Protection method, device and equipment of car networking service platform and storage medium

Abstract

The invention relates to the technical field of Internet of Vehicles, and discloses a protection method, device and equipment for an Internet of Vehicles service platform and a storage medium, applied to the Internet of Vehicles service platform, the method comprises the following steps: obtaining a processing result output by each security protection layer in the Internet of Vehicles service platform in a preset historical period; calculating a risk measurement index corresponding to the processing result according to a preset evaluation standard, and determining a risk level of the security protection layer associated with each processing result based on the risk measurement index; scheduling a hierarchical sequence of security protection layers in the Internet of Vehicles service platform according to the risk level to obtain a dynamic security protection layer with a hierarchical relationship; and executing corresponding protection operation on the car networking service platform by using the dynamic security protection layer with the hierarchical relationship. According to the invention, the problems of single network security protection level, fixed hierarchical relationship, incomplete security protection strategy, insufficient monitoring alarm capability and lack of pertinence of the Internet of Vehicles information service platform in the prior art are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Vehicles, and in particular to a protection method, device, equipment and storage medium for an Internet of Vehicles service platform. Background Art

[0002] With the rapid development of intelligent connected vehicle (ICV) technology, IoV information service platforms have become an indispensable part of the modern automotive industry. However, with its widespread application, the cybersecurity threats faced by IoV information service platforms are becoming increasingly severe. In recent years, cybersecurity attacks on IoV information service platforms have frequently occurred at home and abroad. These attacks can easily lead to vehicle theft and data leakage, and even cause vehicles to lose control while driving, seriously threatening road traffic safety and user privacy.

[0003] There are many deficiencies in the existing security protection methods for the Internet of Vehicles, mainly manifested in the single protection level, fixed hierarchical relationships, imperfect security protection strategies, insufficient monitoring and warning capabilities, and lack of pertinence. These methods often only focus on a certain level of protection, with simple strategies and lack of ability to respond to complex threats. At the same time, the monitoring and warning mechanism is not sound, making it difficult to detect and respond to security incidents in a timely manner, and the specific needs and characteristics of the Internet of Vehicles information service platform are not fully considered, resulting in poor overall protection effects. Summary of the invention

[0004] In view of this, the embodiments of the present invention provide a protection method, device, equipment and storage medium for the Internet of Vehicles service platform to solve the problems in the prior art of the Internet of Vehicles information service platform such as a single network security protection level, fixed hierarchical relationship, imperfect security protection strategy, insufficient monitoring and alarm capabilities, and lack of specificity.

[0005] In a first aspect, an embodiment of the present invention provides a protection method for an Internet of Vehicles service platform, which is applied to the Internet of Vehicles service platform. The method includes:

[0006] Obtaining the processing results output by each security protection layer in the Internet of Vehicles service platform within a preset historical period;

[0007] Calculate the risk measurement index corresponding to the processing result according to the preset evaluation standard, and determine the risk level of the security protection layer associated with each processing result based on the risk measurement index;

[0008] Scheduling the hierarchical order of the security protection layers in the Internet of Vehicles service platform according to the risk level to obtain a dynamic security protection layer with a hierarchical relationship;

[0009] The hierarchical dynamic security protection layer is used to perform corresponding protection operations on the Internet of Vehicles service platform.

[0010] Further, the calculating the risk measurement index corresponding to the processing result according to the preset evaluation standard, and determining the risk level of the security protection layer associated with each processing result based on the risk measurement index, includes:

[0011] Traverse the risk events in the processing results within a preset historical period to obtain the number of events;

[0012] Identify the risk type of each risk event, and determine the risk value corresponding to the risk event according to the risk type;

[0013] Based on the number of events in the processing results and the risk value corresponding to each risk event, the risk level of the security protection layer associated with each processing result is calculated.

[0014] Furthermore, the using the hierarchical security protection layer to perform corresponding protection operations on the Internet of Vehicles service platform includes:

[0015] Receiving first data traffic sent from an external network to the Internet of Vehicles service platform;

[0016] Inputting the first data flow into the hierarchical dynamic security protection layers in the Internet of Vehicles service platform in sequence, wherein each of the dynamic security protection layers is configured with at least one security protection strategy;

[0017] Based on the dynamic security protection layer, the configured security protection policy is called to process the first data traffic to obtain a processing result;

[0018] A security log is generated according to the processing result, and the security log is uploaded to the monitoring alarm platform.

[0019] Further, if the dynamic security protection layer is a boundary protection layer, the processing of the first data traffic by calling the configured security protection policy based on the dynamic security protection layer to obtain a processing result includes:

[0020] Detecting whether there is a first abnormal flow of a denial of service attack in the first data flow based on the denial of service attack protection strategy configured by the boundary protection layer;

[0021] If the first abnormal traffic exists, the first abnormal traffic in the first data traffic is intercepted, and the first data traffic is restricted from accessing the platform address and the platform resource library through the asset protection policy configured by the boundary protection layer to obtain a first processing result.

[0022] Further, if the dynamic security protection layer is a network protection layer, the processing of the first data traffic by calling the configured security protection policy based on the dynamic security protection layer to obtain a processing result includes:

[0023] Acquire a second data flow transmitted to the network protection layer, wherein the second data flow is obtained after the first data flow is processed by the upper-level dynamic security protection layer;

[0024] Detecting whether there is a virus feature in the second data flow based on the virus protection strategy configured by the network protection layer;

[0025] If the virus feature exists, the second abnormal traffic with the virus feature in the second data traffic is intercepted, and the communication source of the second abnormal traffic is limited based on the access control policy configured by the network protection layer to generate a second processing result.

[0026] Further, if the dynamic security protection layer is an application protection layer, the processing of the first data traffic by calling the configured security protection policy based on the dynamic security protection layer to obtain a processing result includes:

[0027] Acquire a third data flow transmitted to the application protection layer, wherein the third data flow is obtained after the upper-level dynamic security protection layer processes the second data flow;

[0028] Detecting whether there is a third abnormal traffic of application interface call in the third data traffic based on the API protection strategy configured by the application protection layer;

[0029] If the third abnormal traffic exists, the third abnormal traffic is parsed to obtain identity information, and a verification operation is performed on the identity information based on the website protection policy configured by the application protection layer to generate a third processing result.

[0030] Further, if the dynamic security protection layer is a system protection layer, the processing of the first data traffic by calling the configured security protection policy based on the dynamic security protection layer to obtain a processing result includes:

[0031] Acquire a fourth data flow transmitted to the system protection layer, wherein the fourth data flow is obtained after the upper-level dynamic security protection layer processes the third data flow;

[0032] Analyzing the fourth data flow based on the asset management policy configured by the system protection layer to determine whether there is an intrusion in the service operation environment;

[0033] If the intrusion behavior exists, the fourth abnormal traffic containing the intrusion behavior in the fourth data traffic is intercepted, and the configuration information of the service operating environment and the file isolation status are checked based on the collaborative protection strategy configured by the system protection layer to generate a fourth processing result.

[0034] Further, if the dynamic security protection layer is a data protection layer, the processing of the first data traffic by calling the configured security protection policy based on the dynamic security protection layer to obtain a processing result includes:

[0035] Acquire a fifth data flow transmitted to the data protection layer, wherein the fifth data flow is obtained after the fourth data flow is processed by the upper-level dynamic security protection layer;

[0036] Detecting fifth data traffic flowing into the data protection layer based on a transmission encryption policy configured by the data protection layer;

[0037] Determining whether there is a data transmission demand according to the fifth data flow;

[0038] If the data transmission requirement exists, multiple keys are generated based on the storage encryption strategy configured by the data protection layer, and encryption operations are performed on the transmission data of the local server and the local database based on the keys and the transmission requirement to generate the fifth processing result.

