Safety management and control method for business hall multi-protocol intelligent equipment based on edge collaboration

Abstract

The invention discloses a security management and control method for a business hall multi-protocol intelligent device based on edge collaboration, and the method comprises the steps: constructing a cloud management and control platform-edge node-terminal device three-stage collaboration architecture, and enabling an edge node to carry out the protocol recognition and adaptive conversion of intelligent devices of different protocol types in a business hall, equipment access authentication is completed through a preset security authentication mechanism; and the edge node and the cloud management and control platform cooperatively realize real-time monitoring of the equipment state, abnormal behavior analysis and dynamic issuing of the security policy, the edge node locally stores key security data and synchronizes the key security data to the cloud, and a basic security management and control task is autonomously executed in a network disconnection state. According to the invention, the problems of poor access compatibility, delayed centralized management and control response, lack of offline state security protection and the like of the existing business hall multi-protocol intelligent equipment are solved, unified security management and control of the multi-protocol equipment are realized, the real-time performance and reliability of management and control are improved, the cloud computing load is reduced, and the method is suitable for various business hall scenes such as banks, communication and the like.

Description

Technical Field

[0001] This invention relates to the field of smart device security management technology, specifically to a security control method for multi-protocol smart devices in a business hall based on edge collaboration. Background Technology

[0002] With the deepening of digital transformation, business halls, as the core scenario for service and business processing, have deployed a large number of intelligent terminal devices, such as smart teller machines, self-service inquiry machines, surveillance cameras, fire sensors, and power monitoring equipment. These devices come from different manufacturers and use different communication protocols, such as TCP / IP, MQTT, and Modbus, forming a "protocol silo" phenomenon, which poses a great challenge to unified security management.

[0003] Currently, the management of intelligent devices in service halls mostly adopts a centralized cloud-based management model, where all device data is uploaded to the cloud for processing and analysis. However, this model has several drawbacks: First, it suffers from delayed response. The large volume of real-time data generated by service hall devices and the long-distance transmission to the cloud cause data processing delays, making it difficult to detect and address security risks in a timely manner. This delayed response can lead to serious losses, especially in emergency scenarios such as fires or device intrusions. Second, it suffers from poor compatibility. The lack of an effective multi-protocol adaptation mechanism makes it difficult to achieve unified access and management of devices with different protocols. Some older devices cannot be included in the management system due to protocol incompatibility, creating security blind spots. Third, it suffers from insufficient reliability when the network is down. Once the network is interrupted, cloud-based management fails, leaving devices in an unmanaged state and unable to cope with security risks in network outage scenarios. Fourth, it incurs a high cloud computing load. The transmission and processing of large amounts of real-time data consumes a significant amount of cloud resources, increasing management costs and the risk of data leakage during transmission.

[0004] Furthermore, existing technologies for authenticating access to smart devices mostly employ single identity verification methods, which are insufficiently secure and vulnerable to attacks such as spoofed devices and key cracking. Simultaneously, the lack of a comprehensive security management mechanism for the entire device lifecycle makes it impossible to effectively track the entire process of device registration, operation, upgrades, and deregistration, leading to security issues such as unauthorized misuse of devices and continued access to the system after deregistration. For example, in bank branches, security vulnerabilities in self-service machines could result in serious consequences such as the leakage of user identity information and financial losses; similarly, if smart devices in telecommunications service centers are compromised, it could disrupt normal business operations and damage the company's reputation.

[0005] Therefore, there is an urgent need for a technical solution that can address multi-protocol adaptation, real-time response, reliable control during network outages, and full lifecycle security management, thereby improving the security and effectiveness of intelligent device management in business halls. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention aims to solve the following technical problems: 1. Poor compatibility of multi-protocol smart devices in business halls, making unified management impossible; 2. Delayed response of centralized cloud management, making it difficult to cope with real-time security risks; 3. Management fails when the network is offline, failing to guarantee device security; 4. Insufficient security of device access authentication, making it vulnerable to attacks; 5. Lack of full lifecycle security management for devices, resulting in blind spots in management.

