A cloud-edge collaborative hybrid cloud network security system and its construction method

Abstract

This application discloses a cloud-edge collaborative hybrid cloud network security system and its construction method, relating to the field of cloud computing network security technology. By setting up a three-layer hybrid cloud security architecture with cloud-edge collaboration, the 5G CPE obtains a public IPv6 address using an IPv6-only IoT card, and establishes an IPSec encrypted tunnel through a VPN gateway deployed in the public cloud with both IPv4 and IPv6 dual-stack capabilities. This solves the problem of building a secure VPN for low-cost 5G access without a public IPv4 address. The cloud server VPN gateway acts as a fixed anchor point, uniformly carrying out protocol conversion, tunnel aggregation, and network interconnection, enabling the enterprise intranet and cloud resources to form a logically unified virtual enterprise network. Furthermore, the internal security gateway synchronizes threat intelligence and collaborative policies with the cloud server VPN gateway through an independent management channel, enabling local blocking upon detecting risks at the edge, shortening the security response link.

Description

Technical Field

[0001] This application relates to the field of cloud computing network security technology, specifically to a cloud-edge collaborative hybrid cloud network security system and its construction method. Background Technology

[0002] With the popularization of cloud computing technology, more and more small and medium-sized enterprises (SMEs) are adopting hybrid cloud architectures to balance cost and flexibility. However, traditional hybrid cloud solutions present a trade-off between cost and performance. Enterprise leased lines such as MPLS VPNs have high monthly fees, while ordinary internet VPNs are cheaper but lack security and performance. Existing technologies such as CN107370715B reduce hardware costs through cloud virtualization, but their technical solutions require a stable internet connection between the local terminal and the cloud virtual security gateway, are sensitive to network jitter, and cannot establish tunnels in scenarios without public IPv4 addresses. They also fail to address the special access issues in 5G IoT card scenarios.

[0003] Existing hybrid cloud security solutions still suffer from fragmented security protection and delayed response times. For example, CN113824692B employs a layered protection architecture, where the network layer, application layer, and host layer each have independent security components. However, the security policies at each layer are independent of each other, lacking an effective linkage mechanism. When an internal network endpoint is compromised, it takes several hours from threat detection to cloud-based policy implementation, failing to curb rapidly spreading threats such as ransomware. CN121486024A proposes a policy consistency solution, the core of which lies in detecting and resolving cloud-edge policy conflicts. This falls under the category of post-incident policy modification, rather than proactive and coordinated threat response.

[0004] In 5G IoT SIM card access scenarios, operators generally assign IPv6 addresses to IoT SIM cards instead of public IPv4 addresses, making it impossible to directly establish traditional IPv4-based IPSec VPNs. For IoT SIM card scenarios, SMEs face the problem of wanting low-cost 5G access but being unable to establish secure tunnels. Furthermore, existing hybrid cloud solutions are deployed in IPv4 network environments by default, failing to consider protocol conversion and service compatibility issues in IPv6-only access scenarios. When the underlying network is IPv6-only, traditional protocol stack assumptions become ineffective, and compatibility gaps exist in existing IPv4 service access, protocol conversion, and public network egress proxying. Summary of the Invention

[0005] In order to solve the above-mentioned technical problems, this application proposes the following technical solution: In a first aspect, embodiments of this application provide a cloud-edge collaborative hybrid cloud network security system, comprising: a 5G CPE access layer, a cloud server VPN gateway layer, and an internal security gateway layer, wherein: The 5G CPE access layer provides Internet access through the 5G mobile network, supports IPv6-only IoT card access mode, and obtains public IPv6 addresses from the operator network. The cloud server VPN gateway layer is deployed on a public cloud platform and has a fixed public IPv4 address and a public IPv6 address. It serves as a fixed anchor point for network connections and has dual-stack protocol conversion capabilities. The internal security gateway layer is deployed at the enterprise intranet boundary, integrating firewall and intrusion detection functions, and acts as an edge security node to perform local blocking based on threat detection. An IPSec VPN encrypted tunnel is established between the 5G CPE and the cloud server VPN gateway; an independent management channel is established between the internal security gateway and the cloud server VPN gateway for proactive threat intelligence synchronization and policy coordination. The three-layer architecture achieves proactive cloud-edge coordination through the management channel, jointly forming a logically unified virtual enterprise network. In one possible implementation, the 5G CPE access layer provides internet access via a 5G mobile network, supports IPv6-only IoT card access mode, and obtains a public IPv6 address from the operator network, including: 5G CPE obtains a public routable IPv6 address from the 5G operator's network via an IoT card; The cloud server VPN gateway is also configured with a public IPv6 address, forming two endpoints that can be reached by IPv6; An IPSec VPN encrypted tunnel is established between the 5G CPE and the cloud server VPN gateway on the IPv6 transport layer, and the original IP data packets are fully encapsulated in tunnel mode. IPv4 or IPv6 service traffic generated by the enterprise intranet is inspected by the internal security gateway policy and then transmitted to the cloud by the 5G CPE through the IPv6 tunnel.

