Object management platform based on endogenous safety

Abstract

The invention provides a property management platform based on endogenous safety. The property management platform comprises an endogenous safety property management system, wherein the endogenous safety property management system comprises essential place analysis, heterogeneous resource configuration, heterogeneous execution body generation and mimicry component embedding; a security architecture technical route in the endogenous security property management system comprises a control plane and a data plane. The endogenous security property management system further comprises a mimicry construction intelligent Internet of Things zero-trust assembly, and the mimicry construction intelligent Internet of Things zero-trust assembly is used for providing endogenous security for the zero-trust system. Fine-grained security control of continuous authentication and dynamic authorization is realized by taking a software-defined dynamic fine-grained boundary as guidance, that is, a trusted network is established by taking an identity label of an Internet of Things terminal as a center, a model framework for realizing an intelligent Internet of Things zero-trusted network is researched, and a framework of an endogenous security property management system is constructed.

Description

Technical Field

[0001] The present invention relates to the technical field of property management platforms, and in particular to a property management platform based on intrinsic security. Background Art

[0002] In order to solve the problem that the unknown vulnerability backdoors in the property management platform make it easy for attackers to launch attacks through the IoT device side or the user side, the mimetic defense technology is used to study the mimetic transformation method of the property management platform with intrinsic security capabilities, break through the key technologies such as the intrinsic security property management platform architecture, heterogeneous execution body operation environment adaptation, mimetic bracket adaptation, label non-sense implantation and mimetic transformation incremental mode, build an intrinsic security property management platform, implant the intrinsic security gene based on "dynamic, heterogeneous, and redundant" into the property management platform, complete the mimetic transformation of the property management information system, and enhance the intrinsic security capabilities of the system, so that in the IoT access system, the attack behaviors from the hijacked terminal or the user side cannot destroy the high availability of the property management platform function, and can realize the discovery and timely disposal of unknown threats. At the same time, in response to network security issues such as illegal access to the smart IoT network and unauthorized access to resources, the zero-trust security concept is used to build a terminal trusted identity, mimetic construction of the core components of the entire architecture, and establish a smart IoT zero-trust network architecture with the characteristics of intrinsic security, software-defined network boundaries, continuous authentication services and dynamic trust authorization. Summary of the invention

[0003] In order to make up for the above shortcomings, the present invention provides a property management platform based on intrinsic security, which is used to solve the problem that the unknown vulnerabilities and backdoors in the existing technical property management platforms mentioned above make it easy for attackers to launch attacks through the IoT device side or the user side, and the network security problems such as illegal access to the smart IoT network and unauthorized access to resources.

[0004] The present invention is achieved in that: A property management platform based on intrinsic security includes an intrinsic security property management system: the intrinsic security property management system includes key point analysis, heterogeneous resource configuration, heterogeneous executable body generation and mimetic component embedding, the key point analysis includes a server or computer, and a physical resource pool, the heterogeneous resource configuration is a heterogeneous operating system, the heterogeneous executable body generation is an executable body in a multi-executor running environment, and the mimetic component embedding is a mimetic component in a multi-executor running environment. First, the attack surface exposed by the system, the main threat type and the attack accessibility factor are comprehensively considered, and the property management information system is selected as the target object for mimetic transformation; secondly, heterogeneous resources are configured, such as adding X86, ARM architecture heterogeneous servers or hosts, and creating Window, Linux heterogeneous operating systems, application running environments, etc.; thirdly, after adapting the existing application to the operation of heterogeneous servers or hosts, a software heterogeneous tool is used to generate heterogeneous executable bodies, and they are deployed to different heterogeneous execution environments accordingly. Finally, a mimetic bracket component is added to distribute service requests, output decisions and schedule executable bodies; The security architecture technology route in the endogenous security property management system includes a control plane and a data plane. The access subject initiates an access request, and the policy engine of the control plane performs multi-source trust evaluation calculations. The control engine determines the calculation results and determines the authorization policy. Once the access is authorized, the control engine will notify the security agent of the data plane to establish a secure connection for the access. The policy engine continues to evaluate. Once the participating object or its behavior changes, the policy engine will perform trust evaluation based on the new evaluation source. The control engine determines whether the authorization policy needs to be changed at any time based on the evaluation results, and notifies the security agent to perform corresponding operations at any time to maximize resource security. The intrinsic security property management system also includes a mimetic construction of a zero-trust smart Internet of Things network component, which is used to provide intrinsic security for the zero-trust system, that is, if the internal policy engine is breached or the policy database is leaked, the zero-trust security architecture will lose its function. Once the unknown vulnerability backdoor in the identity information database or the policy engine in the zero-trust network is successfully exploited by an attacker, sensitive data will be leaked and the system will fail. Therefore, the idea of ​​intrinsic security is introduced into the zero-trust security architecture of the smart Internet of Things network, and the various components or modules of the policy engine and the control engine are mimeticized, so that the entire system can obtain the unique effect gain of intrinsic security and avoid the risks brought by internal vulnerabilities. The mimetic-structured smart IoT network zero-trust component is mainly based on the mimetic defense DHR architecture and intrinsic security ideas. The zero-trust security architecture is mimetic-structured through mobile attack space, heterogeneous redundant construction, input assignment and multi-mode arbitration mechanism. In order to reduce the difficulty of implementation and effectively control the complexity of implementation, according to the idea of ​​combining zero trust and mimetic defense, the mimetic zero-trust security architecture is divided into five parts and implemented separately.

