Software-defined dynamic Internet of Things boundary management system

Abstract

The invention discloses a software-defined dynamic Internet of Things boundary management system which realizes decoupling of a network and a security policy by introducing a software-defined boundary (SDP) and allows the security policy to be dynamically adjusted independent of a physical network structure. Specifically, firstly, when an Internet of Things terminal tries to access a protected network resource, an access request needs to be sent to an SDP client; the SDP client is responsible for carrying out preliminary identity verification on the terminal and forwarding verification information to the SDP controller. And then, the SDP controller is used as a decision center of the whole system, and the access request is evaluated according to the received identity verification information and the security policy so as to realize fine-grained access control. Through the mode, the safety protection capability in the Internet of Things environment is enhanced, new threats can be quickly responded, the safety strategy can be adjusted, and high-level safety guarantee can be continuously provided in the continuously changing Internet of Things environment.

Description

Technical Field

[0001] The present application relates to the field of intelligent management, and more specifically, to a software-defined dynamic Internet of Things boundary management system. Background Art

[0002] In today's information and networking era, the development of Internet of Things (IoT) technology has penetrated into every corner of social life, from smart homes, smart transportation to industrial Internet and many other fields. With the surge in IoT devices and the deep integration of these devices with the Internet, the traditional concept of network security boundaries has gradually been broken, bringing unprecedented challenges to security management and access control. Traditional firewalls and IP address-based security strategies are difficult to adapt to this change, especially in the face of the dynamic and changing IoT environment, their static nature and limitations are particularly prominent.

[0003] In the existing IoT architecture, terminal devices are directly exposed to the Internet, which not only increases the attack surface, but also enables malicious actors to easily discover and exploit system vulnerabilities. At the same time, many IoT devices have limited resources and cannot support complex encryption algorithms or authentication protocols, which further exacerbates security risks. In addition, current security solutions often rely on pre-set rules to determine which traffic is allowed, which lacks sufficient flexibility and responsiveness to deal with unknown threats or abnormal behavior of internal users. In response to the above problems, software-defined networking (SDN) and network function virtualization (NFV) technologies provide new ideas for solving these problems. However, even in the scenario of adopting SDN / NFV, how to effectively manage the dynamic changes of IoT boundaries is still an urgent problem to be solved. Although traditional SDN controllers can realize centralized management of network configuration, their management efficiency and real-time performance are still insufficient for a large number of heterogeneous and distributed terminal devices in the IoT environment, and they lack support for terminal authentication and fine-grained access control.

[0004] Therefore, an optimized software-defined dynamic IoT border management system is expected. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. An embodiment of the present application provides a software-defined dynamic IoT boundary management system, which realizes the decoupling of network and security policy by introducing software-defined boundary (SDP), allowing security policy to be dynamically adjusted independently of the physical network structure. Specifically, first, when an IoT terminal attempts to access protected network resources, it first needs to send an access request to the SDP client. The SDP client is responsible for performing preliminary identity authentication on the terminal and forwarding the verification information to the SDP controller. Then, the SDP controller, as the decision-making center of the entire system, evaluates the access request based on the received authentication information and security policy to achieve fine-grained access control. In this way, not only the security protection capability in the IoT environment is enhanced, but also the ability to quickly respond to new threats and adjust security policies can ensure that a high level of security is continuously provided in the ever-changing IoT environment.

[0006] According to one aspect of the present application, a software-defined dynamic Internet of Things border management system is provided, which includes:

[0007] An access request sending module, configured to send an access request to an SDP client when an IoT terminal device attempts to access a protected network resource;

[0008] An identity authentication module, configured to enable the SDP client to perform preliminary identity authentication on the IoT terminal device after receiving the access request, and forward the identity authentication information to the SDP controller;

[0009] An access request judgment module, used to use the SDP controller to judge whether to allow the access request to continue according to the identity authentication information and the current security policy, and if allowed, to generate a temporary key and pass it to the SDP gateway through a secure channel;

[0010] The encryption module is used to open the port and service and prepare to receive the encrypted communication flow from the IoT terminal device after the SDP gateway receives the temporary key.