[0039] Further, the performing encryption operation on the transmission data of the local server and the local database based on the key and the transmission requirement includes:

[0040] Obtaining a transmission requirement corresponding to the transmission data;

[0041] If the transmission requirement is from a remote terminal to a local server, the second key in the transmission data is verified according to the first key stored in the local server, and after the verification is passed, the transmission data is encrypted using the first encryption strategy to obtain first encrypted data;

[0042] If the transmission requirement is from a remote server to a local server, encrypt the transmission data using a second encryption strategy to obtain second encrypted data;

[0043] If the transmission requirement is from a remote database to a local database, encrypting the transmission data using a third key stored in the local database to obtain third encrypted data;

[0044] If the transmission requirement is to transmit a data file to a local disk, the transmission data is encrypted using a fourth key stored in the key generator to obtain fourth encrypted data.

[0045] In a second aspect, an embodiment of the present invention provides a protection method and device for a vehicle networking service platform, which is applied to the vehicle networking service platform, and the device includes:

[0046] An acquisition module, used to obtain the processing results output by each security protection layer in the Internet of Vehicles service platform within a preset historical period;

[0047] A calculation module, used to calculate the risk measurement index corresponding to the processing result according to a preset evaluation standard, and determine the risk level of the security protection layer associated with each processing result based on the risk measurement index;

[0048] A scheduling module, used to schedule the hierarchical order of the security protection layer in the Internet of Vehicles service platform according to the risk level to obtain a dynamic security protection layer with a hierarchical relationship;

[0049] An execution module is used to use the dynamic security protection layer with a hierarchical relationship to perform corresponding protection operations on the Internet of Vehicles service platform.

[0050] In a third aspect, an embodiment of the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0051] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method of the first aspect or any corresponding embodiment thereof.

[0052] The method provided in the embodiment of the present application has the following beneficial effects:

[0053] The method provided in this application can fully understand the working conditions of each security protection layer of the Internet of Vehicles service platform by obtaining the processing results of each security protection layer within a preset historical period, provide accurate data for risk assessment and protection layer scheduling, and discover potential safety problem trends to take preventive measures. By calculating the risk measurement indicators of the processing results and determining the risk level of the protection layer, the degree of risk can be quantified, the safety situation can be intuitively understood, and safety resources can be allocated accordingly to improve protection efficiency, timely discover high-risk layers and take strict measures to reduce the possibility of accidents. Scheduling the order of protection layers according to risk levels can enable the safety protection system to flexibly adapt to different risks. When risks increase, the order can be adjusted to invest more resources, improve the overall protection effect and optimize resource allocation. Using dynamic security protection layers to perform protection operations, multi-level and three-dimensional protection can be achieved. Different layers are specially protected against different security threats. Processing data traffic in sequence can intercept potential threats and reduce their impact.

[0054] The method provided in the embodiment of the present application traverses the statistical number of risk events in the historical processing results, clarifies the total amount of security risks faced by the platform within a specific period, provides basic data for risk assessment, and understands the stability of the security situation and risk trends. Identifying risk types and determining risk values ​​helps to classify and assess different security risks, measure their severity, and provide specific risk indicators so that corresponding protective measures can be taken. The risk level of the protection layer is calculated based on the number of events and risk values. The risk can be quantified to allow managers to understand the situation, and the protection strategy can be adjusted accordingly to improve the effect, providing a basis for hierarchical sequential scheduling to ensure that high-risk layers are given priority to reduce the possibility of accidents.

[0055] The method provided in the embodiment of the present application realizes comprehensive and multi-level security protection for the Internet of Vehicles information service platform through the multi-layer network security protection method and monitoring and alarm architecture of the Internet of Vehicles, and solves the problems of single protection level, fixed protection layer structure, imperfect security protection strategy, insufficient monitoring and alarm capability and lack of pertinence in the prior art. By inputting the received external network data traffic into the security protection layer with hierarchical relationship in sequence, and calling the security protection strategy configured in each layer for processing, multi-level and three-dimensional security protection for the Internet of Vehicles information service platform is realized, and the network security protection capability of the platform is effectively improved. By generating security logs and uploading the logs to the monitoring and alarm platform, timely discovery and response to network security incidents are realized, the monitoring and alarm capability of the platform is improved, and it is helpful to take countermeasures in time and reduce losses.

[0056] The method provided in the embodiment of the present application can timely detect and intercept abnormal traffic and restrict its access to platform addresses and resource libraries by configuring denial of service attack protection strategies and asset protection strategies at the boundary protection layer, thereby effectively resisting network threats such as denial of service attacks. At the network protection layer, by configuring virus protection strategies and access control strategies, data traffic with virus characteristics can be detected and intercepted, while limiting its communication source, further enhancing the network security protection effect of the platform. At the application protection layer, by configuring API protection strategies and website protection strategies, abnormal traffic called by application interfaces can be detected and processed, and identity information can be verified to ensure the security and stability of the application layer. At the system protection layer, by configuring asset management strategies and collaborative protection strategies, data traffic can be analyzed and determined whether there is intrusion in the service operating environment, abnormal traffic can be intercepted in time, and configuration information and file isolation can be checked, effectively ensuring the security of the system layer. At the data protection layer, by configuring transmission encryption strategies and storage encryption strategies, transmission data can be encrypted to ensure the confidentiality and integrity of data and prevent data leakage and tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 is a flowchart of a protection method for a vehicle networking service platform according to an embodiment of the present invention;

[0059] Figure 2 Schematic diagram of the scheduling structure of the security protection layer of the Internet of Vehicles information service platform according to an embodiment of the present invention

[0060] Figure 3 is a schematic diagram of the protection structure of the security protection layer of the Internet of Vehicles information service platform according to an embodiment of the present invention;

[0061] Figure 4 is a schematic diagram of the structure of internal units of each protection layer of the Internet of Vehicles information service platform according to an embodiment of the present invention;

[0062] Figure 5 is a schematic flow chart of key-related operations of a vehicle networking information service platform according to an embodiment of the present invention;

[0063] Figure 6 is a structural diagram of a monitoring and alarm architecture of a vehicle networking information service platform according to an embodiment of the present invention;

[0064] Figure 7 is a structural block diagram of a protection method and device for a vehicle networking service platform according to an embodiment of the present invention;

[0065] Figure 8 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0067] According to an embodiment of the present invention, a protection method, apparatus, device and storage medium for a vehicle networking service platform are provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0068] In this embodiment, a protection method for an Internet of Vehicles service platform is provided, which is applied to the Internet of Vehicles service platform. Figure 1 is a flow chart of a protection method for a vehicle networking service platform according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0069] Step S11, obtaining the processing results output by each security protection layer in the Internet of Vehicles service platform within a preset historical period.

[0070] In the embodiment of the present application, the results of data processing by each security protection layer of the Internet of Vehicles service platform in the past period of time are collected. These processing results reflect the processing of external network data traffic by each security protection layer in the historical period, including whether abnormal traffic is detected, what protection measures are taken, and the final processing effect. By obtaining these processing results, a data basis can be provided for the subsequent evaluation of the risk level of each security protection layer.

[0071] Step S12, calculating the risk measurement index corresponding to the processing result according to the preset evaluation standard, and determining the risk level of the security protection layer associated with each processing result based on the risk measurement index.

[0072] In the embodiment of the present application, step S12 includes the following steps A1-A3:

[0073] Step A1, traverse the risk events in the processing results within a preset historical period to obtain the number of events.

[0074] Specifically, the processing results of each security protection layer are checked in detail to identify the risk events. For example, in the processing results of the Internet boundary protection layer, risk events may include the number of denial of service attacks detected, the number of abnormal IP accesses, etc.; in the network protection layer, risk events may include the number of virus detections, the number of intrusion events, etc. The number of risk events in the processing results of each security protection layer is counted to provide an important parameter for the subsequent determination of the risk level.

[0075] Step A2: Identify the risk type of each risk event and determine the risk value corresponding to the risk event according to the risk type.