[0005] In one embodiment of the present invention, the mimetic transformation technology of the intrinsic safety property management system is to perform mimetic transformation on the property management system and build an intrinsic safety property management platform. First, it is necessary to implement a dynamic heterogeneous redundant mimetic mechanism by building a heterogeneous infrastructure layer, a polymorphic operating environment layer, a mimetic plug-in layer, a mimetic application layer, an operation and maintenance management layer, etc., to enhance the ability of the property management system application to cope with unknown threats; secondly, based on the front-end and back-end separation architecture of the mainstream property management system, the mimetic transformation method for the front-end display layer, the back-end interface layer and the basic service layer is studied to realize the full-stack heterogeneous design of the mimetic property management system; furthermore, it is necessary to study the structured implementation of the key modules such as the distributor, the voter, the non-similar web virtual machine pool, and the scheduler of the mimetic property management system based on the DHR architecture; The mimetic bracket component adaptation technology of the endogenous safety property management system mainly encapsulates the property management platform into a mimetic architecture, distributes service requests, outputs decisions, and schedules executors. The specific operation process is to pull the input data that needs to be processed by the property management system before the transformation to the IO agent, which distributes it to different heterogeneous executors. After the processing of different heterogeneous executors is completed, the processing results are sent to the arbitrator, which selects the results based on the decision strategy, and the arbitrator sends the selected results to the IO agent for output, thereby realizing the assembly of mimetic applications.

[0006] In one embodiment of the present invention, the encrypted traffic normalization and streaming arbitration technology of the endogenous safety property management system adopts an application layer encrypted transmission protocol, and needs to apply transparent encrypted flow normalization and streaming arbitration technology to realize normalization arbitration under encryption and persistent connection conditions. First, a key consensus negotiation mechanism is designed to ensure that the handshake information between the pseudo bracket and all executors is consistent, and the encryption randomness problem is solved. Secondly, the streaming arbitration technology for block transmission is realized, the size of the block data on the executor side is controlled, and the flow arbitration is performed in blocks as units to solve the randomness problem of the block length. Finally, a standardized and universal driver tool library is developed to realize application-free integration. The endogenous safety property management system application software technology of the endogenous safety property management system adopts a layered design of a front-end display layer, a back-end interface layer, and a basic service layer, and is independently deployed on heterogeneous computing units. The heterogeneous computing units implement heterogeneous redundant design at the hardware, operating system, virtualization layer, middleware, and software levels. The virtualization layer is equipped with virtualization software to flexibly build a heterogeneous computing environment for the endogenous safety property management system. The control flow-based software heterogeneous quantification technology of the endogenous safety property management system first parses the internal instructions of the software variants and extracts the control flow graph as the semantic information feature of the software. The control flow graph is a directed acyclic graph, which transforms the software heterogeneous quantification problem into a graph structure heterogeneous quantification problem. Finally, the existing graph data heterogeneous quantification algorithm is used for actual solution to realize software heterogeneous quantification containing semantic information.

[0007] In one embodiment of the present invention, the core logic components of the security architecture technical route are mainly divided into three parts: the first is the policy engine, which is responsible for trust evaluation. By collecting and analyzing multi-source information of participating objects and behaviors, continuous trust evaluation is performed on the access subject; the second is the control engine, which serves as a policy control point and relies on the trust evaluation results of the policy engine to continuously determine the authorization policy; the third is the security agent, which serves as a policy execution point and establishes a secure channel between the access subject and the accessed resource for the authorized access subject. In the actual architecture, this logic component may be a single agent component or composed of two different components: the client and the resource-side gateway; In addition to the core logical components, the security architecture technology route also includes internal and external trust sources, which work with the policy engine to collect and analyze security information of participating objects and their behaviors, and pass it to the policy engine to provide a basis for trust assessment. The trust sources mainly include CDM, industry compliance systems, threat intelligence sources, data access policies, PKI, ID management systems, network and system activity logs, and security event management systems.

[0008] In one embodiment of the present invention, the mimetic-structured smart IoT network zero-trust component includes a policy execution component heterogeneous layer, which is used to interact with the policy engine and complete authorization decisions, enforce the authorization decision results, and is logically located at the first checkpoint of the authorization information flow of the zero-trust security center. It is responsible for intercepting client requests sent to the server and calling the policy engine to make authorization decisions.

[0009] In one embodiment of the present invention, the mimetic-structured smart IoT network zero-trust component includes a heterogeneous component scheduling layer. The heterogeneous component scheduling layer interacts with the mimetic component operation and maintenance layer of the policy execution component heterogeneous layer, selects heterogeneous policy execution components according to the scheduling requirements and policies generated by the mimetic scheduling module, adjusts the selected components from the to-be-scheduled queue to the service set queue, and then waits for the input request of the input control module.

[0010] In one embodiment of the present invention, the mimetic-structured smart IoT network zero-trust component includes a mimetic component operation and maintenance layer, which is a key layer of the endogenous security architecture of the zero-trust security center, including an input / output assignment module, a mimetic scheduling module, a multi-mode arbiter module, and a negative feedback control module. It obtains feedback information through interaction with the lower heterogeneous component layer, combines the diversified policy engine module and the historical information provided by the heterogeneous trust database layer, generates a consistent output to the multi-mode arbiter, and performs a common-mode judgment output.

