Network equipment security protection system and protection method based on big data

Abstract

The invention discloses a network equipment security protection system and protection method based on big data, and relates to the field of network security. In order to solve the problem that attacks and unknown threats from the inside of a network are difficult to effectively deal with by filtering data packets entering and exiting the network based on predefined rules traditionally, a dynamic token management mechanism is introduced, and a communication token is dynamically generated and updated according to safety interaction information and requirements of equipment. Compared with a traditional static token, the dynamic token has higher security and flexibility, and can effectively resist security threats such as replay attacks and token leakage. Meanwhile, according to changes of the network environment and the security threats, the security protection strategy can be dynamically adjusted, and the self-adaptive capacity of the system is improved.

Description

Technical Field

[0001] The present invention relates to the field of network device security, specifically a network device security protection system and method based on big data. Background Art

[0002] With the rapid development of the Internet and the wide access of intelligent devices, network devices are facing increasingly severe security threats. Traditional network security protection methods, such as firewalls, intrusion detection systems (IDS), and antivirus software, although have played an important role in a certain period, gradually expose many limitations when dealing with the current complex and changeable network environment and new security threats.

[0003] Traditional firewalls mainly filter data packets entering and leaving the network based on predefined rules, and it is difficult to effectively deal with attacks from within the network and unknown threats. Although IDS can monitor abnormal behaviors in the network, its detection rules often lag behind the development of attack technologies, and there are relatively high false alarm rates and missed alarm rates.

[0004] Traditional security protection methods usually adopt static defense strategies. Once an attacker breaks through the defense line, they can move freely within the network, causing a large amount of losses. This static mechanism lacks dynamic adaptability and self-learning ability, and it is difficult to deal with constantly changing attack techniques.

[0005] Traditional methods often focus on the security protection of individual devices or local networks, lacking an overall grasp of the security situation of the entire network. In a large network environment, this local protection is prone to protection blind spots, and attackers can use these blind spots to launch attacks without being detected.

[0006] With the wide application of big data technology, the amount of data generated by network devices has increased explosively. Traditional security protection methods often face performance bottlenecks when dealing with massive data, and it is difficult to achieve real-time analysis and response. At the same time, new attack techniques in the big data environment, such as advanced persistent threats (APT), are characterized by strong concealment and long attack chains, and traditional methods are difficult to effectively detect and defend against. Summary of the Invention

[0007] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a network device security protection method based on big data, including the following steps: Step 1, the permission communication module establishes a communication token maintenance table according to device security interaction information, and the device generates a device communication token maintenance table according to the communication token maintenance table; Step 2, according to the device interaction requirement information and the device communication token maintenance table, determine whether the target interaction device is an already interacted device. If it is an already interacted device, enter Step 3; if it is an un-interacted device, enter Step 4; Step 3: Interact with the target interaction device through the device communication token maintenance table. After the interaction is completed, proceed to Step 7; Step 4: The permission communication module generates a point-to-point device communication token based on the device interaction request and the communication token maintenance table. The device performs point-to-point interaction with the target interaction device according to the point-to-point device communication token. If the interaction is secure, according to the inheritance interaction relationship, the inheritance interaction device of the device interacts with the device. If the interaction is secure, proceed to Step 5; otherwise, it is determined that the permission of the inheritance interaction device is terminated, and proceed to Step 6; Step 5: Perform the interaction between the inheritance interaction device of the inheritance interaction device and the device until the interaction of all inheritance devices is completed, and proceed to Step 6; Step 6: Update the device communication token maintenance table according to the inheritance interaction devices that have interacted securely; Step 7: Update the communication token maintenance table according to the updated device communication token maintenance table to complete the security protection of network devices.

[0008] Furthermore, the permission communication module establishes a communication token maintenance table based on the device security interaction information. The device generates a device communication token maintenance table according to the communication token maintenance table, including: If there is a secure interaction event between two devices, the permission communication module retains the communication token between the corresponding two devices. The permission communication module establishes a communication token list for the corresponding device according to the device information in the retained communication token; all the communication token lists of the corresponding devices constitute the communication token maintenance table; The device obtains the communication token list of the corresponding device in the communication token maintenance table to obtain the device communication token maintenance table; Wherein the communication token is the communication permission between two devices in the interaction event, and is generated by the permission communication module according to the target interaction device information in the device interaction requirement.