[0007] To address the aforementioned technical problems, this invention provides a security management method for multi-protocol smart devices in business halls based on edge collaboration. The specific technical solution is as follows:

[0008] A three-tiered collaborative management and control architecture is constructed: This architecture comprises a cloud-based management and control platform, edge nodes, and terminal devices. The cloud-based management and control platform is deployed in a remote data center, responsible for global security policy formulation, big data analysis, historical data storage, and full lifecycle management. Edge nodes are deployed locally in the business hall, employing industrial-grade edge computing gateways. They possess local data processing, protocol conversion, local policy execution, and autonomous control capabilities even in the event of network outages. Edge nodes establish encrypted communication links with the cloud-based management and control platform via fiber optics, 5G, etc., employing SSL / VPN encryption technology to ensure link security. Edge nodes establish communication connections with various smart terminal devices within the business hall via wired or wireless methods, supporting multiple communication interfaces such as Ethernet, RS485, WiFi, and Bluetooth to adapt to the access needs of different types of devices.

[0009] Multi-protocol adaptation and device access authentication: The edge node performs a multi-protocol adaptation process: First, it collects the communication protocol data sent by the access device, and extracts protocol features through the protocol parsing module. The protocol features include protocol header format, data frame structure, transmission rate, verification method, and instruction set, etc. The extracted features are compared with the protocol feature library pre-stored by the edge node to identify the protocol type used by the device. The protocol type includes, but is not limited to, TCP / IP, MQTT, CoAP, Modbus, etc. Based on the identification result, the corresponding protocol stack is adaptively loaded to complete the conversion between different protocols and standard protocols, thereby realizing unified access for multi-protocol devices.

[0010] Access authentication employs a multi-dimensional composite authentication mechanism: the edge node sends an authentication request to the access device to obtain the device's unique hardware identifier (such as MAC address and device serial number) and pre-stored key; it compares the obtained unique identifier with a locally stored device whitelist, which is synchronized from the cloud management platform to the edge node and contains information on all legitimate devices in the business hall; simultaneously, the edge node performs security status checks on the device, including checking whether the device has antivirus software installed, whether the virus database is updated, whether there are malicious processes, and whether the security configuration meets the standards; if the device's unique identifier matches, the key verification passes, and the security status check is qualified, authentication is successful, and the device is allowed to access the management system; if any check fails, authentication fails, the edge node rejects the device access, records alarm information (including device identifier, access time, and reason for failure) and synchronizes it to the cloud management platform, while also alerting maintenance personnel through a local audible and visual alarm device.

[0011] Edge Collaborative Security Monitoring: Edge nodes collect real-time operational status data (such as CPU utilization, memory usage, power supply status, firmware version), communication data (such as communication objects, data volume, transmission frequency), and environmental data (such as temperature, humidity, and smoke concentration in the service hall) from each access device. A local data preprocessing module cleans, filters, and standardizes the collected data, removing redundant and noisy data. Based on preset anomaly detection rules, the edge nodes perform preliminary anomaly detection on the preprocessed data.

[0012] The rules for determining anomalies include: device operating parameters exceeding preset thresholds (such as CPU utilization consistently exceeding 80% or memory usage exceeding 90%), abnormal fluctuations in communication data volume (such as a sudden increase or decrease in data volume within a short period of time), unauthorized communication behavior (such as communication with unknown IP addresses), and failure of device security protection software (such as virus database not being updated for more than 7 days or protection software not running). If abnormal data is detected, the edge node is marked as suspected abnormal data, and the suspected abnormal data and key operating data (such as device operating status snapshots every 5 minutes) are synchronized to the cloud management platform.

[0013] The cloud-based management platform utilizes a big data analytics model for deep anomaly identification. This model employs a machine learning-based anomaly detection algorithm, trained on extensive historical normal operation data to learn normal equipment operation patterns. Suspected anomaly data and key data synchronized from edge nodes are input into the model and compared with the normal operation patterns to determine the presence of genuine anomalies. Identified anomaly types include equipment malfunctions, malicious intrusions, data leaks, and environmental security risks. If a genuine anomaly is detected, the cloud-based management platform generates anomaly warning information, including the anomaly device identifier, anomaly type, occurrence time, and risk level, and generates corresponding security control policies based on a pre-set policy library.

[0014] Collaborative execution of security policies: The cloud-based management platform distributes the generated security management policies to edge nodes. These policies include access control policies (such as prohibiting devices from communicating with unknown external IPs), data encryption policies (such as using AES-256 encryption for sensitive data), fault isolation policies (such as disconnecting abnormal devices from other devices), and firmware upgrade policies (such as pushing security patches to devices with vulnerabilities).