[0011] In one embodiment of the present invention, the mimetic structured intelligent Internet of Things zero-trust component includes a diversified policy engine layer, which receives a request from a policy execution component, determines whether the request is allowed based on a pre-established policy comparison, and then returns the authorization result to the policy execution component for mandatory execution of the authorization service result. In the endogenous security architecture of the zero-trust security center, the multi-mode arbitrator module selects the policy engine based on the historical trust information of the trust evaluation module, executes the authorization-related services of this request, and ensures the principle of minimum authorization, that is, maintaining the requesting user with only the minimum set of permissions required to complete the service. The diversified policy engine layer structure mainly adopts the following three mechanisms: formulating different scoring weight mechanisms for the same type of request authorization behavior; formulating different scoring weight mechanisms for different types of request authorization behaviors; and adopting different policy engine implementation syntaxes.

[0012] In one embodiment of the present invention, the mimetic structured intelligent Internet of Things zero-trust component includes a risk and trust assessment layer, which is a system component that performs risk analysis on specific network requests or activities. Its main function is to perform quantitative analysis on non-quantitative behaviors or features to obtain a definite trust value assessment. The policy engine makes authorization decisions based on this trust assessment value. The reference information for risk and trust assessment mainly comes from user historical data, device operation data, and access behavior data. A comprehensive assessment is performed by accessing the historical information database to obtain trust assessment parameters. In the endogenous security architecture of the zero-trust security center, instruction set randomization technology is used for user requests to query the database. By assigning different randomized fields to users with different trust levels, SQL injection judgment is implemented to provide security protection for the system database. For risk assessment and trust assessment, in addition to formulating static trust assessment rules based on historical data, it is also necessary to combine machine learning technology and big data analysis to implement a dynamic trust scoring mechanism. Combining static analysis with dynamic assessment can achieve better results. The factors that trust scoring relies on often have a certain degree of ambiguity, but it is this ambiguity that plays an important role. Under this mechanism, the formulation of authorization policies is not only based on certain policies, but also on the measurement of constantly changing situations. Dynamic considerations are introduced, providing a method for the system to defend against unknown threats.

[0013] In one embodiment of the present invention, the risk and trust assessment layer is composed of a variety of functionally equivalent heterogeneous policy execution components composed of different standardized software and hardware modules, which serve as the first layer of the underlying information flow processing gateway and serve the upper scheduling layer. The mimic component operation and maintenance layer controls the heterogeneous component scheduling layer to select heterogeneous components, wherein the selection of the scheduling strategy is determined by the mimic scheduler module of the operation and maintenance layer, and the appropriate scheduling strategy is selected according to the user identity information and the system situation. The input allocation module of the operation and maintenance layer receives the authorization request, copies it into n copies and transmits them to the selected heterogeneous policy execution components respectively. After the heterogeneous components are executed, the output allocation module collects the outputs and then transmits them together to the multi-mode policy arbitrator module for execution. Consistency decisions are made. According to the trust assessment parameters derived from the risk and trust assessment, the corresponding policy engine is comprehensively considered for authorization services. In the trust assessment mode of a single policy engine, there are problems such as single scoring metrics and trust accumulation. By adopting a policy engine group composed of different strategies and written in different languages ​​to select services, such problems can be effectively avoided. The execution of heterogeneous executors is controlled by the negative feedback control module of the operation and maintenance layer. According to the component feedback information provided by the multi-mode arbitrator, heterogeneous components are replaced and taken offline according to the current situation of the system, and new components are reselected to replace the offline components. At the same time, the confidence of the offline components is cleaned, and the executor set is rotated regularly to maintain the dynamic nature of the system.