[0076] Specifically, different risk events belong to different risk types. For example, a denial of service attack belongs to a high risk type, while some minor abnormal access belongs to a low risk type. According to pre-set rules, corresponding risk values ​​are assigned to different risk types. High-risk type events are assigned higher risk values, while low-risk type events are assigned lower risk values.

[0077] Step A3, based on the number of events in the processing result and the risk value corresponding to each risk event, calculate the risk level of the security protection layer associated with each processing result.

[0078] Specifically, the number of risk events in the processing results and the risk value of each risk event are comprehensively analyzed to calculate the risk level of each security protection layer. For example, the risk level can be determined by weighted summing the number of risk events and the risk value. The risk level can be divided into multiple levels, such as the first level: high risk, the second level: medium risk, the third level: low risk, etc., to intuitively reflect the degree of security risk faced by each security protection layer.

[0079] Step S13, scheduling the hierarchical order of the security protection layers in the Internet of Vehicles service platform according to the risk level to obtain a dynamic security protection layer with a hierarchical relationship.

[0080] In an embodiment of the present application, the hierarchical order of the security protection layer in the Internet of Vehicles service platform is scheduled according to the risk level to obtain a dynamic security protection layer with a hierarchical relationship. This step is to adjust the hierarchical order of the security protection layer according to the determined risk level. If the risk level of a certain security protection layer is higher, it is necessary to adjust it to a higher level so that it can play a role earlier when processing external network data traffic and strengthen the protection of high-risk areas. By dynamically adjusting the hierarchical order, the security protection system of the Internet of Vehicles service platform can respond to different security risk situations more flexibly, optimize the allocation of security protection resources, and improve the overall security protection efficiency.

[0081] It should be noted that if Figure 2 As shown, the scheduling structure of the security protection layer of the Internet of Vehicles information service platform includes: a monitoring and alarm platform 6, an intelligent analysis unit 7, and an intelligent scheduling unit 8, wherein the monitoring and alarm platform 6 includes a log collection unit 61 and an alarm unit (14, 24, 33, 49, 53). The intelligent analysis unit 7 stores a risk level table 71, which covers the cycle (which can be selected from min, hour, day, mouth), risk type (including DDos, virus, API, vulnerability, file, etc.), risk measurement indicators (risk quantity, cycle, risk value and weight), and risk level (divided into four levels 1, 2, 3, and 4). The intelligent scheduling unit 8 includes a configuration management module 81 and a policy management module 82.

[0082] Step S14, using a dynamic security protection layer with a hierarchical relationship to perform corresponding protection operations on the Internet of Vehicles service platform.

[0083] In the embodiment of the present application, a hierarchical dynamic security protection layer is used to perform corresponding protection operations on the Internet of Vehicles service platform. This step is to apply the adjusted dynamic security protection layer to the actual Internet of Vehicles service platform protection.

[0084] The method provided in this application can fully understand the working conditions of each security protection layer of the Internet of Vehicles service platform by obtaining the processing results of each security protection layer within a preset historical period, provide accurate data for risk assessment and protection layer scheduling, and discover potential safety problem trends to take preventive measures. By calculating the risk measurement indicators of the processing results and determining the risk level of the protection layer, the degree of risk can be quantified, the safety situation can be intuitively understood, and safety resources can be allocated accordingly to improve protection efficiency, timely discover high-risk layers and take strict measures to reduce the possibility of accidents. Scheduling the order of protection layers according to risk levels can enable the safety protection system to flexibly adapt to different risks. When risks increase, the order can be adjusted to invest more resources, improve the overall protection effect and optimize resource allocation. Using dynamic security protection layers to perform protection operations, multi-level and three-dimensional protection can be achieved. Different layers are specially protected against different security threats. Processing data traffic in sequence can intercept potential threats and reduce their impact.

[0085] In the embodiment of the present application, step S14 includes the following steps S21-S24:

[0086] Step S21, receiving the first data flow sent from the external network to the Internet of Vehicles service platform.

[0087] In the embodiment of the present application, the Internet of Vehicles service platform receives the first data flow sent from the external network, where the external network can include multiple sources, such as networking devices of other vehicles, traffic management systems, various Internet of Things devices, etc. This data flow is the object of subsequent security protection processing. After receiving the data flow, it will enter the subsequent security protection processing process, that is, it will be input into the hierarchical dynamic security protection layer in the Internet of Vehicles service platform for processing.

[0088] Step S22: input the first data traffic into the hierarchical dynamic security protection layers in the Internet of Vehicles service platform in sequence, wherein each dynamic security protection layer is configured with at least one security protection strategy.

[0089] As an example, Figure 3As shown, the protection structure of the dynamic security protection layer includes five levels, from high to low, namely boundary protection layer 1, network protection layer 2, application protection layer 3, system protection layer 4 and data protection layer 5. For each dynamic security protection layer, a corresponding preset security protection strategy is selected, wherein each security protection strategy corresponds to a different security defense technology, which is used to realize the network security protection of the Internet of Vehicles information platform. Specifically, the Internet boundary protection layer adopts DDos protection and bastion host technology; the network protection layer adopts firewall technology; the application protection layer adopts web application firewall and API gateway technology; the system firewall adopts host security and container security technology; the data protection layer adopts data transmission encryption and data storage encryption technology.

[0090] Step S23: Based on the dynamic security protection layer, the configured security protection policy is called to process the first data traffic to obtain a processing result.

[0091] As an example, Figure 4 As shown, the boundary protection layer 1 includes: a denial of service attack protection unit 11, an asset protection unit 12, a permission management unit 13 and a first monitoring and alarm unit 14; the network protection layer 2 includes: an intrusion protection unit 21, a virus protection unit 22, an access control unit 23 and a second monitoring and alarm unit 24; the application protection layer 3 includes: a website protection unit 31, an API protection unit 32 and a third monitoring and alarm unit 33; the system protection unit 4 includes: an asset management unit 41, a container protection unit 42, a vulnerability management unit 43, a baseline check unit 44, an intrusion detection unit 45, a virus protection unit 46, a file protection unit 47, an authentication protection unit 48 and a fourth monitoring and alarm unit 49; the data protection unit 5 includes: a transmission encryption unit 51, a storage encryption unit 52 and a fifth monitoring and alarm unit 53.

[0092] In an embodiment of the present application, when the first data flow enters each dynamic security protection layer in turn, each layer processes the data flow according to a pre-configured strategy. For example, in the Internet boundary protection layer 1, the denial of service attack protection unit 11 prevents DDos attacks, the asset protection unit 12 protects the platform IP, the authority management unit 13 manages user authority, and the first monitoring alarm unit 14 collects and analyzes the uploaded security logs, and then the data flow enters the network protection layer 2. In the network protection layer 2, the intrusion protection unit 21 performs intrusion detection and protection, the virus protection unit 22 detects and handles viruses, the access control unit 23 performs access control, and the second monitoring alarm unit 24 collects and analyzes the uploaded security logs. The data flow then passes through the application protection layer 3, the system protection layer 4, and the data protection layer 5 in turn, and each layer is processed according to the corresponding strategy to finally obtain the processing result. In this way, the external network data flow can be comprehensively and multi-level protected, network attacks can be prevented, and the security of the Internet of Vehicles service platform can be improved.

[0093] In the embodiment of the present application, if the dynamic security protection layer is a boundary protection layer, step S23 includes the following steps B1-B2:

[0094] Step B1: Detect whether there is a first abnormal flow of a denial of service attack in the first data flow based on the denial of service attack protection strategy configured by the boundary protection layer.