[0011] Compared with the prior art, the present application provides a software-defined dynamic IoT boundary management system, which realizes the decoupling of network and security policy by introducing software-defined boundary (SDP), allowing security policy to be dynamically adjusted independently of the physical network structure. Specifically, first, when the IoT terminal attempts to access protected network resources, it first needs to send an access request to the SDP client. The SDP client is responsible for preliminary identity authentication of the terminal and forwarding the verification information to the SDP controller. Then, the SDP controller, as the decision-making center of the entire system, evaluates the access request based on the received authentication information and security policy to achieve fine-grained access control. In this way, not only the security protection capability in the IoT environment is enhanced, but also the ability to quickly respond to new threats and adjust security policies can ensure that a high level of security is continuously provided in the ever-changing IoT environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0013] Figure 1 A block diagram of a software-defined dynamic Internet of Things border management system according to an embodiment of the present application;

[0014] Figure 2 A data flow diagram of a software-defined dynamic Internet of Things border management system according to an embodiment of the present application;

[0015] Figure 3 A block diagram of an access request determination module in a software-defined dynamic Internet of Things border management system according to an embodiment of the present application;

[0016] Figure 4 The present invention is a block diagram of a feature fusion unit in a software-defined dynamic Internet of Things border management system according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0018] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0019] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0020] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0021] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0022] In the technical solution of the present application, a software-defined dynamic Internet of Things boundary management system is proposed. Figure 1 The block diagram is a software-defined dynamic Internet of Things border management system according to an embodiment of the present application. Figure 2 Schematic diagram of data flow of a software-defined dynamic IoT border management system according to an embodiment of the present application. Figure 1 and Figure 2As shown, according to the software-defined dynamic IoT boundary management system 300 of an embodiment of the present application, it includes: an access request sending module 310, which is used for the IoT terminal device to send an access request to the SDP client when the IoT terminal device attempts to access protected network resources; an identity authentication module 320, which is used for the SDP client to perform preliminary identity authentication on the IoT terminal device after receiving the access request, and forward the identity authentication information to the SDP controller; an access request judgment module 330, which is used to use the SDP controller to judge whether to allow the access request to continue based on the identity authentication information and the current security policy, and if allowed, generate a temporary key and pass it to the SDP gateway through a secure channel; an encryption module 340, which is used to open ports and services and prepare to receive encrypted communication streams from the IoT terminal device after the SDP gateway receives the temporary key.

[0023] In particular, the access request sending module 310 is used for the IoT terminal device to send an access request to the SDP client when the IoT terminal device attempts to access a protected network resource. The access request includes an identity (such as a device ID), an identifier of the requested service or resource, a timestamp, and any data that facilitates subsequent verification and authorization. For some application scenarios, the access request may also include encrypted authentication credentials or other forms of identity proof materials to enhance the strength of verification. In order to ensure the integrity and confidentiality of data during transmission, the access request will be encapsulated in a secure transport layer protocol (such as TLS / SSL) and then sent to the SDP client.

[0024] In particular, after receiving the access request, the identity authentication module 320, the SDP client performs preliminary identity authentication on the IoT terminal device, and forwards the identity authentication information to the SDP controller. It should be understood that by performing preliminary identity authentication on the IoT terminal device through the SDP client, those devices that obviously do not meet the identity requirements or are identified as potential threats can be immediately screened out. In a specific example of the present application, the preliminary identity authentication provides basic information about the IoT terminal device, such as device ID, authentication credentials, etc., and by matching this information with a preset legal device list or authentication rules, legal and illegal devices can be quickly identified. If the IoT terminal device passes the preliminary identity authentication, its identity authentication information will be forwarded to the SDP controller for further processing to ensure that only verified devices can enter the next security check process, thereby improving the overall security of the system.