[0014] The beneficial effects of the present invention are: The present invention builds a zero-trust security architecture for the smart Internet of Things. Focusing on new security goals, the invention uses software-defined dynamic fine-grained boundaries as a guide to achieve fine-grained security control of continuous authentication and dynamic authorization. That is, a trust network is established with the IoT terminal identity as the center. The model framework for realizing the zero-trust network of the smart Internet of Things is studied, the security goals are clarified, the main components of the model framework and their functions are determined, the core components or modules are decomposed, basic solutions are given for typical network application environments, and the endogenous security concept is introduced into the zero-trust security architecture of the smart Internet of Things. By integrating various components such as the policy engine and the control engine, the Or module mimicry, so that the whole system can obtain the unique effect of intrinsic security, avoid the risks brought by internal vulnerabilities, and build the architecture of intrinsic security property management system, which mainly includes key point analysis, heterogeneous resource configuration, heterogeneous executor generation and mimic component embedding, etc., to realize the attack surface exposed by the comprehensive system, the main threat type and attack accessibility, etc., select the property management information system as the target object for mimicry transformation; configure heterogeneous resources, adapt the existing applications to heterogeneous servers or hosts, use software heterogeneity tools to generate heterogeneous executors, and deploy them to different heterogeneous execution environments accordingly. Add mimic bracket components to distribute service requests, output decisions and schedule executors. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 It is a schematic diagram of the architecture of the endogenous safety property management information system of the present invention; Figure 2 A schematic diagram of the technical route of the smart IoT network security architecture of the present invention; Figure 3 This is a schematic diagram of the mimetic structure of the zero-trust smart IoT security system of the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] See also Figure 1-3 , the present invention provides a technical solution: A property management platform based on intrinsic security includes an intrinsic security property management system: the intrinsic security property management system includes key point analysis, heterogeneous resource configuration, heterogeneous executable body generation and mimetic component embedding, the key point analysis includes a server or computer, and a physical resource pool, the heterogeneous resource configuration is a heterogeneous operating system, the heterogeneous executable body generation is an executable body in a multi-executor running environment, and the mimetic component embedding is a mimetic component in a multi-executor running environment. First, the attack surface exposed by the system, the main threat type and the attack accessibility factor are comprehensively considered, and the property management information system is selected as the target object for mimetic transformation; secondly, heterogeneous resources are configured, such as adding X86, ARM architecture heterogeneous servers or hosts, and creating Window, Linux heterogeneous operating systems, application running environments, etc.; thirdly, after adapting the existing application to the operation of heterogeneous servers or hosts, a software heterogeneous tool is used to generate heterogeneous executable bodies, and they are deployed to different heterogeneous execution environments accordingly. Finally, a mimetic bracket component is added to distribute service requests, output decisions and schedule executable bodies; The security architecture technology route in the endogenous security property management system includes a control plane and a data plane. The access subject initiates an access request, and the policy engine of the control plane performs multi-source trust evaluation calculations. The control engine determines the calculation results and determines the authorization policy. Once the access is authorized, the control engine will notify the security agent of the data plane to establish a secure connection for the access. The policy engine continues to evaluate. Once the participating object or its behavior changes, the policy engine will perform trust evaluation based on the new evaluation source. The control engine determines whether the authorization policy needs to be changed at any time based on the evaluation results, and notifies the security agent to perform corresponding operations at any time to maximize resource security. The intrinsic security property management system also includes a mimetic construction of a zero-trust smart Internet of Things network component, which is used to provide intrinsic security for the zero-trust system, that is, if the internal policy engine is breached or the policy database is leaked, the zero-trust security architecture will lose its function. Once the unknown vulnerability backdoor in the identity information database or the policy engine in the zero-trust network is successfully exploited by an attacker, sensitive data will be leaked and the system will fail. Therefore, the idea of ​​intrinsic security is introduced into the zero-trust security architecture of the smart Internet of Things network, and the various components or modules of the policy engine and the control engine are mimeticized, so that the entire system can obtain the unique effect gain of intrinsic security and avoid the risks brought by internal vulnerabilities. The mimetic-structured smart IoT network zero-trust component is mainly based on the mimetic defense DHR architecture and intrinsic security ideas. The zero-trust security architecture is mimetic-structured through mobile attack space, heterogeneous redundant construction, input assignment and multi-mode arbitration mechanism. In order to reduce the difficulty of implementation and effectively control the complexity of implementation, according to the idea of ​​combining zero trust and mimetic defense, the mimetic zero-trust security architecture is divided into five parts and implemented separately.

[0019] Specifically, the intrinsic security property management system includes key point analysis, heterogeneous resource configuration, heterogeneous executor generation and mimetic component embedding. The key point analysis includes servers or computers, and physical resource pools. The heterogeneous resource configuration is a heterogeneous operating system. The heterogeneous executor generation is an executor in a multi-executor operating environment. The mimetic component embedding is a mimetic component in a multi-executor operating environment. First, the attack surface exposed by the system, the main threat types and attack accessibility factors are comprehensively considered, and the property management information system is selected as the target object for mimetic transformation; secondly, heterogeneous resources are configured, such as adding X86, ARM architecture heterogeneous servers or hosts, and creating Window, Linux heterogeneous operating systems, Application running environment, etc.; secondly, after adapting the existing application to run on heterogeneous servers or hosts, use the software heterogeneity tool to generate heterogeneous executables, and deploy them to different heterogeneous execution environments accordingly. Finally, add the mimetic bracket component to distribute service requests, output decisions, and schedule executables. The mimetic transformation technology of the intrinsically safe property management system is to perform mimetic transformation on the property management system and build an intrinsically safe property management platform. First, it is necessary to implement a dynamic heterogeneous redundant mimetic mechanism by building a heterogeneous infrastructure layer, a polymorphic running environment layer, a mimetic plug-in layer, a mimetic application layer, and an operation and maintenance management layer to enhance the ability of the property management system application to respond to unknown threats; secondly, based on the front-end and back-end separation architecture of the mainstream property management system, research is conducted on the front-end and back-end separation architecture of the property management system. The mimetic transformation method of the display layer, back-end interface layer and basic service layer realizes the full-stack heterogeneous design of the mimetic property management system; furthermore, it is necessary to study the structured implementation of key modules such as the distributor, voter, non-similar web virtual machine pool, and scheduler of the mimetic property management system based on the DHR architecture; the mimetic bracket component adaptation technology of the intrinsic security property management system mainly encapsulates the property management platform into a mimetic architecture, distributes service requests, outputs decisions and schedules executors. The specific operation process is to pull the input data to be processed by the property management system before the transformation to the IO agent, which distributes it to different heterogeneous executors; after the processing of different heterogeneous executors is completed, the processing results are sent to the arbitrator, and the arbitrator selects the results according to the decision strategy. , the arbiter sends the selection result to the IO agent output to realize the assembly of the mimetic application. The encrypted traffic normalization and streaming arbitration technology of the endogenous security property management system adopts the application layer encrypted transmission protocol. It is necessary to apply transparent encrypted flow normalization and streaming arbitration technology to realize normalized arbitration under the conditions of encryption and persistent connection. First, a key consistency negotiation mechanism is designed to ensure the consistency of handshake information between the mimetic bracket and all executors to solve the encryption randomness problem. Secondly, the streaming arbitration technology for block transmission is realized to control the size of the block data on the executor side, and the flow arbitration is performed in blocks to solve the randomness problem of block length. Finally, a standardized and universal driver tool library is developed to realize application seamless integration;The endogenous safety property management system application software technology of the endogenous safety property management system adopts a layered design of the front-end display layer, the back-end interface layer, and the basic service layer, and is independently deployed on the heterogeneous computing unit. The heterogeneous computing unit implements heterogeneous redundant design at the hardware, operating system, virtualization layer, middleware, and software levels. The virtualization layer is equipped with virtualization software to flexibly build a heterogeneous computing environment for the endogenous safety property management system; the control flow-based software heterogeneous quantification technology of the endogenous safety property management system first parses the internal instructions of the software variant and extracts the control flow graph as the semantic information feature of the software. The control flow graph is a directed acyclic graph, which transforms the software heterogeneous quantification problem into a graph structure heterogeneous quantification problem. Finally, the existing graph data heterogeneous quantification algorithm is used for actual solution to realize the software heterogeneous quantification containing semantic information. ;