[0009] Furthermore, judging whether the target interaction device is an interacted device according to the device interaction requirement information and the device communication token maintenance table includes: The interacted device is the corresponding device that interacts with the device in the device communication token maintenance table; the interacted device includes a direct interaction device and an inheritance interaction device. If there is a communication token with the target interaction device in the device communication token maintenance table, the target device is a direct interaction device; If the interacted device of the interacted device in the device communication token maintenance table is the target interaction device, the target interaction device is the inheritance interaction device of the device; Otherwise, the target device is an un-interacted device.

[0010] Further, the permission communication module generates a peer-to-peer device communication token according to the device interaction request and the communication token maintenance table. The device performs peer-to-peer interaction with the target interaction device according to the peer-to-peer device communication token. If the interaction is secure, according to the inherited interaction relationship, the inherited interaction device of the device interacts with the device, including: The permission communication module generates a communication permission between the device and the target interaction device according to the target device information in the device interaction request. The device interacts with the target interaction device according to the communication permission. If no security event occurs in the target device, the interaction between the device and the target device is secure. Then, according to the inherited interaction relationship, the inherited interaction device of the device interacts with the device.

[0011] Further, updating the device communication token maintenance table according to the securely interacted inherited interaction devices includes: Generating corresponding communication tokens according to the securely interacted inherited interaction devices and updating them to the device communication token maintenance table.

[0012] Further, updating the communication token maintenance table according to the updated device communication token maintenance table to complete the security protection of network devices includes: The permission communication module updates the communication token list of the corresponding device in the communication token maintenance table according to the updated device communication token maintenance table.

[0013] The network device security protection system based on big data applies the network device security protection method based on big data, including a permission communication module, a device information collection module, and a device security event monitoring module; the device information collection module and the device security event monitoring module are respectively connected to the permission communication module.

[0014] The permission communication module includes a communication token maintenance module and a communication token generation module; The communication token maintenance module is used to update and modify the communication token maintenance table; The communication token generation module is used to generate communication tokens between device groups according to the device information of the two interacting devices.

[0015] The beneficial effects of the present invention are as follows: The present invention introduces a dynamic token management mechanism, which dynamically generates and updates communication tokens according to the secure interaction information and requirements of devices. Compared with traditional static tokens, dynamic tokens have higher security and flexibility, and can effectively resist security threats such as replay attacks and token leakage. At the same time, the present invention can dynamically adjust the security protection strategy according to changes in the network environment and security threats, improving the adaptive ability of the system.

[0016] The present invention fully considers the inheritance interaction relationship among network devices. On the basis of devices and security interaction devices, it further provides security protection for inheritance interaction devices. This multi-level protection mechanism can ensure the security of the entire interaction chain and prevent attackers from launching attacks through intermediate devices. Compared with traditional single-point protection methods, the present invention has a more comprehensive protection scope and can cope with complex network attack scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a schematic flowchart of a network device security protection method based on big data; Figure 2 is a schematic flowchart for determining the type of a target interaction device; Figure 3 is a schematic diagram of the principle of a network device security protection system based on big data. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0018] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings, but the protection scope of the present invention is not limited to the following description.

[0019] The features and performance of the present invention will be further described in detail below with reference to the embodiments.

[0020] As Figure 1 shown, a network device security protection method based on big data includes the following steps: Step 1, the permission communication module establishes a communication token maintenance table according to device security interaction information, and the device generates a device communication token maintenance table according to the communication token maintenance table; Step 2, according to the device interaction requirement information and the device communication token maintenance table, determine whether the target interaction device is an already-interacted device. If it is an already-interacted device, go to Step 3; if it is an un-interacted device, go to Step 4; Step 3, interact with the target interaction device through the device communication token maintenance table. After the interaction is completed, go to Step 7; Step 4, the permission communication module generates a point-to-point device communication token according to the device interaction request and the communication token maintenance table. The device performs point-to-point interaction with the target interaction device according to the point-to-point device communication token. If the interaction is secure, according to the inheritance interaction relationship, the inheritance interaction device of the device interacts with the device. If the interaction is secure, go to Step 5; otherwise, it is determined that the inheritance interaction device permission is terminated, and go to Step 6; Step 5, perform the interaction between the inheritance interaction device of the inheritance interaction device and the device until the interaction of all inheritance devices is completed, and go to Step 6; Step 6, update the device communication token maintenance table according to the already-securely-interacted inheritance interaction devices; Step 7: Update the communication token maintenance table according to the updated device communication token maintenance table to complete the security protection of network devices.