[0025] In particular, the access request judgment module 330 is used to use the SDP controller to determine whether the access request is allowed to continue according to the identity authentication information and the current security policy. If allowed, a temporary key is generated and passed to the SDP gateway through a secure channel. That is, after the SDP client completes the preliminary identity authentication of the IoT terminal device, the collected identity authentication information is forwarded to the SDP controller. The SDP controller is responsible for evaluating this information and making a final decision. Once the SDP controller confirms that the access request meets all requirements, a temporary key is generated. The creation of a temporary key is to provide a short-life security credential for establishing a secure communication channel. This approach effectively limits the risk of even key leakage, because the validity period of the temporary key is extremely short, usually limited to a single session or a very short period of time. Furthermore, the temporary key is passed to the SDP gateway through a secure channel to ensure that the key will not be intercepted or tampered with during transmission, maintaining the security of the entire system. Finally, after the SDP gateway receives the temporary key, it will open the corresponding port and service, ready to receive the encrypted communication stream from the IoT terminal device. In particular, it should be understood that in the process of the SDP controller judging whether to allow the access request to continue, with the development of the Internet of Things, network attacks have become more and more complex and difficult to predict. Therefore, how to accurately judge the access request is crucial. Based on this, in the technical solution of this application, the SDP controller uses advanced semantic coding and feature fusion technology to achieve fine-grained understanding and matching of identity authentication information and security policies, thereby improving the accuracy and flexibility of access control decisions. Specifically, in a specific example of this application, such as Figure 3 As shown, the access request judgment module 330 includes: an identity authentication information semantic encoding unit 331, which is used to semantically encode the identity authentication information to obtain an identity authentication information semantic encoding feature vector; a current security policy semantic encoding unit 332, which is used to semantically encode the current security policy to obtain a current security policy semantic encoding feature vector; a feature fusion unit 333, which is used to input the identity authentication information semantic encoding feature vector and the current security policy semantic encoding feature vector to perform semantic alignment feature fusion to obtain an identity information-security policy fine-grained alignment fusion feature vector as an identity information-security policy fine-grained alignment fusion feature; an access request review form 334, which is used to determine whether to allow the access request to continue based on the identity information-security policy fine-grained alignment fusion feature.

[0026] Specifically, the identity authentication information semantic encoding unit 331 is used to semantically encode the identity authentication information to obtain a semantic encoding feature vector of the identity authentication information. That is, in a specific example of the present application, the identity authentication information is input into a semantic encoder based on the Bert model to obtain the semantic encoding feature vector of the identity authentication information. It should be understood that in the Internet of Things environment, the identity authentication information may contain various types of text data such as device descriptions, user behavior logs, geographic location tags, etc. These text data often have rich semantic backgrounds, and there are challenges in using them directly for calculation and analysis. Through the BERT model, these text information can be converted into high-dimensional vectors rich in contextual features. For example, when processing an identity authentication request containing a device name and model, BERT can not only identify the specific device type, but also understand the behavior pattern and history of the device in a specific application scenario, thereby providing a more comprehensive basis for security assessment.

[0027] Specifically, the current security policy semantic encoding unit 332 is used to semantically encode the current security policy to obtain the semantic encoding feature vector of the current security policy. Similarly, in a specific example of the present application, the current security policy is input into the semantic encoder based on the Bert model to obtain the semantic encoding feature vector of the current security policy. In the technical solution of the present application, for security policies, security policies are usually composed of a series of rules and conditions, such as access control lists, device whitelists, time restrictions, resource access rights, etc. These rules usually exist in text form, and the BERT model can deeply understand each word in the security policy text and its contextual relationship through its bidirectional encoding mechanism. For example, when processing a security policy containing time restrictions, such as "during working hours", BERT can not only identify specific time periods, but also deeply understand the association between this time period and other conditions such as specific device types and geographical locations through the self-attention mechanism. This deep understanding helps the SDP controller make more sophisticated and accurate access control decisions. In addition, security policies often involve complex logical relationships between multiple variables, such as "if device A is located at location B and user C has no abnormal behavior in the past 24 hours, access is allowed." The BERT model can effectively capture these complex semantic relationships and encode them into high-dimensional feature vectors. In this way, even when faced with security policies that combine multiple conditions, the system can accurately evaluate whether each access request meets all conditions, rather than just based on simple keyword matching.