[0020] The security architecture technology route in the endogenous security property management system includes a control plane and a data plane. The access subject initiates an access request, and the policy engine of the control plane performs multi-source trust evaluation calculations. The control engine determines the calculation results and decides the authorization policy. Once the access is authorized, the control engine will notify the security agent of the data plane to establish a secure connection for the access. The policy engine continues to evaluate. Once the participating objects or their behaviors change, the policy engine will perform trust evaluation based on the new evaluation source. The control engine determines whether the authorization policy needs to be changed at any time based on the evaluation results, and notifies the security agent to perform corresponding operations at any time to maximize resource security. The core logical components of the security architecture technology route are mainly divided into three parts. The first is the policy engine, which is responsible for trust evaluation. By collecting and analyzing multi-source information of participating objects and behaviors, The first is to conduct continuous trust evaluation on the access subject. The second is the control engine, which serves as a policy control point and relies on the trust evaluation results of the policy engine to continuously determine the authorization policy. The third is the security agent, which serves as a policy execution point and establishes a secure channel between the access subject and the accessed resource for the access subject with granted permissions. In the actual architecture, this logical component may be a single agent component or composed of two different components: the client and the resource-side gateway. In addition to the core logical components, the security architecture technology route also includes internal and external trust sources, which work with the policy engine to collect and analyze the security information of the participating objects and their behaviors, and pass it to the policy engine to provide a basis for its trust evaluation. The trust sources mainly include CDM, industry compliance system, threat intelligence source, data access policy, PKI, ID management system, network and system activity log, and security event management system.