[0015] After receiving security control policies, edge nodes parse the policy content and execute control operations on the corresponding smart terminal devices according to the policies. For example, for ATMs that have detected malicious intrusion, the edge node performs fault isolation operations, disconnects them from the core business system, and simultaneously initiates local data encryption storage to prevent user data leakage; for monitoring devices with outdated virus definitions, the edge node pushes virus definition update packages to guide the devices to complete the upgrade.

[0016] For network outage scenarios, edge nodes possess autonomous management capabilities. Edge nodes monitor their communication status with the cloud in real time. When a network interruption is detected, they automatically switch to local emergency management mode. Based on locally pre-stored security policies (regularly updated by the cloud management platform) and historical operational data, they autonomously perform device status monitoring, anomaly detection, and management operations. During the network outage, the edge node stores all management records and anomaly alarm information in a local encrypted storage module. When the network is restored, the edge node automatically re-establishes a connection with the cloud management platform, synchronizing all records from the outage period to the cloud to ensure the integrity of management data. Simultaneously, the edge node activates a local emergency power supply monitoring module to monitor the device's power supply status in real time. If a mains power interruption is detected, it promptly issues an alarm via a local audible and visual alarm device and pushes power anomaly information to maintenance personnel via a preset offline communication method (such as a 4G backup communication module), ensuring safety warnings during network and power outage scenarios.

[0017] Full lifecycle security management: The cloud-based management platform and edge nodes collaborate to perform full lifecycle tracking and management of devices, specifically including:

[0018] Device registration: When a new device is connected, the edge node collects the device's basic information (model, manufacturer, unique identifier, protocol type) and synchronizes it to the cloud management platform. After the cloud completes the device information review, the device is entered into the system, a device security profile is generated, and a unique management number is assigned.

[0019] Status Update: Edge nodes collect device operating status data in real time and synchronize it to the cloud management platform. The cloud dynamically updates the device security profile to ensure that the profile information is consistent with the actual status of the device.

[0020] Firmware upgrade: The cloud management platform monitors the device firmware version. When a version with security vulnerabilities is detected, the corresponding firmware upgrade package is pushed to the edge node. The edge node guides the device to complete the upgrade. Data backup is performed during the upgrade process. If the upgrade fails, a rollback operation is performed to ensure the normal operation of the device.

[0021] Cancellation and Recycling: When equipment is scrapped or removed from the business hall, the maintenance personnel initiate a cancellation request through the cloud management platform. The cloud marks the equipment status as cancelled and synchronizes it to the edge node. The edge node refuses the subsequent access of the equipment. At the same time, the cloud management platform deletes the equipment's sensitive information and completes the secure liquidation of the equipment recycling.

[0022] The equipment security files are stored in encrypted form. The cloud management platform centrally stores and regularly backs up the files, and the backup data is stored off-site to prevent data loss. Edge nodes store file summary information for local quick query and verification, ensuring the security and integrity of the file information.

[0023] Beneficial effects

[0024] Compared with the prior art, the present invention has the following advantages:

[0025] 1. Improve the compatibility of multi-protocol device access: Through the protocol identification and adaptive adaptation mechanism of edge nodes, unified access of devices with multiple protocols such as TCP / IP, MQTT, and Modbus is achieved, solving the "protocol island" problem, covering various smart devices in the business hall, and eliminating blind spots in management and control.

[0026] 2. Achieve real-time security control: Edge nodes process real-time data locally, perform preliminary anomaly judgment, and only synchronize suspected abnormal data and critical data to the cloud, significantly reducing data transmission latency, improving the response speed to security risks, and enabling timely handling of real-time risks such as device intrusion and failure, thus preventing the expansion of losses.

[0027] 3. Ensure security in network outage scenarios: In the event of a network outage, edge nodes autonomously execute control operations based on locally pre-stored policies and record control logs. Data is synchronized after the network is restored, which solves the problem of centralized control failure during network outages and improves the reliability of the control system.

[0028] 4. Enhance access authentication security: Adopt a multi-dimensional composite authentication mechanism, combining unique device identifiers, key verification, and security status detection, to effectively resist attacks such as counterfeit device access and key cracking, thereby improving the security of device access.