[0095] Specifically, first, the denial of service attack protection unit 11 of the boundary protection layer can use a specific algorithm and mechanism to monitor the first data flow. The algorithm can be judged based on the flow characteristics, such as the distribution of the source IP address of the flow. Under normal circumstances, the source IP of the traffic of the Internet of Vehicles platform is scattered. A large number of traffic requests from the same or a few IPs in a short period of time are signs of DDos attacks (such as SYNFlood attacks, where attackers send a large number of forged TCP connection requests to exhaust server resources). Secondly, monitor the flow rate. The normal network flow rate fluctuates within a reasonable range. If it suddenly rises sharply and far exceeds the normal business needs, there is a risk of denial of service attacks, such as UDPFlood attacks. The attacker sends a large number of UDP data packets to occupy the network bandwidth, making the service unable to respond to normal requests normally. In addition, analyze the content of the data packet. Some data packets of denial of service attacks have specific patterns or abnormal structures, such as malicious instructions or abnormal protocol headers. The denial of service attack protection unit 11 searches for these abnormal content patterns by deeply parsing the data packet. Finally, the source IP address distribution, flow rate, data packet content and other factors of the first data flow are comprehensively considered to determine whether there is abnormal flow of denial of service attacks. If so, the relevant protection measures of the boundary protection layer are triggered to ensure the security of the Internet of Vehicles service platform.

[0096] Step B2: if there is a first abnormal flow, intercept the first abnormal flow in the first data flow, and restrict the first data flow from accessing the platform address and the platform resource library through the asset protection policy configured by the boundary protection layer to obtain a first processing result.

[0097] Specifically, first, after the denial of service attack protection unit 11 detects the first abnormal traffic, it intercepts it according to the detection feature information. If abnormal traffic (such as a large amount of traffic from malicious IP) is identified according to the IP address distribution, a rule is set at the network entrance to prevent it from entering the platform; if abnormal traffic (such as containing malicious instructions or abnormal protocol headers) is found through data packet content analysis, it is determined and intercepted according to the TCP / IP protocol rules.

[0098] Secondly, the asset protection unit 12 in the border protection layer maintains a list of legal IP addresses. When the first data flow enters, it checks whether the source IP is in the list. If not, the platform address is denied access and only the IP of the authorized device can access it. In addition, for domain name access, the asset protection unit 12 monitors and restricts the domain name resolution process, only processing legal requests, and preventing tampering with the resolution results to direct traffic to malicious places.

[0099] Finally, the authority control unit 13 verifies the user authority of the first data flow accessing the platform resource library (such as servers, storage, databases and other resources). Only the flow initiated by users with corresponding authority after identity authentication and authorization mechanism authentication is allowed to access specific resources. For example, ordinary users can only access some public resource information, while administrators with advanced authority can access and operate more sensitive resources. The asset protection unit 12 can also set access rules according to resource type and importance. For example, database resources have stricter restrictions (limiting access frequency, time, etc.), and the flow that does not meet the rules will be denied access to the platform resource library.

[0100] Through the above operations of intercepting the first abnormal traffic and restricting the first data traffic from accessing the platform address and the platform resource library, a first processing result is obtained. This result will be used as a part of the subsequent dynamic security protection layer processing or as a part of the overall security protection processing result, thereby ensuring the security of the Internet of Vehicles service platform.

[0101] In the embodiment of the present application, if the dynamic security protection layer is a network protection layer, step S23 includes the following steps C1-C3:

[0102] Step C1, obtaining the second data flow transmitted to the network protection layer, wherein the second data flow is obtained after the upper-level dynamic security protection layer processes the first data flow.

[0103] Specifically, in the Internet of Vehicles security protection system, when the dynamic security protection layer is a network protection layer, it will receive the traffic processed by the previous layer. The second data traffic is obtained after the first-level dynamic security protection layer processes the first data traffic (the traffic sent from the external network to the Internet of Vehicles platform). After the previous-level dynamic security protection layer processes the first data traffic through multiple units, it transmits the processed traffic to the network protection layer for further detection and protection.

[0104] Step C2: Detect whether there are virus features in the second data flow based on the virus protection strategy configured by the network protection layer.

[0105] Specifically, first, the virus protection unit 22 of the network protection layer detects with a virus feature library containing known virus feature information such as specific code segments, file structure patterns, and data byte sequences. When the second data flow enters, the unit scans the data packet content. For file type data, the virus protection unit 22 checks its header, metadata, and key content to see if it matches the file virus feature, such as checking whether there is a known malicious pattern at a specific offset position of the executable file. For the network flow data part, the network protocol is parsed to check whether the data payload contains network virus-related features, such as checking whether a specific field of the network data packet contains malicious content.

[0106] Secondly, the virus protection unit 22 uses a heuristic detection algorithm based on the general behavior pattern of viruses, such as frequent connection to malicious servers or abnormal reading and writing of system files when some viruses infect or spread. If there is data in the second data flow that matches these malicious behavior patterns, even if it does not completely match the specific features of the virus feature library, it is considered to have virus features. Virus features in the second data flow are detected through virus feature library matching checks and heuristic detection algorithms.

[0107] Step C3: if there are virus features, intercept the second abnormal traffic with virus features in the second data traffic, and limit the communication source of the second abnormal traffic based on the access control policy configured by the network protection layer to generate a second processing result.

[0108] Specifically, first, after the virus feature is detected in the second data flow and the second abnormal flow is determined, the virus protection unit 22 marks the data packet with the virus feature (based on the virus type or the general "danger" mark). Then, the intrusion protection unit 21 of the network protection layer sets a checkpoint at the network flow entrance or key node according to the mark, and blocks the transmission of the marked data packet when it is found, thereby intercepting the second abnormal flow.

[0109] In addition to tag interception, for complex or new virus features, when simple tags are difficult to accurately identify, the intrusion prevention unit 21 will perform deep packet detection of suspected second abnormal traffic. It deeply analyzes the content of the data packet, including the structure, flow direction and association with other packets. For example, some viruses disperse malicious codes in multiple packets and execute them in a special combination. After identifying this combination pattern, the intrusion prevention unit 21 intercepts the relevant data packets to prevent them from spreading in the Internet of Vehicles platform network.

[0110] Secondly, the access control unit 23 first checks the communication source IP address of the second abnormal traffic in the access control strategy. If an IP address is determined as the source and is not in the trusted IP list, its further communication request is rejected. For example, if an IP (XXXX) is the source of the second abnormal traffic, all data packets from the IP are blocked from entering the Internet of Vehicles platform in the firewall rules.

[0111] In addition, the access control unit 23 also checks the network protocol and port number of the second abnormal traffic. If a specific malicious protocol or a banned port (such as port 21 used for malicious attacks, i.e., FTP port, which is often used for malicious attacks) is used for communication, the communication of the relevant protocol and port is prohibited in the access control rules to limit the communication path.

[0112] Through the above operations of intercepting the second abnormal traffic and limiting its communication source, a second processing result is generated. This result will be used as a part of the subsequent dynamic security protection layer processing or as a part of the overall security protection processing result, so as to ensure the security of the Internet of Vehicles information service platform.

[0113] In the embodiment of the present application, if the dynamic security protection layer is an application protection layer, step S23 includes the following steps D1-D3:

[0114] Step D1, obtaining the third data flow transmitted to the application protection layer, wherein the third data flow is obtained after the upper-level dynamic security protection layer processes the second data flow.

[0115] Specifically, in the Internet of Vehicles security protection system, when the dynamic security protection layer is the application protection layer, it will receive the traffic processed by the previous layer. The third data traffic is obtained after the previous layer processes the second data traffic (the traffic processed by the second protection layer starting from the first protection layer). After the previous layer processes the second data traffic through multiple units, the processed traffic is transmitted to the application protection layer for further detection and protection.

[0116] Step D2, the API protection strategy configured by the base application protection layer detects whether there is a third abnormal traffic of application interface calls in the third data traffic.