[0006] In one possible implementation, the complete encapsulation of the original IP data packet using tunnel mode includes: Let the original data packet be After packaging, it is as follows: The outer layer uses IPv6 for transmission, while the inner layer carries either IPv4 or IPv6 data, achieving protocol independence; where: For inner source IP, For the inner target IP, For the outer source IP, The public IPv6 address obtained for the 5G CPE; For the outer target IP, This is the public IPv6 address of the cloud server's VPN gateway. For IP security protocol suite, This is the original data packet.

[0007] In one possible implementation, the cloud server VPN gateway layer includes: The protocol conversion unit is used to decapsulate traffic received from the IPv6 tunnel and perform NAT64 protocol conversion on traffic accessing the IPv4 Internet. Dual-stack anchor unit is used to simultaneously maintain the IPv6 tunnel endpoint and the IPv4 public network exit, serving as a unified external connection point for the enterprise network; The address mapping unit is used to maintain the mapping relationship between the IPv6 address of the internal network terminal and the temporary IPv4 session port.

[0008] In one possible implementation, the decapsulation of traffic received from the IPv6 tunnel and the NAT64 protocol translation of traffic accessing the IPv4 Internet include: Define session mapping function and its inverse mapping : in: For the IPv6 address of the enterprise's intranet terminals. This is the source port number used by intranet terminals when initiating a connection. This is the public IPv4 address of the cloud server's VPN gateway. The port number temporarily assigned to this session by the gateway; Define protocol conversion operators : in: The input data packet uses the IPv6 protocol at its network layer; This is the source IPv6 address of the data packet. For the output data packets, the network layer converts them to the IPv4 protocol. The source IPv4 address and port after conversion. This is a session mapping table that records the translation relationships between IPv6 addresses and IPv4 addresses and ports; Perform reverse transformation on traffic returning from the Internet: ,in: The time it takes for an IPv6 packet to arrive at the gateway. This is the time it takes for the converted IPv4 packet to leave the gateway.

[0009] In one possible implementation, the internal security gateway layer, acting as an edge security node, performs local blocking based on threat detection, including: in: Threat level, The IP address of the abnormal terminal. The output firewall blocking rules, The action is to discard the data packet. This is the local expiration time of the rule.

[0010] In one possible implementation, an independent management channel is established between the internal security gateway and the cloud server VPN gateway for proactive synchronization of threat intelligence and policy coordination. The three-tier architecture achieves proactive cloud-edge coordination through this management channel, including: The internal security gateway monitors the communication patterns of internal network terminals in real time and constructs behavioral feature vectors. And calculate threat score ; When abnormal behavior matching threat characteristics is detected, the terminal IP address, anomaly type, timestamp, and threat level are extracted to generate a standardized threat intelligence data packet: in: The IP address of the abnormal terminal. This serves as an anomaly type identifier. For the detection time, Threat level, For contextual information; Dynamically add blocking rules to the local firewall to restrict network access from abnormal terminals and prevent threats from spreading laterally within the internal network; Threat intelligence packets are transmitted to the cloud server VPN gateway via a separate management VPN tunnel; After receiving threat intelligence, the cloud server VPN gateway calls the cloud platform security API to create temporary blocking rules for abnormal terminal IPs in the cloud security group and set an automatic expiration time.

[0011] In one possible implementation, when a device accesses the system, a device role label is created based on the device's business functions. The role label is defined as follows: in: For the equipment to be sorted, For a predefined set of role tags, For equipment eigenvectors, For the role template feature vector, It is a similarity function; Bind device identity based on device MAC address and IP address; Configure role-based access control policies on the internal security gateway; The internal security gateway performs deep inspection of data packets to identify device roles; Based on the network access control rules corresponding to the device role, access requests that violate the policy are blocked in real time and security alerts are generated.