[0029] 5. Achieve full lifecycle management: Track and manage the entire process of equipment registration, operation, upgrade, and deregistration, maintain complete equipment security files, avoid problems such as illegal misappropriation of equipment and unauthorized access after deregistration, and improve the comprehensiveness of management.

[0030] 6. Reduced management and control costs: Edge nodes process large amounts of real-time data locally, reducing the amount of data transmitted to the cloud and lowering the cloud computing load and data transmission costs; at the same time, the unified management and control system reduces the workload of operation and maintenance personnel and improves operation and maintenance efficiency. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of a three-level collaborative management and control architecture in an embodiment of the present invention;

[0032] Figure 2 This is a schematic diagram of the multi-protocol adaptation and access authentication process in an embodiment of the present invention;

[0033] Figure 3 This is a schematic diagram of the edge collaborative security monitoring process in an embodiment of the present invention;

[0034] Figure 4 This is a schematic diagram of the equipment lifecycle management process in an embodiment of the present invention.

[0035] Figure 5 This is a schematic diagram of the implementation steps of the method of the present invention.

[0036] Explanation of markings in the diagram:

[0037] Figure 1 In Chinese: 1-Cloud management platform, 2-Encrypted communication link, 3-Edge node, 4-Smart terminal device, 41-Smart teller machine, 42-Surveillance camera, 43-Fire sensor, 44-Power monitoring equipment, 5-Local communication network;

[0038] Figure 2 In Chinese: S201 - Collect protocol data, S202 - Extract protocol features, S203 - Identify protocol type, S204 - Load corresponding protocol stack, S205 - Protocol conversion, S206 - Send authentication request, S207 - Obtain device identifier and key, S208 - Whitelist comparison, S209 - Security status detection, S210 - Authentication passed, S211 - Authentication failed, S212 - Record alarm;

[0039] Figure 3 In Chinese: S301 - Collect multi-dimensional data, S302 - Local data preprocessing, S303 - Preliminary anomaly judgment, S304 - Synchronize suspected anomaly data to the cloud, S305 - Cloud big data analysis, S306 - Deep anomaly identification, S307 - Generate early warning information and control strategies;

[0040] Figure 4In Chinese: S501 - Device registration, S502 - Real-time status update, S503 - Firmware upgrade management, S504 - Device deregistration request, S505 - Cloud review, S506 - Mark deregistration status, S507 - Delete sensitive information, S508 - Complete recycling and liquidation. Detailed Implementation

[0041] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. This embodiment takes a bank branch as the application scenario. The branch is equipped with various intelligent terminal devices such as smart teller machines, surveillance cameras, fire sensors, and power monitoring equipment. Each device uses different communication protocols, requiring unified security management.

[0042] Example 1

[0043] according to Figures 1 to 4 This paper presents a security management method for multi-protocol intelligent devices in a bank branch based on edge collaboration. The architecture comprises a three-tiered collaborative structure: a cloud-based management platform 1, edge nodes 3, and intelligent terminal devices 4. The cloud-based management platform 1 is deployed in the bank's remote data center, employing a distributed server cluster and configured with a big data analysis module, a security policy library, a device file management module, and a data backup module. Edge nodes 3 utilize industrial-grade edge computing gateways deployed in the bank branch's computer room, configured with a protocol parsing module, a local data processing module, an encrypted storage module, an emergency power supply monitoring module, and a 4G backup communication module. Edge nodes 3 establish a communication connection with the cloud-based management platform 1 via fiber optic cable, employing SSL / VPN encryption technology to ensure link security. Edge nodes 3 connect to intelligent teller machines 41 and power monitoring equipment 44 via Ethernet, to surveillance cameras 42 via WiFi, and to fire sensors 43 via an RS485 interface, achieving communication coverage with all terminal devices.

