Safety protection system of communication equipment

Abstract

The invention discloses a security protection system of communication equipment. According to the security protection system, an executable file directory is locked through a file system protection unit, a temporary file directory is scanned, configuration and sensitive files are encrypted, and key configuration files are locked; the network management login and operation protection unit is used for grading all accounts based on preset configuration permissions, limiting the number of login clients, executing a white list mechanism and recording login information; meanwhile, an access forbidding blacklist is periodically updated through the data center platform, and abnormity analysis is periodically carried out based on log information uploaded by communication equipment. Through linkage of file protection, login control and data center analysis, a'protection-monitoring-response 'closed loop is formed, and the fragmentation problem of a traditional scheme is solved. According to the invention, through a modular design and a collaborative mechanism, the comprehensive defense capability of the communication equipment to internal tampering, external attacks and unknown threats is remarkably improved, and the method can be widely applied to the technical field of data security.

Description

Technical Field

[0001] The present invention relates to the technical field of data security, and in particular, to a security protection system for communication devices. Background Art

[0002] With the wide application of communication devices, the security threats they face are increasing day by day. Existing security protection solutions usually have the following defects: Traditional solutions usually only rely on basic permission management, which may lead to risks such as malicious program tampering and sensitive data leakage. Most existing systems use simple account password authentication, which is vulnerable to attacks such as brute force cracking and unauthorized operations. There is a lack of real-time or regular automated anomaly detection mechanisms, making it difficult to detect potential threats in a timely manner.

[0003] Currently, some solutions adopt single protection measures (such as only encrypting configuration files or recording login logs), lacking system-level collaborative protection, resulting in fragmented security protection and making it difficult to cope with complex attack scenarios. Summary of the Invention

[0004] The present invention proposes a security protection system for communication devices, aiming to solve at least one of the technical problems in the related art to some extent. Embodiments of the present invention can achieve the security protection of communication devices.

[0005] On the one hand, embodiments of the present invention provide a security protection system for communication devices, including:

[0006] A file system protection unit, configured to lock the executable file directory, scan the temporary file directory, encrypt configuration and sensitive files, and lock key configuration files;

[0007] A network management login and operation protection unit, configured to classify all accounts based on preset configuration permissions, limit the number of login clients, implement a whitelist mechanism, and record login information;

[0008] A data center platform, configured to regularly update the blacklist of prohibited access and perform anomaly analysis regularly based on the log information uploaded by the communication device.

[0009] Optionally, when the file system protection unit locks the executable file directory, it is specifically configured to perform the following operations:

[0010] Create an executable file directory through a read-only file system to configure the executable file target to be in read-only mode and cannot be modified;

[0011] Among them, the process of creating an executable file directory by the read-only file system uses the mount command to configure the directory folder;

[0012] When the communication device is running, close the user's permission to execute the mount command.

[0013] Optionally, when the file system protection unit scans the temporary file directory, it is specifically used to perform the following operations:

[0014] Perform execution monitoring on the service process storing the temporary file directory in the communication device through an extended Berkeley packet filter;

[0015] In response to the result of the execution monitoring, find and obtain the parent process of the service process. If the parent process is not called by the service process in the communication device, perform a stop execution process on the parent process.

[0016] Optionally, when the file system protection unit encrypts the configuration and sensitive files, it is specifically used to perform the following operations:

[0017] Perform encryption processing on the configuration and sensitive files generated by the target program based on the application layer encryption method;

[0018] Among them, the key for the encryption processing is hard-coded in the target program.

[0019] Optionally, when the file system protection unit locks the critical configuration files, it is specifically used to perform the following operations:

[0020] Configure the modification permissions of the critical configuration files for the target program, and close the authorization for the target program to call and add user management.

[0021] Optionally, when the network management login and operation protection unit classifies all accounts based on the preset configuration permissions, it is specifically used to perform the following operations:

[0022] Perform a classification process of read-write differentiation on all accounts based on the preset configuration permissions; the results of the classification process include low-level users, mid-level users, and high-level users;

[0023] Among them, low-level users are configured with read-only permissions for status information; mid-level users are configured with business-level operation permissions; high-level users are configured with system management operation permissions.

