An interactive trusted security management and control method suitable for a trusted relay protection device

Abstract

The application discloses an interactive trusted security management and control method suitable for trusted relay protection devices, and steps are as follows: each trusted relay protection device is installed with a trusted defense component and is registered to a network monitoring device; the network monitoring device synchronizes a first security rule list to each trusted relay protection device to form a second security rule list; terminal physical / logical information of the trusted relay protection device is acquired in real time, and a security score is calculated according to the second security rule list; when the security score is lower than a pre-set threshold value, an abnormal behavior data set is formed, the network monitoring device forms a disposal command list according to the abnormal behavior data set and in combination with a network node list, and the disposal command list is issued in a control command mode; the trusted relay protection device executes the control command, and records a command execution process this time. The security management and control method can further cover security risk management and control of each module of the linux device, a complete trusted security management and control mechanism is established for the power monitoring device, and the safe operation of the device and the power monitoring system is supported.

Description

Technical Field

[0001] This invention belongs to the field of information security of power monitoring systems, and relates to an interactive trusted device management method based on trusted computing and game theory models for various Linux system devices in power monitoring systems. In particular, it relates to an interactive trusted security management method applicable to trusted relay protection devices. Background Technology

[0002] The power monitoring system consists of protection equipment, automation equipment, station control layer equipment and software, metering and power quality equipment, communication and security equipment, auxiliary equipment and other equipment and systems. It is the core of the business to realize real-time monitoring, fault prevention and operation control of the power grid, and is of great importance to ensuring the safe and stable operation of the power system.

[0003] Power monitoring equipment is mostly traditional embedded devices. To ensure real-time operation, these devices often run various modified versions of Linux and Unix-like operating systems. These operating systems lack a complete Linux network security protection mechanism, and there are the following security risks, especially in terms of abnormal behavior control:

[0004] (1) Relay protection equipment currently lacks a mature local security protection scheme and has no protection capability when facing external attacks;

[0005] (2) Existing trusted computing protection technologies for substations are mostly applied to equipment such as servers and industrial control computers, and are deployed as stand-alone devices without being connected to the power monitoring network. This will result in some devices having a significant economic impact on the power system network after their behavior is controlled according to their fixed security rules.

[0006] (3) There are many substations and a wide range of professional fields. The supervision of relay protection equipment is difficult, the overall system security boundary is complex, and unknown risk attacks are increasing. Precise monitoring of the internal parts of the equipment is required. Summary of the Invention

[0007] The purpose of this invention is to provide an interactive and trusted security management method suitable for trusted relay protection devices, which can further cover the security risk management of various modules of Linux devices, establish a complete and trusted security management mechanism for power monitoring equipment, and support the safe operation of the device and the power monitoring system.

[0008] To achieve the above objectives, the solution of the present invention is:

[0009] An interactive trusted security management method for trusted relay protection devices includes the following steps:

[0010] Step 1: Each trusted relay protection device installs a trusted defense component and registers it with the network monitoring device. The network monitoring device then synchronizes the first security rule list to each trusted relay protection device to form the second security rule list.

[0011] Step 2: Obtain the physical and logical information of the trusted relay protection device in real time, and calculate the security score of the trusted relay protection device according to the second security rule list;

[0012] Step 3: Compare the security score of the trusted relay protection device with a preset threshold. If it is lower than the threshold, collect the data involved in the security score calculation in Step 2 and form an abnormal behavior dataset, which is then sent to the network monitoring device.

[0013] Step 4: The network monitoring equipment matches the various data in the received abnormal behavior dataset with the network node list to form a list of handling commands, and sends the contents of the list of handling commands to the corresponding trusted relay protection devices in the form of control commands.

[0014] Step 5: Execute the control command corresponding to the trusted relay protection device and record the execution process of this command.

[0015] In step 1 above, after the trusted relay protection device successfully installs the trusted defense component and registers with the network monitoring device, the network monitoring device encrypts the first security rule list, sends it out, and stores it in the trusted relay protection device.

[0016] After a trusted relay protection device or network monitoring device unilaterally modifies the security rule data, the terminal proactively sends a synchronization operation request to the other party to cooperate in completing the real-time information synchronization operation.

[0017] In step 2 above, the terminal physical information includes the physical information of the CPU, memory, hard disk, and network card, and the terminal logical information includes process access status, file access status, and network communication traffic.