[0044] Multi-protocol adaptation and access authentication are implemented as follows: When the smart teller machine (using TCP / IP protocol) connects, the protocol parsing module of edge node 3 collects the TCP / IP protocol data it sends, extracts features such as protocol header format and data frame structure, compares them with the pre-stored protocol feature library, identifies the protocol type as TCP / IP, adaptively loads the TCP / IP protocol stack, and completes the S205 protocol conversion; subsequently, edge node 3 sends an S206 authentication request to the smart teller machine 41, obtains the device identifier and key in S207, compares it with the locally synchronized device whitelist in S208, and confirms that the MAC address is in the whitelist; at the same time, it checks the running status of the virus protection software, the update status of the virus database, and the system security configuration of the smart teller machine 41. After confirming that there are no abnormalities, the authentication is passed in S210, allowing the smart teller machine 41 to access the management and control system.

[0045] When a counterfeit surveillance camera (using the MQTT protocol) attempts to connect, edge node 3 identifies its protocol type as MQTT and completes the S205 protocol conversion. After obtaining the device identifier and key, it compares them with the whitelist (208). It finds that the address is not in the whitelist, so authentication fails (S211). Edge node 3 rejects its access, records alarm information (device MAC address, access time, reason for failure: whitelist mismatch) and synchronizes it to the cloud management platform 1. At the same time, it enters the S212 warning recording module and activates the local external audible and visual alarm device.

[0046] Edge collaborative security monitoring implements real-time data collection from various devices via edge node 3: CPU utilization, memory usage, and transaction data of the smart teller machine 41; image parameters and communication data volume of the surveillance camera; smoke concentration data of the fire sensor 43; and voltage and current data of the power monitoring equipment. The S302 local data preprocessing module cleans the collected data, removing noise data caused by sensor errors.

[0047] Edge node 3 performs a preliminary anomaly assessment based on preset rules (S303): When the CPU usage of the smart teller machine 41 is detected to continuously exceed 80%, it is marked as suspected abnormal data; the suspected abnormal data and the real-time operating status snapshot of the smart teller machine 41 (S304) are synchronized to the cloud. The big data analysis model of the cloud management platform 1 compares the synchronized data with the normal operating mode and finds that the smart teller machine 41 has an abnormal process occupying a large amount of CPU resources, which is determined to be a malicious program intrusion. An anomaly warning message is generated (abnormal device: smart teller machine, device identifier: XXX, anomaly type: malicious program intrusion, risk level: high), and a warning message and control strategy are generated (S07): disconnect the smart teller machine 41 from the core business system, start local data encryption, and push a virus scanning program.

[0048] The security strategy is implemented collaboratively. The cloud management platform 1 distributes the above security management strategy to the edge node 3. After parsing the strategy, the edge node 3 performs the following operations: disconnects the encrypted communication link 2 between the smart teller machine 41 and the core business system through the access control module; starts the local data encryption module to encrypt sensitive data such as user identity information and transaction records stored in the smart teller machine 41 using AES-256; and pushes a virus scanning program to the smart teller machine 41 to guide it in completing the malicious program scanning and removal.

[0049] If the network in the business hall is interrupted during the control process, the edge node will automatically switch to the local emergency control mode after detecting the network interruption. Based on the locally stored security policies, it will continue to monitor the operating status of the smart teller machine 41 and record the scanning progress and operating data. At the same time, the power monitoring equipment 44 of the emergency power supply monitoring module will monitor the mains power status in real time. If a mains power interruption is detected, the power supply anomaly information will be pushed to the maintenance personnel through the 4G backup local communication network 5. After the network is restored, the edge node 3 will synchronize the control records during the network outage to the cloud control platform 1.

[0050] Full lifecycle security management is implemented. When a new smart teller machine 41 is connected, edge node 3 collects information such as its model, manufacturer, MAC address, and protocol type, and synchronizes it to the cloud management platform 1. After the cloud verifies the information (S505), a device security file is generated and a management number is assigned. During operation, edge node 3 updates the device's operating status to the file in real time. When the cloud detects a security vulnerability in the firmware of the smart teller machine 41, it enters the firmware upgrade management (S503) and pushes the firmware upgrade package to edge node 3. Edge node 3 guides the smart teller machine 41 to complete the upgrade. Before the upgrade, the device data is backed up, and if the upgrade fails, a rollback operation is performed. When the smart teller machine 41 reaches its service life and needs to be scrapped, the maintenance personnel initiate an S504 deregistration request through the cloud management platform 1. After the cloud verifies the information (S505), the device status is marked as S506 deregistration status and synchronized to edge node 3. Edge node 3 refuses to allow the device to connect again, and at the same time, the cloud (S507) deletes sensitive information and completes the S508 recycling and liquidation.