[0028] Specifically, the feature fusion unit 333 is used to input the identity authentication information semantic encoding feature vector and the current security policy semantic encoding feature vector for semantic alignment feature fusion to obtain the identity information-security policy fine-grained alignment fusion feature vector as the identity information-security policy fine-grained alignment fusion feature. It should be understood that in a typical IoT environment, the identity authentication information (such as device ID, authentication credentials, geographic location, etc.) and the current security policy (such as access time limit, location limit, user behavior pattern, etc.) provided by the IoT terminal device are complex data in text form. Although the contextual semantic information of the identity authentication information and the current security policy is effectively extracted through semantic encoding technology, since the two belong to different data sources, their expressions and emphases may be different, and direct comparison and matching may face greater computational complexity and error rate. Therefore, in order to further improve the efficiency and accuracy of access control decisions, in the technical solution of the present application, the identity authentication information semantic encoding feature vector and the current security policy semantic encoding feature vector are input for semantic alignment feature fusion to obtain the identity information-security policy fine-grained alignment fusion feature vector as the identity information-security policy fine-grained alignment fusion feature. It should be understood that through semantic alignment processing, authentication information and security policies can be mapped to the same semantic space for comparison, and the connection between the two can be established at the semantic level to achieve more accurate and comprehensive semantic interaction matching. For example, when an IoT terminal device requests access to a protected resource, it may provide detailed geographic location information. If the current security policy stipulates that only devices from a specific area can access, then the system needs to accurately determine whether the device is actually located in the permitted area. In addition, in actual applications, security policies often involve complex logical relationships between multiple variables. For example, a security policy may require "access is only allowed from devices within a trusted IP address range during working hours." In this case, the authentication information includes not only the location of the device, but also the timestamp and IP address. Through semantic alignment feature fusion processing, the subtle correlation between these different features can be captured, revealing potential security risks or compliance issues. In this way, the SDP controller can make more accurate decisions under complex multi-condition combinations. Specifically, in a specific example of the present application, such as Figure 4As shown, the feature fusion unit 333 includes: a dimension modulation subunit 3331, which is used to perform dimension modulation on the identity authentication information semantic coding feature vector and the current security policy semantic coding feature vector to obtain the modulated identity authentication information semantic coding feature vector and the modulated current security policy semantic coding feature vector; a semantic feature alignment subunit 3332, which is used to perform semantic feature alignment on the modulated identity authentication information semantic coding feature vector and the modulated current security policy semantic coding feature vector based on the fine-grained association coding features between the modulated identity authentication information semantic coding feature vector and the modulated current security policy semantic coding feature vector to obtain the fine-grained aligned identity authentication information semantic coding feature vector and the fine-grained aligned current security policy semantic coding feature vector; a fine-grained response interaction subunit 3333, which is used to perform feature fine-grained response interaction on the fine-grained aligned identity authentication information semantic coding feature vector and the fine-grained aligned current security policy semantic coding feature vector to obtain the identity information-security policy fine-grained aligned fusion feature vector.

[0029] More specifically, the dimension modulation subunit 3331 is used to perform dimension modulation on the semantic coding feature vector of the identity authentication information and the semantic coding feature vector of the current security policy to obtain the modulated semantic coding feature vector of the identity authentication information and the modulated semantic coding feature vector of the current security policy. In a specific example of the present application, the semantic coding feature vector of the identity authentication information and the semantic coding feature vector of the current security policy are input into a dimension modulation module based on point convolution to obtain the modulated semantic coding feature vector of the identity authentication information and the modulated semantic coding feature vector of the current security policy, wherein the modulated semantic coding feature vector of the identity authentication information and the modulated semantic coding feature vector of the current security policy have the same feature dimension. It is worth mentioning that point convolution is a special convolution operation, which is usually used in neural networks to change the number of channels of feature maps or perform linear transformations to ensure that the weights in the feature space are redistributed without losing important information, so that the feature vector can better capture the subtle differences and complex relationships in the original data. In a specific example, the point convolution-based dimensional modulation module is used to perform dimensional modulation on the identity authentication information semantic coding feature vector and the current security policy semantic coding feature vector using the following dimensional modulation formula to obtain a modulated identity authentication information semantic coding feature vector and a modulated current security policy semantic coding feature vector; wherein the dimensional modulation formula is:

[0030] x1=Leaky ReLU{Conv 1×1 (x1)}

[0031] x2=Leaky ReLU{Conv 1×1 (x2)}

[0032] Wherein, x1 represents the semantic encoding feature vector of the identity authentication information, x2 represents the semantic encoding feature vector of the current security policy, Conv 1×1 represents point convolution coding, Leaky ReLU is the activation function, x1 represents the semantic coding feature vector of the identity authentication information after modulation, and x2 represents the semantic coding feature vector of the current security policy after modulation.