[0024] Optionally, when the network management login and operation protection unit restricts the number of login clients, it is specifically used to perform the following operations:

[0025] Based on the preset timeout mechanism, perform a logout operation on the logged-in users whose continuous login time exceeds the preset timeout threshold and there is no operation during the continuous login time;

[0026] When the concurrent number of logged-in users of the login clients at the same time node exceeds the preset number threshold, perform a reject login operation on the logged-in users.

[0027] Optionally, when the network management login and operation protection unit executes the whitelist mechanism, it is specifically used to perform the following operations:

[0028] Perform login authorization management for logged-in users based on a pre-configured whitelist;

[0029] In response to a target command executed by a logged-in user who has passed the login authorization management, open the access permission of the shell page to the corresponding logged-in user;

[0030] Among them, the target command includes dynamic token verification or agreed password verification.

[0031] Optionally, when the network management login and operation protection unit records login information, it is specifically used to perform the following operations:

[0032] In response to the login operation of a logged-in user, record the login information of the logged-in user, and associate the login result of the corresponding login operation with the login information;

[0033] Among them, when the login results corresponding to the login operations of the same login information for a consecutive target number of times are login failures, block the logged-in user corresponding to the corresponding login information; the blocking process includes temporary blocking or permanent blocking.

[0034] Optionally, when the data center platform regularly updates the prohibited access blacklist and regularly performs anomaly analysis based on the log information uploaded by the communication device, it is specifically used to perform the following operations:

[0035] Regularly update the prohibited access blacklist based on the pre-collected blacklist information;

[0036] Among them, when the blacklist conflicts with the local policy of the communication device, if the priority of the local policy is greater than that of the blacklist, configure the communication device to execute the local policy;

[0037] Retrieve key error words from the log information uploaded by the communication device, or perform regular rule matching on the log information based on pre-configured rules.

[0038] The security protection system of the communication device according to the embodiments of the present invention locks the executable file directory, scans the temporary file directory, encrypts the configuration and sensitive files, and locks the key configuration files through the file system protection unit; and grades all accounts, limits the number of login clients, executes the whitelist mechanism, and records login information through the network management login and operation protection unit based on preset configuration permissions; at the same time, the data center platform regularly updates the prohibited access blacklist and regularly performs anomaly analysis based on the log information uploaded by the communication device. The present invention forms a "protection-monitoring-response" closed loop through the linkage of file protection, login control, and data center analysis, and solves the fragmentation problem of traditional solutions. Through modular design and collaborative mechanism, the present invention significantly improves the comprehensive defense ability of communication devices against internal tampering, external attacks, and unknown threats. Brief Description of the Drawings

[0039] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention, and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention, and do not constitute a limitation to the technical solution of the present invention.

[0040] Figure 1 It is a schematic diagram of the module composition of the security protection system of the communication device provided by the embodiment of the present invention;

[0041] Figure 2 It is a schematic diagram of the architecture principle of the file system protection unit provided by the embodiment of the present invention;

[0042] Figure 3 It is a schematic diagram of the architecture principle of the network management login and operation protection unit provided by the embodiment of the present invention;

[0043] Figure 4 It is a schematic diagram of the architecture principle of the data center platform provided by the embodiment of the present invention. Specific embodiments

[0044] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0045] It should be noted that although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order from the module division in the system or the order in the flowchart. The terms "first / S100", "second / S200", etc. in the specification and claims and the above drawings are used to distinguish similar objects and do not have to be used to describe a specific order or sequence.

[0046] Referring to "embodiments" herein means that the specific features, structures or characteristics described in connection with the embodiments can be included in at least one embodiment of the present invention. The phrase appears in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art will explicitly and implicitly understand that the embodiments described herein can be combined with other embodiments.