[0021] The permission communication module establishes a communication token maintenance table based on device security interaction information. The device generates a device communication token maintenance table based on the communication token maintenance table, including: If there is a security interaction event between two devices, the permission communication module retains the communication tokens between the corresponding two devices. The permission communication module, based on the device information in the retained communication tokens, establishes a communication token list for the corresponding device for each of the two devices according to the two devices respectively; all the communication token lists of the corresponding devices constitute the communication token maintenance table. The device obtains the communication token list of the corresponding device in the communication token maintenance table to obtain the device communication token maintenance table. Wherein the communication token is the communication permission between two devices in the interaction event, and is generated by the permission communication module according to the target interaction device information in the device interaction requirements.

[0022] Such as Figure 2 shown, determining whether the target interaction device is an already-interacted device according to the device interaction requirement information and the device communication token maintenance table includes: The already-interacted device is the corresponding device that interacts with the device in the device communication token maintenance table; the already-interacted device includes a direct interaction device and an inherited interaction device. If there is a communication token with the target interaction device in the device communication token maintenance table, then the target device is a direct interaction device. If the already-interacted device of the already-interacted device exists in the device communication token maintenance table and is the target interaction device, then the target interaction device is the inherited interaction device of the device. Otherwise, the target device is an un-interacted device.

[0023] The permission communication module generates a point-to-point device communication token according to the device interaction request and the communication token maintenance table. The device performs point-to-point interaction with the target interaction device according to the point-to-point device communication token. If the interaction is secure, according to the inherited interaction relationship, the inherited interaction device of the device interacts with the device, including: The permission communication module generates a communication permission between the device and the target interaction device according to the target device information in the device interaction request, and the device interacts with the target interaction device according to the communication permission. If no security event occurs for the target device, the interaction between the device and the target device is secure, and then according to the inherited interaction relationship, the inherited interaction device of the device interacts with the device.

[0024] Updating the device communication token maintenance table according to the already-securely-interacted inherited interaction device includes: Generate a corresponding communication token based on the inherited interaction devices that have interacted securely, and update it to the device communication token maintenance table.

[0025] Updating the communication token maintenance table according to the updated device communication token maintenance table to complete the security protection of network devices includes: The permission communication module updates the communication token list of the corresponding device in the communication token maintenance table according to the updated device communication token maintenance table.

[0026] As Figure 3 shown, a network device security protection system based on big data applies the network device security protection method based on big data, including a permission communication module, a device information collection module, and a device security event monitoring module; the device information collection module and the device security event monitoring module are respectively connected to the permission communication module.

[0027] The permission communication module includes a communication token maintenance module and a communication token generation module; The communication token maintenance module is used to update and modify the communication token maintenance table; The communication token generation module is used to generate a communication token between device groups according to the device information of two interacting devices.

[0028] Specifically, the present invention proposes a network device security protection method based on big data. The innovations of the present invention are mainly reflected in the following aspects: The present invention introduces a dynamic token management mechanism, which dynamically generates and updates communication tokens according to the security interaction information and requirements of devices. Compared with traditional static tokens, dynamic tokens have higher security and flexibility, and can effectively resist security threats such as replay attacks and token leakage.

[0029] The present invention fully considers the inheritance interaction relationship between network devices, and further protects the inherited interaction devices on the basis of the devices and security interaction devices. This multi-level protection mechanism can ensure the security of the entire interaction chain and prevent attackers from launching attacks through intermediate devices.

[0030] The present invention uses big data technology to collect, store, and analyze the security interaction data of network devices, and mines valuable security information and patterns. Through machine learning algorithms, it realizes the prediction and early warning of security threats, and improves the intelligence and accuracy of security protection.

[0031] The present invention adopts a modular system architecture, decouples and encapsulates core components such as a permission communication module, a device information collection module, and a device security event monitoring module. This architecture improves the scalability and maintainability of the system, and is convenient for customization and optimization according to different security requirements.

