Safety management and control system and method

Abstract

The invention provides a security management and control system and method. The system comprises a security management and control core device and a management and control information processing device, the management and control information processing device is connected with equipment to be managed and controlled and is used for collecting equipment information of the equipment to be managed and controlled, sending the equipment information to the security management and control core device and executing corresponding operation according to an instruction fed back by the security management and control core device and a scheduling task; the security management and control core device is connected with the management and control information processing device through a network, and is used for processing the received equipment information, generating a security management and control report, generating a security management and control strategy according to a preset requirement and the security management and control report, generating an instruction and a scheduling task according to the security management and control strategy, and sending the instruction and the scheduling task to the management and control information processing device. Therefore, the managed and controlled equipment can be controlled. According to the security management and control system and method provided by the invention, the network security problem can be found in time, and the stable operation of a financial system is ensured.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a security management and control system and method. Background Art

[0002] Security control is divided into internal and external, including software security of user data privacy and hardware security of server network equipment. The financial industry usually adopts a business model with centralized accounting servers and decentralized branch personnel. There are few external network exports, and only a few servers open Internet service exports. Some servers are connected to other companies through dedicated lines. The exports can be monitored with centralized forces, and external threats are relatively small.

[0003] The internal management of financial institutions must ensure the safe and stable operation of business servers to prevent authorized internal personnel from intentionally or unintentionally damaging the system. The hardware security of the server is based on permission control and vulnerability patching. Minimized permissions should be set for users, and vulnerabilities in the operating system and various software on the server should be scanned and repaired in a timely manner to avoid service interruptions.

[0004] There are many security companies on the market that provide security software products with similar functions. By installing monitoring software on the controlled server, the monitoring software collects various types of information from the server and sends it to an independent core control server through the network (usually a local area network). The core control server organizes and displays the collected information. When using software for security control, there is a risk of control failure due to software instability. For example, after the system is invaded, the relevant software is closed, and the software conflicts with other software in the system and cannot run normally. Since the software runs based on the operating system, it is difficult for the software to handle problems related to the operating system and hardware. Summary of the invention

[0005] In response to the problems in the prior art, the embodiments of the present application provide a security management and control system and method, which can at least partially solve the problems in the prior art.

[0006] In a first aspect, the present application provides a security control system, including: a security control core device and a control information processing device;

[0007] The control information processing device is connected to the controlled device, and is used to collect device information of the controlled device, send the device information to the security control core device, and perform corresponding operations according to the instructions and scheduling tasks fed back by the security control core device;

[0008] The security control core device is connected to the control information processing device via a network, and is used to process the received device information, generate a security control report, generate a security control strategy according to preset requirements and the security control report, and generate instructions and scheduling tasks according to the security control strategy to control the controlled device;

[0009] The control information processing device includes a real-time monitoring module for monitoring the ports of the controlled equipment and identifying and blocking risky operations.

[0010] Furthermore, the security control core device includes:

[0011] A first network communication module, used to communicate with the control information processing device;

[0012] An information collection module, used to receive and summarize the device information sent by the management and control information processing device;

[0013] A report generation module, used to process the device information and generate a security management and control report;

[0014] A control strategy configuration module, used to generate a security control strategy based on preset requirements and the security control report;

[0015] The task scheduling module is used to generate instructions and schedule tasks according to the security management and control strategy.

[0016] Furthermore, the security control core device also includes:

[0017] The security certificate module is used to generate and manage security certificates, which are used to perform security certificate authentication through certificate key encryption during data transmission.

[0018] Furthermore, the security control core device also includes:

[0019] The vulnerability management module is used to identify vulnerabilities based on the device information and generate repair tasks.

[0020] Furthermore, the control information processing device includes:

[0021] An information collection module is used to collect software information and hardware information of the controlled device and record operation logs;

[0022] A second network communication module, used to communicate with the security management and control core device;

[0023] A program update module, used to distribute software and application versions to the controlled devices according to the instructions of the security control core device;

[0024] The real-time monitoring module is used to monitor the ports of the controlled devices and identify and block risky operations.

[0025] Furthermore, the control information processing device further includes: an information storage module;

[0026] The information storage module includes a read-only memory and a readable and writable memory; the read-only memory is used to store core program logic; the readable and writable memory is used to store upgradeable data and instructions issued by the security management and control core device.