[0117] Specifically, first, the API protection unit 32 in the application protection layer first, the API protection unit 32 establishes a legal API call specification model, including API name, parameter type, quantity, call frequency, order and other features. When the third data flow enters, the API protection unit 32 parses the API call part and checks whether it meets the model parameter characteristics. The API name is not in the legal list, the parameter type does not match or the quantity does not match (such as two integer parameters, but actually a string and an integer parameter or only one parameter) are all determined as the third abnormal flow. Secondly, the API call frequency is detected. If the API is called at an abnormal frequency in a short period of time, even if the name and parameters are correct, it is confirmed as a malicious attack (such as brute force or abnormal data acquisition), and it will be determined that there is a third abnormal flow. For example, the normal vehicle location query API is called once every few minutes, and if it is called dozens of times within one second, it is abnormal. Through the above comparative analysis of the API call name, parameter type, quantity and call frequency and other factors with the legal API call specification model, it is detected whether there is a third abnormal flow of application interface calls in the third data flow.

[0118] Step D3, if there is a third abnormal traffic, the third abnormal traffic is parsed to obtain identity information, and a verification operation is performed on the identity information based on the website protection policy configured by the application protection layer to generate a third processing result.

[0119] Specifically, after determining the third abnormal traffic, first, the API protection unit 32 parses the third abnormal traffic according to the protocol (such as HTTP, custom protocol, etc.). The HTTP protocol parses the request header to find identity information (such as the "Authorization" field), and the custom protocol finds the relevant part according to the format. Next, extract the key identity information (such as the request header identity, the account ID in the request body, the device number, etc.) from the parsed data, and analyze whether the information format complies with the platform regulations. In addition, mining related information includes analyzing the association between the IP address of the traffic source and the user / device, considering time and operation sequence related information (such as different IP addresses in a short period of time and the identity identifier is changeable but the operation is similar), so as to obtain more accurate identity information. Through the above protocol parsing, data extraction and analysis, and related information mining operations, more accurate identity information is obtained.

[0120] Secondly, the website protection unit 31 verifies the identity information according to the identity authentication rules of the website protection strategy of the network protection layer. First check whether it is in the legal identity list (the Internet of Vehicles platform stores a database of relevant identifications). If not, it will be initially rejected; the authority part is matched according to the rules, and the API call identity will not be passed if the operation exceeds the authority range. In addition to static verification, there is also dynamic verification, including: sending a verification code to the relevant device, and failure if the correct verification code is not received within the specified time; stricter verification (requiring more proof or inspection) when the device behavior is abnormal (such as questionable API calls during dormancy). The website protection unit 31 associates the identity information with other security information for verification, and associates it with the IP access history of the network protection layer. If the identity corresponds to a large number of abnormal accesses in a short period of time, the IP will not be passed; it is associated with the security status and vulnerabilities of the system protection layer equipment. If the equipment has vulnerabilities that affect the results, it needs to be repaired or measures are taken before it is allowed to pass.

[0121] Through the above verification operation, a third processing result is generated, which will be used as a part of the subsequent other dynamic security protection layer processing or as a part of the overall security protection processing result, so as to ensure the security of the Internet of Vehicles information service platform.

[0122] In the embodiment of the present application, if the dynamic security protection layer is a system protection layer, step S23 includes the following steps E1-E3:

[0123] Step E1, obtaining the fourth data flow transmitted to the system protection layer, wherein the fourth data flow is obtained after the upper-level dynamic security protection layer processes the third data flow.

[0124] Specifically, in the Internet of Vehicles security protection system, when the dynamic security protection layer is the system protection layer, it will receive the traffic processed by the previous layer. The fourth data traffic is obtained after the previous layer processes the third data traffic (starting from the first protection layer, and then passing through the second protection layer and the third protection layer in sequence). After the previous layer processes the third data traffic through multiple units, the processed traffic is transmitted to the system protection layer for further detection and protection.

[0125] Step E2, analyzing the fourth data flow based on the asset management policy configured by the system protection layer to determine whether there is any intrusion in the service operation environment.

[0126] Specifically, the asset management unit 41 sorts out the fourth data flow information and establishes an association mapping with the service operation environment assets (servers, containers, etc.) (identifying IP addresses, container identifiers and corresponding registered assets). The vulnerability management unit 43 detects the fourth data flow according to the vulnerability knowledge base, checks whether the application interaction or system call information matches the vulnerability characteristics, and application calls containing specific versions with vulnerabilities (such as SQL injection vulnerabilities) are at risk of intrusion. The intrusion detection unit 45 monitors the fourth data flow behavior pattern (source, destination, flow frequency, operation type, etc.). Under normal circumstances, the data flow is regular (the communication frequency of specific services is stable, and the operation type is predictable such as query and update operations). If there is an abnormal pattern (unknown sources send a large number of suspicious write operations to key servers), there is an intrusion behavior. The baseline inspection unit 44 compares the fourth data flow system configuration information with the security baseline (such as port opening, user permission settings). If it does not match (the port should not be opened for interaction or low-privilege users perform high-privilege operations), it indicates that there is an intrusion behavior.

[0127] Through the above-mentioned asset management unit, vulnerability management unit, intrusion detection unit and baseline inspection unit and other aspects of detection and analysis, a comprehensive judgment is made as to whether there is intrusion in the service operation environment.

[0128] Step E3, if there is intrusion, intercept the fourth abnormal traffic with intrusion in the fourth data traffic, and check the configuration information of the service operating environment and the file isolation status based on the collaborative protection strategy configured by the system protection layer to generate a fourth processing result.

[0129] Specifically, first, after determining that there is an intrusion in the service operation environment, the intrusion detection unit 45 marks the fourth abnormal traffic according to the intrusion type (such as malware intrusion is marked as "malware-related abnormal traffic"). The container protection unit 42 sets checkpoints at the network traffic entrance and interaction key nodes of the container cluster, and the file protection unit 47 sets checkpoints at the key access path of the server file system, and the two mark and identify the fourth abnormal traffic based on this. After identifying the fourth abnormal traffic, the container protection unit 42 intercepts illegal traffic inside and outside the container cluster (such as cutting off the transmission channel when a malicious program sends abnormal data from the invaded container), and the file protection unit 47 prevents the fourth abnormal traffic from illegally accessing important files (system configuration, user data files, etc.) of the server (such as malicious read, modification, and deletion requests), and intercepts the fourth abnormal traffic to avoid damaging files in the service operation environment.

[0130] Secondly, the container protection unit 42 checks the isolation of files in the container. In the Internet of Vehicles environment, containers are used to isolate applications or services. Files in the container should be well isolated to prevent illegal interactions. It will check whether the file sharing settings between containers are compliant and whether there are abnormal sharing channels (such as channels where two isolated containers can access files from each other, which is a hidden danger). The file protection unit 47 checks the isolation of server files, especially files used by different users or services, and checks whether system and user files are properly isolated to prevent malicious programs from accessing key files through vulnerabilities. It also checks the file access permission settings. If the permissions are illegally expanded (such as ordinary users have system file write permissions), it means that there is a problem with file isolation and there is a security risk.

[0131] Through the above operations of intercepting the fourth abnormal traffic and checking the configuration information of the service operating environment and the file isolation status, a fourth processing result is generated. This result will be used as a part of the subsequent dynamic security protection layer processing or as a part of the overall security protection processing result, thereby ensuring the security of the Internet of Vehicles information service platform.

[0132] In the embodiment of the present application, if the dynamic security protection layer is a data protection layer, step S23 includes F1-F4:

[0133] Step F1, obtain the fifth data flow transmitted to the data protection layer, wherein the fifth data flow is obtained after the upper-level dynamic security protection layer processes the fourth data flow.

[0134] Specifically, in the Internet of Vehicles security protection system, when the dynamic security protection layer is a data protection layer, it will receive the traffic processed by the previous layer. The fifth data traffic is obtained after the previous layer processes the fourth data traffic (starting from the first protection layer, and passing through the second protection layer, the third protection layer, and the fourth protection layer in sequence). After the previous layer processes the fourth data traffic through multiple units, the processed traffic is transmitted to the data protection layer for further detection and protection.

[0135] Step F2, detecting the fifth data flow flowing into the data protection layer based on the transmission encryption policy configured by the data protection layer.