[0032] Specifically, it includes: The permission communication module obtains the secure interaction information of the network device through the device information collection module, including the device's identity identifier, interaction time, interaction content, etc. According to the device secure interaction information, the permission communication module uses the communication token generation module to generate corresponding communication tokens. The communication token is a credential for secure communication between devices and contains information such as the device's identity information and interaction permissions. The permission communication module groups the generated communication tokens according to the device identity and establishes a communication token maintenance table. The communication token maintenance table records the communication token list of each device and is used for subsequent secure communication between devices.

[0033] The device obtains the corresponding communication token maintenance table through the permission communication module and extracts the communication token information related to itself from it. The device generates a device communication token maintenance table according to the obtained communication token information. This table records the communication tokens required for the device to conduct secure communication with other devices and is an important basis for the device to conduct secure interactions.

[0034] Based on the device interaction requirement information and the device communication token maintenance table, it is determined whether the target interaction device is an already-interacted device: The device generates device interaction requirement information according to its own business requirements, including the identity identifier of the target interaction device, interaction content, etc.

[0035] The device compares the device interaction requirement information with the device communication token maintenance table to determine whether the target interaction device is an already-interacted device. If there is a communication token corresponding to the target interaction device in the device communication token maintenance table, it is determined that the target interaction device is an already-interacted device; otherwise, it is determined that the target interaction device is an un-interacted device.

[0036] If the target interaction device is an already-interacted device, the device conducts secure communication with the target interaction device according to the communication token information in the device communication token maintenance table. During the communication process, both parties ensure the security and legality of the communication by verifying the validity of the communication token.

[0037] If the target interaction device is an un-interacted device, the permission communication module generates a point-to-point device communication token according to the device interaction request and the communication token maintenance table.

[0038] The device generates a device interaction request according to the device interaction requirement information, including information such as the identity identifier of the target interaction device, interaction content, security requirements, etc.

[0039] After receiving the device interaction request, the permission communication module generates a point-to-point device communication token according to the communication token maintenance table and the preset security policy. The point-to-point device communication token is a temporary communication token generated for the secure interaction between specific devices and has higher security and flexibility.

[0040] The device performs point-to-point secure interaction with the target interaction device based on the generated point-to-point device communication token. During the interaction process, both parties ensure the security and legality of the interaction by verifying the validity of the point-to-point device communication token.

[0041] If the interaction is secure, according to the inherited interaction relationship, the inherited interaction device of the device interacts with the device: on the premise of secure point-to-point interaction, the device determines whether there is an inherited interaction device according to the preset rules of the inherited interaction relationship. The inherited interaction relationship refers to the indirect interaction relationship between the device and the target interaction device, such as the device interacting with other devices through the target interaction device.

[0042] If there is an inherited interaction device, the device interacts with the inherited interaction device according to the rules of the inherited interaction relationship. During the interaction process, both parties also need to verify the validity of the communication token to ensure the security and legality of the interaction.

[0043] If the interaction is not secure, it is determined that the permission of the inherited interaction device is terminated. During the interaction process of the inherited interaction device, the device monitors the security of the interaction in real time. Once it is found that there are security threats or abnormal behaviors in the interaction, it is immediately determined that the permission of the inherited interaction device is terminated.

[0044] In the case of multiple-level inherited interaction relationships, the device needs to interact with each level of inherited interaction device in turn. Each level of interaction requires verifying the validity of the communication token to ensure the security and legality of the interaction. When all inherited interaction devices have completed secure interaction, the device determines that the interaction with all inherited devices is completed.

[0045] The device records the information of the inherited interaction devices that have had secure interaction, including device identity identification, interaction time, interaction content, etc. The device updates the device communication token maintenance table according to the information of the inherited interaction devices that have had secure interaction. The updated content includes adding new communication token information, updating the validity period of existing communication tokens, etc.

[0046] The permission communication module updates the communication token maintenance table according to the updated information of the device communication token maintenance table sent by the device. The updated content includes synchronizing the new communication token information in the device communication token maintenance table, updating the validity period of the communication token, etc.