[0027] Furthermore, the control information processing device also includes:

[0028] The certificate authentication module is used to encrypt and decrypt using the certificate key of the security certificate generated by the security management and control core device during data transmission.

[0029] Furthermore, the control information processing device also includes:

[0030] The fingerprint recognition module is used to collect fingerprint information and perform identity authentication based on the fingerprint information to activate the management and control information processing device.

[0031] Furthermore, the network connection method between the security management and control core device and the management and control information processing device includes a wireless communication method using a network cable, WiFi, Bluetooth, infrared, or a SIM card that supports GPRS traffic.

[0032] Furthermore, the control information processing device is connected to the controlled device via a universal standard interface, and the universal standard interface includes a serial port and a USB interface.

[0033] In a second aspect, the present application provides a security management and control method, which is applied to the security management and control system as described in any of the above embodiments, including:

[0034] The control information processing device collects device information of the controlled device and sends the device information to the security control core device;

[0035] The security control core device processes the received device information and sends instructions and scheduling tasks to the control information processing device;

[0036] The control information processing device performs corresponding operations according to the instructions and scheduling tasks of the security control core device.

[0037] The present application provides a security control system and method, which includes a security control core device and a control information processing device, which is connected to the controlled device through the control information processing device, used to collect the device information of the controlled device, send the device information to the security control core device and perform corresponding operations according to the instructions and scheduling tasks fed back by the security control core device; the security control core device is connected to the control information processing device through a network, used to process the received device information, generate a security control report, generate a security control strategy according to the preset requirements and the security control report, and generate instructions and scheduling tasks according to the security control strategy to control the controlled device, so as to timely discover network security problems and ensure the stable operation of the financial system. Among them, the ports of the controlled device are monitored by a real-time monitoring module, and risk operations are identified and blocked, which can prevent network threat attacks, control personnel operation risks, detect system network failures, and standardize the processing of system alarms and events; the received device information is processed by the security control core device, and instructions and scheduling tasks are sent to the control information processing device to control the controlled device, so that system vulnerabilities can be discovered in time to patch, and further ensure the stable operation of the financial system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 It is a structural diagram of a security management and control system provided in one embodiment of the present application;

[0040] Figure 2 It is a structural diagram of a security control core device provided in one embodiment of the present application;

[0041] Figure 3 It is a structural diagram of a security control core device provided in one embodiment of the present application;

[0042] Figure 4 It is a structural diagram of a security control core device provided in one embodiment of the present application;

[0043] Figure 5 It is a structural diagram of a control information processing device provided in an embodiment of the present application;

[0044] Figure 6 It is a structural diagram of a control information processing device provided in an embodiment of the present application;

[0045] Figure 7 It is a structural diagram of a control information processing device provided in an embodiment of the present application;

[0046] Figure 8 It is a structural diagram of a control information processing device provided in an embodiment of the present application;

[0047] Fig. 9 It is a flowchart of a security management method provided in one embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. Here, the illustrative embodiments of the present application and their descriptions are used to explain the present application, but are not intended to limit the present application. It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined arbitrarily with each other.

[0049] Figure 1 is a schematic diagram of the structure of a security management and control system provided in an embodiment of the present application, such as Figure 1 As shown, the security control system provided by the present application includes: a security control core device 1 and a control information processing device 2;

[0050] The control information processing device 2 is connected to the controlled device 100, and is used to collect device information of the controlled device 100, send the device information to the security control core device 1, and perform corresponding operations according to the instructions and scheduling tasks fed back by the security control core device 1;

[0051] The security control core device 1 is connected to the control information processing device 2 via a network, and is used to process the received device information, generate a security control report, generate a security control strategy based on preset requirements and the security control report, and generate instructions and scheduling tasks based on the security control strategy to control the controlled device 100.

[0052] Specifically, each controlled device 100 is connected to a corresponding control information processing device 2. The control information processing device 2 is an external hardware device that is responsible for the information collection function. It can read the device information of the controlled device 100, record the operation traces of various accounts on the server, manage the server login account, and feed back the collected device information to the security control core device 1 in real time.

[0053] The security control core device 1 has external service functions and database functions, collects device information fed back by each control information processing device 2 (node), performs in-depth analysis and processing on the received device information, and generates security control reports for management personnel to analyze and evaluate, including trend prediction and abnormal behavior analysis, so as to send instructions and data to all or part of the control information processing devices 2 in combination with security policies, and manipulate the control information processing devices 2 to control the controlled devices 100. The control information processing devices 2 perform corresponding operations according to the instructions received from the security control core, including update tasks or vulnerability repair tasks, etc.