[0018] In step 2 above, the terminal physical information and terminal logical information are matched with the second security rule list to obtain the types and number of abnormal behaviors triggered within a set period, and a security score is calculated according to the following formula.

[0019]

[0020] Where Score represents the security score of the trusted relay protection device within the set period, e∈Event bad This indicates that the set of events that triggers the safety exceedance condition has been activated. bad One type of condition, Weight e Num represents the safety weight data for condition e. eThis indicates the number of times the safety over-limit condition e is triggered within the period.

[0021] In step 3 above, if the safety score of the reliable relay protection device is lower than a preset threshold, the safety over-limit condition set Event is... bad Each behavior type e∈Event bad Subdata e within i The information content of the triggering rules is integrated to form an attribute set {I} for this type of abnormal behavior. e |e i ∈I e}, integrate the event attribute set of all abnormal behavior types within the abnormal behavior set {I|I e ∈I}.

[0022] In step 4 above, the network node list includes the importance weight of each node, the economic value of each node, the network traffic of each node per unit time, and the total number of external connections of each node. The importance weight and economic value of each node are set according to the situation. The two attributes of network traffic and total number of external connections of each node per unit time are updated in real time after being periodically sent to the network monitoring equipment by each trusted relay protection device.

[0023] Step 4 above includes,

[0024] Step 4-1: The network monitoring device extracts the abnormal behavior data and its corresponding network node attributes based on the received abnormal behavior dataset, and calculates the loss R caused by a successful abnormal behavior attack according to the following formula. a The business interruption cost C caused by the corresponding measures for network outages d Losses L resulting from a successful attack when the defender fails to take corresponding measures such as disconnecting the network. d ,

[0025] R a =α×Price,C d =Net×Num Connect ,

[0026] Where α is the importance weight of each node, Price is the economic value of a node, Net is the network traffic of each node per unit time, and Num Connect This represents the total number of external connections for each node.

[0027] Step 4-2: Calculate the impact of behavioral benefits under the corresponding conditions, and obtain the Nash equilibrium point according to the max-in-min method. Use the impact of behavioral benefits at the Nash equilibrium point as the risk index. Compare the risk index with a threshold. If it is higher than the threshold, issue a network disconnection command to the trusted relay protection device and execute the command set. Otherwise, continuously monitor the trusted relay protection device.

[0028] Upon receiving a control command, the aforementioned trusted relay protection device performs corresponding behavioral control through the hook function family established by the trusted defense component, thereby disconnecting the physical network or network link.

[0029] In steps 1, 3, and 4 above, the data interaction and source verification between the network monitoring equipment and the trusted relay protection equipment adopt the SM4 and SM2 and SM3 national cryptographic algorithms based on trusted computing.

[0030] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor; when the processor executes the computer program, it implements the steps of the interactive trusted security management method for trusted relay protection devices as described above.

[0031] A computer-readable storage medium storing a computer program; when executed by a processor, the computer program implements the steps of the interactive trusted security management method for trusted relay protection devices as described above.

[0032] After adopting the above scheme, this invention uses a trusted security status monitoring module to continuously monitor the logical / physical information of the relay protection device, and calculates the current security score of the relay protection device according to the security rule list. If the score is low, the abnormal behavior dataset is sent to the network monitoring device. The network monitoring device will match the abnormal behavior data with the handling measures to form a list of handling commands. Finally, the trusted relay protection device executes the handling measures to complete the security control process. Compared with the prior art, the technical solution conceived in this invention can achieve the following beneficial effects:

[0033] (1) The system-level parameters that can be obtained in real time by the trusted defense component are used to accurately calculate the safety risks of relay protection equipment. Compared with other traditional relay protection equipment, the control method of the present invention has stronger real-time performance, finer risk calculation granularity, and more accurate system status.

[0034] (2) Combining the characteristics of the secondary system network of the power system, the network monitoring equipment is used to connect each independent relay protection device for data collection, strategy generation and distribution. Under the condition of obtaining complete network information, the abnormal node response measures are determined. Compared with the existing equipment management methods of relay protection devices, the method of this invention can maximize the benefits. Attached Figure Description

[0035] Figure 1 This is a flowchart of the method of the present invention;

[0036] Figure 2 This is a schematic diagram of the interactive communication between the network monitoring equipment and the trusted relay protection equipment in this invention;

[0037] Figure 3 This is a schematic diagram of the treatment measure matching process in this invention. Detailed Implementation

[0038] The technical solution and beneficial effects of the present invention will be described in detail below with reference to the accompanying drawings.