[0047] By dynamically updating the communication token maintenance table and the device communication token maintenance table, the permission communication module and the device jointly complete the security protection of network devices. Throughout the process, the system can dynamically adjust the security protection strategy according to the changes in the network environment and security threats, improving the adaptive ability and protection effect of the system.

[0048] Example: Implementation case of the network device security interaction system Three core devices are deployed in the intranet of an enterprise: a router (Device A, ID: RA-001), a file server (Device B, ID: FS-002), and a newly connected database server (Device C, ID: DB-003). The Permission Communication Module (PCM) is responsible for the network-wide token management, and the Device Information Collection Module (DIM) collects device status in real time.

[0049] 1. Establishment of Communication Token Generation and Maintenance Table Step 1.1 Device Information Collection DIM scans the open ports of Device A and obtains its secure interaction information: {Device ID: RA-001, Interaction Time: 2024-09-01 09:00, Interaction Content: Routing Table Synchronization, Authentication Method: SHA-256}. After obtaining similar information from Device B, it is sent to PCM.

[0050] Step 1.2 Token Generation PCM calls the communication token generation module to generate a token for Device A: Token_RA-001 = {Device ID: RA-001, Permission: Routing Management, Validity Period: 2024-09-02 09:00, Signature: PCM-PrivKey}, and stores it in the communication token maintenance table grouped by device ID, as shown in Table 1.

[0051] Table 1 Example of Communication Token Maintenance Table 2. Establishment of Device Communication Token Maintenance Table Step 2.1 Device Obtains Token Table Device B requests its own token from PCM, and PCM returns: {Device ID: FS-002, Token List: [Token_FS-002_v3], Validity Period: 2024-09-02 08:00}. Device B generates a local device communication token maintenance table (as shown in Table 2).

[0052] Table 2 Example of Device B Communication Token Maintenance Table 3. Device Interaction Judgment and Secure Communication Step 3.1 Interaction Requirement Generation Device B needs to send a database backup request to Device C and generates an interaction requirement: {Target ID: DB-003, Content: Full Backup, Security Requirement: TLS1.3}.

[0053] Step 3.2 Token Existence Check Device B queries Table 2 and finds that the token corresponding to Device C is empty, and determines it as an un-interacted device.

[0054] Step 3.3 Point-to-Point Token Generation Device B sends an interaction request to the PCM, and the PCM generates a temporary token according to the policy: TempToken_DB-003 = {Validity period: 2024-09-01 11:00, Permission: Backup operation, Encryption: AES-256}.

[0055] Step 3.4 Secure Interaction Execution Device B uses TempToken_DB-003 to communicate with Device C, and both parties verify the token signature and validity period to complete the backup.

[0056] 4. Inheritance Interaction Relationship Processing Step 4.1 Inheritance Relationship Detection The backup of Device C needs to be synchronized to the disaster recovery center (Device D, ID: DR-004), and there is an inheritance relationship rule: DB-003 → DR-004.

[0057] Step 4.2 Multi-Level Security Verification Device B interacts with Device C and Device D in sequence: 1. After verifying TempToken_DB-003, Device C generates a sub-token SubToken_DR-004; 2. Device D verifies SubToken_DR-004 to complete disaster recovery synchronization; Step 4.3 Security Monitoring and Termination If Device D detects abnormal traffic, it immediately sends an alarm to the PCM. The PCM adds DR-004 to the blacklist and updates the global token table.

[0058] 5. Dynamic Table Update and Policy Adjustment Step 5.1 Local Table Update Device B adds the token of Device C to Table 2: {Target device ID: DB-003, Token content: TempToken_DB-003, Interaction record: Backup completed at 2024-09-01 10:45}; Step 5.2 Global Table Synchronization The PCM receives the update request from Device B, adds TempToken_DB-003 to Table 1, and shortens its validity period to 2024-09-01 11:30 to cope with temporary operation risks.

[0059] Through dynamic token lifecycle management (initial tokens are valid for a long time + temporary tokens have a short cycle) and multi-level verification of inheritance relationships, the system successfully intercepted 3 illegal access attempts within 48 hours, the communication efficiency between devices increased by 40%, and the security policy response latency was less than 2 seconds.