[0054] In one embodiment, the security control core device 1 can be a PC, a server or an industrial computer, but the present application is not limited thereto.

[0055] In one embodiment, the controlled device 100 may be a minicomputer, a PC server, a PC computer, an ATM or other banking devices, but the present application is not limited thereto.

[0056] Figure 2 is a structural diagram of a security control core device 1 provided in an embodiment of the present application, such as Figure 2 As shown, the security management core device 1 includes:

[0057] A first network communication module 101, used to communicate with the control information processing device 2;

[0058] The information collection module 102 is used to receive and summarize the device information sent by the control information processing device 2;

[0059] A report generation module 103 is used to process the device information and generate a security management and control report;

[0060] A control strategy configuration module 104 is used to generate a security control strategy according to preset requirements and the security control report;

[0061] The task scheduling module 105 is used to generate instructions and schedule tasks according to the security management and control strategy.

[0062] Specifically, the security control core device 1 performs efficient and secure data communication with the control information processing device 2 through the first network communication module 101, receives information from the control information processing device 2, supports multiple network protocols to adapt to different network environments, supports point-to-multipoint communication mode, and is convenient for managing multiple control information processing devices 2 at the same time. The information collection module 102 receives and summarizes the device information sent by the control information processing device 2, the device information includes hardware information, software information, operation logs, etc., and normalizes the multi-source data for subsequent processing and analysis.

[0063] The report generation module 103 performs in-depth processing of device information, completes trend analysis and risk prediction, generates multi-dimensional security control reports, and customizes the report format and content as needed for management personnel to analyze and evaluate to meet management needs. The security control report has a variety of report presentation methods, which can intuitively display the system operation status and potential risks.

[0064] The control strategy configuration module 104 generates security control strategies based on preset actual needs and security control reports, supports dynamic strategy adjustment mechanisms, optimizes control strategies in real time based on device status, system operation status and feedback information, ensures the flexibility and effectiveness of control measures, records historical strategy modification records, and allows rollback to any version. Security control strategies include device operation authority management strategies, data transmission encryption strategies, high-risk port monitoring strategies, and system vulnerability repair priority strategies. The task scheduling module 105 sends instructions and scheduling tasks to the control information processing device 2 according to the security control strategy, and sends the configured strategies to each control information processing device 2 in the form of instructions to ensure that each node performs the corresponding control tasks.

[0065] The management and control policy configuration module 104 can provide flexible policy configuration capabilities and improve the efficiency of policy adjustment and deployment. Managers can design personalized policies based on the security requirements and operating status of different devices, and implement differentiated security management for different devices and business scenarios. Through the collaborative work of the security management and control core device 1 and the management and control information processing device 2, the real-time distribution and execution of policies is ensured, and the dynamic adjustment function enables the system to respond to security threats and operating anomalies in a timely manner, thereby improving the system's adaptability.

[0066] In one embodiment, the report generation module 103 uses a high-performance processor (such as FPGA, ASIC, high-performance CPU or graphics processing unit GPU) to perform data preprocessing and real-time calculation. After data analysis, the report generation module 103 uses the embedded software operating system to generate customized reports, and the generated reports can be output to an external display device through a hardware interface (such as HDMI, VGA or Ethernet, etc.). The report generation module 103 can not only complete the in-depth processing of device information, but also automatically generate reports with predictive capabilities and security control value based on the analysis results, providing timely and accurate decision-making basis for equipment management and maintenance personnel.

[0067] In one embodiment, the report generation module 103 is specifically used for:

[0068] Preprocessing the device information;

[0069] Specifically, the acquired device information is standardized and the data is converted into a standard distribution using Z-score standardization:

[0070]

[0071] In the formula, μ is the mean and σ is the standard deviation.

[0072] The preprocessed equipment information is input into a risk prediction model pre-built based on data distribution to generate a risk prediction result;

[0073] Specifically, the report generation module pre-models the equipment operation data, learns the distribution of normal operation status, and obtains a risk prediction model. In actual operation, if it is detected that the equipment operation data deviates from the normal distribution, it is judged as abnormal.