[0021] The intrinsic security property management system also includes a mimetic construction of a zero-trust smart Internet of Things network component, which is used to provide intrinsic security for the zero-trust system, that is, if the internal policy engine is breached or the policy database is leaked, the zero-trust security architecture will lose its function. Once the unknown vulnerability backdoor in the identity information database or the policy engine in the zero-trust network is successfully exploited by an attacker, sensitive data will be leaked and the system will fail. Therefore, the idea of ​​intrinsic security is introduced into the zero-trust security architecture of the smart Internet of Things network, and the various components or modules of the policy engine and the control engine are mimeticized, so that the entire system can obtain the unique effect gain of intrinsic security and avoid the risks brought by internal vulnerabilities.The mimetic construction of the zero-trust component of the intelligent Internet of Things network is mainly based on the mimetic defense DHR architecture and the inherent security concept. The zero-trust security architecture is mimeticized through mobile attack space, heterogeneous redundant construction, input assignment and multi-mode arbitration mechanism. In order to reduce the difficulty of implementation and effectively control the complexity of implementation, according to the idea of ​​combining zero trust and mimetic defense, the mimetic zero-trust security architecture is divided into five parts and implemented separately. The mimetic construction of the zero-trust component of the intelligent Internet of Things network includes a heterogeneous layer of the policy execution component. The heterogeneous layer of the policy execution component is used to interact with the policy engine and complete the authorization decision, and enforce the authorization decision result. It is logically located at the first gate of the authorization information flow of the zero-trust security center, responsible for intercepting client requests sent to the server, calling the policy engine for authorization decisions, and in terms of operating systems, Windows and Linux can be selected to complete the selection and construction of the component system. In terms of processors, different processors including Intel, AMD, IBM and Cyrix can be built as the bottom component of the heterogeneous policy execution component. For the compiler, GCC and Clang can be selected, which can be compatible with various operating environments. The mimetic structure of the zero-trust component of the smart Internet of Things network includes a heterogeneous component scheduling layer. The heterogeneous component scheduling layer interacts with the mimetic component operation and maintenance layer of the heterogeneous layer of the policy execution component, and selects the heterogeneous policy execution component according to the scheduling requirements and policies generated by the mimetic scheduling module, and adjusts the selected component from the queue to be scheduled to the service set queue, and then waits for the input request of the input control module. The mimetic structure of the zero-trust component of the smart Internet of Things network includes a mimetic component operation and maintenance layer. The mimetic component operation and maintenance layer is the key layer of the intrinsic security architecture of the zero-trust security center, including an input / output assignment module, a mimetic scheduling module, a multi-mode arbiter module and a negative feedback control module. It obtains feedback information through interaction with the lower heterogeneous component layer, and combines the diversified policy engine module and the historical information provided by the heterogeneous trust database layer to generate The consistency is output to the multi-mode arbitrator for common mode judgment output. The mimetic structure of the intelligent Internet of Things zero trust component includes a diversified policy engine layer. The diversified policy engine layer receives the request from the policy execution component, and determines whether the request is allowed according to the pre-established policy comparison. Then, the authorization result is returned to the policy execution component for mandatory execution of the authorization service result. In the endogenous security architecture of the zero trust security center, the multi-mode arbitrator module selects the policy engine according to the historical trust information of the trust evaluation module, executes the authorization-related services of this request, and ensures the principle of minimum authorization at the same time, that is, maintains that the requesting user only has the minimum set of permissions required to complete this service. The diversified policy engine layer structure mainly adopts the following three mechanisms: formulate different scoring weight mechanisms for the same type of request authorization behavior; formulate different scoring weight mechanisms for different types of request authorization behaviors;Different policy engines are used to implement syntax. The mimetic construction of the smart IoT zero-trust component includes a risk and trust assessment layer. The risk and trust assessment layer is a system component that performs risk analysis on specific network requests or activities. Its main function is to perform quantitative analysis on non-quantitative behaviors or features to obtain a definite trust value assessment. The policy engine makes authorization decisions based on this trust assessment value. The reference information for risk and trust assessment mainly comes from user historical data, device operation data, and access behavior data. A comprehensive assessment is performed by accessing the historical information database to obtain trust assessment parameters. In the endogenous security architecture of the zero-trust security center, for user requests to query the database, an instruction set is used. Randomization technology, by assigning different randomized fields to users with different trust levels, implements SQL injection judgment and provides security protection for the system database. For risk assessment and trust assessment, in addition to formulating static trust assessment rules based on historical data, it is also necessary to combine machine learning technology and big data analysis to implement a dynamic trust scoring mechanism. Combining static analysis with dynamic assessment can achieve better results. The factors that trust scoring relies on often have a certain degree of ambiguity, but it is this ambiguity that plays an important role. Under this mechanism, the formulation of authorization policies is not only based on certain policies, but also based on constantly changing situation measurements, introducing dynamic considerations to provide system defense against unknown threats. A method is provided, wherein the risk and trust assessment layer is composed of a plurality of functionally equivalent heterogeneous policy execution components composed of different standardized software and hardware modules, which serve as the first layer of the underlying information flow processing gateway and serve the upper scheduling layer, and the mimic component operation and maintenance layer controls the heterogeneous component scheduling layer to select heterogeneous components, wherein the selection of the scheduling strategy is determined by the mimic scheduler module of the operation and maintenance layer, and the appropriate scheduling strategy is selected according to the user identity information and the system situation, and the input allocation module of the operation and maintenance layer receives the authorization request, copies it into n copies and transmits them to the selected heterogeneous policy execution components respectively, and after the heterogeneous components are executed, the output allocation module collects the outputs and then transmits them together to the multi-mode policy arbitrator module for a single operation. Consistency decision: Based on the trust assessment parameters obtained from the risk and trust assessment, the corresponding policy engine is comprehensively considered to be selected for authorization services. In the trust assessment mode of a single policy engine, there are problems such as single scoring measurement and trust accumulation. By adopting a policy engine group composed of different policies and written in different languages ​​to select services, such problems can be effectively avoided. The execution of heterogeneous executors is controlled by the negative feedback control module of the operation and maintenance layer. According to the component feedback information provided by the multi-mode arbitrator, heterogeneous components are replaced and offline according to the current situation of the system, and new components are selected to replace offline components. At the same time, the confidence of offline components is cleaned, and the executor set is rotated regularly to maintain the dynamic nature of the system. ;

