Multi-source heterogeneous security resource automatic collection system based on zero trust identity creation environment

Abstract

The application relates to the technical field of network security, and particularly discloses a multi-source heterogeneous security resource automatic collection system based on a zero-trust credit environment. The technical scheme of the application deploys a resource adaptation framework on a heterogeneous domestic hardware and software platform to obtain resource description information, an access protocol type and an authentication mode type of each security resource node, generates a standardized resource object model with the aid of unified resource modeling, and combines collection strategies to adaptively generate conflict resolution, dynamically schedule execution, normalize processing and incremental linkage, so that automatic adaptive collection of multi-source heterogeneous security resources, dynamic generation and conflict resolution of strategies and data normalization processing are realized, and the real-time performance, completeness and accuracy of security resource data received by a zero-trust policy decision end are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an automatic collection system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment. Background Technology

[0002] As zero-trust architectures are gradually implemented in critical infrastructures, security protection logic has shifted from perimeter defense to continuous verification and dynamic authorization, which places higher demands on the real-time performance and integrity of security resources. However, most organizations still rely on asset ledgers and periodic scanning for resource collection. The collection results are independent of the update schedule of security policies, and the resource status often changes by the time the policy takes effect. As a result, the fine-grained access control upon which zero trust relies lacks a reliable data foundation.

[0003] Meanwhile, the domestic IT innovation and replacement process has further dispersed security resources across various domestically produced software and hardware platforms with different architectures. These platforms differ significantly in resource description specifications, access protocols, and authentication mechanisms. Existing data collection tools are typically developed for single environments and lack the ability to uniformly model and automatically adapt to heterogeneous resources. As the number of security nodes increases and resource types continue to expand, relying on manual configuration of data collection rules for each node not only fails to cover all assets but is also prone to data collection interruptions due to rule conflicts or version differences. This makes it impossible to provide stable and comprehensive resource support for continuous risk assessment with zero trust.

[0004] Therefore, there is an urgent need to provide a technical solution to address the above problems. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides an automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust domestic IT innovation environment. The technical solution of this system is as follows:

[0006] The resource adaptation framework module is used to connect with various security resource nodes deployed on heterogeneous domestic software and hardware platforms, obtain resource description information, access protocol type and authentication mechanism type of each security resource node, and provide protocol adapters corresponding to each access protocol type and authentication components corresponding to each authentication mechanism type.

[0007] The unified resource modeling module is used to receive the resource description information, perform resource object modeling on the security resource nodes of different architecture platforms, and generate a standardized resource object model.

[0008] The adaptive acquisition strategy generation module is used to dynamically generate acquisition strategies for each security resource node based on the standardized resource object model, the access protocol type, and the authentication mechanism type, and to perform conflict detection on each generated acquisition strategy, resolve conflicting acquisition strategies, and output conflict-free acquisition strategies.

[0009] The dynamic scheduling execution module is used to call the protocol adapter and authentication component corresponding to each security resource node in the resource adaptation framework module according to the conflict-free acquisition strategy, issue acquisition instructions to each security resource node, and receive security resource data returned by each security resource node.

[0010] The normalization processing module is used to receive the security resource data and convert the security resource data into security resource data in a standardized format according to the standardized resource object model.

[0011] The incremental linkage module is used to detect changes in the resource data of each security resource node. When a change is detected, it sends an update request to the adaptive generation module of the acquisition strategy to regenerate the acquisition strategy of the changed resource node, and drives the dynamic scheduling execution module to perform incremental acquisition, outputting the updated standardized security resource data to the zero-trust policy decision end.

[0012] The technical solution of this invention deploys a resource adaptation framework on heterogeneous domestic software and hardware platforms to obtain resource description information, access protocol types, and authentication method types of each security resource node. It generates a standardized resource object model by leveraging unified resource modeling, and combines adaptive generation and conflict resolution of collection strategies, dynamic scheduling and execution, normalization processing, and incremental linkage. This solves the problem that the resource status has changed when the policy takes effect due to the independent rhythm of existing resource collection and security policy updates, as well as the problem that there are significant differences in resource description specifications, access protocols, and authentication methods among multiple architecture platforms in the context of domestic IT innovation, and that existing collection tools lack unified modeling and automatic adaptation capabilities. It realizes automatic adaptation and collection of multi-source heterogeneous security resources, dynamic generation and conflict resolution of policies, and data normalization processing, thereby improving the real-time performance, completeness, and accuracy of security resource data received by the zero-trust policy decision-making end.