[0074] The method of building a risk prediction model is to map high-dimensional data to a potential low-dimensional space and learn the probability distribution of the data in this space. Any input data that deviates from this distribution will be considered abnormal. Training is performed by maximizing the following objective function:

[0075]

[0076] In the formula, Used to measure the similarity between the reconstructed sample x′ generated by the model and the original input x; D KL (q φ (z|x)||p(z)) is used to constrain the distribution Q of the latent space φ (z|x) is close to the standard normal distribution p(z); x is the input device data, z is the low-dimensional representation of the latent space, and θ and φ are the parameters of the encoder and decoder.

[0077] The risk prediction model consists of two parts: an encoder and a decoder. The encoder maps the input data x to the latent space z:

[0078]

[0079] In the formula, μ φ (x) is the mean of the latent variable, σ φ (x) is the standard deviation of the latent variable.

[0080] The decoder reconstructs the sample z from the latent space back to the input space:

[0081] p θ (x|z)=Decoder(z) (4)

[0082] The loss function combines the reconstruction error and KL divergence:

[0083]

[0084] Where β is a trade-off term used to adjust the importance of the two parts of the loss.

[0085] The report generation module 103 uses the data during normal operation of the equipment to train the risk prediction model, adjust the model parameters θ and φ, minimize the loss function, and make the reconstruction error and KL divergence as small as possible.

[0086] During the security management process, the report generation module 103 uses the trained risk prediction model to reconstruct the preprocessed device information and calculates the anomaly score based on the reconstruction error:

[0087] Score(x)=||xx′|| 2 (6)

[0088] When Score(x) exceeds the set threshold, it is judged as abnormal, and the risk level is divided according to the size of the abnormal batch score.

[0089] Generate a safety management and control report based on the risk prediction results.

[0090] Specifically, the report generation module 103 generates a security control report based on the risk prediction results. The abnormal time point, abnormal index and abnormal score are recorded. The security control report includes but is not limited to equipment health, performance trends, predicted failure time and related security risks. When generating multi-dimensional reports, the report generation module 103 considers multiple factors to present a comprehensive view of the equipment security status.

[0091] In one embodiment, the control policy configuration module 104 is connected to the report generation module 103 via a hardware interface and is equipped with a high-performance processing unit, such as an embedded CPU (such as an ARM architecture processor) or a dedicated processing unit (such as an FPGA). The processor is responsible for executing the policy algorithm based on the received data and generating the corresponding control policy. The control policy configuration module 104 automatically generates a security control policy based on the preset requirements input by the user (such as equipment status monitoring, fault prediction, and performance tuning, etc.) and the analysis results extracted from the security control report. The security control policy includes operation thresholds, alarm levels, and response measures.

[0092] In one embodiment, when the PC server is overloaded, the device information obtained includes: CPU utilization is 92%, memory utilization is 96%, and the risk level obtained by the report generation module 103 is high risk. The security control strategy generated by the control strategy configuration module 104 based on the template of pre-defined rules and the reinforcement learning optimization strategy is: migrate some tasks to the backup node, enable low power mode, reduce resource utilization, and notify the administrator to monitor the task migration status.

[0093] In one embodiment, the task scheduling module 105 processes the task scheduling logic through an embedded controller (such as a microcontroller or a digital signal processor (DSP)). The controller analyzes the priority, execution conditions, time window, etc. of the task according to the instructions generated by the security management and control strategy, and schedules the appropriate task. Through mechanisms such as timers and priority control, the task scheduling module 105 can dynamically allocate tasks according to the timeliness, importance and resource requirements of different tasks. The task scheduling module 105 will define the execution method of tasks (such as equipment control, alarm processing, fault repair, etc.) according to the generated management and control strategy, and generate corresponding instructions. The task scheduling module 105 sends the generated task instructions to the management and control information processing device through the first network communication module 101 to perform specific tasks. At the same time, the task execution status will be returned to the task scheduling module 105 through a feedback mechanism (such as sensor and actuator status) to ensure that the completion of the task is monitored in time and necessary adjustments are made.

[0094] Figure 3 is a structural diagram of a security control core device 1 provided in an embodiment of the present application, such as Figure 3 As shown, the security control core device 1 also includes:

[0095] The security certificate module 106 is used to generate and manage security certificates, which are used to perform security certificate authentication through certificate key encryption during data transmission.

