Network equipment security protection system and protection method based on big data

Abstract

The present invention discloses a big data-based network device security protection system and method, relating to the field of network security. Traditional filtering of data packets entering and leaving the network based on predefined rules is difficult to effectively address attacks and unknown threats from within the network. By introducing a dynamic token management mechanism, communication tokens are dynamically generated and updated based on the device's security interaction information and needs. Compared to traditional static tokens, dynamic tokens offer greater security and flexibility, effectively defending against security threats such as replay attacks and token leaks. Furthermore, the present invention can dynamically adjust security protection strategies based on changes in the network environment and security threats, improving the system's adaptability.

Description

Technical Field

[0001] The present invention relates to the field of network equipment security, and in particular to a network equipment security protection system and protection method based on big data. Background Art

[0002] With the rapid development of the internet and the widespread access to smart devices, network devices face increasingly severe security threats. Traditional network security protection methods, such as firewalls, intrusion detection systems (IDS), and antivirus software, while effective for a period, are gradually revealing their limitations when dealing with today's complex and volatile network environment and emerging security threats.

[0003] Traditional firewalls primarily filter inbound and outbound data packets based on predefined rules, making them ineffective against attacks and unknown threats originating from within the network. While IDS can monitor abnormal behavior within the network, its detection rules often lag behind the development of attack techniques and suffer from high rates of false positives and false negatives.

[0004] Traditional security approaches typically employ static defense strategies. Once an attacker breaches the defenses, they can freely roam within the network, causing significant damage. These static mechanisms lack dynamic adaptability and self-learning capabilities, making them incapable of responding to ever-changing attack methods.

[0005] Traditional approaches often focus on protecting individual devices or local networks, lacking a comprehensive understanding of the overall network security landscape. In large-scale network environments, this localized approach can easily lead to blind spots, which attackers can exploit to launch attacks undetected.

[0006] With the widespread adoption of big data technologies, the amount of data generated by network devices is exploding. Traditional security approaches often face performance bottlenecks when processing massive amounts of data, making real-time analysis and response difficult. Furthermore, emerging attack methods in big data environments, such as advanced persistent threats (APTs), are highly concealed and have long attack chains, making them difficult to effectively detect and defend against with traditional methods. Summary of the Invention

[0007] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a network device security protection method based on big data, comprising the following steps:

[0008] Step 1: The permission communication module establishes a communication token maintenance table according to the device security interaction information, and the device generates a device communication token maintenance table according to the communication token maintenance table;

[0009] Step 2: Determine whether the target interactive device is an interacted device based on the device interaction requirement information and the device communication token maintenance table. If it is an interacted device, proceed to step 3; if it is a non-interacted device, proceed to step 4.

[0010] Step 3: interact with the target interactive device through the device communication token maintenance table. After the interaction is completed, proceed to step 7;

[0011] In step 4, the permission communication module generates a point-to-point device communication token based on the device interaction request and the communication token maintenance table. The device performs point-to-point interaction with the target interaction device based on the point-to-point device communication token. If the interaction is safe, the device's inherited interaction device interacts with the device based on the inherited interaction relationship. If the interaction is safe, the process proceeds to step 5. Otherwise, the inherited interaction device permission is determined to be terminated, and the process proceeds to step 6.

[0012] Step 5: The inherited interactive device interacts with the inherited interactive device until the interaction of all inherited devices is completed, and then proceeds to step 6;

[0013] Step 6: Update the device communication token maintenance table based on the inherited interaction device that has safely interacted;

[0014] Step seven: Update the communication token maintenance table according to the updated device communication token maintenance table to complete the network device security protection.

[0015] Furthermore, the permission communication module establishes a communication token maintenance table according to the device security interaction information, and the device generates a device communication token maintenance table according to the communication token maintenance table, including:

[0016] If there is a security interaction event between two devices, the permission communication module retains the communication tokens between the two devices. The permission communication module establishes a communication token list of the corresponding devices based on the device information in the retained communication token and the two devices respectively; the communication token lists of all corresponding devices constitute a communication token maintenance table;

[0017] The device obtains the communication token list of the corresponding device in the communication token maintenance table to obtain the device communication token maintenance table;

[0018] The communication token is a communication permission between two devices in an interaction event, and is generated by the permission communication module according to the target interaction device information in the device interaction requirement.

