisition request sent by a user device, determining an application scenario corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario;

[0165] Provide targeted security services to user devices.

[0166] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0167] Obtain relevant resources corresponding to the target security service, and map the relevant resources to resource pools to generate a mapping relationship between virtual resource pools and physical resource pools; the virtual resource pool is in the security protection platform, and the physical resource pool is in the user device;

[0168] Provide target security services to user devices based on mapping relationships and related resources.

[0169] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0170] The security application resource engine in the security protection platform is called to obtain security resources, the security application data protection engine in the security protection platform is called to obtain data protection resources, and the security application management engine in the security protection platform is called to obtain security monitoring resources.

[0171] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0172] Package related resources and mapping relationships to generate resource packages;

[0173] The resource package is sent to the user device; the resource package is used to instruct the user device to map the relevant resources of the target security service to the physical resource pool.

[0174] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0175] A physical resource pool of the user device is virtualized to determine a virtual resource pool.

[0176] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0177] If the application scenario corresponding to the security service acquisition request is an invalid scenario, the application management module in the security protection platform is called to determine the target security service corresponding to the security service acquisition request, and execute the step of providing the target security service to the user device.

[0178] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0179] The security application orchestration engine in the security protection platform is called to obtain multiple security services, and the application scenarios corresponding to each security service are determined according to the service objects of each security service.

[0180] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0181] Upon receiving a security service acquisition request sent by a user device, determining an application scenario corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario;

[0182] Provide targeted security services to user devices.

[0183] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0184] Obtain relevant resources corresponding to the target security service, and map the relevant resources to resource pools to generate a mapping relationship between virtual resource pools and physical resource pools; the virtual resource pool is in the security protection platform, and the physical resource pool is in the user device;

[0185] Provide target security services to user devices based on mapping relationships and related resources.

[0186] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0187] The security application resource engine in the security protection platform is called to obtain security resources, the security application data protection engine in the security protection platform is called to obtain data protection resources, and the security application management engine in the security protection platform is called to obtain security monitoring resources.

[0188] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0189] Package related resources and mapping relationships to generate resource packages;

[0190] The resource package is sent to the user device; the resource package is used to instruct the user device to map the relevant resources of the target security service to the physical resource pool.

[0191] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0192] A physical resource pool of the user device is virtualized to determine a virtual resource pool.

[0193] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0194] If the application scenario corresponding to the security service acquisition request is an invalid scenario, the application management module in the security protection platform is called to determine the target security service corresponding to the security service acquisition request, and execute the step of providing the target security service to the user device.

[0195] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0196] The security application orchestration engine in the security protection platform is called to obtain multiple security services, and the application scenarios corresponding to each security service are determined according to the service objects of each security service.

[0197] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0198] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0199] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A border network security protection method, characterized in that: Applied to a security protection platform, the method comprises: Upon receiving a security service acquisition request sent by a user device, determining an application scenario corresponding to the security service acquisition request, and determining a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario; The target security service is provided to the user equipment.

2. The method according to claim 1, characterized in that The providing the target security service to the user equipment includes: Acquire relevant resources corresponding to the target security service, and map the relevant resources to resource pools to generate a mapping relationship between a virtual resource pool and a physical resource pool; the virtual resource pool is in the security protection platform, and the physical resource pool is in the user device; The target security service is provided to the user equipment according to the mapping relationship and the related resources.

3. The method according to claim 2, characterized in that The related resources include security resources, data protection resources and security monitoring resources, and the obtaining of the related resources corresponding to the target security service includes: The security application resource engine in the security protection platform is called to obtain the security resources, the security application data protection engine in the security protection platform is called to obtain the data protection resources, and the security application management engine in the security protection platform is called to obtain the security monitoring resources.

4. The method according to claim 2, characterized in that: The providing the target security service to the user equipment according to the mapping relationship and the relevant resources includes: Packaging the relevant resources and the mapping relationship to generate a resource package; The resource package is sent to the user equipment; the resource package is used to instruct the user equipment to map the relevant resources of the target security service to the physical resource pool.

5. The method according to any one of claims 2 to 4, characterized in that: The method further comprises: A physical resource pool of the user equipment is virtualized to determine the virtual resource pool.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If the application scenario corresponding to the security service acquisition request is an invalid scenario, the application management module in the security protection platform is called to determine the target security service corresponding to the security service acquisition request, and the step of providing the target security service to the user device is performed.

7. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: The security application orchestration engine in the security protection platform is called to obtain multiple security services, and the application scenarios corresponding to each of the security services are determined according to the service objects of each of the security services.

8. A security protection device for a border network, characterized in that: The device comprises: A determination module, configured to, upon receiving a security service acquisition request sent by a user device, determine an application scenario corresponding to the security service acquisition request, and determine a target security service corresponding to the security service acquisition request from a set of security services associated with the application scenario; A service module is used to provide the target security service to the user equipment.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images