[0012] In one possible implementation, a role-based access control policy is configured on the internal security gateway, including: Configure a default policy to completely block internet access for specific devices: ; Simultaneously configure whitelist rules to allow access to specific intranet services: Priority satisfied ; Blocking the device's query requests to external DNS servers: in: The device role label to which the data packet sender belongs. The destination address of the data packet. The default blocking policy for IoT devices. Rules for allowing IoT devices to access specific services. This is the IP address of the MES server. The destination port number of the data packet. For the target DNS server, For external DNS sets, This indicates a logical AND operation.

[0013] Secondly, this application provides a method for constructing a cloud-edge collaborative hybrid cloud network security system as described in any possible implementation of the first aspect, comprising: Deploy a VPN gateway virtual machine on a public cloud platform and configure dual-stack addresses; deploy an internal security gateway on the enterprise's local machine and configure a 5G CPE device to obtain the operator's IPv6 address. Choose to establish an IPv4 or IPv6 IPSec VPN tunnel based on the IP type assigned by the operator, establish an independent management channel and configure routing policies; Deploy threat detection rules and device micro-segmentation policies on the internal security gateway, configure basic security group policies on the cloud platform, and establish a cloud-edge collaborative security response process. Finally, the VPN tunnel connectivity was tested to verify the threat detection and automatic blocking functions, and the device access control policy was verified.

[0014] In this embodiment, a three-layer hybrid cloud security architecture with cloud-edge collaboration is formed by setting up a 5G CPE access layer, a cloud server VPN gateway layer, and an internal security gateway layer. On one hand, the 5G CPE can obtain a public IPv6 address using an IPv6-only IoT card and establish an IPSec encrypted tunnel through a VPN gateway deployed in the public cloud with dual IPv4 and IPv6 capabilities. This solves the problem of building a secure VPN for low-cost 5G access without a public IPv4 address, balancing access cost, service compatibility, and transmission security. On the other hand, the cloud server VPN gateway acts as a fixed anchor point, uniformly carrying out protocol conversion, tunnel aggregation, and network interconnection, enabling the enterprise intranet and cloud resources to form a logically unified virtual enterprise network. Furthermore, the internal security gateway synchronizes threat intelligence and collaborative policies with the cloud server VPN gateway through an independent management channel. It can execute local blocking after detecting risks at the edge, shortening the security response link and reducing the risk of ransomware and other threats spreading within the enterprise intranet. Attached Figure Description

[0015] Figure 1 A schematic diagram of the framework of a cloud-edge collaborative hybrid cloud network security system provided in this application embodiment; Figure 2 A scenario architecture diagram of a cloud-edge collaborative hybrid cloud network security system provided in this application embodiment; Figure 3 This is a schematic diagram of an IPv6-only access scenario provided in an embodiment of this application; Figure 4 This is a schematic diagram of a security incident response scenario provided in an embodiment of this application; Figure 5 This is a schematic diagram of a cloud-edge collaborative hybrid cloud network security system construction method provided in an embodiment of this application. Detailed Implementation

[0016] The present solution will now be described in conjunction with the accompanying drawings and specific embodiments.

[0017] See Figure 1 and Figure 2The cloud-edge collaborative hybrid cloud network security system provided in this embodiment includes: a 5G CPE access layer, a cloud server VPN gateway layer, and an internal security gateway layer. An IPSec VPN encrypted tunnel is established between the 5G CPE and the cloud server VPN gateway; an independent management channel is established between the internal security gateway and the cloud server VPN gateway for proactive synchronization of threat intelligence and policy coordination. The three-layer architecture achieves proactive cloud-edge collaboration through the management channel, jointly forming a logically unified virtual enterprise network.

[0018] The 5G CPE access layer provides internet access through the 5G mobile network, supports IPv6-only IoT card access mode, and obtains public IPv6 addresses from the operator network.

[0019] Specifically, the 5G CPE obtains a publicly routable IPv6 address from the 5G operator's network via an IoT SIM card. The cloud server VPN gateway is also configured with a public IPv6 address, forming two IPv6-reachable endpoints. An IPSec VPN encrypted tunnel is established between the 5G CPE and the cloud server VPN gateway at the IPv6 transport layer, using tunnel mode to fully encapsulate the original IP packets. IPv4 or IPv6 service traffic generated within the enterprise intranet is checked by the internal security gateway policy and then transmitted by the 5G CPE to the cloud via the IPv6 tunnel.