[0022] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A property management platform based on intrinsic security, characterized in that: Including an endogenous security property management system: the endogenous security property management system includes key site analysis, heterogeneous resource configuration, heterogeneous executor generation and mimetic component embedding. The key site analysis includes servers or computers, and physical resource pools. The heterogeneous resource configuration is a heterogeneous operating system. The heterogeneous executor generation is an executor in a multi-executor operating environment. The mimetic component embedding is a mimetic component in a multi-executor operating environment. First, the attack surface exposed by the comprehensive system, the main threat type and the attack accessibility factors are selected to select the property management information system as the target object for mimetic transformation; secondly, configure heterogeneous resources, such as adding X86, ARM architecture heterogeneous servers or hosts, and create Window, Linux heterogeneous operating systems, application operating environments, etc.; Furthermore, after adapting the existing applications to run on heterogeneous servers or hosts, the software heterogeneity tool is used to generate heterogeneous executables and deploy them to different heterogeneous execution environments accordingly. Finally, a mimetic bracket component is added to perform service request distribution, decision output, and executable scheduling; The security architecture technology route in the endogenous security property management system includes a control plane and a data plane. The access subject initiates an access request, and the policy engine of the control plane performs multi-source trust evaluation calculations. The control engine determines the calculation results and determines the authorization policy. Once the access is authorized, the control engine will notify the security agent of the data plane to establish a secure connection for the access. The policy engine continues to evaluate. Once the participating object or its behavior changes, the policy engine will perform trust evaluation based on the new evaluation source. The control engine determines whether the authorization policy needs to be changed at any time based on the evaluation results, and notifies the security agent to perform corresponding operations at any time to maximize resource security. The intrinsic security property management system also includes a mimetic construction of a zero-trust smart Internet of Things network component, which is used to provide intrinsic security for the zero-trust system, that is, if the internal policy engine is breached or the policy database is leaked, the zero-trust security architecture will lose its function. Once the unknown vulnerability backdoor in the identity information database or the policy engine in the zero-trust network is successfully exploited by an attacker, sensitive data will be leaked and the system will fail. Therefore, the idea of ​​intrinsic security is introduced into the zero-trust security architecture of the smart Internet of Things network, and the various components or modules of the policy engine and the control engine are mimeticized, so that the entire system can obtain the unique effect gain of intrinsic security and avoid the risks brought by internal vulnerabilities. The mimetic-structured smart IoT network zero-trust component is mainly based on the mimetic defense DHR architecture and intrinsic security ideas. The zero-trust security architecture is mimetic-structured through mobile attack space, heterogeneous redundant construction, input assignment and multi-mode arbitration mechanism. In order to reduce the difficulty of implementation and effectively control the complexity of implementation, according to the idea of ​​combining zero trust and mimetic defense, the mimetic zero-trust security architecture is divided into five parts and implemented separately.

2. A property management platform based on intrinsic security according to claim 1, characterized in that: The mimetic transformation technology of the intrinsic safety property management system is to perform mimetic transformation on the property management system and build an intrinsic safety property management platform. First, it is necessary to implement a dynamic heterogeneous redundant mimetic mechanism by building a heterogeneous infrastructure layer, a polymorphic operating environment layer, a mimetic plug-in layer, a mimetic application layer, an operation and maintenance management layer, etc., to enhance the ability of the property management system application to cope with unknown threats; secondly, based on the front-end and back-end separation architecture of the mainstream property management system, the mimetic transformation method for the front-end display layer, the back-end interface layer and the basic service layer is studied to realize the full-stack heterogeneous design of the mimetic property management system; furthermore, it is necessary to study the structured implementation of the key modules of the mimetic property management system based on the distributor, voter, non-similar web virtual machine pool, scheduler, etc. under the DHR architecture; The mimetic bracket component adaptation technology of the endogenous safety property management system mainly encapsulates the property management platform into a mimetic architecture, distributes service requests, outputs decisions, and schedules executors. The specific operation process is to pull the input data that needs to be processed by the property management system before the transformation to the IO agent, which distributes it to different heterogeneous executors. After the processing of different heterogeneous executors is completed, the processing results are sent to the arbitrator, which selects the results based on the decision strategy, and the arbitrator sends the selected results to the IO agent for output, thereby realizing the assembly of mimetic applications.

3. A property management platform based on intrinsic security according to claim 2, characterized in that: The encryption flow normalization and streaming adjudication technology of the endogenous safety property management system adopts the application layer encryption transmission protocol, and needs to apply transparent encryption flow normalization and streaming adjudication technology to realize normalization adjudication under encryption and persistent connection conditions. First, a key consistency negotiation mechanism is designed to ensure the consistency of handshake information between the pseudo bracket and all executors, and solve the encryption randomness problem. Secondly, the streaming adjudication technology for block transmission is realized to control the size of the block data on the executor side, and the flow adjudication is performed in blocks to solve the randomness problem of block length. Finally, a standardized and universal driver tool library is developed to realize application-free integration. The endogenous safety property management system application software technology of the endogenous safety property management system adopts a layered design of a front-end display layer, a back-end interface layer, and a basic service layer, and is independently deployed on heterogeneous computing units. The heterogeneous computing units implement heterogeneous redundant design at the hardware, operating system, virtualization layer, middleware, and software levels. The virtualization layer is equipped with virtualization software to flexibly build a heterogeneous computing environment for the endogenous safety property management system. The control flow-based software heterogeneous quantification technology of the endogenous safety property management system first parses the internal instructions of the software variants and extracts the control flow graph as the semantic information feature of the software. The control flow graph is a directed acyclic graph, which transforms the software heterogeneous quantification problem into a graph structure heterogeneous quantification problem. Finally, the existing graph data heterogeneous quantification algorithm is used for actual solution to realize software heterogeneous quantification containing semantic information.

4. A property management platform based on intrinsic security according to claim 1, characterized in that: The core logic components of the security architecture technology route are mainly divided into three parts: the first is the policy engine, which is responsible for trust evaluation. By collecting and analyzing multi-source information of participating objects and behaviors, it continuously evaluates the trust of the access subject. The second is the control engine, which serves as a policy control point and relies on the trust evaluation results of the policy engine to continuously determine the authorization policy. The third is the security agent, which serves as a policy execution point and establishes a secure channel between the access subject and the accessed resource for the authorized access subject. In the actual architecture, this logic component may be a single agent component or composed of two different components: the client and the resource-side gateway; In addition to the core logical components, the security architecture technology route also includes internal and external trust sources, which work with the policy engine to collect and analyze security information of participating objects and their behaviors, and pass it to the policy engine to provide a basis for trust assessment. The trust sources mainly include CDM, industry compliance systems, threat intelligence sources, data access policies, PKI, ID management systems, network and system activity logs, and security event management systems.