[0019] Furthermore, judging whether the target interactive device is an interacted device according to the device interaction requirement information and the device communication token maintenance table includes:

[0020] The interacted device is the corresponding device that interacts with the device in the device communication token maintenance table; the interacted device includes direct interaction devices and inherited interaction devices. If the device communication token maintenance table contains a communication token with the target interaction device, the target device is a direct interaction device;

[0021] If the interacted device in the device communication token maintenance table is the target interacted device, the target interacted device is the inherited interacted device of the device;

[0022] Otherwise, the target device is a non-interactive device.

[0023] Furthermore, the permission communication module generates a point-to-point device communication token based on the device interaction request and the communication token maintenance table. The device performs point-to-point interaction with the target interaction device based on the point-to-point device communication token. If the interaction is safe, the device's inherited interaction device interacts with the device based on the inherited interaction relationship, including:

[0024] The permission communication module generates a communication permission between the device and the target interaction device based on the target device information in the device interaction request, and the device interacts with the target interaction device based on the communication permission. If no security incident occurs in the target device, the interaction between the device and the target device is safe. Then, based on the inherited interaction relationship, the inherited interaction device of the device interacts with the device.

[0025] Furthermore, the updating of the device communication token maintenance table according to the inherited interaction device that has safely interacted includes:

[0026] Generate a corresponding communication token based on the inherited interaction device that has safely interacted, and update it to the device communication token maintenance table.

[0027] Furthermore, the updating of the communication token maintenance table according to the updated device communication token maintenance table to complete the network device security protection includes:

[0028] The permission communication module updates the communication token list of the corresponding device in the communication token maintenance table according to the updated device communication token maintenance table.

[0029] A network equipment security protection system based on big data applies the network equipment security protection method based on big data, including an authority communication module, an equipment information collection module, and an equipment security event monitoring module; the equipment information collection module and the equipment security event monitoring module are respectively connected to the authority communication module.

[0030] The authority communication module includes a communication token maintenance module and a communication token generation module;

[0031] The communication token maintenance module is used to update and modify the communication token maintenance table;

[0032] The communication token generation module is used to generate a communication token between device groups based on the device information of two interacting devices.

[0033] The present invention has the following beneficial effects: It introduces a dynamic token management mechanism that dynamically generates and updates communication tokens based on the device's security interaction information and needs. Compared to traditional static tokens, dynamic tokens offer greater security and flexibility, effectively defending against security threats such as replay attacks and token leakage. Furthermore, the present invention dynamically adjusts security protection strategies based on changes in the network environment and security threats, improving the system's adaptability.

[0034] This invention fully considers the inherited interaction relationships between network devices. Beyond the security interactions between devices, it also provides security protection for inherited interaction devices. This multi-layered protection mechanism ensures the security of the entire interaction chain, preventing attackers from launching attacks through intermediary devices. Compared with traditional single-point protection methods, this invention offers a more comprehensive protection range and can cope with complex network attack scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a flowchart of a network device security protection method based on big data;

[0036] Figure 2 A flowchart for determining the type of target interactive device;

[0037] Figure 3 This is a schematic diagram of the principle of the network equipment security protection system based on big data. DETAILED DESCRIPTION

[0038] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings, but the protection scope of the present invention is not limited to the following.

[0039] The features and performance of the present invention are further described in detail below with reference to the embodiments.

[0040] like Figure 1 As shown, the network device security protection method based on big data includes the following steps:

[0041] Step 1: The permission communication module establishes a communication token maintenance table according to the device security interaction information, and the device generates a device communication token maintenance table according to the communication token maintenance table;

[0042] Step 2: Determine whether the target interactive device is an interacted device based on the device interaction requirement information and the device communication token maintenance table. If it is an interacted device, proceed to step 3; if it is a non-interacted device, proceed to step 4.

[0043] Step 3: interact with the target interactive device through the device communication token maintenance table. After the interaction is completed, proceed to step 7;

[0044] In step 4, the permission communication module generates a point-to-point device communication token based on the device interaction request and the communication token maintenance table. The device performs point-to-point interaction with the target interaction device based on the point-to-point device communication token. If the interaction is safe, the device's inherited interaction device interacts with the device based on the inherited interaction relationship. If the interaction is safe, the process proceeds to step 5. Otherwise, the inherited interaction device permission is determined to be terminated, and the process proceeds to step 6.