[0020] In this embodiment, tunnel mode is used to completely encapsulate the original IP data packets, including: Let the original data packet be After packaging, it is as follows: The outer layer uses IPv6 for transmission, while the inner layer carries IPv4 or IPv6 data, achieving protocol independence. in: For inner source IP, For the inner target IP, For the outer source IP, The public IPv6 address obtained for 5GCPE; For the outer target IP, This is the public IPv6 address of the cloud server's VPN gateway. For IP security protocol suite, This is the original data packet.

[0021] The cloud server VPN gateway layer is deployed on a public cloud platform and has a fixed public IPv4 address and a public IPv6 address. It serves as a fixed anchor point for network connections and has dual-stack protocol conversion capabilities.

[0022] In this embodiment, traffic received from the IPv6 tunnel is decapsulated, and traffic accessing the IPv4 Internet is converted using the NAT64 protocol, including: Define session mapping function and its inverse mapping : in: For the IPv6 address of the enterprise's intranet terminals. This is the source port number used by intranet terminals when initiating a connection. This is the public IPv4 address of the cloud server's VPN gateway. The port number temporarily assigned to this session by the gateway.

[0023] Define protocol conversion operators : in: The input data packet uses the IPv6 protocol at its network layer; This is the source IPv6 address of the data packet. For the output data packets, the network layer converts them to the IPv4 protocol. The source IPv4 address and port after conversion. This is a session mapping table that records the translation relationships between IPv6 addresses and IPv4 addresses and ports.

[0024] Perform reverse transformation on traffic returning from the Internet: ,in: The time it takes for an IPv6 packet to arrive at the gateway. This is the time it takes for the converted IPv4 packet to leave the gateway.

[0025] The internal security gateway layer is deployed at the enterprise intranet boundary, integrating firewall and intrusion detection functions, and acts as an edge security node to perform local blocking based on threat detection.

[0026] In this embodiment, the internal security gateway layer, acting as an edge security node, performs local blocking based on threat detection, including: in: Threat level, The IP address of the abnormal terminal. The output firewall blocking rules, The action is to discard the data packet. This is the local expiration time of the rule.

[0027] In this embodiment, the three-tier architecture achieves proactive cloud-edge collaboration through the management channel, enabling threat detection and response. The internal security gateway monitors the communication patterns of internal network terminals in real time and constructs behavioral feature vectors. And calculate threat score .

[0028] The five-dimensional behavioral feature vector is: in: For communication frequency characteristics, As a protocol feature, For time pattern features, As a content feature, This represents the characteristics of traffic flow.

[0029] In this embodiment, the feature vector The meanings, value ranges, and anomaly detection conditions of the features are shown in Table 1: Table 1 Meaning, value range, and anomaly detection criteria of the features Threat Score The function is: in: For feature weights, for The characteristic parameters in.

[0030] In this embodiment, the corresponding feature weights correspond to... The feature parameters and weight values ​​are shown in Table 2. Table 2 Feature weights and their corresponding values Suppose the behavioral feature vector of a certain terminal is: .

[0031] Calculated using the above weights: .

[0032] When abnormal behavior matching threat characteristics is detected, the terminal IP address, anomaly type, timestamp, and threat level are extracted to generate a standardized threat intelligence data packet: in: The IP address of the abnormal terminal. This serves as an anomaly type identifier. For the detection time, Threat level, This is contextual information.

[0033] Dynamically add blocking rules to the local firewall to restrict network access from abnormal terminals and prevent threats from spreading laterally within the internal network.

[0034] Threat intelligence packets are transmitted to the cloud server VPN gateway via a separate management VPN tunnel; After receiving threat intelligence, the cloud server VPN gateway calls the cloud platform security API to create temporary blocking rules for abnormal terminal IPs in the cloud security group and set an automatic expiration time.

[0035] In this embodiment, the cloud blocking failure time function is: in: The base failure time is typically set to 2 hours. Threat level.

[0036] In this embodiment, when a device accesses the service, a device role label is created based on the device's service functions. The role label is defined as follows: in: For the equipment to be sorted, For a predefined set of role tags, For equipment eigenvectors, For the role template feature vector, This is the similarity function.

[0037] when At that time, the device was classified as an IoT device.

[0038] Device identity is bound based on device MAC address and IP address; role-based access control policies are configured on the internal security gateway; the internal security gateway performs deep inspection of data packets to identify device roles; and network access control rules are applied according to the device roles to block access requests that violate the policies in real time and generate security alerts.