[0033] More specifically, the semantic feature alignment subunit 3332 is used to perform semantic feature alignment on the modulated identity authentication information semantic encoding feature vector and the modulated current security policy semantic encoding feature vector based on the fine-grained association encoding feature between the modulated identity authentication information semantic encoding feature vector and the modulated current security policy semantic encoding feature vector to obtain a fine-grained alignment identity authentication information semantic encoding feature vector and a fine-grained alignment current security policy semantic encoding feature vector. In a specific example of the present application, first, the modulated identity authentication information semantic encoding feature vector and the modulated current security policy semantic encoding feature vector are fine-grained association encoded to obtain an identity authentication information-current security policy semantic feature fine-grained association matrix; it should be understood that when the IoT terminal device requests access to a protected resource, the identity authentication information (such as device ID, authentication credentials, geographic location, etc.) and the current security policy (such as access time limit, location limit, user behavior pattern, etc.) provided by it are both complex data sets. After semantic encoding and dimensional modulation, although these data have been converted into high-dimensional feature vectors, the semantic connection between the two still needs to be further mined and refined to ensure the accuracy and flexibility of access control decisions. Fine-grained association coding captures the subtle semantic relationship between the two features by constructing an association matrix and comparing each element in the two feature vectors. In addition, traditional association methods can only reflect the simple similarity or distance between features, and it is difficult to reveal complex logical relationships. Fine-grained association coding enhances the expression of association between features by introducing more contextual information and background knowledge. For example, when dealing with security policies with multiple variable combinations, fine-grained association coding can capture the synergistic effects of different condition combinations, so that the system can make more reasonable evaluations under complex multi-condition combinations. Then, the identity authentication information-current security policy semantic feature fine-grained association matrix is ​​input into the semantic information field encoding network based on the convolution kernel to obtain the identity authentication information-current security policy semantic feature fine-grained semantic information field; in this process, the convolution kernel, as a local receptive field, slides through the entire association matrix at multiple scales, gradually extracts the subtle semantic relationship in the local area, and as the convolution layer deepens, the system gradually forms a more abstract and high-level feature representation. Each layer of convolution operation can further refine the feature representation based on the previous layer, and finally construct a highly comprehensive and semantically rich information field. Furthermore, the modulated identity authentication information semantic coding feature vector and the modulated current security policy semantic coding feature vector are respectively mapped to the identity authentication information-current security policy semantic feature fine-grained semantic information field to obtain the fine-grained aligned identity authentication information semantic coding feature vector and the fine-grained aligned current security policy semantic coding feature vector.That is, the fine-grained semantic information field of the semantic feature of the identity authentication information-current security policy is used as a shared semantic space, so that the semantic encoding feature vector of the modulated identity authentication information and the semantic encoding feature vector of the modulated current security policy can find the closest expression form in the same high-dimensional space. Through fine-grained alignment, the system can carefully compare the two feature vectors in multiple dimensions to ensure that the match between them does not just stay at the surface level, but goes deep into every detail. In addition, fine-grained alignment enables the system to capture the subtle semantic relationship between features, strengthen the intrinsic connection between different features, and help the SDP controller to more accurately understand the security background of each access request, so as to make more reasonable decisions. In a specific example, based on the fine-grained associated coding features between the semantic encoding feature vector of the identity authentication information after modulation and the semantic encoding feature vector of the current security policy after modulation, the semantic feature alignment of the semantic encoding feature vector of the identity authentication information after modulation and the semantic encoding feature vector of the current security policy after modulation is performed to obtain a fine-grained aligned semantic encoding feature vector of the identity authentication information and a fine-grained aligned semantic encoding feature vector of the current security policy; wherein the semantic feature alignment formula is:.

[0034]

[0035]

[0036]

[0037] Among them, x ′2 T is x ′2 The transposed vector of is matrix multiplication, L is x ′2 The length of Conv 3×3 is a convolutional code with a convolution kernel of 3×3, M x represents the identity authentication information-current security policy semantic feature fine-grained association matrix, Ω represents the identity authentication information-current security policy semantic feature fine-grained semantic information field, x 1t represents the semantic encoding feature vector of the fine-grained aligned authentication information, x 2t Represents the fine-grained alignment of the current security policy semantic encoding feature vector.