[0096] Specifically, the security certificate module 106 can ensure the credibility and security of devices, data, and operations. The security certificate module 106 generates digital certificates for device identity authentication and data encryption. Each control information processing device 2 and the security control core device 1 have a unique digital certificate as their unique identification in the system. The security control core device 1 distributes exclusive security certificates to each control information processing device 2, assigns a unique identity to each node, prevents node forgery, and prevents third-party illegal devices from accessing the system.

[0097] Use the public key and private key contained in the certificate to establish a secure communication link. All data transmission is encrypted and transmitted through asymmetric encryption to prevent middleman attacks or data leakage. Ensure that the two-way authentication confirmation device between the control information processing device 2 and the security control core device 1 is a legitimate and credible device. After the certificate authentication is passed, the two parties will start to establish a communication connection and exchange data.

[0098] Figure 4 is a structural diagram of a security control core device 1 provided in an embodiment of the present application, such as Figure 4 As shown, the security control core device 1 also includes:

[0099] The vulnerability management module 107 is used to identify vulnerabilities according to the device information and generate repair tasks.

[0100] Specifically, the vulnerability management module 107 can ensure the security of the system and equipment, regularly perform security scans on the software and hardware of the controlled device 100, identify potential vulnerabilities, and the scanning scope includes the operating system, application program, network configuration, and port status. Perform a risk level assessment on the discovered vulnerabilities, and generate a repair plan based on the degree of harm of the vulnerability and the urgency of repair to provide vulnerability repair suggestions, such as patch installation, configuration optimization, etc. The vulnerability management module 107 automatically generates repair tasks according to the repair plan, and remotely distributes patches or updated versions through the control information processing node. The vulnerability management module 107 implements the full process management of vulnerability scanning, risk assessment, and repair, and collaborates with the control information processing device 2 to ensure the rapid distribution and execution of vulnerability repair tasks; by timely discovering and repairing vulnerabilities, the possibility of vulnerabilities being attacked by the network is reduced, ensuring that the system and equipment are always in a safe state.

[0101] Figure 5 is a schematic diagram of the structure of a control information processing device 2 provided in an embodiment of the present application. Figure 5 As shown, the control information processing device 2 includes:

[0102] The information collection module 201 is used to collect software information and hardware information of the controlled device 100 and record operation logs;

[0103] The second network communication module 202 is used to communicate with the security management and control core device 1;

[0104] A program update module 203, used to distribute software and application versions to the controlled device 100 according to the instructions of the security control core device 1;

[0105] The real-time monitoring module 204 is used to monitor the ports of the controlled device 100 and identify and block risky operations.

[0106] Specifically, the information collection module 201 collects multi-dimensional information of the controlled device 100, including software information and hardware information. Among them, the software information includes the operating system version, application version, running status and configuration parameters, etc.; the hardware information includes the device model, hardware specifications and operating environment, etc. The collection frequency can be customized, supporting real-time collection and timed collection modes. The information collection module 201 also records detailed operation logs, including user operation records, system event logs and communication logs.

[0107] The control information processing device 2 communicates with the security control core device 1 at high speed and security through the second network communication module 202, supports multiple communication protocols, and meets the needs of different network environments. The program update module 203 distributes software and application versions to the controlled device 100 according to the instructions of the security control core device 1, can identify the current version status of the device and match the adapted update package, and supports the following update functions: differential update, version rollback and batch update. Among them, differential update is to transmit only the changed part of the software or application to improve the update efficiency; version rollback is to be able to quickly restore to the last stable version when the update fails or an exception occurs; batch update is to support the push of updates in stages by device group to reduce the risk of large-scale updates.

[0108] The real-time monitoring module 204 monitors the ports of the controlled device 100 in real time, captures and analyzes the device operation behavior, identifies high-risk or abnormal operations, warns and immediately blocks high-risk or abnormal operations, and generates detailed security event logs for subsequent review by relevant managers. The real-time monitoring module 204 can timely discover network security issues, prevent network threat attacks, control personnel operation risks, and ensure the stable operation of the financial system.

[0109] Figure 6 is a schematic diagram of the structure of a control information processing device 2 provided in an embodiment of the present application. Figure 6 As shown, the control information processing device 2 further includes: an information storage module 205;

[0110] The information storage module 205 includes a read-only memory 2051 and a readable and writable memory 2052; the read-only memory 2051 is used to store core program logic; the readable and writable memory 2052 is used to store upgradeable data and instructions issued by the security control core device 1.