[0039] Specifically, in this embodiment, a role-based access control policy is configured on the internal security gateway, including: Set a default policy to completely block internet access for IoT device roles: Simultaneously configure whitelist rules that allow access only to specific intranet services: Priority relationship: Ensure that the blocking rule takes effect before the allowing rule to block the query request of the IoT device to the external DNS server: .

[0040] Where: is the device role label of the data packet sender, is the destination address of the data packet, is the default blocking policy of the IoT device, is the allowing rule for the IoT device to access specific services, is the IP address of the MES server, is the destination port number of the data packet, is the target DNS server, is the external DNS set, represents logical AND.

[0041] Figure 3 Shows the complete data flow of the barcode scanner accessing the cloud MES system securely through the IPv6-only IoT card and the three-layer cloud-edge collaborative architecture in the daily enterprise scenario. Step 1: The barcode scanner (IP: 192.168.1.10) generates business data with the target of the cloud MES server (IP: 10.0.0.100). Step 2: The internal security gateway performs an IoT micro-isolation policy check on the data packet, confirms that the barcode scanner belongs to the "IoT device" role, matches the whitelist rule (allow access to port 1433 of IP_MES), and the data packet is released. Step 3: The 5G CPE obtains the IPv6 address (2001:db8:1::2) assigned by the operator through the IoT card, establishes an IPSec VPN tunnel on the IPv6 transport layer, encapsulates the original data packet and sends it to the cloud VPN gateway. Step 4: The cloud server VPN gateway (IPv6: 2001:db8:2::1) receives the tunnel data packet, de-encapsulates and restores the original data packet, performs NAT64 protocol conversion, maps the internal network IPv6 address to a temporary IPv4 session, and forwards it to the MES server in the cloud VPC. Step 5: The data responded by the MES server returns to the barcode scanner through the IPv6 tunnel after reverse NAT64 conversion, completing a complete business interaction.

[0042] Figure 4 Shows the complete process of the system actively collaborating in a closed loop with edge detection first, local instantaneous blocking, and cloud linkage taking effect when a certain office terminal in the enterprise intranet is infected with ransomware, and completing the blocking before the virus spreads to the intranet server and the cloud. The process steps are as follows: Step 1 (Edge Detection): The office terminal (192.168.1.100) is infected with ransomware and begins initiating abnormal scanning connections. The internal security gateway detects the abnormal communication pattern in real time and constructs a behavioral feature vector. Calculate threat score The threat level is determined to be High.

[0043] Step 2 (Local Blocking): The internal security gateway immediately adds a blocking rule to the local firewall. It takes effect within 0.5 seconds, restricting the terminal's network access and blocking its path to spread to internal network servers. It also generates threat intelligence data packets. .

[0044] Step 3 (Cloud Synchronization): Synchronize threat intelligence data packets to the cloud server VPN gateway via a separate management VPN tunnel. Synchronization delay. Two-way certificate authentication is used to ensure communication security.

[0045] Step 4 (Cloud-based Blocking): After receiving threat intelligence, the cloud server VPN gateway calls the cloud platform security API to create a temporary blocking rule in the cloud security group, blocking abnormal terminals from accessing cloud resources. Expiration Time Hour.

[0046] Corresponding to the cloud-edge collaborative hybrid cloud network security system provided in the above embodiments, this application also provides a method for constructing a cloud-edge collaborative hybrid cloud network security system.

[0047] See Figure 5 The cloud-edge collaborative hybrid cloud network security system construction method in this embodiment includes: S101 deploys a VPN gateway virtual machine on a public cloud platform and configures dual-stack addresses, and deploys an internal security gateway on the enterprise's local machine and configures a 5G CPE device to obtain the operator's IPv6 address.

[0048] Create a cloud server instance on a public cloud platform. This cloud server instance will serve as a VPN gateway. Install and configure StrongSwan or OpenSwan software on the cloud server instance to establish an IPSec VPN tunnel. Configure a fixed public IPv4 address and a fixed IPv6 address for the cloud server VPN gateway, enabling it to support both IPv4 and IPv6 network access simultaneously.

[0049] An internal security gateway is deployed on the enterprise's local network side. This gateway connects the enterprise intranet, office terminals, servers, IoT devices, and 5G CPE access devices. The internal security gateway deploys an NGFW hardware firewall or software firewall and configures WAN and LAN interfaces. It also deploys NAT64 or protocol conversion functionality to achieve protocol adaptation between IPv6-only terminals and IPv4 service resources. Furthermore, an IDS or IPS function is deployed in the internal security gateway for intrusion detection, intrusion prevention, and threat identification of access traffic.