[0039] This invention provides an interactive, trusted security management method for trusted relay protection devices, applied between network monitoring equipment and multiple trusted relay protection devices. The method includes the following steps:

[0040] Step 1: The trusted relay protection device installs the trusted defense component and registers it with the network monitoring device. The network monitoring device then synchronizes security rule list 1 to the trusted relay protection device to form security rule list 2.

[0041] After the trusted relay protection device described in step 1 successfully installs the trusted defense component and registers with the network monitoring device, the network monitoring device encrypts its security rule list, distributes it, and stores it in the trusted relay protection device. If the trusted relay protection device or the network monitoring device unilaterally modifies the security rule data, the device will proactively send a synchronization operation request to the other party to cooperate in completing the real-time information synchronization operation.

[0042] Step 2: The trusted security status monitoring module in the trusted relay protection device continuously monitors information such as CPU usage, memory usage, process access, file access, and network communication traffic in the device, and calculates the security score of the trusted relay protection device according to security rule list 2.

[0043] The information set obtained in step 2 is used to calculate the overall security score data of the node after each matching entry in the security rule list. The security rule list contains attributes such as rule attribute name, security violation condition, and violation condition weight.

[0044] In step 2, the trusted relay protection device pre-sets weights for abnormal behaviors such as abnormal process execution, abnormal file access, abnormal network connection, and abnormal user login. After acquiring the terminal's physical / logical information, the trusted relay protection device searches the security rule database for abnormal behavior matching and records the types of abnormal behaviors and the number of rule triggers. After a certain period, it uses the following formula to score the overall security status over the period:

[0045]

[0046] In the formula, Score represents the total security score of the corresponding trusted relay protection device within the specified period, e∈Event bad This indicates that the set of events that triggers the safety exceedance condition has been activated. badOne type of condition, Weight e Num represents the safety weight data for condition e. e This indicates the number of times the safety over-limit condition e is triggered within the period.

[0047] Step 3: The trusted relay protection device compares the security score generated in Step 2 with a preset threshold. If the score is lower than the threshold, the trusted security status monitoring module collects the data involved in the security score calculation in Step 2 and forms an abnormal behavior dataset, which is then sent to the network monitoring device.

[0048] Furthermore, in the abnormal behavior dataset generation method formed by this invention, in step 3, if the safety score generated by the trusted relay protection device in step 2 is lower than a preset threshold, the safety over-limit condition set Event will be... bad Each type of condition e∈Event bad Subdata e within i The information content of the triggering rules is integrated to form an attribute set {I} for this type of abnormal behavior. e |e i ∈I e}, integrate the event attribute set of all abnormal behavior types within the abnormal behavior set {I|I e ∈I}.

[0049] Step 4: The network monitoring equipment matches the various data in the received abnormal behavior dataset with the network node list to form a list of handling commands. Then, the contents of the handling command list are sent to the corresponding trusted relay protection devices in the form of control commands.

[0050] Furthermore, the network node list formed by this invention, as described in step 4, includes the importance weight α of each node, the economic value Price of each node, the network traffic Net of each node per unit time, and the total number of external connections Num of each node. Connect The node importance weight and node economic value are preset values, while the network traffic and total number of external connections of each node per unit time are updated in real time after each node sends them to the network monitoring equipment periodically.

[0051] The handling measures matching mentioned in step 4 refers to a game model that separates network nodes based on a pre-modeled payoff function. The risk index Nash equilibrium is solved for each node with abnormal behavior using network node list data and abnormal behavior dataset. The obtained risk index is then compared with a threshold. If it is higher than the threshold, a network disconnection command is issued to the problematic node. Otherwise, the node is continuously monitored.