[0013] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0015] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0016] Figure 1 This is a schematic diagram of an embodiment of an automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment according to the present invention. Detailed Implementation

[0017] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0018] Figure 1 This diagram illustrates a structural schematic of an embodiment of an automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology environment, provided by the present invention. Figure 1 As shown, the automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust domestic IT innovation environment includes:

[0019] The resource adaptation framework module 110 is used to connect to various security resource nodes deployed on heterogeneous domestic software and hardware platforms, obtain resource description information, access protocol type and authentication mechanism type of each security resource node, and provide protocol adapters corresponding to each access protocol type and authentication components corresponding to each authentication mechanism type.

[0020] After obtaining the resource description information of each security resource node, the resource adaptation framework module 110 outputs the original resource description information of each security resource node to the unified resource modeling module 120 according to the architecture platform type indicated by the runtime environment identifier in the resource description information.

[0021] The heterogeneous domestic software and hardware platform refers to a collection of computing environments composed of domestically produced central processing units (CPUs) with different instruction set architectures and corresponding domestically produced operating systems. These computing environments differ in their hardware instruction sets, system call interfaces, and system service components. For example, in a power monitoring system's security resource acquisition environment, the heterogeneous domestic software and hardware platform includes three servers: the first server is equipped with processor A and operating system B; the second server is equipped with processor C and operating system D; and the third server is equipped with processor E and operating system F. A security resource node refers to an independent physical device or virtualized instance deployed on the heterogeneous domestic software and hardware platform, providing network security protection functions or storing security-related data. This independent physical device or virtualized instance has an independent network address and can provide security service interfaces externally. For example, in the power monitoring system's security resource acquisition environment, the security resource node is a firewall device instance deployed on the first server. This firewall device instance has an independent IP address (192.168.1.10) and can provide status detection service interfaces externally.

[0022] The resource description information refers to a set of parameters characterizing the attributes of a security resource node. This set includes the security resource type, software version number, network address information, service port number, running status identifier, and running environment identifier. For example, the resource description information of a firewall device instance includes: security resource type is firewall, software version number is V3.2.1, network address information is IP address 192.168.1.10, service port number is 8080, running status identifier is online, and running environment identifier is operating system B. The access protocol type refers to the communication protocol specification followed by the security resource node when providing data interaction services. This communication protocol specification defines the data transmission format, message structure, and interaction process. For example, the access protocol type followed by the firewall device instance when providing data interaction services is the SNMP protocol. This SNMP protocol specifies that the data transmission format is TLV format, the message structure includes a version number, community name, and protocol data unit, and the interaction process includes GET requests and responses. The authentication mechanism type refers to the classification of the identity verification methods used by security resource nodes when verifying the legitimate identity of the access requester. This classification includes certificate authentication, token authentication, and password authentication. For example, the authentication mechanism type used by the firewall device instance when verifying the legitimate identity of the access requester is password authentication, which requires the access requester to submit a username and password for identity verification.

[0023] The protocol adapter refers to a software component that encapsulates the data interaction format conversion logic and message assembly logic under a specific access protocol type. This software component is used to convert internal standardized requests into request messages that conform to the access protocol type requirements of the security resource node, and to convert the response messages returned by the security resource node into an internally recognizable data structure. For example, the protocol adapter corresponding to the SNMP protocol of the firewall device instance is an SNMP protocol adapter. This SNMP protocol adapter converts internal collection requests into SNMP GET request messages and parses the SNMP response messages returned by the firewall device instance into an internally recognizable key-value pair data structure. The authentication component refers to a software component that encapsulates the authentication credential generation logic and authentication process processing logic under a specific authentication mechanism type. This software component is used to generate corresponding authentication credentials according to the authentication mechanism type of the security resource node and embed the authentication credentials into the communication request. For example, the authentication component corresponding to the password authentication of the firewall device instance is a password authentication component. This password authentication component generates authentication credentials containing the username and password based on a preset username and password and embeds the authentication credentials into the community name field of the SNMP GET request message.