5. The property management platform based on intrinsic security according to claim 1, characterized in that: The mimetic-structured smart IoT network zero-trust component includes a heterogeneous layer of policy execution components, which is used to interact with the policy engine and complete authorization decisions, enforce the authorization decision results, and is logically located at the first checkpoint of the authorization information flow of the zero-trust security center. It is responsible for intercepting client requests sent to the server and calling the policy engine to make authorization decisions.

6. A property management platform based on intrinsic security according to claim 5, characterized in that: The mimetic-structured smart IoT network zero-trust component includes a heterogeneous component scheduling layer. The heterogeneous component scheduling layer interacts with the mimetic component operation and maintenance layer of the policy execution component heterogeneous layer, selects heterogeneous policy execution components according to the scheduling requirements and policies generated by the mimetic scheduling module, adjusts the selected components from the to-be-scheduled queue to the service set queue, and then waits for the input request of the input control module.

7. The property management platform based on intrinsic security according to claim 1, characterized in that: The mimetic-structured smart IoT network zero-trust component includes a mimetic component operation and maintenance layer, which is a key layer of the endogenous security architecture of the zero-trust security center, including an input / output assignment module, a mimetic scheduling module, a multi-mode arbiter module, and a negative feedback control module. It obtains feedback information through interaction with the lower heterogeneous component layer, combines the diversified policy engine module and the historical information provided by the heterogeneous trust database layer, generates a consistent output to the multi-mode arbiter, and performs a common-mode judgment output.

8. The property management platform based on intrinsic security according to claim 1, characterized in that: The mimetic structure of the smart Internet of Things zero-trust component includes a diversified policy engine layer, which receives requests from the policy execution component, determines whether the request is allowed based on a pre-established policy comparison, and then returns the authorization result to the policy execution component for mandatory execution of the authorization service result. In the endogenous security architecture of the zero-trust security center, the multi-mode arbiter module selects the policy engine based on the historical trust information of the trust assessment module, executes the authorization-related services of this request, and ensures the principle of minimum authorization, that is, maintaining the requesting user with only the minimum set of permissions required to complete the service. The diversified policy engine layer structure mainly adopts the following three mechanisms: formulating different scoring weight mechanisms for the same type of request authorization behavior; formulating different scoring weight mechanisms for different types of request authorization behaviors; and adopting different policy engine implementation syntaxes.

9. The property management platform based on intrinsic security according to claim 1, characterized in that: The mimetic structured smart IoT zero-trust component includes a risk and trust assessment layer, which is a system component that performs risk analysis on specific network requests or activities. Its main function is to perform quantitative analysis on non-quantitative behaviors or features to obtain a definite trust value assessment. The policy engine makes authorization decisions based on this trust assessment value. The reference information for risk and trust assessment mainly comes from user historical data, device operation data, and access behavior data. A comprehensive assessment is performed through access to the historical information database to obtain trust assessment parameters. In the endogenous security architecture of the zero-trust security center, for user requests to query the database, instruction set randomization technology is used to give different Different randomized fields are assigned to users of trust to implement SQL injection judgment and provide security protection for the system database. For risk assessment and trust assessment, in addition to formulating static trust assessment rules based on historical data, it is also necessary to combine machine learning technology and big data analysis to implement a dynamic trust scoring mechanism. Combining static analysis with dynamic assessment can achieve better results. The factors that trust scoring relies on often have a certain degree of ambiguity, but it is this ambiguity that plays an important role. Under this mechanism, the formulation of authorization policies is not only based on certain policies, but also on the measurement of constantly changing situations. Dynamic considerations are introduced, providing a method for the system to defend against unknown threats.

10. A property management platform based on intrinsic security according to claim 9, characterized in that: The risk and trust assessment layer is composed of a variety of functionally equivalent heterogeneous policy execution components composed of different standardized software and hardware modules. As the first layer of the underlying information flow processing gateway, it serves the upper scheduling layer. The mimic component operation and maintenance layer controls the heterogeneous component scheduling layer to select heterogeneous components. The selection of the scheduling strategy is determined by the mimic scheduler module of the operation and maintenance layer. The appropriate scheduling strategy is selected according to the user identity information and system conditions. The input allocation module of the operation and maintenance layer receives the authorization request, copies it into n copies and transmits them to the selected heterogeneous policy execution component. After the heterogeneous components are executed, the output allocation module aggregates the outputs and then transmits them together to the multi-mode policy arbitrator module for consistency determination. According to the trust assessment parameters obtained from the risk and trust assessment, the corresponding policy engine is comprehensively considered to be selected for authorization services. In the trust assessment mode of a single policy engine, there are problems such as single scoring metrics and trust accumulation. By adopting a policy engine group composed of different strategies and written in different languages ​​to select services, such problems can be effectively avoided. The execution of heterogeneous executors is controlled by the negative feedback control module of the operation and maintenance layer. According to the component feedback information provided by the multi-mode arbitrator, heterogeneous components are replaced and offline according to the current situation of the system, and new components are selected to replace the offline components. At the same time, the confidence of the offline components is cleaned, and the executor set is rotated regularly to maintain the dynamic nature of the system.

Images