[0047] On the one hand, as Figure 1 shown, the embodiment of the present invention provides a security protection system 100 for a communication device, which may include a file system protection unit 110, a network management login and operation protection unit 120, and a data center platform 130; specifically:

[0048] The file system protection unit is used to lock the executable file directory, scan the temporary file directory, encrypt the configuration and sensitive files, and lock the critical configuration files;

[0049] It should be noted that in some embodiments, when the file system protection unit locks the executable file directory, it can specifically be used to perform the following operations: create an executable file directory through a read-only file system to configure the executable file target as read-only mode and cannot be modified; among them, the process of creating an executable file directory by the read-only file system uses the mount command to configure the directory folder; when the communication device is running, the user's permission to execute the mount command is disabled.

[0050] Exemplarily, in some specific embodiments, directories storing various executable files or services, such as / bin, / sbin, etc. directories, are not allowed to be modified and can only be viewed to prevent hackers from tampering with relevant services or executable files for attacks. In some specific application scenarios, the system uses the squanshFS read-only file system. By default, all folders and files will be in read-only mode and cannot be modified when creating the file system, but individual directories such as / tmp can be configured as tmpfs folders using the mount command as needed, so that they can have read-write permissions. These are all created and processed during the system production, and users will no longer be allowed to execute mount to make such modifications when the device is actually running. Exemptions are not considered because exemptions also bring risks. Update various services and make modifications by upgrading the software version of the entire device, and the upgrade operation requires the highest-level permission to operate. The upgrade file has a file header, and the file header contains a check field, which is the check value calculated for all subsequent file contents according to a certain check mechanism. The device only performs this for upgrades and needs to pass the verification to be considered a correct file before writing to the flash.

[0051] It should be noted that in some embodiments, when the file system protection unit scans the temporary file directory, it can specifically be used to perform the following operations: perform execution monitoring on the business processes storing the temporary file directory in the communication device through an extended Berkeley packet filter; in response to the result of the execution monitoring, find and obtain the parent process of the business process, and if the parent process is not called by the business process within the communication device, perform a stop execution process on the parent process.

[0052] Exemplarily, in some specific embodiments, the directory storing temporary files such as / tmp is scanned, and files in this directory are not allowed to have execution permissions. If a new file with execution permissions is identified, the permissions are modified to prohibit execution. At the same time, services that are already running are scanned. If there are any in the temporary directory such as / tmp, an alarm is issued and the execution is stopped. In some specific application scenarios, the execution status of processes is monitored through eBPF (extended Berkeley Packet Filter) technology. eBPF can monitor process services by implanting code. When monitoring, it will exempt business processes in the device from being called. By looking up the ppid (parent process) of the tmp process, if it is not called by a business process in the device, it is considered irrelevant to the business and has no impact, and direct stop execution processing is performed. Of course, a whitelist mechanism will also be provided during user management to allow adding corresponding process names for exemption. And additional processing actions can be no processing, termination, and isolation.

[0053] It should be noted that in some embodiments, when the file system protection unit encrypts configuration and sensitive files, it can specifically be used to perform the following operations: encrypt the configuration and sensitive files generated by the target program based on the application layer encryption method; wherein, the encryption key is hard-coded in the target program.

[0054] Exemplarily, in some specific embodiments, various configuration parameter files and sensitive files of the device are encrypted to prevent hackers from viewing relevant information. In some specific application scenarios, application layer encryption is used for file encryption. The key is hard-coded in the program. Only the relevant program decrypts according to the key, and the configuration file is also generated in the program according to a specific key.

[0055] It should be noted that in some embodiments, when the file system protection unit locks key configuration files, it can specifically be used to perform the following operations: configure the modification permissions of the key configuration files for the target program, and close the authorization for the target program to call and add user management.

[0056] Exemplarily, in some specific embodiments, the system's key configuration files such as / etc / passwd, / etc / shadow, etc. are prohibited from being changed by users and can only be modified by existing programs to prevent customers from adding or modifying accounts and permissions. In some specific application scenarios, the program is not authorized to call useradd to manage user names. All users are specified preferentially when starting the entire program of the upgraded device after being planned.