[0045] Step 5: The inherited interactive device interacts with the inherited interactive device until the interaction of all inherited devices is completed, and then proceeds to step 6;

[0046] Step 6: Update the device communication token maintenance table based on the inherited interaction device that has safely interacted;

[0047] Step seven: Update the communication token maintenance table according to the updated device communication token maintenance table to complete the network device security protection.

[0048] The permission communication module establishes a communication token maintenance table according to the device security interaction information, and the device generates a device communication token maintenance table according to the communication token maintenance table, including:

[0049] If there is a security interaction event between two devices, the permission communication module retains the communication tokens between the two devices. The permission communication module establishes a communication token list of the corresponding devices based on the device information in the retained communication token and the two devices respectively; the communication token lists of all corresponding devices constitute a communication token maintenance table;

[0050] The device obtains the communication token list of the corresponding device in the communication token maintenance table to obtain the device communication token maintenance table;

[0051] The communication token is a communication permission between two devices in an interaction event, and is generated by the permission communication module according to the target interaction device information in the device interaction requirement.

[0052] like Figure 2 As shown, the method of determining whether the target interactive device is an interacted device based on the device interaction requirement information and the device communication token maintenance table includes:

[0053] The interacted device is the corresponding device that interacts with the device in the device communication token maintenance table; the interacted device includes direct interaction devices and inherited interaction devices. If the device communication token maintenance table contains a communication token with the target interaction device, the target device is a direct interaction device;

[0054] If the interacted device in the device communication token maintenance table is the target interacted device, the target interacted device is the inherited interacted device of the device;

[0055] Otherwise, the target device is a non-interactive device.

[0056] The permission communication module generates a point-to-point device communication token based on the device interaction request and the communication token maintenance table. The device performs point-to-point interaction with the target interaction device based on the point-to-point device communication token. If the interaction is safe, the device's inherited interaction device interacts with the device based on the inherited interaction relationship, including:

[0057] The permission communication module generates a communication permission between the device and the target interaction device based on the target device information in the device interaction request, and the device interacts with the target interaction device based on the communication permission. If no security incident occurs in the target device, the interaction between the device and the target device is safe. Then, based on the inherited interaction relationship, the inherited interaction device of the device interacts with the device.

[0058] The updating of the device communication token maintenance table according to the inherited interaction device that has safely interacted includes:

[0059] Generate a corresponding communication token based on the inherited interaction device that has safely interacted, and update it to the device communication token maintenance table.

[0060] The updating of the communication token maintenance table according to the updated device communication token maintenance table to complete the network device security protection includes:

[0061] The permission communication module updates the communication token list of the corresponding device in the communication token maintenance table according to the updated device communication token maintenance table.

[0062] like Figure 3 As shown, the network equipment security protection system based on big data applies the network equipment security protection method based on big data, including an authority communication module, an equipment information collection module, and an equipment security event monitoring module; the equipment information collection module and the equipment security event monitoring module are respectively connected to the authority communication module.

[0063] The authority communication module includes a communication token maintenance module and a communication token generation module;

[0064] The communication token maintenance module is used to update and modify the communication token maintenance table;

[0065] The communication token generation module is used to generate a communication token between device groups based on the device information of two interacting devices.

[0066] Specifically, the present invention proposes a network device security protection method based on big data. The innovations of the present invention are mainly reflected in the following aspects:

[0067] This invention introduces a dynamic token management mechanism that dynamically generates and updates communication tokens based on the security interaction information and needs of the devices. Compared with traditional static tokens, dynamic tokens offer greater security and flexibility, effectively resisting security threats such as replay attacks and token leaks.

[0068] This invention fully considers the inherited interaction relationship between network devices. On the basis of the device and the secure interaction device, it further provides security protection for the inherited interaction device. This multi-layered protection mechanism can ensure the security of the entire interaction chain and prevent attackers from launching attacks through intermediate devices.

[0069] This invention uses big data technology to collect, store, and analyze security interaction data from network devices, mining valuable security information and patterns. Through machine learning algorithms, it predicts and warns of security threats, improving the intelligence and precision of security protection.