[0038] More specifically, the fine-grained response interaction subunit 3333 is used to perform feature fine-grained response interaction on the fine-grained aligned identity authentication information semantic encoding feature vector and the fine-grained aligned current security policy semantic encoding feature vector to obtain the identity information-security policy fine-grained aligned fusion feature vector. In a specific example of the present application, the position-weighted sum between the fine-grained aligned identity authentication information semantic encoding feature vector and the fine-grained aligned current security policy semantic encoding feature vector is calculated to obtain the identity information-security policy fine-grained aligned fusion feature vector. That is, by calculating the position-weighted sum between the fine-grained aligned identity authentication information semantic encoding feature vector and the fine-grained aligned current security policy semantic encoding feature vector, the importance of each feature can be flexibly adjusted according to the needs of the actual scenario, thereby providing a more comprehensive and balanced evaluation basis for the final decision. The identity information-security policy fine-grained aligned fusion feature vector finally generated not only contains all the details of the original feature vector, but also enhances the semantic relevance between the identity authentication information and the current security policy. This comprehensive representation enables the SDP controller to more accurately understand the security context of each access request, thereby making more reasonable decisions. In this way, it is ensured that the SDP controller can determine whether to allow the access request to continue based on richer and more detailed semantic information, thereby ensuring the security of protected network resources. In a specific example, the fine-grained alignment of the identity authentication information semantic encoding feature vector and the fine-grained alignment of the current security policy semantic encoding feature vector are subjected to feature fine-grained response interaction using the following feature fine-grained response interaction formula to obtain the identity information-security policy fine-grained alignment fusion feature vector; wherein the feature fine-grained response interaction formula is:

[0039] x c =αx 1t +βx 2t

[0040] Among them, α and β are weight factors, x c Represents the identity information-security policy fine-grained alignment fusion feature vector.

[0041] Specifically, the access request audit form 334 yuan is used to determine whether to allow the access request to continue based on the identity information-security policy fine-grained alignment fusion feature. In a specific example of the present application, the identity information-security policy fine-grained alignment fusion feature vector is input into the access request intelligent audit module based on the classifier to obtain the audit result, and the audit result is used to indicate whether the access request is allowed to continue. Among them, the classifier relies on machine learning algorithms, such as support vector machine (SVM), random forest (Random Forest), neural network, etc. These algorithms can find the optimal decision boundary in multidimensional space so that data points of different categories (i.e., legal access and illegal access) are separated as much as possible. When a new access request arrives, the classifier calculates the distance or similarity between the corresponding identity information-security policy fine-grained alignment fusion feature vector and the decision boundary of each category, and then determines which category the access request belongs to, and further determines whether to allow the access request to continue based on the classification result. By introducing the classifier technology in machine learning, the system can make more accurate and intelligent access control decisions based on the identity information-security policy fine-grained alignment fusion feature, which not only improves the intelligence level of the system, but also enhances the accuracy of the audit. In one example, the identity information-security policy fine-grained aligned fusion feature vector is input into a classifier-based access request intelligent audit module to obtain an audit result, including: using multiple fully connected layers of the classifier to fully connect encode the identity information-security policy fine-grained aligned fusion feature vector to obtain an encoded classification feature vector; passing the encoded classification feature vector through the Softmax classification function of the classifier to obtain the audit result.

[0042] Preferably, inputting the identity information-security policy fine-grained alignment fusion feature vector into a classifier-based access request intelligent audit module to obtain an audit result includes:

[0043] The distance between each pair of eigenvalues ​​of the identity information-security policy fine-grained alignment fusion feature vector is calculated, such as the L2 distance, and the square root of the distance is taken to obtain the identity information-security policy fine-grained alignment fusion distance representation matrix, that is,

[0044]

[0045] Where V represents the identity information-security policy fine-grained alignment fusion feature vector, v i and v j represents the i-th and j-th eigenvalues ​​of the identity information-security policy fine-grained alignment fusion feature vector, d(v i ,v j) represents the distance between the i-th and j-th eigenvalues ​​of the identity information-security policy fine-grained alignment fusion feature vector, D represents the identity information-security policy fine-grained alignment fusion distance representation matrix, D i,j Represents the element value at the (i, j)th position in the identity information-security policy fine-grained alignment fusion distance representation matrix;

[0046] Obtain the identity information-security policy fine-grained alignment fusion autocorrelation matrix of the identity information-security policy fine-grained alignment fusion feature vector as a row vector, that is,

[0047] The identity information-security policy fine-grained alignment fusion feature vector is matrix-multiplied with the identity information-security policy fine-grained alignment fusion distance representation matrix to obtain the identity information-security policy fine-grained alignment fusion first-level mapping vector, that is,

[0048] The identity information-security policy fine-grained alignment fusion first-level mapping vector is matrix-multiplied with the matrix product of the identity information-security policy fine-grained alignment fusion distance representation matrix and the identity information-security policy fine-grained alignment fusion self-correlation matrix to obtain the identity information-security policy fine-grained alignment fusion multi-level mapping vector

[0049] The identity information-security policy fine-grained alignment fusion multi-level mapping vector is interpolated with the identity information-security policy fine-grained alignment fusion associated eigenvector composed of the eigenvalues ​​of the identity information-security policy fine-grained alignment fusion auto-association matrix to obtain an optimized identity information-security policy fine-grained alignment fusion feature vector, wherein interpolation or zero padding is performed when the eigenvalue is insufficient;

[0050] The optimized identity information-security policy fine-grained alignment fusion feature vector is input into a classifier-based access request intelligent audit module to obtain an audit result.