[0057] The network management login and operation protection unit is used to classify all accounts, limit the number of logged-in clients, implement a whitelist mechanism, and record login information based on preset configuration permissions;

[0058] It should be noted that in some embodiments, when the network management login and operation protection unit classifies all accounts based on preset configuration permissions, it can be specifically used to perform the following operations: perform a classification process for read / write distinction on all accounts based on preset configuration permissions; the results of the classification process include low-level users, mid-level users, and high-level users; among them, low-level users are configured with read-only permissions for status information; mid-level users are configured with business-level operation permissions; high-level users are configured with system management operation permissions.

[0059] Exemplarily, in some specific embodiments, the network management account has a classification mechanism, and low-level accounts only have viewing permissions and no configuration permissions. In some specific application scenarios, the granularity of permission division is read / write distinction. Low-level users can only view status information and cannot change business configurations and system configurations. Mid-level users can only perform business-level operations such as modifying and configuring services on the basis of low-level users. The highest-level users can perform system management operations such as system reset, parameter restoration to factory settings, parameter upgrade, and device version upgrade on the basis of the basic level.

[0060] It should be noted that in some embodiments, when the network management login and operation protection unit restricts the number of logged-in clients, it can be specifically used to perform the following operations: perform a logout operation on logged-in users whose continuous login time exceeds a preset timeout threshold and who have no operation actions during the continuous login time based on a preset timeout mechanism; when the concurrent number of logged-in users of logged-in clients at the same time node exceeds a preset number threshold, perform a reject login operation on the logged-in users.

[0061] Exemplarily, in some specific embodiments, the network management has a timeout mechanism. If there is no operation after logging in for a certain period of time, the user will be automatically logged out, such as 5 minutes. At the same time, the number of concurrent logged-in clients is also restricted to prevent hackers from logging in and operating in large numbers. In some specific application scenarios, the login timeout threshold and the concurrent number limit support user configuration and do not support exceptions. There will be a maximum threshold, and it is not allowed to configure a value exceeding this threshold.

[0062] It should be noted that in some embodiments, when the network management login and operation protection unit executes the whitelist mechanism, it can be specifically used to perform the following operations: perform login authorization management on logged-in users based on a pre-configured whitelist; in response to a target command executed by a logged-in user who has passed the login authorization management, open the access permission to the shell page for the corresponding logged-in user; among them, the target command includes dynamic token verification or agreed password verification.

[0063] Exemplarily, in some specific embodiments, network managers accessing the shell such as via ssh or telnet can set up a whitelist mechanism, and relevant commands need to be executed after logging in to enter the shell page, so as to prevent unauthorized personnel from damaging the shell. In some specific application scenarios, executing commands to enter the shell is similar to privilege elevation. Adding dynamic token verification is a relatively secure method. Another simple method is to agree on a password, and users need to remember the password themselves and cannot disclose it.

[0064] It should be noted that in some embodiments, when the network manager login and operation protection unit records login information, it can specifically be used to perform the following operations: in response to the login operation of the logged-in user, record the login information of the logged-in user, and associate the login result of the corresponding login operation with the login information; wherein, when the login results corresponding to the login operations of the same login information reach the target number consecutively and are login failures, perform a blocking process on the logged-in user corresponding to the corresponding login information; the blocking process includes temporary blocking or permanent blocking.

[0065] Exemplarily, in some specific embodiments, record each login information, including the logged-in mac, ip, whether the login is successful, etc., for easy reference. If the login fails 3 times consecutively, prohibit the user from logging in for 10 minutes. If the login fails 10 more times, permanently prohibit the client mac from logging in. In some specific application scenarios, the blocking of login failures depends on the mac table. When verifying the login, the mac of the device during login is considered, and no special processing for cross-router access is considered. As long as the blocking conditions are met, block it. We can appropriately relax the blocking conditions. Support the highest-privilege administrator to make exemptions and manual recoveries.