[0024] The unified resource modeling module 120 is used to receive the resource description information, perform resource object modeling on the security resource nodes of different architecture platforms, and generate a standardized resource object model.

[0025] After receiving the resource description information of each security resource node output by the resource adaptation framework module 110, the unified resource modeling module 120 identifies the architecture platform type of each security resource node based on the runtime environment identifier in each resource description information. According to the architecture platform type, it calls the corresponding architecture feature mapping table to map the hardware register addresses in the resource description information of security resource nodes of different architecture platforms to the logical resource addresses in the standardized resource object model. Then, according to the predefined unified metadata description specification, it generates a standardized resource object model containing resource identifier field, resource type field, resource attribute set field, logical resource address field, and access interface field.

[0026] The standardized resource object model refers to a resource object expression paradigm obtained by abstracting and describing various security resource nodes on heterogeneous domestic software and hardware platforms using a unified data structure. This resource object expression paradigm includes a resource identifier field, a resource type field, a resource attribute set field, a logical resource address field, and an access interface field. Security resource nodes on different architecture platforms are mapped according to this unified data structure to form object descriptions with consistent structures. For example, in the standardized resource object model formed after the firewall device instance is mapped by the unified data structure, the resource identifier field is FW-001, the resource type field is firewall, the resource attribute set field is {maximum number of connections 10000, throughput 5Gbps}, the logical resource address field is " / logics / firewall / 001", and the access interface field is " / api / v1 / firewall".

[0027] The adaptive acquisition strategy generation module 130 is used to dynamically generate acquisition strategies for each security resource node based on the standardized resource object model, the access protocol type, and the authentication mechanism type, and to perform conflict detection on each generated acquisition strategy, resolve conflicting acquisition strategies, and output conflict-free acquisition strategies.

[0028] The adaptive generation module 130 determines the collection field set parameters based on the resource attribute set fields in the standardized resource object model, determines the collection timeout threshold parameters based on the historical response delay data of the security resource node corresponding to the access interface field in the standardized resource object model, determines the collection frequency parameters based on the network bandwidth occupancy characteristics corresponding to the access protocol type, and determines the collection time window parameters based on the security policy update frequency of the business period to which the security resource node belongs.

[0029] The collection strategy refers to a data structure containing collection behavior constraints for a single security resource node. This data structure includes collection frequency parameters, collection field set parameters, collection timeout threshold parameters, and collection time window parameters, which are used to control the behavior of the dynamic scheduling execution module 140 when performing collection operations on the security resource node. For example, in the collection strategy generated for a firewall device instance, the collection frequency parameter is to collect once every 60 seconds, the collection field set parameter is {number of connections, CPU utilization, memory utilization}, the collection timeout threshold parameter is 5 seconds, and the collection time window parameter is from 0:00 to 23:59 every day.

[0030] Among them, the conflict-free collection strategy refers to the collection strategy set obtained after conflict detection and resolution, in which there is no overlap in collection time windows between any two collection strategies and no mutual exclusion of authentication credentials between the collection strategies corresponding to any security resource node; for example, after the collection strategy of the firewall device instance and the collection strategy of another intrusion detection system instance in the same security resource collection environment are processed through conflict detection and resolution, the collection time window parameter of the former is adjusted to 0:00 to 12:00 every day, and the collection time window parameter of the latter is adjusted to 12:00 to 23:59 every day, and their respective authentication credentials are effective independently, forming a conflict-free collection strategy set.

[0031] The dynamic scheduling execution module 140 is used to call the protocol adapter and authentication component corresponding to each security resource node in the resource adaptation framework module 110 according to the conflict-free acquisition strategy, issue acquisition instructions to each security resource node, and receive security resource data returned by each security resource node.

[0032] The collection command refers to the control command issued by the dynamic scheduling execution module 140 to the security resource node according to the parameters specified in the conflict-free collection strategy, requiring the security resource node to return specific security resource data. The control command includes the field identifier to be collected and the timestamp of the collection time. For example, the dynamic scheduling execution module 140 issues a collection command to the firewall device instance at 8:00 AM according to the conflict-free collection strategy of the firewall device instance. The collection command includes the field identifiers ifInOctets and ifOutOctets to be collected and the timestamp of the collection time "2026-07-25 08:00:00".