[0052] After obtaining the set of abnormal behavior event attributes sent by the trusted device node in step 3, the network monitoring equipment evaluates and calculates the data using existing game theory, and finally derives a handling measure, which specifically includes the following steps:

[0053] Step 4-1: After receiving the periodically uploaded abnormal behavior reports from each node, the network monitoring equipment organizes the abnormal behavior data and its corresponding network node attributes, and uses the following formula to calculate the loss R caused by a successful abnormal behavior attack. a The business interruption cost C caused by the corresponding measures for network outages d Losses L resulting from a successful attack when the defender fails to take corresponding measures such as disconnecting the network. d :

[0054] R a =α×Price,C d =Net×Num Connect ,

[0055] Step 4-2: Based on the three parameter data calculated in Step 4-1, calculate the impact of behavioral benefits according to the corresponding conditions, and obtain the Nash equilibrium point using the max-in-min method. The Nash equilibrium point is calculated as follows:

[0056]

[0057] The Nash equilibrium point p in the formula * ∈(0,1] represents the risk index when a node with abnormal behavior does not take corresponding measures under given conditions. The calculated risk index is compared with a threshold. If it is higher than the threshold, a network disconnection command is issued to the network node to execute the command set; otherwise, the node is continuously monitored.

[0058] Step 5: After the reliable relay protection device executes the downlink control command described in step 4, it records the execution process of this command.

[0059] In step 5, after receiving the action command, the trusted relay protection device uses the hook function family established by the trusted defense component to perform corresponding behavior control to disconnect the physical network or network link.

[0060] In steps 1, 3, and 4, the data interaction and source verification between the network monitoring equipment and the trusted relay protection equipment adopt the SM4, SM2, and SM3 national cryptographic algorithms based on trusted computing to ensure the confidentiality and integrity of the interaction content, as well as the correctness of the source.

[0061] To better describe the embodiments of the present invention and demonstrate its inventiveness, the following example illustrates the process of a trusted relay protection device detecting an abnormal process and network communication anomalies, followed by joint handling of the anomaly by a local node and network monitoring equipment, including the following steps:

[0062] Before implementing trusted device management, trusted relay protection device hardware and software must be deployed on all relay protection devices. Furthermore, the network monitoring device needs to store the communication platform certificate of the trusted relay protection device within its node beforehand; similarly, the trusted relay protection device also needs to import the communication platform certificate of the network monitoring device into its own node beforehand. This platform certificate will be used in subsequent communication processes.

[0063] After the above preparatory work is completed, the specific steps from the detection of abnormal operation behavior to the execution of corresponding measures by the finally reliable relay protection equipment will proceed:

[0064] Step 1: The trusted relay protection device installs the trusted defense component and registers it with the network monitoring device. The network monitoring device then synchronously generates a security rule list 2 and periodically uploads node network information to populate the network node list of the network monitoring device, specifically including:

[0065] 1-1) The network monitoring device sends its own configured security rule list 1 to the trusted relay protection device after being encrypted with SM4. The relay protection device decrypts the data through the encryption and decryption module of the trusted defense component and configures it in the device to form security rule list 2.

[0066] 1-2) After the trusted relay protection device is registered with the network monitoring device, it will automatically send the network traffic and total number of network connections of its own node at regular intervals. After receiving the traffic and connection information sent by the relay protection device, the network monitoring device will fill it into the attribute column of the corresponding network node in the network node list.

[0067] Step 2: The trusted security status monitoring module in the trusted relay protection device continuously monitors various information within the device and calculates the security score of the trusted relay protection device according to security rule list 2, specifically including:

[0068] 2-1) The trusted security status monitoring module continuously monitors and acquires the terminal physical information of the device, such as CPU, memory, hard disk, and network card, as well as terminal logical data such as process access, file access, and network communication traffic. After a certain period of time, it organizes all terminal logical / physical data and obtains the average value of each data within the period. Preferably, the period is generally selected as 5-15 minutes.

[0069] 2-2) The trusted security status monitoring module compares the statistical data components obtained in step 2-1) with the corresponding security rule items in the security rule list 2. When a security rule is triggered, the trigger count of the corresponding security rule item is incremented by 1. After all statistical data components have completed the security rule comparison and trigger record, all trigger record statistical data are brought into the security score calculation formula to calculate the security score of the trusted relay protection device.

[0070] Step 3: The trusted relay protection device compares the security score generated in Step 2 with a preset threshold. If the score is lower than the threshold, the trusted security status monitoring module collects the data involved in the security score calculation in Step 2 and forms an abnormal behavior dataset, which is then sent to the network monitoring device. The abnormal behavior dataset includes: logical / physical data of all terminals that have triggered security rules, the name of the triggered security rule item, the number of times the security rule item has been triggered, and the weight of the triggered security rule item.