[0066] The data center platform is used to regularly update the blacklist of prohibited access and perform anomaly analysis regularly based on the log information uploaded by communication devices;

[0067] It should be noted that in some embodiments, when the data center platform regularly updates the blacklist of prohibited access and performs anomaly analysis regularly based on the log information uploaded by communication devices, it can specifically be used to perform the following operations: regularly update the blacklist of prohibited access based on the pre-collected blacklist information; wherein, when the blacklist conflicts with the local policy of the communication device, if the priority of the local policy is higher than that of the blacklist, configure the communication device to execute the local policy; perform a key error word search on the log information uploaded by the communication device, or perform a regular rule matching on the log information based on the pre-configured rules.

[0068] Exemplarily, in some specific embodiments, a data center platform is established to implement the following two functions: (1) The platform regularly updates the blacklist of prohibited access, such as the MAC blacklist, IP blacklist, URL blacklist, etc. These sources can be the blacklist information purchased from a third-party virus library or collected by other communication devices. The device can obtain the blacklist information from them, automatically intercept relevant accesses and prohibit access to relevant URLs to avoid being attacked. (2) The device regularly uploads log information to the platform center for analyzing whether there are any abnormal situations of the device, which is convenient for making timely responses.

[0069] In some specific application scenarios, (1) when the blacklist conflicts with the local policy, the local policy is followed by default, but the administrator is allowed to change it to follow the third-party blacklist, and manual override is supported. This operation requires the highest-level administrator. (2) The logs are transmitted in real time. The administrator can formulate relevant rules to judge abnormalities, such as retrieving key error words like "failed, error", or matching relevant regular rules, etc.

[0070] To explain the principle of the technical solution of the present invention in detail, the overall process of the present invention will be described below in conjunction with some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and should not be regarded as a limitation of the present invention.

[0071] First of all, it should be noted that traditional communication devices generally protect some key services and add functions such as MAC address filtering, port filtering, IP filtering, etc. to perform manual configuration protection when an attack is detected. In view of this, the embodiments of the present invention provide a security protection system for communication devices, which is specifically implemented as follows:

[0072] 1. As Figure 2 shown, file system protection: (1) For directories storing various executable files or services, such as the / bin, / sbin directories, etc., they are not allowed to be modified and can only be viewed to prevent hackers from tampering with relevant services or executable files for attacks. (2) Scan directories storing temporary files such as / tmp. Files in this directory are not allowed to have execution permissions. If a new file with execution permissions is identified, the permissions are modified to prohibit execution. At the same time, scan the services that are already running. If there are any in the / tmp and other temporary directories, an alarm is issued and the execution is stopped. (3) Encrypt various configuration parameter files and sensitive files of the device to prevent hackers from viewing relevant information. (4) Key configuration files of the system, such as / etc / passwd, / etc / shadow, etc., are prohibited from being changed by users and can only be modified by existing programs to prevent customers from adding or modifying accounts and permissions.

[0073] 2. As Figure 3As shown in the figure, network management login and operation protection: (1) There is a hierarchical mechanism for network management accounts. Low-level accounts only have viewing permissions and no configuration permissions. (2) The network management has a timeout mechanism. If there is no operation after logging in for a certain period of time, the login will automatically expire, such as 5 minutes. At the same time, the number of simultaneously logged-in clients is also restricted to prevent hackers from logging in and operating in large numbers. (3) For network management that accesses the shell through ssh, telnet, etc., a whitelist mechanism can be set, and relevant commands need to be executed after logging in to enter the shell page, preventing unauthorized personnel from damaging the shell. (4) Record all login information, including the logged-in mac, ip, and whether the login is successful, etc., for easy reference. If a user fails to log in 3 times consecutively, the user is prohibited from logging in for 10 minutes. If the login fails 10 more times, the client mac is permanently prohibited from logging in.