[0033] Among them, security resource data refers to the original performance index values ​​and configuration parameter values ​​returned by the security resource node after responding to the collection command, which reflect the operating status and protection capabilities of the security resource node. The original performance index values ​​and configuration parameter values ​​include numeric type fields and non-numeric type fields. For example, the security resource data returned by the firewall device instance after responding to the collection command includes: the current value of the connection number (1520), CPU utilization (35%), and memory utilization (62%) in the numeric type fields, and the operating status (normal) in the non-numeric type field.

[0034] The normalization processing module 150 is used to receive the security resource data and convert the security resource data into security resource data in a standardized format according to the standardized resource object model.

[0035] The standardized format refers to the unified data expression form obtained by converting and mapping the data structure fields of the standardized resource object model to the data of security resources. The naming conventions, data types and value ranges of each field in this unified data expression form all conform to the predefined standardization of the standardized resource object model. For example, the current value of the number of connections returned by the firewall device instance, 1520, is mapped to the resource attribute set field of the standardized resource object model after type conversion and stored as the unified data expression form "{"currentConnections": 1520}".

[0036] The incremental linkage module 160 is used to detect changes in the resource data of each security resource node. When a change is detected, it sends an update request to the acquisition strategy adaptive generation module 130 to regenerate the acquisition strategy of the changed resource node, and drives the dynamic scheduling execution module 140 to perform incremental acquisition, and outputs the updated standardized format security resource data to the zero trust policy decision end.

[0037] Among them, resource data change refers to the quantifiable difference in the content of numerical vectors or non-numerical fields between the security resource data returned by the same security resource node at the current collection time and the security resource data returned at the previous collection time. For example, if the current value of the connection count returned by the firewall device instance at 8:00 AM is 1520 and the current value of the connection count returned at 8:01 AM is 1580, the difference between the two is 60, and this difference constitutes resource data change. An update request refers to a signal instruction sent by the incremental linkage unit to the adaptive generation unit of the acquisition policy when it detects a change in resource data and the amount of the change is greater than a preset change threshold. This signal instruction is used to trigger the regeneration of the acquisition policy for the changed resource node. The signal instruction contains the node identifier of the changed resource node and the timestamp of the time when the change occurred. For example, if the firewall device instance returns a current connection count of 1580 at 8:01 AM relative to the current connection count of 1520 at 8:00 AM, the calculated change value is 3.9%, which is greater than the preset change threshold of 3%. The incremental linkage unit sends an update request to the adaptive generation unit of the acquisition policy containing the firewall node identifier FW-001 and the time when the change occurred, "2026-07-25 08:01:00".

[0038] The zero-trust policy decision-making center refers to a security policy decision-making center that determines access permissions based on continuous verification and dynamic authorization mechanisms. This center receives standardized security resource data as a basis for risk assessment and dynamically adjusts access control permissions based on the assessment results. For example, in a power monitoring system, after receiving standardized security resource data from a firewall device instance, the zero-trust policy decision-making center assesses the current network load status based on the current connection count of 1520 and adjusts the remote access permissions of maintenance personnel from full access to restricted access based on the assessment results.

[0039] The technical solution of this embodiment deploys a resource adaptation framework on a heterogeneous domestic software and hardware platform to obtain resource description information, access protocol type, and authentication method type of each security resource node. It generates a standardized resource object model with the help of unified resource modeling, and combines adaptive generation and conflict resolution of collection strategies, dynamic scheduling and execution, normalization processing, and incremental linkage. This solves the problem that the resource status has changed when the policy takes effect due to the independent rhythm of existing resource collection and security policy updates, as well as the problem that there are significant differences in resource description specifications, access protocols, and authentication methods among multiple architecture platforms in the information technology innovation environment, and that existing collection tools lack unified modeling and automatic adaptation capabilities. It realizes automatic adaptation and collection of multi-source heterogeneous security resources, dynamic generation and conflict resolution of policies, and data normalization processing, which improves the real-time performance, completeness, and accuracy of security resource data received by the zero-trust policy decision-making end.

[0040] In one optional approach, the resource description information includes the security resource type, software version number, network address information, service port number, running status identifier, and running environment identifier for each security resource node.