[0111] Specifically, the read-only memory 2051 (ROM) stores the core program logic, including device initialization code, communication protocol stack and basic operation instruction set, etc. It adopts high-reliability storage media to ensure the long-term stability of program data and is equipped with an anti-tampering mechanism to ensure that the core program logic is protected from malicious attacks or accidental modifications.

[0112] The read-write memory 2052 (RAM) stores dynamic data and upgradeable content, including temporary cache, instructions issued by the security control core device 1, policy files and log records, supports large-capacity storage configuration, meets the needs of high-frequency data acquisition and complex instruction storage, provides data verification function to prevent data damage caused by storage failure, integrates automatic backup and recovery mechanism, can quickly restore normal operation after the device is restarted or powered off, supports partition management, distinguishes important data from ordinary data to optimize read and write performance and extend storage life.

[0113] Figure 7 is a schematic diagram of the structure of a control information processing device 2 provided in an embodiment of the present application. Figure 7 As shown, the control information processing device 2 also includes:

[0114] The certificate authentication module 206 is used to encrypt and decrypt using the certificate key of the security certificate generated by the security management and control core device 1 during data transmission.

[0115] Specifically, the certificate authentication module 206 uses security certificates to encrypt and decrypt during data transmission to ensure the confidentiality, integrity and verifiability of the data, supports multiple security certificate protocols, automatically updates security certificate keys, ensures the timeliness and security of the keys, provides two-way authentication functions, and verifies the identities of both parties before data transmission.

[0116] The certificate authentication module 206 uses the certificate key to perform end-to-end encryption on the transmitted data to prevent data from being tampered with during transmission; supports high-intensity encryption algorithms to meet security requirements in different scenarios; integrates a session key negotiation mechanism to ensure that each communication uses an independent encryption key to reduce the risk of replay attacks. The certificate authentication module 206 decrypts the received data and verifies its integrity to ensure that the data has not been tampered with during transmission; and confirms the credibility of the source of the data by verifying the digital signature.

[0117] Figure 8 is a schematic diagram of the structure of a control information processing device 2 provided in an embodiment of the present application. Figure 8 As shown, the control information processing device 2 also includes:

[0118] The fingerprint recognition module 207 is used to collect fingerprint information and perform identity authentication based on the fingerprint information to activate the management and control information processing device 2.

[0119] Specifically, the fingerprint recognition module 207 realizes the activation of the control information processing device 2 through fingerprints. When the control information processing device 2 is first enabled or re-enabled, it needs to be verified by the fingerprint recognition module 207. Only when the fingerprint of the pre-registered authorized personnel is verified, the node device can be activated and start working normally. The fingerprint recognition module 207 can verify the identity of the equipment user in daily operation to ensure that only authorized personnel can access the functions of the node device. By binding the device with fingerprints, the device is prevented from being activated or used by unauthorized personnel; even if the node device is stolen, the attacker cannot bypass the fingerprint recognition for illegal activation or operation; through identity authentication, the sensitive functions of the device are restricted to authorized personnel. By combining the high security of biometric authentication with the specific needs of the financial industry, physical access control, identity authentication, authority hierarchical management and operation audit of the control information processing node are realized. The fingerprint recognition module 207 not only improves the overall security of the system, but also optimizes the user experience, and is particularly suitable for highly sensitive scenarios such as banks and financial equipment management systems.

[0120] In one embodiment, the network connection method between the security control core device 1 and the control information processing device 2 includes a wireless communication method using a network cable, WiFi, Bluetooth, infrared, or a SIM card that supports GPRS traffic.

[0121] Specifically, the network connection method between the security control core device 1 and the control information processing device 2 supports multiple communication methods, including: network cable, WiFi, Bluetooth, infrared or wireless communication using a SIM card that supports GPRS traffic. Among them, the network cable can provide a stable high-speed wired connection, which is suitable for fixed places and high-bandwidth demand scenarios; WiFi supports wireless LAN communication, which is convenient for flexible deployment and is particularly suitable for occasions that require rapid installation and change of location; Bluetooth is suitable for short-distance, low-power data transmission scenarios, such as portable devices and small application scenarios; infrared supports point-to-point short-distance communication, which is suitable for specific security or physically isolated environments; the wireless communication method of the SIM card that supports GPRS traffic realizes remote data transmission through a mobile communication network (such as 3G / 4G / 5G), which is particularly suitable for distributed scenarios or areas with insufficient network coverage. The network connection method can automatically and dynamically switch between multiple connection methods to ensure the continuity and reliability of communication.