[0074] 3. As Figure 4 As shown in the figure, establish a data center platform to achieve the following two functions: (1) The platform regularly updates the blacklist of prohibited access, such as the mac blacklist, ip blacklist, url blacklist, etc. These sources can be the blacklist information purchased from a third-party virus library or collected by other communication devices. The device can obtain the blacklist information from it and automatically intercept relevant access and prohibit access to relevant URLs to avoid being attacked. (2) The device regularly uploads log information to the platform center for analyzing whether there are any abnormal situations with the device, facilitating timely response.

[0075] In summary, the embodiments of the present invention fully protect the device file system, preventing services from being tampered with and hackers from executing hacker services on the device to cause damage. Moreover, the embodiments of the present invention construct a sufficient network management protection mechanism to prevent network management from being continuously attacked and logged in and exploited by hackers. In addition, the embodiments of the present invention introduce a data center, regularly update the virus library, and the device regularly and automatically obtains the content of the virus library to set a blacklist, avoiding having to react after an attack has been discovered, when losses may already have occurred. Regularly upload logs to analyze the operation of the device, facilitating the discovery of abnormal situations.

[0076] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, a segment of a program, or a part of code that contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, as well as combinations of blocks in the block diagram or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0077] It should be noted that although several modules of devices for action execution are mentioned in the above detailed description, such a division is not mandatory. In fact, according to the embodiments of the present invention, the features and functions of two or more of the above-mentioned modules or units can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0078] From the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software, or by a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the embodiments of the present invention.

[0079] In some alternative embodiments, the functions / operations mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the functions / operations involved, two consecutive blocks shown may actually be executed substantially simultaneously or the blocks can sometimes be executed in the reverse order. In addition, the embodiments presented and described in the flowcharts of the present invention are provided by way of example for the purpose of providing a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logical flows presented herein. Alternative embodiments are contemplated, where the order of various operations is changed and where sub-operations described as part of a larger operation are executed independently.

[0080] In addition, although the present invention has been described in the context of functional modules, it should be understood that, unless otherwise stated to the contrary, one or more of the functions and / or features may be integrated in a single physical device and / or software module, or one or more functions and / or features may be implemented in separate physical devices or software modules. It should also be understood that a detailed discussion of the actual implementation of each module is not necessary for understanding the present invention. Rather, given the attributes, functions, and internal relationships of the various functional modules in the devices disclosed herein, the actual implementation of the modules will be understood within the ordinary skills of an engineer. Thus, those skilled in the art can implement the present invention as set forth in the claims without undue experimentation. It should also be understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0081] If a function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or part of the solution of the present invention can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0082] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a definite sequence list of executable instructions for implementing a logical function, and can be specifically implemented in any computer-readable medium for use by an instruction execution device, apparatus, or equipment (such as a computer-based device, a device including a processor, or other devices that can fetch instructions from the instruction execution device, apparatus, or equipment and execute the instructions), or in combination with these instruction execution devices, apparatus, or equipment. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transmit a program for use by or in combination with an instruction execution device, apparatus, or equipment.

[0083] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection (electronic device) having one or more wirings, a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable media can even be paper or other suitable media on which a program can be printed, as the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or otherwise processing it as appropriate, and then storing it in a computer memory.

[0084] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution device. For example, if implemented by hardware, as in another embodiment, any one or a combination of the following techniques well known in the art can be used: a discrete logic circuit having logic gate circuits for implementing logical functions on data signals, an application specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0085] In the description of this specification, the description referring to terms such as "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc., means that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0086] Although the embodiments of the present invention have been shown and described, those of ordinary skill in the art can understand that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the claims and their equivalents.

[0087] The above has specifically described the preferred embodiments of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art can also make various equivalent deformations or substitutions without departing from the spirit of the present invention, and these equivalent deformations or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A security protection system for a communication device, characterized in that, Including: A file system protection unit for locking the executable file directory, scanning the temporary file directory, encrypting configuration and sensitive files, and locking critical configuration files; A network management login and operation protection unit for classifying all accounts based on preset configuration permissions, restricting the number of logged-in clients, implementing a whitelist mechanism, and recording login information; A data center platform for regularly updating the blacklist of prohibited access and performing anomaly analysis regularly based on the log information uploaded by communication devices.