[0071] Step 4: The network monitoring equipment matches the received abnormal behavior dataset with the network node list to generate a list of handling commands. The handling commands are then sent as control commands to the corresponding trusted relay protection devices, specifically including:

[0072] 4-1) After receiving the periodically uploaded abnormal behavior reports from each node, the network monitoring equipment sorts out the abnormal behavior data and its corresponding network node attributes, and uses the following formula to calculate the loss R caused by a successful abnormal behavior attack. a The business interruption cost C caused by the corresponding measures for network outages d Losses L resulting from a successful attack when the defender fails to take corresponding measures such as disconnecting the network. d :

[0073] R a =α×Price,C d =Net×Num Connect ,

[0074] 4-2): Based on the three parameter data obtained in step 4-1, calculate the reward function value under the corresponding conditions, and obtain the Nash equilibrium point using the max-in-min method. The calculation method of the Nash equilibrium point is as follows:

[0075]

[0076] The Nash equilibrium point p in the formula *∈(0,1] represents the risk index when a node with abnormal behavior does not take corresponding measures under given conditions. The calculated risk index is compared with a threshold. If it is higher than the threshold, a network disconnection command is issued to the network node to execute the command set; otherwise, the node is continuously monitored.

[0077] Step 5: After the reliable relay protection device executes the downlink control command described in Step 4, it records the execution process of this command, specifically including:

[0078] In step 5, after receiving the action command, the trusted relay protection device uses the hook function family established by the trusted defense component to perform corresponding behavior control to disconnect the physical network or network link.

[0079] In summary, in the technical solution provided by this invention, security rule list 1 is deployed in the network monitoring equipment, and security rule list 2 is deployed in the trusted relay protection equipment, responsible for storing rule attribute names, security over-limit conditions, over-limit condition weights, and other attributes related to security score calculation; the network node list is deployed in the network monitoring equipment, including the importance weight of each node, the economic value of each node, the network traffic of each node per unit time, and the total number of external connections of each node, responsible for participating in the calculation of handling measures; the handling measure matching module is deployed in the network monitoring equipment, and uses a game model of network node stripping based on a pre-modeled payoff function, and uses the network node list data and abnormal behavior dataset to solve the risk index Nash equilibrium for each node with abnormal behavior, and then determines whether a control command needs to be issued based on the solution result; trusted security status monitoring... The monitoring module is deployed on the trusted relay protection device and serves as the real-time status monitoring submodule of the trusted defense component. It is responsible for establishing a family of hook functions based on the LSM mechanism. These hook functions act as filtering devices and are connected in series in the data request chain of all kernels and applications of the power monitoring device. When the request chain is activated and executed to the hook function, the function will call the system function to obtain the terminal physical information at this moment and obtain the terminal logical information by retrieving the context content of the request chain. Specifically, it includes terminal physical information such as CPU, memory, hard disk, and network card, as well as terminal logical information such as process access, file access, and network communication traffic. The module integrates the two types of information and forms the overall security score of the node through a fixed calculation formula. The handling and execution module is deployed on the trusted relay protection device and is responsible for receiving and processing handling measure messages from the network monitoring device.

[0080] This invention also provides another computer device, including a processor and a memory configured to store a computer program capable of running on the processor; wherein, when the processor is configured to run the computer program, it performs the method steps described in the foregoing embodiments.

[0081] In practical applications, the aforementioned processor includes a Field-Programmable Gate Array (FPGA), and the processor can be a Central Processing Unit (CPU) or a Digital Signal Processor (DSP). It is understood that for different devices, the electronic devices used to implement the functions of the aforementioned processor can also be other types, and this embodiment of the invention does not impose specific limitations.

[0082] The aforementioned memory can be volatile memory, such as random-access memory (RAM); or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); or a combination of the above types of memory, and provides instructions and data to the processor.

[0083] In an exemplary embodiment, the present invention also provides a computer-readable storage medium for storing a computer program.

[0084] Optionally, the computer-readable storage medium can be applied to any of the methods in the embodiments of the present invention, and the computer program causes the computer to execute the corresponding processes implemented by the processor in the various methods of the embodiments of the present invention. For the sake of brevity, these will not be described in detail here.