[0051] Considering that the identity authentication information semantic encoding feature vector and the current security policy semantic encoding feature vector represent the semantic encoding features of the identity authentication information and the current security policy respectively, when performing feature alignment interaction based on the semantic information field, the semantic divergence between the identity authentication information semantic encoding feature vector and the current security policy semantic encoding feature vector will make the fine-grained alignment of the semantic information fields between the two difficult, resulting in the lack of fine-grained interaction feature instance determination of the identity information-security policy fine-grained alignment fusion feature vector, thereby affecting the accuracy of the audit results obtained through the classifier-based access request intelligent audit module.

[0052] Therefore, through the linear target mapping representation of the similarity distance representation matrix of the identity information-security policy fine-grained alignment fusion feature vector, the self-correlation complete similarity instantiation of the identity information-security policy fine-grained alignment fusion feature vector is instantiated with a secondary target mapping representation based on a multi-level distribution hierarchy, and the association mismatch negative influence factor is compensated by the association fusion kernel bias to improve the degree of instance determination of the eigenvalue of the identity information-security policy fine-grained alignment fusion feature vector under similarity constraints, that is, the degree of significance of the eigenvalue as an instance for classification regression determination, thereby improving the accuracy of the audit result obtained by the classifier-based access request intelligent audit module of the identity information-security policy fine-grained alignment fusion feature vector.

[0053] In particular, the encryption module 340 is used to open ports and services and prepare to receive encrypted communication streams from the IoT terminal device after the SDP gateway receives the temporary key. That is, after receiving the temporary key, the SDP gateway will perform a series of operations to ensure that subsequent communications are both secure and efficient. Specifically, the SDP gateway will use the temporary key to decrypt any incoming data packets, and will also use it to encrypt response data packets to ensure that all transmitted data is encrypted. In this way, it is ensured that only IoT terminal devices with the correct temporary key can establish an encrypted communication connection with the SDP gateway, and interact with protected network resources while meeting security policies, thereby effectively protecting sensitive information and critical infrastructure from external threats.

[0054] As described above, the software-defined dynamic IoT boundary management system 300 according to the embodiment of the present application can be implemented in various wireless terminals, such as a server with a software-defined dynamic IoT boundary management algorithm. In one possible implementation, the software-defined dynamic IoT boundary management system 300 according to the embodiment of the present application can be integrated into the wireless terminal as a software module and / or a hardware module. For example, the software-defined dynamic IoT boundary management system 300 can be a software module in the operating system of the wireless terminal, or can be an application developed for the wireless terminal; of course, the software-defined dynamic IoT boundary management system 300 can also be one of the many hardware modules of the wireless terminal.

[0055] Alternatively, in another example, the software-defined dynamic IoT boundary management system 300 and the wireless terminal may also be separate devices, and the software-defined dynamic IoT boundary management system 300 may be connected to the wireless terminal via a wired and / or wireless network and transmit interactive information in accordance with an agreed data format.

[0056] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A software-defined dynamic Internet of Things border management system, characterized in that: include: An access request sending module, configured to send an access request to an SDP client when an IoT terminal device attempts to access a protected network resource; An identity authentication module, configured to enable the SDP client to perform preliminary identity authentication on the IoT terminal device after receiving the access request, and forward the identity authentication information to the SDP controller; An access request judgment module, used to use the SDP controller to judge whether to allow the access request to continue according to the identity authentication information and the current security policy, and if allowed, to generate a temporary key and pass it to the SDP gateway through a secure channel; The encryption module is used to open the port and service and prepare to receive the encrypted communication flow from the IoT terminal device after the SDP gateway receives the temporary key.