2. The security protection system of the communication device according to claim 1, characterized in that, When the file system protection unit locks the executable file directory, it is specifically used to perform the following operations: Create the executable file directory through a read-only file system to configure the executable file target as read-only mode and cannot be modified; Among them, the process of creating the executable file directory by the read-only file system uses the mount command to configure the directory folder; When the communication device is running, close the user's permission to execute the mount command.

3. The security protection system of the communication device according to claim 1, characterized in that, When the file system protection unit scans the temporary file directory, it is specifically used to perform the following operations: Perform execution monitoring on the business processes in the communication device that store the temporary file directory through an extended Berkeley packet filter; In response to the result of the execution monitoring, find and obtain the parent process of the business process. If the parent process is not called by the business process in the communication device, stop the execution of the parent process.

4. The security protection system of the communication device according to claim 1, characterized in that, When the file system protection unit encrypts configuration and sensitive files, it is specifically used to perform the following operations: Perform encryption processing on the configuration and sensitive files generated by the target program based on the application layer encryption method; Among them, the encryption key is hard-coded in the target program.

5. The security protection system of the communication device according to claim 1, characterized in that, When the file system protection unit locks critical configuration files, it is specifically used to perform the following operations: Configure the modification permission of the target program for critical configuration files, and close the authorization for the target program to call and increase user management.

6. The security protection system of the communication device according to claim 1, characterized in that, When the network management login and operation protection unit classifies all accounts based on preset configuration permissions, it is specifically used to perform the following operations: Perform a grading process of read-write differentiation on all accounts based on the preset configuration permissions; the results of the grading process include low-level users, mid-level users, and high-level users; Among them, the low-level users are configured with read-only permissions for status information; the mid-level users are configured with business-level operation permissions; the high-level users are configured with system management operation permissions.

7. The security protection system of the communication device according to claim 1, characterized in that, When the network management login and operation protection unit restricts the number of logged-in clients, it is specifically used to perform the following operations: Based on a preset timeout mechanism, perform a logout operation on logged-in users whose continuous login time exceeds the preset timeout threshold and have no operation actions during the continuous login time; When the concurrent number of logged-in users logging in to the client at the same time node exceeds the preset number threshold, perform a reject login operation on the logged-in users.

8. The security protection system of the communication device according to claim 1, characterized in that, When the network management login and operation protection unit implements the whitelist mechanism, it is specifically used to perform the following operations: Perform login authorization management on logged-in users based on a pre-configured whitelist; In response to a target command executed by the logged-in user managed through the login authorization, open the access permission of the shell page to the corresponding logged-in user; wherein, the target command includes dynamic token verification or agreed password verification.

9. The security protection system of the communication device according to claim 1, characterized in that, When recording the login information, the network management login and operation protection unit is specifically used to perform the following operations: In response to the login operation of the logged-in user, record the login information of the logged-in user, and associate the login result of the corresponding login operation with the login information; wherein, when the login results corresponding to the login operations of the same login information for a target number of consecutive times are login failures, block the logged-in user corresponding to the corresponding login information; the blocking process includes temporary blocking or permanent blocking.

10. The security protection system of the communication device according to claim 1, characterized in that, When the data center platform regularly updates the blacklist of prohibited access and regularly performs anomaly analysis based on the log information uploaded by the communication device, it is specifically used to perform the following operations: Regularly update the blacklist of prohibited access based on the pre-collected blacklist information; wherein, when the blacklist conflicts with the local policy of the communication device, if the priority of the local policy is higher than that of the blacklist, configure the communication device to execute the local policy; Retrieve key error words from the log information uploaded by the communication device, or perform regular expression matching on the log information based on pre-configured rules.

Images