[0122] In one embodiment, the control information processing device 2 is connected to the controlled device 100 via a universal standard interface, and the universal standard interface includes a serial port and a USB interface.

[0123] Specifically, the control information processing device 2 is connected to the controlled device 100 through a universal standard interface, and the following interface types are supported: serial port and USB interface. Among them, the serial port is compatible with RS232, RS485 and other standards, which is suitable for the robust communication requirements of industrial equipment; the USB interface supports a variety of USB standards (such as USB2.0, USB3.0 or Type-C), which is suitable for the connection of high-bandwidth, hot-swappable devices.

[0124] In one embodiment, the universal standard interface also includes an Ethernet interface, a CAN bus interface, a GPIO interface, and a wireless module interface, providing expansion capabilities for large-scale connection scenarios, and easily accessing more devices through a hub or an expansion card.

[0125] The present application provides a security control system, which includes a security control core device and a control information processing device, which is connected to the controlled device through the control information processing device, used to collect the device information of the controlled device, send the device information to the security control core device and perform corresponding operations according to the instructions and scheduling tasks fed back by the security control core device; the security control core device is connected to the control information processing device through a network, used to process the received device information, generate a security control report, generate a security control strategy according to the preset requirements and the security control report, and generate instructions and scheduling tasks according to the security control strategy to control the controlled device, so as to timely discover network security problems and ensure the stable operation of the financial system. Among them, the ports of the controlled device are monitored by the real-time monitoring module, and risk operations are identified and blocked, which can prevent network threat attacks, control personnel operation risks, detect system network failures, and standardize the processing of system alarms and events; the received device information is processed by the security control core device, and instructions and scheduling tasks are sent to the control information processing device to control the controlled device, so that system vulnerabilities can be discovered in time to patch, and further ensure the stable operation of the financial system.

[0126] In addition, the present application also provides a security management and control method, which completes the security management and control of the controlled device by using the security management and control system described in the above embodiments.

[0127] Fig. 9 is a flowchart of a security management method provided by an embodiment of the present application, such as Fig. 9 As shown, the security control method provided by this application includes:

[0128] S901: The control information processing device collects device information of the controlled device and sends the device information to the security control core device;

[0129] S902: The security control core device processes the received device information, generates a security control report, generates a security control strategy according to preset requirements and the security control report, and generates instructions and scheduling tasks according to the security control strategy;

[0130] S903: The control information processing device performs corresponding operations according to the instructions and scheduling tasks fed back by the security control core device.

[0131] Specifically, each controlled device is connected to a corresponding control information processing device. The control information processing device is an external hardware device that is responsible for information collection. It can read the device information of the controlled device, record the operation traces of various accounts on the server, manage the server login account, and feed back the collected device information to the security control core device in real time.

[0132] The security control core device has external service functions and database functions, collects device information fed back by each control information processing device (node), conducts in-depth analysis and processing of the received device information, and generates security control reports for management personnel to analyze and evaluate, including trend prediction and abnormal behavior analysis, so as to send instructions and data to all or part of the control information processing devices in combination with security policies, and manipulate the control information processing devices to control the controlled devices. The control information processing devices perform corresponding operations according to the instructions received from the security control core, including update tasks or vulnerability repair tasks, etc.

[0133] In one embodiment, the core security control device may be a PC, a server, or an industrial computer, but the present application is not limited thereto.

[0134] In one embodiment, the controlled device may be a minicomputer, PC server, PC computer, ATM and other types of banking equipment, but the present application is not limited thereto.

[0135] The present application provides a security control method, wherein the control information processing device collects the device information of the controlled device and sends the device information to the security control core device; the security control core device processes the received device information, generates a security control report, generates a security control strategy according to the preset requirements and the security control report, and generates instructions and scheduling tasks according to the security control strategy; the control information processing device performs corresponding operations according to the instructions and scheduling tasks fed back by the security control core device, thereby realizing timely discovery of network security issues and ensuring the stable operation of the financial system. In addition, by monitoring the ports of the controlled devices through the real-time monitoring module, identifying and blocking risky operations, it is possible to prevent network threat attacks, control personnel operation risks, detect system network failures, and standardize the processing of system alarms and events; the security control core device processes the received device information, and sends instructions and scheduling tasks to the control information processing device to control the controlled devices, so that system vulnerabilities can be discovered in time to patch them, further ensuring the stable operation of the financial system.