[0085] In the several embodiments provided by this invention, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0086] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0087] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0088] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0089] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0090] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0091] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. An interactive trusted security management method for trusted relay protection devices, characterized in that... Includes the following steps: Step 1: Each trusted relay protection device installs a trusted defense component and registers it with the network monitoring device. The network monitoring device then synchronizes the first security rule list to each trusted relay protection device to form the second security rule list. Step 2: Obtain the physical and logical information of the trusted relay protection device in real time, and calculate the security score of the trusted relay protection device according to the second security rule list; Step 3: Compare the security score of the trusted relay protection device with a preset threshold. If it is lower than the threshold, collect the data involved in the security score calculation in Step 2 and form an abnormal behavior dataset, which is then sent to the network monitoring device. Step 4: The network monitoring equipment matches the various data in the received abnormal behavior dataset with the network node list to form a list of handling commands, and sends the contents of the list of handling commands to the corresponding trusted relay protection devices in the form of control commands. Step 5: Execute the control command corresponding to the trusted relay protection device and record the execution process of this command.

2. The method as described in claim 1, characterized in that: In step 1, after the trusted relay protection device installs the trusted defense component and successfully registers with the network monitoring device, the network monitoring device encrypts the first security rule list, sends it out, and stores it in the trusted relay protection device. After a trusted relay protection device or network monitoring device unilaterally modifies the security rule data, the terminal proactively sends a synchronization operation request to the other party to cooperate in completing the real-time information synchronization operation.

3. The method as described in claim 1, characterized in that: In step 2, the terminal physical information includes the physical information of the CPU, memory, hard disk, and network card, and the terminal logical information includes process access status, file access status, and network communication traffic.

4. The method as described in claim 1, characterized in that: In step 2, the terminal physical information and terminal logical information are matched with the second security rule list to obtain the types and number of abnormal behaviors triggered within a set period, and a security score is calculated according to the following formula. Where Score represents the security score of the trusted relay protection device within the set period, e∈Event bad This indicates that the set of events that triggers the safety exceedance condition has been activated. bad One type of condition, Weight e Num represents the safety weight data for condition e. e This indicates the number of times the safety over-limit condition e is triggered within the period.

5. The method as described in claim 1, characterized in that: In step 3, if the safety score of the reliable relay protection device is lower than a preset threshold, the safety over-limit condition set Event is... bad Each behavior type e∈Event bad Subdata e within i The information content of the triggering rules is integrated to form an attribute set {I} for this type of abnormal behavior. e |e i ∈I e }, integrate the event attribute set of all abnormal behavior types within the abnormal behavior set {I|I e ∈I}.

6. The method as described in claim 1, characterized in that: In step 4, the network node list includes the importance weight of each node, the economic value of each node, the network traffic of each node per unit time, and the total number of external connections of each node. The importance weight and economic value of each node are set according to the situation. The two attributes of network traffic and total number of external connections of each node per unit time are updated in real time after being periodically sent to the network monitoring equipment by each trusted relay protection device.

7. The method as described in claim 1, characterized in that: Step 4 includes, Step 4-1: The network monitoring device extracts the abnormal behavior data and its corresponding network node attributes based on the received abnormal behavior dataset, and calculates the loss R caused by a successful abnormal behavior attack according to the following formula. a The business interruption cost C caused by the network outage response measures d Losses L resulting from a successful attack when the defender fails to take corresponding measures such as disconnecting the network. d , R a =α×Price,C d =Net×Num Connect , Where α is the importance weight of each node, Price is the economic value of a node, Net is the network traffic of each node per unit time, and Num Connect This represents the total number of external connections for each node. Step 4-2: Calculate the impact of behavioral benefits under the corresponding conditions, and obtain the Nash equilibrium point according to the max-in-min method. Use the impact of behavioral benefits at the Nash equilibrium point as the risk index. Compare the risk index with a threshold. If it is higher than the threshold, issue a network disconnection command to the trusted relay protection device and execute the command set. Otherwise, continuously monitor the trusted relay protection device.

8. The method as described in claim 1, characterized in that: Upon receiving a control command, the trusted relay protection device performs corresponding behavioral control through the hook function family established by the trusted defense component, thereby disconnecting the physical network or network link.

9. The method as described in claim 1, characterized in that: In steps 1, 3, and 4, the data interaction and source verification between the network monitoring equipment and the trusted relay protection equipment adopt the SM4, SM2, and SM3 national cryptographic algorithms based on trusted computing.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor; characterized in that: When the processor executes the computer program, it implements the steps of the interactive trusted security management method for trusted relay protection devices as described in any one of claims 1 to 9.

11. A computer-readable storage medium storing a computer program; characterized in that: When the computer program is executed by a processor, it implements the steps of the interactive trusted security management method for trusted relay protection devices as described in any one of claims 1 to 9.

Images