[0050] A 5G CPE device is deployed on the enterprise's local network side, and a 5G IoT SIM card is inserted into the 5G CPE device. The 5G CPE device accesses the Internet through the operator's 5G network and obtains an IPv6 address assigned by the operator. After obtaining the IPv6 address, the connectivity between the 5G CPE device and the Internet is verified, providing a network foundation for the subsequent establishment of an IPSec VPN tunnel.

[0051] S102, select to establish an IPv4 or IPv6 IPSec VPN tunnel according to the IP type assigned by the operator, establish an independent management channel and configure routing policies.

[0052] Based on the access network type, a corresponding IPSec VPN tunnel is established. When the enterprise's local side uses IPv4 access (including leased line or broadband access), an IPv4 IPSec tunnel is established between the enterprise's local side and the cloud server VPN gateway. When the enterprise's local side uses IPv6 access (including IoT card access), an IPv6-based IPSec tunnel is established between the 5G CPE or enterprise-side VPN client and the cloud server VPN gateway. This IPv6-based IPSec tunnel serves as the core enhancement of this solution, enabling secure cloud-edge interconnection in an IPv6-only access environment. When establishing the IPSec VPN tunnel, IPSec VPN parameters are configured, including the AES-256 encryption algorithm, SHA-256 authentication algorithm, and IKEv2 key exchange protocol. Through these configurations, encrypted communication between the enterprise's local network and the public cloud platform is achieved.

[0053] Establish an independent management channel between the enterprise's local system and the cloud-based security management platform. This independent management channel is used to call cloud-based security APIs, issue security policies, synchronize threat events, and transmit security logs.

[0054] By separating the business data channel from the security management channel, the impact of business access traffic on security policy synchronization is reduced, and the stability of cloud-edge collaborative response is improved.

[0055] After the IPSec VPN tunnel and independent management channel are established, configure secure access control policies.

[0056] The security access control policy includes an access whitelist, abnormal feature access restrictions, and API access permission restrictions. The access whitelist limits the number of local enterprise terminals, IoT devices, or servers allowed to access cloud-based business resources; abnormal feature access restrictions identify and block abnormal access behavior; and API access permission restrictions limit the scope of interface calls between the internal security gateway and the cloud-based security management platform.

[0057] S103 deploys threat detection rules and device micro-segmentation policies on the internal security gateway, configures basic security group policies on the cloud platform, and establishes a cloud-edge collaborative security response process.

[0058] Endpoint security behavior and network access behavior are collected through the enterprise's local internal security gateway. These security behaviors include access behavior from office terminals, IoT devices, servers, business access requests, DNS requests, external connection requests, abnormal traffic characteristics, and threat detection results. During the collection process, terminal type, source address, destination address, access protocol, access time, business type, context information, and threat level are recorded, providing a data foundation for subsequent cloud-edge collaborative response.

[0059] Based on the collected security behaviors and threat detection results, cloud-edge collaborative linkage trigger conditions are configured. When the detected threat level reaches Medium or higher, the cloud-edge collaborative response process is triggered. The linkage trigger conditions may include the following: detection of ransomware, Trojans, worms, or malicious scripts; detection of abnormal external connection behavior; detection of IoT devices accessing unauthorized Internet resources; detection of office terminals accessing malicious domains or making abnormal DNS requests; detection of east-west lateral movement behavior; detection of abnormal access or suspected intrusion behavior on business servers. When the trigger conditions are met, the internal security gateway synchronizes the threat event to the cloud security platform and generates local and cloud linkage rules.

[0060] Upon triggering the linkage, the internal security gateway first executes local blocking policies. These local blocking policies include blocking threat terminals from accessing any internal network resources, blocking abnormal external traffic, restricting the access range of suspicious IoT devices, isolating high-risk terminals, and prohibiting access to unauthorized internet resources. Simultaneously, the cloud security platform receives threat intelligence synchronized from the internal security gateway and calls the cloud security API to generate cloud-based linkage policies. These cloud-based linkage policies include synchronizing blocking rules in cloud security groups, firewall policies, or access control policies, and restricting access to relevant business resources. For IoT devices, the system can further implement micro-segmentation policies, prohibiting target IoT devices from accessing unauthorized internet resources and restricting their access to only specified business services or authorized resources within a specified time range. For temporary blocking policies, the system configures corresponding expiration times, allowing blocking rules to be effective only within a specific time window to avoid long-term blocking impacting normal business operations.