2. The software-defined dynamic Internet of Things border management system according to claim 1, characterized in that: The access request judgment module includes: An identity verification information semantic encoding unit, used for semantically encoding the identity verification information to obtain an identity verification information semantic encoding feature vector; A current security policy semantic encoding unit, used for semantically encoding the current security policy to obtain a current security policy semantic encoding feature vector; A feature fusion unit, used for performing semantic alignment feature fusion on the identity authentication information semantic encoding feature vector and the current security policy semantic encoding feature vector input to obtain an identity information-security policy fine-grained alignment fusion feature vector as an identity information-security policy fine-grained alignment fusion feature; The access request review unit is used to determine whether to allow the access request to continue based on the identity information-security policy fine-grained alignment fusion feature.

3. The software-defined dynamic Internet of Things border management system according to claim 2, characterized in that: The identity authentication information semantic encoding unit is used to: The identity verification information is input into a semantic encoder based on the Bert model to obtain a semantic encoding feature vector of the identity verification information.

4. The software-defined dynamic Internet of Things border management system according to claim 3, characterized in that: The current security policy semantic encoding unit is used to: The current security policy is input into the semantic encoder based on the Bert model to obtain the semantic encoding feature vector of the current security policy.

5. The software-defined dynamic Internet of Things border management system according to claim 4, characterized in that: The feature fusion unit comprises: A dimension modulation subunit, used for dimensionally modulating the identity authentication information semantic coding feature vector and the current security policy semantic coding feature vector to obtain a modulated identity authentication information semantic coding feature vector and a modulated current security policy semantic coding feature vector; A semantic feature alignment subunit, configured to perform semantic feature alignment on the modulated identity authentication information semantic coding feature vector and the modulated current security policy semantic coding feature vector based on the fine-grained association coding features between the modulated identity authentication information semantic coding feature vector and the modulated current security policy semantic coding feature vector to obtain a fine-grained aligned identity authentication information semantic coding feature vector and a fine-grained aligned current security policy semantic coding feature vector; The fine-grained response interaction subunit is used to perform feature fine-grained response interaction on the fine-grained aligned identity authentication information semantic encoding feature vector and the fine-grained aligned current security policy semantic encoding feature vector to obtain the identity information-security policy fine-grained alignment fusion feature vector.

6. The software-defined dynamic Internet of Things border management system according to claim 5, characterized in that: The dimension modulation subunit is used for: The identity authentication information semantic coding feature vector and the current security policy semantic coding feature vector are input into a point convolution-based dimensional modulation module to obtain the modulated identity authentication information semantic coding feature vector and the modulated current security policy semantic coding feature vector, wherein the modulated identity authentication information semantic coding feature vector and the modulated current security policy semantic coding feature vector have the same feature dimension.

7. The software-defined dynamic Internet of Things border management system according to claim 6, characterized in that: The feature alignment subunit comprises: A fine-grained association coding secondary subunit is used to perform fine-grained association coding on the modulated identity authentication information semantic coding feature vector and the modulated current security policy semantic coding feature vector to obtain an identity authentication information-current security policy semantic feature fine-grained association matrix; A semantic information field construction secondary subunit is used to construct a fine-grained semantic information field of identity authentication information-current security policy semantic features based on the identity authentication information-current security policy semantic features fine-grained association matrix; The fine-grained alignment secondary sub-unit is used to map the modulated identity authentication information semantic coding feature vector and the modulated current security policy semantic coding feature vector to the identity authentication information-current security policy semantic feature fine-grained semantic information field respectively to obtain the fine-grained aligned identity authentication information semantic coding feature vector and the fine-grained aligned current security policy semantic coding feature vector.

8. The software-defined dynamic Internet of Things border management system according to claim 7, characterized in that: The semantic information field constructs a secondary subunit, which is used to: The identity authentication information-current security policy semantic feature fine-grained association matrix is ​​input into a convolution kernel-based semantic information field encoding network to obtain the identity authentication information-current security policy semantic feature fine-grained semantic information field.

9. The software-defined dynamic Internet of Things border management system according to claim 8, characterized in that: The fine-grained response interaction subunit is used to: The position-weighted sum between the fine-grained aligned identity authentication information semantic encoding feature vector and the fine-grained aligned current security policy semantic encoding feature vector is calculated to obtain the identity information-security policy fine-grained aligned fusion feature vector.

10. The software-defined dynamic Internet of Things border management system according to claim 9, characterized in that: The access request review unit is used to: The identity information-security policy fine-grained aligned fusion feature vector is input into a classifier-based access request intelligent audit module to obtain an audit result, and the audit result is used to indicate whether the access request is allowed to continue.

Images