[0136] In the description of this specification, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application. In addition, the terms "first", "second", etc. are used only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first", "second", etc. may explicitly or implicitly include one or more of the features. In the description of the present application, unless otherwise specified, "multiple" means two or more.

[0137] The descriptions with reference to the terms "one embodiment", "a specific embodiment", "some embodiments", "for example", "example", "specific example", or "some examples" etc. mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. The order of steps involved in each embodiment is used to schematically illustrate the implementation of the present application, and the order of steps therein is not limited and may be appropriately adjusted as needed.

[0138] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood by specific circumstances.

[0139] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A security management and control system, characterized in that: include: Security control core device and control information processing device; The control information processing device is connected to the controlled device, and is used to collect device information of the controlled device, send the device information to the security control core device, and perform corresponding operations according to the instructions and scheduling tasks fed back by the security control core device; The security control core device is connected to the control information processing device via a network, and is used to process the received device information, generate a security control report, generate a security control strategy based on preset requirements and the security control report, and generate instructions and scheduling tasks based on the security control strategy to control the controlled device.

2. The safety management and control system according to claim 1, characterized in that: The security control core device includes: A first network communication module, used to communicate with the control information processing device; An information collection module, used to receive and summarize the device information sent by the management and control information processing device; A report generation module, used to process the device information and generate a security management and control report; A control strategy configuration module, used to generate a security control strategy based on preset requirements and the security control report; The task scheduling module is used to generate instructions and schedule tasks according to the security management and control strategy.

3. The safety management and control system according to claim 2, characterized in that: The report generation module is specifically used for: Preprocessing the device information; The preprocessed equipment information is input into a risk prediction model pre-built based on data distribution to generate a risk prediction result; Generate a safety management and control report based on the risk prediction results.

4. The safety management and control system according to claim 2, characterized in that: The security control core device also includes: The security certificate module is used to generate and manage security certificates, which are used to perform security certificate authentication through certificate key encryption during data transmission.

5. The safety management and control system according to claim 2, characterized in that: The security control core device also includes: The vulnerability management module is used to identify vulnerabilities based on the device information and generate repair tasks.

6. The safety management and control system according to claim 1, characterized in that: The control information processing device comprises: An information collection module is used to collect software information and hardware information of the controlled device and record operation logs; A second network communication module, used to communicate with the security management and control core device; A program update module, used to distribute software and application versions to the controlled devices according to the instructions of the security control core device; The real-time monitoring module is used to monitor the ports of the controlled devices and identify and block risky operations.

7. The safety management and control system according to claim 6, characterized in that: The control information processing device further includes: an information storage module; The information storage module includes a read-only memory and a read-write memory; the read-only memory is used to store core program logic; the read-write memory is used to store upgradeable data and instructions issued by the security management and control core device.

8. The safety management and control system according to claim 6, characterized in that: The control information processing device also includes: The certificate authentication module is used to encrypt and decrypt using the certificate key of the security certificate generated by the security management and control core device during data transmission.

9. The security management and control system according to claim 1, characterized in that: The control information processing device also includes: The fingerprint recognition module is used to collect fingerprint information and perform identity authentication based on the fingerprint information to activate the management and control information processing device.

10. The security management and control system according to claim 1, characterized in that: The network connection method between the security management and control core device and the management and control information processing device includes a wireless communication method using a network cable, WiFi, Bluetooth, infrared, or a SIM card that supports GPRS traffic.

11. The security management and control system according to claim 1, characterized in that: The control information processing device is connected to the controlled device via a universal standard interface, and the universal standard interface includes a serial port and a USB interface.

12. A security management and control method, applied to the security management and control system according to any one of claims 1 to 11, characterized in that: include: The control information processing device collects device information of the controlled device and sends the device information to the security control core device; The security control core device processes the received device information, generates a security control report, generates a security control strategy according to preset requirements and the security control report, and generates instructions and scheduling tasks according to the security control strategy; The control information processing device performs corresponding operations according to the instructions and scheduling tasks fed back by the security control core device.

Images