Claims

1. A network device security protection method based on big data, characterized in that It includes the following steps: Step 1, the permission communication module establishes a communication token maintenance table based on the device security interaction information, and the device generates a device communication token maintenance table according to the communication token maintenance table; Step 2, based on the device interaction requirement information and the device communication token maintenance table, determine whether the target interaction device is an already-interacted device. If it is an already-interacted device, go to Step 3; if it is a non-interacted device, go to Step 4; Step 3, interact with the target interaction device through the device communication token maintenance table. After the interaction is completed, go to Step 7; Step 4, the permission communication module generates a point-to-point device communication token according to the device interaction request and the communication token maintenance table. The device conducts point-to-point interaction with the target interaction device according to the point-to-point device communication token. If the interaction is secure, according to the inheritance interaction relationship, the inheritance interaction device of the device interacts with the device. If the interaction is secure, go to Step 5; Otherwise, it is determined that the permission of the inheritance interaction device is terminated, and go to Step 6; Step 5, conduct the interaction between the inheritance interaction device of the inheritance interaction device and the device until the interaction of all inheritance devices is completed, and go to Step 6; Step 6, update the device communication token maintenance table according to the already-securely-interacted inheritance interaction devices; Step 7, update the communication token maintenance table according to the updated device communication token maintenance table to complete the security protection of the network device.

2. The method for network device security protection based on big data according to claim 1, characterized in that The permission communication module establishes a communication token maintenance table based on the device security interaction information, and the device generates a device communication token maintenance table according to the communication token maintenance table, including: If there is a security interaction event between two devices, the permission communication module retains the communication token between the corresponding two devices. The permission communication module establishes a communication token list for the corresponding device according to the device information in the retained communication token; all the communication token lists of the corresponding devices constitute the communication token maintenance table; The device obtains the communication token list of the corresponding device in the communication token maintenance table to obtain the device communication token maintenance table; Wherein the communication token is the communication permission between two devices in the interaction event, and is generated by the permission communication module according to the target interaction device information in the device interaction requirement.

3. The network device security protection method based on big data according to claim 2, wherein, The determination of whether the target interaction device is an already-interacted device according to the device interaction requirement information and the device communication token maintenance table includes: The already-interacted device is the corresponding device that interacts with the device in the device communication token maintenance table; the already-interacted device includes a direct interaction device and an inheritance interaction device. If there is a communication token with the target interaction device in the device communication token maintenance table, the target device is a direct interaction device; If the already-interacted device of the already-interacted device in the device communication token maintenance table is the target interaction device, the target interaction device is the inheritance interaction device of the device; Otherwise, the target device is a non-interacted device.

4. The method for network device security protection based on big data according to claim 3, wherein The permission communication module generates a point-to-point device communication token according to the device interaction request and the communication token maintenance table. The device conducts point-to-point interaction with the target interaction device according to the point-to-point device communication token. If the interaction is secure, according to the inheritance interaction relationship, the inheritance interaction device of the device interacts with the device, including: The permission communication module generates a communication permission between the device and the target interaction device according to the target device information in the device interaction request, and the device interacts with the target interaction device according to the communication permission. If no security event occurs in the target device, the interaction between the device and the target device is secure, and then according to the inheritance interaction relationship, the inheritance interaction device of the device interacts with the device.

5. The method for network device security protection based on big data according to claim 4, wherein, Updating the device communication token maintenance table according to the inherited interaction device that has interacted securely includes: Generating a corresponding communication token according to the inherited interaction device that has interacted securely and updating it to the device communication token maintenance table.

6. The network device security protection method based on big data according to claim 1, wherein Updating the communication token maintenance table according to the updated device communication token maintenance table to complete the security protection of network devices includes: The permission communication module updates the communication token list of the corresponding device in the communication token maintenance table according to the updated device communication token maintenance table.

7. A network device security protection system based on big data, characterized in that, Applying the network device security protection method based on big data according to any one of claims 1-6, including a permission communication module, a device information collection module, and a device security event monitoring module; the device information collection module and the device security event monitoring module are respectively connected to the permission communication module.

8. The network device security protection system based on big data according to claim 7, characterized in that The permission communication module includes a communication token maintenance module and a communication token generation module; The communication token maintenance module is used to update and modify the communication token maintenance table; The communication token generation module is used to generate a communication token between device groups according to the device information of the two interacting devices.

Images