[0070] The present invention adopts a modular system architecture, decoupling and encapsulating core components such as the permission communication module, device information collection module, and device security event monitoring module. This architecture improves the system's scalability and maintainability, facilitating customization and optimization based on different security requirements.

[0071] Specifically include:

[0072] The Permission Communication Module obtains secure interaction information from network devices through the Device Information Collection Module, including device identity, interaction time, and interaction content. Based on this secure interaction information, the Permission Communication Module generates corresponding communication tokens using the Communication Token Generation Module. Communication tokens are credentials for secure communication between devices and contain information such as the device's identity and interaction permissions. The Permission Communication Module groups the generated communication tokens by device identity and establishes a Communication Token Maintenance Table. This table records a list of communication tokens for each device, which is used for subsequent secure communication between devices.

[0073] The device uses the permissioned communication module to retrieve the corresponding communication token maintenance table and extract its own communication token information. Based on this information, the device generates a device communication token maintenance table. This table records the communication tokens required for secure communication between the device and other devices and serves as a crucial basis for secure device interaction.

[0074] Based on the device interaction requirement information and the device communication token maintenance table, determine whether the target interaction device is an interacted device: the device generates device interaction requirement information based on its own business needs, including the identity of the target interaction device, interaction content, etc.

[0075] The device compares the device interaction request information with the device communication token maintenance table to determine whether the target interaction device is an existing interaction device. If a communication token corresponding to the target interaction device exists in the device communication token maintenance table, the target interaction device is determined to be an existing interaction device; otherwise, the target interaction device is determined to be a non-interaction device.

[0076] If the target device is already an active device, the device uses the communication token information in the device communication token maintenance table to securely communicate with the target device. During the communication process, both parties verify the validity of the communication token to ensure the security and legitimacy of the communication.

[0077] If the target interactive device is a non-interactive device, the permission communication module generates a point-to-point device communication token according to the device interaction request and the communication token maintenance table.

[0078] The device generates a device interaction request based on the device interaction requirement information, including the identity of the target interaction device, interaction content, security requirements and other information.

[0079] After receiving a device interaction request, the permissioned communication module generates a peer-to-peer device communication token based on the communication token maintenance table and pre-set security policies. Peer-to-peer device communication tokens are temporary communication tokens generated for secure interactions between specific devices, offering enhanced security and flexibility.

[0080] The device uses the generated peer-to-peer communication token to conduct secure peer-to-peer interaction with the target device. During the interaction, both parties verify the validity of the peer-to-peer communication token to ensure the security and legitimacy of the interaction.

[0081] If interaction is safe, the device's inherited interaction device interacts with the device based on the inherited interaction relationship. Under the premise of point-to-point interaction safety, the device determines whether an inherited interaction device exists based on the preset inherited interaction relationship rules. An inherited interaction relationship refers to an indirect interaction relationship between a device and a target interaction device, such as when a device interacts with another device through a target interaction device.

[0082] If there is an inherited interaction device, the device will interact with the inherited interaction device according to the inherited interaction relationship rules. During the interaction process, both parties also need to verify the validity of the communication token to ensure the security and legitimacy of the interaction.

[0083] If the interaction is unsafe, the inherited interaction device permissions will be terminated. During the interaction process, the device monitors the security of the interaction in real time. If a security threat or abnormal behavior is found in the interaction, the inherited interaction device permissions will be terminated immediately.

[0084] In the case of multiple levels of inherited interaction, a device must interact with each level of inherited interaction device in turn. Each level of interaction requires verification of the validity of the communication token to ensure the security and legitimacy of the interaction. When all inherited interaction devices have completed secure interaction, the device considers that all inherited devices have completed interaction.

[0085] The device records the inherited interaction device information that has been securely interacted with, including the device identity, interaction time, and interaction content. Based on the inherited interaction device information that has been securely interacted with, the device updates the device communication token maintenance table. This update includes adding new communication token information and updating the validity period of existing communication tokens.

[0086] The permission communication module updates the communication token maintenance table based on the updated device communication token maintenance table information sent by the device. The update content includes synchronizing the newly added communication token information in the device communication token maintenance table and updating the validity period of the communication token.