[0051] Example 2

[0052] The multi-protocol adaptation and access authentication process in this embodiment is as follows:

[0053] The process involves: collecting protocol data via S201, extracting protocol feature data frame structure via S202, identifying protocol type via S203, collecting protocol data via S201, loading the corresponding protocol stack via S204, and performing protocol conversion via S205. After protocol conversion, an authentication request is sent via S206, the corresponding protocol stack is loaded via S204, and the device identifier and key are obtained via S207, followed by comparison. A whitelist comparison is performed via S208, and a status result message (authentication pass via S210 or failure via S211) is sent in real time. After comparison, the branch node performs security status monitoring via S209, and a warning is recorded via S212. The authentication request, comparison information, and authentication results (authentication pass via S210 and failure via S211) sent via S206 are used to record warnings.

[0054] Example 3

[0055] The edge collaborative security monitoring process in this embodiment is as follows:

[0056] The edge node local process involves collecting multi-dimensional data via S301, followed by local data preprocessing in S302, then preliminary anomaly detection and analysis of the processed data in S303, followed by obtaining the judgment results in S304, and then synchronizing suspected abnormal data to the cloud in S305. The cloud process involves big data analysis in S305, which performs deep anomaly identification based on the synchronized suspected abnormal data, and finally generates early warning information and control strategies in S307.

[0057] Example 4

[0058] The device lifecycle management process in this embodiment is as follows:

[0059] The S501 device registration collects device information to generate a security profile, which is then stored in the cloud. When there are updates, the S502 status update monitors the device's operating data in real time and periodically synchronizes the status information. If the status update module detects that a firmware upgrade is needed, the S503 firmware upgrade management detects the new version, downloads the upgrade package, verifies its integrity, and executes the upgrade. If the status update indicates that deregistration is required, the S504 deregistration request is submitted by the user, the system performs preliminary verification, and then sends it to the S505 cloud for review. The S506 cloud review marks the device as deregistered and restricts access to functions. The administrator reviews the qualifications to confirm the necessity of deregistration, and then the S507 process deletes sensitive information, clears user data, encrypts and erases the stored content. Finally, the S508 process collects hardware information, arranges the recycling or destruction process, and completes the full lifecycle management.

[0060] Example 5

[0061] according to Figure 5The implementation steps of a security management method for multi-protocol smart devices in a business hall based on edge collaboration are as follows: Step S1: Construct a three-level collaborative management architecture, which includes a cloud management platform 1, edge nodes 3, and multi-protocol smart terminal devices 4 in the business hall. Edge nodes 3 are deployed locally in the business hall and establish an encrypted communication link 2 with the cloud management platform 1, while also establishing communication connections with each smart terminal device 4; Step S2: Edge nodes 3 perform multi-protocol adaptation and device access authentication, collect communication protocol data of the access devices, extract protocol features and identify protocol types, adaptively load the corresponding protocol stack in S204 to complete the protocol conversion in S205; perform access authentication based on the device's unique identifier, key, and security status detection results. If the authentication is successful, the device is allowed to access the management system; if the authentication fails, access is denied and alarm information is recorded; Step S3: Edge collaborative security monitoring, edge nodes 3 collect the operating status data, communication data, and environmental data of each access device in real time, and perform local preprocessing in S302 and S303 on the data. Preliminary anomaly assessment; S304 suspected anomaly data and key operational data are synchronized to cloud management platform 1. Cloud management platform 1 performs deep anomaly identification for S306 based on big data analysis model, and generates early warning information and control policies for S307; Step S4: Collaborative execution of security policies. Cloud management platform 1 distributes the generated security policies to edge node 3. Edge node 3 performs access control, data encryption, fault isolation, and other control operations on the corresponding smart terminal device 4 according to the policies; In the offline state, edge node 3 autonomously executes security control based on locally pre-stored security policies and historical data. After the network is restored, the control records are synchronized to the cloud; Step S5: Full lifecycle security management. Cloud management platform 1 and edge node 3 collaborate to track the device throughout its entire lifecycle, including S501 device registration, S502 status update, S503 firmware upgrade management, S504 deregistration request, S505 cloud audit, S506 marking deregistration status, S507 deleting sensitive information, S508 recycling and liquidation, etc., and maintains the device security file in real time.