[0136] Specifically, first, the transmission encryption unit 51 checks the source identifier of the fifth data flow (including the sender address, network area, device type, etc.). Different sources correspond to different security and encryption requirements (strict detection of external untrusted devices, relatively loose detection of internal specific devices). Then, analyze the data format and protocol type (such as JSON, XML format, HTTP, MQTT protocol), and different encryption detection methods are required (HTTP checks the specific fields of the request header, and JSON checks the key information of the data structure). Next, verify the encryption mark or metadata, and check its legality according to the requirements of the transmission encryption policy. Missing or incorrect format indicates that there is a problem or risk in the transmission. In addition, according to the sampling rules, a portion of the fifth data flow is sampled and decrypted for detection (in a safe environment) to check whether the decrypted data meets the expected format and content requirements (such as whether the vehicle status information is reasonable and complete). If there is an abnormality, the entire flow has security issues and needs to be processed or intercepted.

[0137] Through the above-mentioned detection of the source identification, data format and protocol type, encryption mark or encryption metadata and partial data sampling decryption detection of the fifth data flow, the detection of the fifth data flow flowing into the data protection layer is achieved based on the transmission encryption strategy configured by the data protection layer.

[0138] Step F3: determining whether there is a data transmission demand according to the fifth data flow.

[0139] Specifically, first, the data protection layer related unit (transmission encryption unit 51 or storage encryption unit 52) ​​parses the fifth data flow packet header information, in which the identifier or instruction is associated with the data transmission demand. For example, a specific field in the packet header shows the data transmission destination (local server storage or forwarding, etc.). If there is an identifier indicating that it is sent from a remote terminal to a local server storage, it can be preliminarily determined that there is such a transmission demand direction.

[0140] Next, the data content characteristics of the fifth data flow are analyzed, and different data contents are related to specific transmission requirements. If the data is real-time status information of the vehicle and the format conforms to the local database storage specification, it can be inferred that there is a transmission requirement to the local database; if it contains specific service call request information of the local server, there is a transmission requirement to the local server.

[0141] Then, check whether the fifth data flow matches the predefined business logic rules. The Internet of Vehicles platform has business logic rules that specify different data transmission conditions and target locations. For example, if the vehicle diagnostic data meets certain conditions (faults or scheduled maintenance) and needs to be transmitted to the local server, if the data in the fifth data flow meets the requirements, it is determined that there is a need to transmit to the local server.

[0142] In addition, the source and destination information of the fifth data flow is considered. If the source is a remote terminal (such as a vehicle-mounted terminal) and the destination is a local server or database (identified by an IP address, etc.), it is an important basis for judging whether there is a transmission demand; if the source is a remote server, etc. and the destination is a local server or database and the data content meets the local receiving and processing requirements, it can also be determined that there is a transmission demand.

[0143] Through the above analysis of the packet header information, data content characteristics, matching with business logic rules, source and destination information of the fifth data flow, it is determined whether there is a data transmission demand.

[0144] Step F4, if there is a data transmission requirement, multiple keys are generated based on the storage encryption strategy configured by the data protection layer, and encryption operations are performed on the transmission data of the local server and the local database based on the keys and transmission requirements to generate the fifth processing result.

[0145] As an example, Figure 5 As shown, the key generator generates multiple keys, such as key-0, key-1, key-2, key-3, and key-n. Subsequently, the keys are transmitted to the key manager. The key manager sends key-0 to the server and key-1 to the remote terminal. When data is transmitted between the server and the remote terminal, the SSH algorithm is used to encrypt the data, and the matching between key-0 and key-1 is used to perform the verification operation. In addition, when data is transmitted between servers, the AEAD algorithm is used for encryption. In addition, the key manager will also send key-2 to the data encryptor. When the data encryptor obtains the data file, it will use key-2 to write the data file to storage disk 1, storage disk 2, and storage disk n. The key manager sends key-3 to the database, so that when data encryption is transmitted between databases, the AEAD algorithm and key-3 can be used to achieve it.

[0146] In an embodiment of the present application, an encryption operation is performed on the transmission data of the local server and the local database based on the key and the transmission requirements, including the following steps F41-F45:

[0147] Step F41, obtaining the transmission requirement corresponding to the transmission data.

[0148] Specifically, the relevant units of the data protection layer check the transmission data packet header or specific field identifier (such as the Internet of Vehicles vehicle status data packet header identifier indicating the destination), analyze the content structure (vehicle status data organized according to the local database storage structure is stored there, and data containing the local server service call request structure is transmitted to the local server), check the match with the predefined template (match determines the transmission requirement, such as vehicle fault diagnosis data matching template determines the transmission direction), consider the source and destination metadata (such as the source is the vehicle sensor, the destination is the local database, the storage requirement can be inferred, etc.), and obtain the transmission requirement through multi-faceted analysis.

[0149] Step F42, if the transmission requirement is from a remote terminal to a local server, the second key in the transmission data is verified according to the first key stored in the local server. After the verification is passed, the transmission data is encrypted using the first encryption strategy to obtain first encrypted data.

[0150] Specifically, the local server stores a pre-configured first key. After receiving the data transmitted by the remote terminal, the second key is extracted according to its specific format regulations. The data protection layer encryption verification module compares and verifies the two, which can be done through hash value comparison (preliminary match if the hash values ​​are the same) or public key-private key pair verification mechanism (through private key verification based on the local server public key). After the verification is passed, the transmission data is encrypted according to the first encryption strategy pre-set for the transmission scenario (based on symmetric encryption algorithms such as the AES algorithm, or asymmetric encryption algorithms such as the RSA algorithm, and includes encryption modes such as CBC mode, padding methods and other parameters).

[0151] The specific encryption process includes: the encryption unit (such as the transmission encryption unit 51 in the data protection layer) performs bit-by-bit or block-by-block encryption operations on the valid data part of the transmission data (excluding the header or tag part that has been used for key verification, etc.) according to the provisions of the first encryption strategy. For example, if the CBC mode of the AES algorithm is used, the transmission data is divided into blocks according to the specified block size, and then each block of data is encrypted according to the initial vector (IV) and the first key, and finally the encrypted first encrypted data is obtained.

[0152] Step F43: If the transmission requirement is from a remote server to a local server, the transmission data is encrypted using a second encryption strategy to obtain second encrypted data.

[0153] Specifically, the second encryption strategy is customized for transmission from a remote server to a local server, and includes a specific algorithm (such as the AES-GCM algorithm) and related parameters (determined by multiple factors of the Internet of Vehicles platform). Valid data is obtained according to the transmission data format (the message header, tail, and checksum are removed when the specific message encapsulation format is used). Taking the AES-GCM algorithm as an example, IV is generated in a predetermined manner (randomly or based on system parameters), and the valid data is encrypted block by block using the pre-stored key and IV (each block is calculated with the result of the previous block and IV) to ensure security and integrity. The encryption result is encapsulated and marked as the second encrypted data containing auxiliary information such as valid data, algorithm identifier, and IV (for decryption at the receiving end), and subsequent operations are performed according to the platform process.

[0154] Step F44: if the transmission requirement is from a remote database to a local database, the transmission data is encrypted using the third key stored in the local database to obtain third encrypted data.

[0155] Specifically, the local database stores the third key in a secure manner (such as encrypted storage or based on HSM). Determine and extract the main part of the data (excluding the data header and the checksum part) according to the transmission data format protocol. Use the third key to encrypt the main part according to the encryption algorithm applicable to databases (such as AES and related modes. Taking the CBC mode of AES as an example, IV needs to be generated according to the rules. When encrypting, each block of data is calculated with the result of the previous block and IV). The encryption result is recombined or encapsulated into the third encrypted data containing the main encryption result, algorithm identification, IV and other auxiliary information, so as to facilitate subsequent operations according to the platform process.

[0156] Step F45, if the transmission requirement is to transfer a data file to a local disk, the transmission data is encrypted using the fourth key stored in the key generator to obtain fourth encrypted data.