[0087] By dynamically updating the communication token maintenance table and the device communication token maintenance table, the permissioned communication module and the device jointly implement security protection for network devices. Throughout this process, the system can dynamically adjust security protection strategies based on changes in the network environment and security threats, improving the system's adaptability and protection effectiveness.

[0088] Example: Implementation case of network equipment security interaction system

[0089] An enterprise intranet deployed three core devices: a router (Device A, ID: RA-001), a file server (Device B, ID: FS-002), and a newly connected database server (Device C, ID: DB-003). The Permission Communication Module (PCM) was responsible for network-wide token management, while the Device Information Collection Module (DIM) collected device status in real time.

[0090] 1. Communication token generation and maintenance table establishment

[0091] Step 1.1 Device information collection

[0092] The DIM scans the open ports of device A and obtains its security interaction information: {Device ID: RA-001, Interaction time: 2024-09-01 09:00, Interaction content: Routing table synchronization, Authentication method: SHA-256}. The same information is obtained from device B and sent to the PCM.

[0093] Step 1.2 Token Generation

[0094] The PCM calls the communication token generation module to generate a token for device A: Token_RA-001 = {Device ID: RA-001, Permission: Routing Management, Validity: 2024-09-02 09:00, Signature: PCM-PrivKey}, and stores it in the communication token maintenance table grouped by device ID, as shown in Table 1.

[0095] Table 1 Example of communication token maintenance table

[0096]

[0097] 2. Establishment of device communication token maintenance table

[0098] Step 2.1 Device obtains token table

[0099] Device B requests its own token from PCM, and PCM returns: {Device ID: FS-002, Token list: [Token_FS-002_v3], Validity period: 2024-09-02 08:00} Device B generates a local device communication token maintenance table (as shown in Table 2).

[0100] Table 2 Example of device B communication token maintenance table

[0101]

[0102] 3. Device interaction judgment and secure communication

[0103] Step 3.1 Generate interactive requirements

[0104] Device B needs to send a database backup request to device C, generating the following interaction requirements: {Target ID: DB-003, Content: Full backup, Security requirement: TLS1.3}.

[0105] Step 3.2 Token existence check

[0106] Device B queries Table 2 and finds that the token corresponding to device C is empty, so it determines that the device is not interacting.

[0107] Step 3.3 Peer-to-peer token generation

[0108] Device B sends an interaction request to PCM. PCM generates a temporary token based on the policy: TempToken_DB-003 = {Validity period: 2024-09-01 11:00, Permission: Backup operations, Encryption: AES-256}.

[0109] Step 3.4 Secure Interaction Execution

[0110] Device B uses TempToken_DB-003 to communicate with device C. Both parties verify the token signature and validity period, completing the backup.

[0111] 4. Inheritance interaction relationship processing

[0112] Step 4.1 Inheritance relationship detection

[0113] The backup of device C needs to be synchronized to the disaster recovery center (device D, ID: DR-004). There is an inheritance relationship rule: DB-003 → DR-004.

[0114] Step 4.2 Multi-level security verification

[0115] Device B interacts with device C and device D in sequence:

[0116] 1. After device C verifies TempToken_DB-003, it generates sub-token SubToken_DR-004;

[0117] 2. Device D verifies SubToken_DR-004 and completes disaster recovery synchronization;

[0118] Step 4.3 Safety Monitoring and Termination

[0119] If device D detects abnormal traffic, it immediately sends an alarm to PCM, which then adds DR-004 to the blacklist and updates the global token table.

[0120] 5. Dynamic table updates and policy adjustments

[0121] Step 5.1 Local table update

[0122] Device B adds the token of device C to Table 2: {target device ID: DB-003, token content: TempToken_DB-003, interaction record: 2024-09-01 10:45 Backup completed};

[0123] Step 5.2 Global table synchronization

[0124] PCM receives the update request from device B, adds TempToken_DB-003 to Table 1, and shortens its validity period to 2024-09-01 11:30 to address temporary operation risks.

[0125] Through dynamic token lifecycle management (long-term validity of the initial token + short-term validity of the temporary token) and multi-level verification of inheritance relationships, the system successfully blocked three illegal access attempts within 48 hours, the communication efficiency between devices increased by 40%, and the security policy response delay was less than 2 seconds.