[0061] S104. Finally, test the VPN tunnel connectivity, verify the threat detection and automatic blocking functions, and verify the device access control policy.

[0062] Verify that the IPSec VPN tunnel is successfully established under IPv4 or IPv6 transmission conditions. Verify that the NAT64 protocol translation function is functioning correctly. Test the cross-cloud data transmission latency between the enterprise's local network and the public cloud platform to confirm that the cloud-edge communication link meets the requirements for business access and secure collaboration.

[0063] With business traffic transmitted through an IPSec VPN tunnel, verify whether the internal security gateway can locally block threat access. Verify whether the cloud security platform can receive threat intelligence and complete the cloud-based policy deployment. Furthermore, verify whether the synchronization time between the local security gateway and the cloud security platform is less than 1 second, and verify that the total response time of the entire threat response process is less than 2 minutes.

[0064] The access control policy for IoT terminals is verified. For example, it verifies whether IoT devices such as barcode scanners can access the cloud-based MES server normally, and whether the IoT devices can access legitimate business resources. Simultaneously, it verifies that the IoT devices cannot access external DNS, unauthorized internet resources, or other unauthorized business systems. Through these verifications, it is confirmed that while meeting business access requirements, unauthorized access paths for the IoT terminals are effectively restricted.

[0065] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, or the existence of B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0066] The above description is merely a specific embodiment of this application. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application. The protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A cloud-edge collaborative hybrid cloud network security system, characterized in that, include: The 5G CPE access layer, cloud server VPN gateway layer, and internal security gateway layer include: The 5G CPE access layer provides Internet access through the 5G mobile network, supports IPv6-only IoT card access mode, and obtains public IPv6 addresses from the operator network. The cloud server VPN gateway layer is deployed on a public cloud platform and has a fixed public IPv4 address and a public IPv6 address. It serves as a fixed anchor point for network connections and has dual-stack protocol conversion capabilities. The internal security gateway layer is deployed at the enterprise intranet boundary, integrating firewall and intrusion detection functions, and acts as an edge security node to perform local blocking based on threat detection. An IPSec VPN encrypted tunnel is established between the 5G CPE and the cloud server VPN gateway; an independent management channel is established between the internal security gateway and the cloud server VPN gateway for proactive synchronization of threat intelligence and policy coordination. The three-layer architecture achieves proactive cloud-edge coordination through the management channel, jointly forming a logically unified virtual enterprise network.

2. The cloud-edge collaborative hybrid cloud network security system according to claim 1, characterized in that, The 5G CPE access layer provides internet access through the 5G mobile network, supports IPv6-only IoT card access mode, and obtains public IPv6 addresses from the operator network, including: 5G CPE obtains a public routable IPv6 address from the 5G operator's network via an IoT card; The cloud server VPN gateway is also configured with a public IPv6 address, forming two endpoints that can be reached by IPv6; An IPSec VPN encrypted tunnel is established between the 5G CPE and the cloud server VPN gateway on the IPv6 transport layer, and the original IP data packets are fully encapsulated in tunnel mode. IPv4 or IPv6 service traffic generated by the enterprise intranet is inspected by the internal security gateway policy and then transmitted to the cloud via the IPv6 tunnel by the 5G CPE.

3. The cloud-edge collaborative hybrid cloud network security system according to claim 2, characterized in that, The method of fully encapsulating the original IP data packets using tunnel mode includes: Let the original data packet be After packaging, it is as follows: The outer layer uses IPv6 for transmission, while the inner layer carries either IPv4 or IPv6 data, achieving protocol independence; where: For inner source IP, For the inner target IP, For the outer source IP, The public IPv6 address obtained for the 5G CPE; For the outer target IP, This is the public IPv6 address of the cloud server's VPN gateway. For IP security protocol suite, This is the original data packet.

4. The cloud-edge collaborative hybrid cloud network security system according to claim 1, characterized in that, The cloud server VPN gateway layer includes: The protocol conversion unit is used to decapsulate traffic received from the IPv6 tunnel and perform NAT64 protocol conversion on traffic accessing the IPv4 Internet. Dual-stack anchor unit is used to simultaneously maintain the IPv6 tunnel endpoint and the IPv4 public network exit, serving as a unified external connection point for the enterprise network; The address mapping unit is used to maintain the mapping relationship between the IPv6 address of the internal network terminal and the temporary IPv4 session port.