[0157] Specifically, first, obtain the pre-stored fourth key from the key generator, wherein the key generator is used to generate multiple keys, and the fourth key has been generated and securely stored. Determine the encrypted part according to the format structure of the transmission data (the data file contains a file header, a main body, and a file tail, and the main body is usually encrypted). Use the fourth key to encrypt the main body of the file using a symmetric encryption algorithm (taking the AES algorithm as an example): if the AES-CBC mode is used, first randomly determine the initial vector, divide the main body of the file into 128-bit blocks, and perform a specific operation (such as an exclusive OR operation) on each block with the previous block result and the initial vector. Recombine or encapsulate the encrypted main body with the original file header and file tail into the fourth encrypted data containing auxiliary information such as the encrypted main body, the original file header, file tail, the encryption algorithm identifier (such as AES-CBC) and the initial vector (for decryption by the receiving end), so as to be transmitted to the local disk or stored in a specific location.

[0158] Step S24, generating a security log according to the processing result, and uploading the security log to the monitoring alarm platform.

[0159] In the embodiments of the present application, Figure 6 As shown in the figure, the monitoring and alarm architecture of the Internet of Vehicles information service platform is mainly composed of a monitoring and alarm platform and five monitoring and alarm units, wherein each monitoring and alarm unit is located in each dynamic security protection layer and connected to a unified monitoring and alarm platform. The first monitoring and alarm unit is located in the boundary protection layer, the second monitoring and alarm unit is located in the network protection layer, the third monitoring and alarm unit is located in the application protection layer, the fourth monitoring and alarm unit is located in the system protection layer, and the fifth monitoring and alarm unit is located in the data protection layer.

[0160] Specifically, in the security protection system of the Internet of Vehicles information service platform, each layer will generate corresponding security processing results after executing security operations. For example, the denial of service attack protection unit 11 in the boundary protection layer 1 will record the defense situation, attack source and scale of DDos attacks; the asset protection unit 12 records the IP threat status and protection effect; and the authority control unit 13 records user authority operations. This information is summarized into a security log, which records the execution status of each protection unit in detail.

[0161] Subsequently, the monitoring and alarm units of each dynamic security protection layer are responsible for uploading these security logs to the monitoring and alarm platform. Specifically, the monitoring and alarm unit 14 of the boundary protection layer 1 collects and uploads the logs of each unit; similarly, the monitoring and alarm unit 24 of the network protection layer 2, the monitoring and alarm unit 33 of the application protection layer 3, the monitoring and alarm unit 49 of the system protection layer 4, and the monitoring and alarm unit 53 of the data protection layer 5 all perform the same operation. In this way, the monitoring and alarm platform can centrally obtain the security logs of each layer and conduct comprehensive analysis, monitoring and alarm on the overall security of the Internet of Vehicles information service platform.

[0162] The method provided in the embodiment of the present application realizes comprehensive and multi-level security protection for the Internet of Vehicles information service platform through the multi-layer network security protection method and monitoring and alarm architecture of the Internet of Vehicles, and solves the problems of single protection level, fixed protection layer structure, imperfect security protection strategy, insufficient monitoring and alarm capability and lack of pertinence in the prior art. By inputting the received external network data traffic into the security protection layer with hierarchical relationship in sequence, and calling the security protection strategy configured in each layer for processing, multi-level and three-dimensional security protection for the Internet of Vehicles information service platform is realized, and the network security protection capability of the platform is effectively improved. By generating security logs and uploading the logs to the monitoring and alarm platform, timely discovery and response to network security incidents are realized, the monitoring and alarm capability of the platform is improved, and it is helpful to take countermeasures in time and reduce losses.

[0163] In this embodiment, a protection method device for a vehicle networking service platform is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0164] This embodiment provides a protection method and device for a vehicle networking service platform, which is applied to a vehicle networking service platform, such as Figure 7 As shown, including:

[0165] The acquisition module 701 is used to obtain the processing results output by each security protection layer in the Internet of Vehicles service platform within a preset historical period;

[0166] A calculation module 702 is used to calculate the risk measurement index corresponding to the processing result according to the preset evaluation standard, and determine the risk level of the security protection layer associated with each processing result based on the risk measurement index;

[0167] The scheduling module 703 is used to schedule the hierarchical order of the security protection layer in the Internet of Vehicles service platform according to the risk level to obtain a dynamic security protection layer with a hierarchical relationship;

[0168] The execution module 704 is used to perform corresponding protection operations on the Internet of Vehicles service platform using a dynamic security protection layer with a hierarchical relationship.

[0169] In an optional implementation of the present application, the calculation module 702 is used to traverse the risk events in the processing results within a preset historical period to obtain the number of events; identify the risk type of each risk event, and determine the risk value corresponding to the risk event according to the risk type; based on the number of events in the processing results and the risk value corresponding to each risk event, calculate the risk level of the security protection layer associated with each processing result.

[0170] In an optional implementation of the present application, the execution module 704 includes: a receiving submodule, an input submodule, a processing submodule and a generating submodule, specifically:

[0171] A receiving submodule, used for receiving a first data flow sent from an external network to the Internet of Vehicles service platform;

[0172] An input submodule, used for sequentially inputting the first data flow into the dynamic security protection layers with hierarchical relationships in the Internet of Vehicles service platform, wherein each dynamic security protection layer is configured with at least one security protection strategy;

[0173] A processing submodule, configured to process the first data flow based on the security protection policy configured by the dynamic security protection layer call to obtain a processing result;

[0174] The generation submodule is used to generate security logs according to the processing results and upload the security logs to the monitoring and alarm platform.

[0175] In an optional embodiment of the present application, the processing submodule is used to detect whether there is a first abnormal traffic of a denial of service attack in the first data traffic based on the denial of service attack protection strategy configured by the boundary protection layer if the dynamic security protection layer is a boundary protection layer; if the first abnormal traffic exists, intercept the first abnormal traffic in the first data traffic, and restrict the first data traffic from accessing the platform address and the platform resource library through the asset protection strategy configured by the boundary protection layer, so as to obtain a first processing result.

[0176] In an optional embodiment of the present application, a processing submodule is used to obtain a second data flow transmitted to the network protection layer if the dynamic security protection layer is a network protection layer, wherein the second data flow is obtained after the first data flow is processed by the upper-level dynamic security protection layer; detect whether there is a virus feature in the second data flow based on the virus protection strategy configured by the network protection layer; if there is a virus feature, intercept the second abnormal flow with the virus feature in the second data flow, and limit the communication source of the second abnormal flow based on the access control policy configured by the network protection layer, to generate a second processing result.

[0177] In an optional embodiment of the present application, the processing submodule is used to obtain a third data flow transmitted to the application protection layer if the dynamic security protection layer is an application protection layer, wherein the third data flow is obtained after the second data flow is processed by the upper-level dynamic security protection layer; based on the API protection policy configured by the application protection layer, detect whether there is a third abnormal flow of application interface calls in the third data flow; if there is a third abnormal flow, parse the third abnormal flow to obtain identity information, and perform verification operations on the identity information based on the website protection policy configured by the application protection layer to generate a third processing result.

[0178] In an optional embodiment of the present application, a processing submodule is used to obtain a fourth data flow transmitted to the system protection layer if the dynamic security protection layer is a system protection layer, wherein the fourth data flow is obtained after the upper-level dynamic security protection layer processes the third data flow; analyze the fourth data flow based on the asset management policy configured by the system protection layer to determine whether there is an intrusion in the service operating environment; if there is an intrusion, intercept the fourth abnormal flow containing the intrusion in the fourth data flow, and check the configuration information and file isolation status of the service operating environment based on the collaborative protection strategy configured by the system protection layer to generate a fourth processing result.