Claims

1. A network equipment security protection method based on big data, characterized in that: The steps include: Step 1: The permission communication module establishes a communication token maintenance table according to the device security interaction information, and the device generates a device communication token maintenance table according to the communication token maintenance table; Step 2: Determine whether the target interactive device is an interacted device based on the device interaction requirement information and the device communication token maintenance table. If it is an interacted device, proceed to step 3; if it is a non-interacted device, proceed to step 4. Step 3: interact with the target interactive device through the device communication token maintenance table. After the interaction is completed, proceed to step 7; Step 4: The permission communication module generates a point-to-point device communication token based on the device interaction request and the communication token maintenance table. The device performs point-to-point interaction with the target interaction device based on the point-to-point device communication token. If the interaction is safe, the device's inherited interaction device interacts with the device based on the inherited interaction relationship. If the interaction is safe, the process proceeds to step 5. Otherwise, it is determined that the inherited interactive device permission is terminated, and the process goes to step 6; Step 5: The inherited interactive device interacts with the inherited interactive device until the interaction of all inherited devices is completed, and then proceeds to step 6; Step 6: Update the device communication token maintenance table based on the inherited interaction device that has safely interacted; Step 7: Update the communication token maintenance table according to the updated device communication token maintenance table to complete the network device security protection; The permission communication module establishes a communication token maintenance table according to the device security interaction information, and the device generates a device communication token maintenance table according to the communication token maintenance table, including: If there is a security interaction event between two devices, the permission communication module retains the communication tokens between the two devices. The permission communication module establishes a communication token list of the corresponding devices based on the device information in the retained communication token and the two devices respectively; the communication token lists of all corresponding devices constitute a communication token maintenance table; The device obtains the communication token list of the corresponding device in the communication token maintenance table to obtain the device communication token maintenance table; The communication token is a communication permission between two devices in an interaction event, and is generated by the permission communication module according to the target interaction device information in the device interaction requirement; The step of determining whether the target interactive device is an already interacted device based on the device interaction requirement information and the device communication token maintenance table includes: The interacted device is the corresponding device that interacts with the device in the device communication token maintenance table; the interacted device includes direct interaction devices and inherited interaction devices. If the device communication token maintenance table contains a communication token with the target interaction device, the target device is a direct interaction device; If the interacted device in the device communication token maintenance table is the target interacted device, the target interacted device is the inherited interacted device of the device; Otherwise, the target device is a non-interactive device.

2. The network equipment security protection method based on big data according to claim 1 is characterized in that: The permission communication module generates a point-to-point device communication token based on the device interaction request and the communication token maintenance table. The device performs point-to-point interaction with the target interaction device based on the point-to-point device communication token. If the interaction is safe, the device's inherited interaction device interacts with the device based on the inherited interaction relationship, including: The permission communication module generates a communication permission between the device and the target interaction device based on the target device information in the device interaction request, and the device interacts with the target interaction device based on the communication permission. If no security incident occurs in the target device, the interaction between the device and the target device is safe. Then, based on the inherited interaction relationship, the inherited interaction device of the device interacts with the device.

3. The network equipment security protection method based on big data according to claim 2 is characterized in that: The updating of the device communication token maintenance table according to the inherited interaction device that has safely interacted includes: Generate a corresponding communication token based on the inherited interaction device that has safely interacted, and update it to the device communication token maintenance table.

4. The network equipment security protection method based on big data according to claim 1 is characterized in that: The updating of the communication token maintenance table according to the updated device communication token maintenance table to complete the network device security protection includes: The permission communication module updates the communication token list of the corresponding device in the communication token maintenance table according to the updated device communication token maintenance table.

5. The network equipment security protection system based on big data is characterized by: The network device security protection method based on big data described in any one of claims 1-4 is applied, including an authority communication module, a device information collection module, and a device security event monitoring module; the device information collection module and the device security event monitoring module are respectively connected to the authority communication module.

6. The network equipment security protection system based on big data according to claim 5 is characterized in that: The authority communication module includes a communication token maintenance module and a communication token generation module; The communication token maintenance module is used to update and modify the communication token maintenance table; The communication token generation module is used to generate a communication token between device groups based on the device information of two interacting devices.

Images