[0062] This embodiment achieves unified, real-time, reliable, and secure management and control of multi-protocol intelligent devices in bank branches through the above-mentioned process, effectively improving the security and stability of equipment operation in the branch and reducing security risks and maintenance costs.

Claims

1. A security management method for multi-protocol intelligent devices in a business hall based on edge collaboration, characterized in that, Includes the following steps: Step S1: Construct a three-level collaborative management and control architecture, which includes a cloud management and control platform, edge nodes, and multi-protocol smart terminal devices in the business hall. The edge nodes are deployed locally in the business hall and establish encrypted communication links with the cloud management and control platform, while also establishing communication connections with each smart terminal device. Step S2: Edge nodes perform multi-protocol adaptation and device access authentication. They collect communication protocol data of access devices, extract protocol features from data frame structures, identify protocol types, and adaptively load the corresponding protocol stack to complete protocol conversion. They also obtain device identifiers and keys, and perform access authentication based on the device's unique identifier, key, and security status detection results. If authentication is successful, the device is allowed to access the management system; if authentication fails, access is denied and alarm information is recorded. Step S3: Edge collaborative security monitoring. Edge nodes collect real-time operational status data, communication data, and environmental data from each access device for multi-dimensional data collection. The data is preprocessed locally and preliminary anomaly judgment is made. Suspected abnormal data and key operational data are synchronized to the cloud management platform. The cloud big data analysis platform performs in-depth anomaly identification based on the big data analysis model and generates early warning information and control strategies. Step S4: Collaborative execution of security policies. The cloud management platform will distribute the generated security policies to the edge nodes. The edge nodes will then perform management operations such as access control, data encryption, and fault isolation on the corresponding smart terminal devices according to the policies. In the offline state, edge nodes autonomously perform security control based on locally pre-stored security policies and historical data, and synchronize the control records to the cloud after the network is restored; Step S5: Full lifecycle security management. The cloud management platform and edge nodes work together to track the device throughout its entire lifecycle, including device registration, status updates, firmware upgrade management, deregistration requests, marking deregistration status, deleting sensitive information, recycling and liquidation, and maintaining the device security profile in real time.

2. The security management method for multi-protocol intelligent devices in a business hall based on edge collaboration according to claim 1, characterized in that, The protocol types mentioned in step S2 include, but are not limited to, TCP / IP, MQTT, CoAP, and Modbus. The protocol feature extraction includes the extraction of protocol header format, cloud audit, data frame structure, transmission rate, and verification method. The access authentication specifically includes: the edge node sending an authentication request to the access device, obtaining the device identifier and key, comparing it with the locally stored device whitelist, and simultaneously monitoring the security status to detect whether the device has viruses, malicious programs, or abnormal security configurations. Authentication is completed if all detection items pass.

3. The security management method for multi-protocol intelligent devices in a business hall based on edge collaboration according to claim 1, characterized in that, The judgment conditions for the preliminary judgment of anomalies in step S3 include: the device operating parameters exceed the preset threshold, the communication data volume fluctuates abnormally, there is unauthorized communication behavior, and the device security protection software fails; the cloud big data analysis model adopts an anomaly detection algorithm based on machine learning, and learns the normal operating mode of the device through training samples to realize the identification of unknown abnormal behaviors.

4. The security management method for multi-protocol intelligent devices in a business hall based on edge collaboration according to claim 1, characterized in that, In step S4, the encrypted communication link uses SSL / VPN encryption technology, and sensitive data is encrypted using AES-256 during data transmission. In the offline state, the edge node starts the local emergency power supply monitoring module to monitor the power supply status of the equipment in real time, and at the same time performs local log recording and abnormal alarm. The alarm information is pushed to the operation and maintenance personnel through the local audible and visual alarm device and the preset offline communication method.

5. The security management method for multi-protocol intelligent devices in a business hall based on edge collaboration according to claim 1, characterized in that, The device security file mentioned in step S5 includes basic device information, access history, operating status records, abnormal alarm records, security policy execution records, and firmware upgrade records. The cloud management platform encrypts and stores the security file and backs it up regularly, while the edge node stores the file summary information for local querying.

Images