5. The cloud-edge collaborative hybrid cloud network security system according to claim 4, characterized in that, The process of decapsulating traffic received from the IPv6 tunnel and performing NAT64 protocol translation on traffic accessing the IPv4 Internet includes: Define session mapping function and its inverse mapping : in: For the IPv6 address of the enterprise's intranet terminals. This is the source port number used by intranet terminals when initiating a connection. This is the public IPv4 address of the cloud server's VPN gateway. The port number temporarily assigned to this session by the gateway; Define protocol conversion operators : in: The input data packet uses the IPv6 protocol at its network layer; This is the source IPv6 address of the data packet. For the output data packets, the network layer converts them to the IPv4 protocol. The source IPv4 address and port after conversion. This is a session mapping table that records the translation relationships between IPv6 addresses and IPv4 addresses and ports; Perform reverse transformation on traffic returning from the Internet: ,in: The time it takes for an IPv6 packet to arrive at the gateway. This is the time it takes for the converted IPv4 packet to leave the gateway.

6. The cloud-edge collaborative hybrid cloud network security system according to claim 1, characterized in that, The internal security gateway layer, acting as an edge security node, performs local blocking based on threat detection, including: in: Threat level, The IP address of the abnormal terminal. The output firewall blocking rules, The action is to discard the data packet. This is the local expiration time of the rule.

7. The cloud-edge collaborative hybrid cloud network security system according to claim 1, characterized in that, An independent management channel is established between the internal security gateway and the cloud server VPN gateway for proactive synchronization of threat intelligence and policy coordination. The three-layer architecture achieves proactive cloud-edge coordination through this management channel, including: The internal security gateway monitors the communication patterns of internal network terminals in real time and constructs behavioral feature vectors. And calculate threat score ; When abnormal behavior matching threat characteristics is detected, the terminal IP address, anomaly type, timestamp, and threat level are extracted to generate a standardized threat intelligence data packet: in: The IP address of the abnormal terminal. This serves as an anomaly type identifier. For the detection time, Threat level, For contextual information; Dynamically add blocking rules to the local firewall to restrict network access from abnormal terminals and prevent threats from spreading laterally within the internal network; Threat intelligence packets are transmitted to the cloud server VPN gateway via a separate management VPN tunnel; After receiving threat intelligence, the cloud server VPN gateway calls the cloud platform security API to create temporary blocking rules for abnormal terminal IPs in the cloud security group and set an automatic expiration time.

8. The cloud-edge collaborative hybrid cloud network security system according to any one of claims 1-7, characterized in that, When a device is accessed, a device role label is created based on the device's business functions. The role label is defined as follows: in: For the equipment to be sorted, For a predefined set of role tags, For equipment eigenvectors, For the role template feature vector, For similarity functions; Bind device identity based on device MAC address and IP address; Configure role-based access control policies on the internal security gateway; The internal security gateway performs deep inspection of data packets to identify device roles; Based on the network access control rules corresponding to the device role, access requests that violate the policy are blocked in real time and security alerts are generated.

9. The cloud-edge collaborative hybrid cloud network security system according to claim 8, characterized in that, Configure role-based access control policies on the internal security gateway, including: For specific devices, set a default policy that completely blocks internet access: ； Simultaneously configure whitelist rules to allow access to specific intranet services: Priority satisfied ; Blocking the device's query requests to external DNS servers: in: The device role label to which the data packet sender belongs. The destination address of the data packet. The default blocking policy for IoT devices. Rules for allowing IoT devices to access specific services. This is the IP address of the MES server. The destination port number of the data packet. For the target DNS server, For external DNS sets, This indicates a logical AND operation.

10. A method for constructing a cloud-edge collaborative hybrid cloud network security system according to any one of claims 1-9, characterized in that, include: Deploy a VPN gateway virtual machine on a public cloud platform and configure dual-stack addresses; deploy an internal security gateway on the enterprise's local machine and configure a 5G CPE device to obtain the operator's IPv6 address. Choose to establish an IPv4 or IPv6 IPSec VPN tunnel based on the IP type assigned by the operator, establish an independent management channel and configure routing policies; Deploy threat detection rules and device micro-segmentation policies on the internal security gateway, configure basic security group policies on the cloud platform, and establish a cloud-edge collaborative security response process. Finally, the VPN tunnel connectivity was tested to verify the threat detection and automatic blocking functions, and the device access control policy was verified.

Images