[0179] In an optional embodiment of the present application, a processing submodule is used to obtain a fifth data flow transmitted to the data protection layer if the dynamic security protection layer is a data protection layer, wherein the fifth data flow is obtained after the fourth data flow is processed by the upper-level dynamic security protection layer; detect the fifth data flow flowing into the data protection layer based on the transmission encryption policy configured by the data protection layer; determine whether there is a data transmission demand based on the fifth data flow; if there is a data transmission demand, generate multiple keys based on the storage encryption policy configured by the data protection layer, and perform encryption operations on the transmission data of the local server and the local database based on the keys and the transmission demand to generate a fifth processing result.

[0180] In an optional embodiment of the present application, a processing submodule is used to obtain a transmission requirement corresponding to the transmission data; if the transmission requirement is from a remote terminal to a local server, the second key in the transmission data is verified according to the first key stored in the local server, and after the verification is passed, the transmission data is encrypted using the first encryption strategy to obtain the first encrypted data; if the transmission requirement is from a remote server to a local server, the transmission data is encrypted using the second encryption strategy to obtain the second encrypted data; if the transmission requirement is from a remote database to a local database, the transmission data is encrypted using the third key stored in the local database to obtain the third encrypted data; if the transmission requirement is from a data file to a local disk, the transmission data is encrypted using the fourth key stored in the key generator to obtain the fourth encrypted data.

[0181] See also Figure 8 , Figure 8 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 8 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system).

[0182] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0183] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0184] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the use of a computer device based on the presentation of a small program landing page, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0185] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0186] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0187] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0188] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A protection method for an Internet of Vehicles service platform, applied to the Internet of Vehicles service platform, characterized in that: The method comprises: Obtaining the processing results output by each security protection layer in the Internet of Vehicles service platform within a preset historical period; Calculate the risk measurement index corresponding to the processing result according to the preset evaluation standard, and determine the risk level of the security protection layer associated with each processing result based on the risk measurement index; Scheduling the hierarchical order of the security protection layers in the Internet of Vehicles service platform according to the risk level to obtain a dynamic security protection layer with a hierarchical relationship; The hierarchical dynamic security protection layer is used to perform corresponding protection operations on the Internet of Vehicles service platform.

2. The method according to claim 1, characterized in that The step of calculating the risk measurement index corresponding to the processing result according to the preset evaluation standard, and determining the risk level of the security protection layer associated with each processing result based on the risk measurement index, includes: Traverse the risk events in the processing results within a preset historical period to obtain the number of events; Identify the risk type of each risk event, and determine the risk value corresponding to the risk event according to the risk type; Based on the number of events in the processing results and the risk value corresponding to each risk event, the risk level of the security protection layer associated with each processing result is calculated.

3. The method according to claim 1, characterized in that: The using the hierarchical security protection layer to perform corresponding protection operations on the Internet of Vehicles service platform includes: Receiving first data traffic sent from an external network to the Internet of Vehicles service platform; Inputting the first data flow into the hierarchical dynamic security protection layers in the Internet of Vehicles service platform in sequence, wherein each of the dynamic security protection layers is configured with at least one security protection strategy; Based on the dynamic security protection layer, the configured security protection policy is called to process the first data traffic to obtain a processing result; A security log is generated according to the processing result, and the security log is uploaded to the monitoring alarm platform.

4. The method according to claim 3, characterized in that If the dynamic security protection layer is a boundary protection layer, the processing of the first data traffic to obtain a processing result by calling the configured security protection policy based on the dynamic security protection layer includes: Detecting whether there is a first abnormal flow of a denial of service attack in the first data flow based on the denial of service attack protection strategy configured by the boundary protection layer; If the first abnormal traffic exists, the first abnormal traffic in the first data traffic is intercepted, and the first data traffic is restricted from accessing the platform address and the platform resource library through the asset protection policy configured by the boundary protection layer to obtain a first processing result.

5. The method according to claim 3, characterized in that: If the dynamic security protection layer is a network protection layer, the processing of the first data traffic to obtain a processing result by calling the configured security protection policy based on the dynamic security protection layer includes: Acquire a second data flow transmitted to the network protection layer, wherein the second data flow is obtained after the first data flow is processed by the upper-level dynamic security protection layer; Detecting whether there is a virus feature in the second data flow based on the virus protection strategy configured by the network protection layer; If the virus feature exists, the second abnormal traffic with the virus feature in the second data traffic is intercepted, and the communication source of the second abnormal traffic is limited based on the access control policy configured by the network protection layer to generate a second processing result.

6. The method according to claim 3, characterized in that If the dynamic security protection layer is an application protection layer, the processing of the first data traffic to obtain a processing result by calling the configured security protection policy based on the dynamic security protection layer includes: Acquire a third data flow transmitted to the application protection layer, wherein the third data flow is obtained after the upper-level dynamic security protection layer processes the second data flow; Detecting whether there is a third abnormal traffic of application interface call in the third data traffic based on the API protection strategy configured by the application protection layer; If the third abnormal traffic exists, the third abnormal traffic is parsed to obtain identity information, and a verification operation is performed on the identity information based on the website protection policy configured by the application protection layer to generate a third processing result.

7. The method according to claim 3, characterized in that If the dynamic security protection layer is a system protection layer, the processing of the first data traffic to obtain a processing result by calling the configured security protection policy based on the dynamic security protection layer includes: Acquire a fourth data flow transmitted to the system protection layer, wherein the fourth data flow is obtained after the upper-level dynamic security protection layer processes the third data flow; Analyzing the fourth data flow based on the asset management policy configured by the system protection layer to determine whether there is an intrusion in the service operation environment; If the intrusion behavior exists, the fourth abnormal traffic containing the intrusion behavior in the fourth data traffic is intercepted, and the configuration information of the service operating environment and the file isolation status are checked based on the collaborative protection strategy configured by the system protection layer to generate a fourth processing result.

8. The method according to claim 3, characterized in that If the dynamic security protection layer is a data protection layer, the processing of the first data traffic to obtain a processing result by calling the configured security protection policy based on the dynamic security protection layer includes: Acquire a fifth data flow transmitted to the data protection layer, wherein the fifth data flow is obtained after the fourth data flow is processed by the upper-level dynamic security protection layer; Detecting fifth data traffic flowing into the data protection layer based on a transmission encryption policy configured by the data protection layer; Determining whether there is a data transmission demand according to the fifth data flow; If the data transmission requirement exists, multiple keys are generated based on the storage encryption strategy configured by the data protection layer, and encryption operations are performed on the transmission data of the local server and the local database based on the keys and the transmission requirement to generate the fifth processing result.

9. The method according to claim 8, characterized in that The performing encryption operation on the transmission data of the local server and the local database based on the key and the transmission requirement includes: Obtaining a transmission requirement corresponding to the transmission data; If the transmission requirement is from a remote terminal to a local server, the second key in the transmission data is verified according to the first key stored in the local server, and after the verification is passed, the transmission data is encrypted using the first encryption strategy to obtain first encrypted data; If the transmission requirement is from a remote server to a local server, encrypt the transmission data using a second encryption strategy to obtain second encrypted data; If the transmission requirement is from a remote database to a local database, encrypting the transmission data using a third key stored in the local database to obtain third encrypted data; If the transmission requirement is to transmit a data file to a local disk, the transmission data is encrypted using a fourth key stored in the key generator to obtain fourth encrypted data.

10. A protection device for a vehicle networking service platform, applied to the vehicle networking service platform, characterized in that: The device comprises: An acquisition module, used to obtain the processing results output by each security protection layer in the Internet of Vehicles service platform within a preset historical period; A calculation module, used to calculate the risk measurement index corresponding to the processing result according to a preset evaluation standard, and determine the risk level of the security protection layer associated with each processing result based on the risk measurement index; A scheduling module, used to schedule the hierarchical order of the security protection layer in the Internet of Vehicles service platform according to the risk level to obtain a dynamic security protection layer with a hierarchical relationship; An execution module is used to use the dynamic security protection layer with a hierarchical relationship to perform corresponding protection operations on the Internet of Vehicles service platform.

Images