[0041] Among them, "security resource type" refers to the functional category identifier of the security resource node in the network security protection system. This functional category identifier is used to distinguish the protection functions of the security resource node, including firewall type, intrusion detection type, bastion host type, and log auditing type. For example, the security resource type of the security resource node on the first server is firewall type, and the security resource type of the security resource node on the second server is intrusion detection type. "Software version number" refers to the version identifier string of the software program running on the security resource node. This version identifier string is used to distinguish the data interaction formats and parameter ranges supported by different versions of the software program. For example, the software version number of the firewall device instance is V3.2.1, and this version identifier string indicates that the major version number is 3, the minor version number is 2, and the patch version number is 1. "Network address information" refers to the logical location identifier of the security resource node in the network. This logical location identifier includes the IP address and media access control address. For example, the network address information of the firewall device instance is the IP address 192.168.1.10 and the media access control address AA:BB:CC:DD:EE:FF.

[0042] The service port number refers to the transport layer port number bound to the security resource node when providing security service interfaces. This transport layer port number is used to distinguish different services on the same network address. For example, the service port number bound to the firewall device instance when providing stateful inspection service interfaces is 8080. The running status identifier refers to the flag information used to characterize whether the security resource node is currently in a normal working state. This flag information includes two values: online and offline. For example, the running status identifier of the firewall device instance is online, indicating that the firewall device instance can currently respond normally to collection commands. The running environment identifier refers to the combined encoding information used to characterize the processor architecture type and operating system type of the heterogeneous domestic software and hardware platform on which the security resource node resides. This combined encoding information is used to distinguish the differences in hardware instruction sets and system call interfaces between different architecture platforms. For example, the running environment identifier of the firewall device instance on the first server is "ARM-BOS", indicating that the instance runs in an environment combining an ARM architecture processor and a B operating system.

[0043] Among the above optional methods, the specific components of the resource description information are further clarified, covering the security resource type, software version number, network address, service port number, running status identifier, and running environment identifier, so that the resource adaptation framework can obtain more comprehensive basic attribute information when connecting to security resource nodes.

[0044] In one alternative approach, the protocol adapter parses the data interaction format using a data parsing template corresponding to the security resource type, based on the security resource type and the access protocol type.

[0045] The data parsing template refers to a predefined set of field mapping rules for a specific security resource type. This set of field mapping rules includes the correspondence between field names in the original data returned by the security resource node and field names in the standardized resource object model, as well as data type conversion rules. For example, the predefined data parsing template for the firewall type includes the correspondence between the original field ifInOctets and the standardized field receivedBytes, as well as the conversion rules for converting the original data type Counter64 to the standardized data type Long.

[0046] Among the above optional methods, it is further clarified that the protocol adapter needs to call the corresponding data parsing template to complete the data interaction format parsing based on the combination relationship between the security resource type and the access protocol type, and perform adaptation processing for the differences in message structure and field definition of different security resources.

[0047] In an alternative embodiment, the unified resource modeling module 120 is specifically used for:

[0048] The architecture platform to which each security resource node belongs is identified based on the operating environment identifier. The architecture platform includes a domestic processor platform based on ARM architecture, a domestic processor platform based on LoongArch architecture, and a domestic processor platform based on x86 architecture. The unified resource modeling module 120 establishes an architecture feature mapping table for each of the architecture platforms.

[0049] For each architecture platform, the unified resource modeling module 120 reads the correspondence between hardware register addresses and functional attributes in the device tree file or advanced configuration and power management interface table of the security resource nodes under that architecture platform, extracts the mapping entries between hardware register address segments and functional attribute names, and arranges each mapping entry in ascending order of the starting value of the hardware register address segment to form an architecture feature mapping table. When the firmware version of the security resource node changes, the unified resource modeling module 120 rereads the changed device tree file or advanced configuration and power management interface table and updates the corresponding mapping entries in the architecture feature mapping table.

[0050] Among them, the domestic processor platform based on ARM architecture refers to the hardware infrastructure environment consisting of a domestic central processing unit using the ARM instruction set architecture and a supporting domestic operating system. The register width of the processor in this hardware infrastructure environment is 64 bits and it adopts a reduced instruction set computing architecture. For example, the A processor and the B operating system used in the first server together constitute the domestic processor platform based on ARM architecture.

[0051] Among them, the domestic processor platform based on the LoongArch architecture refers to the hardware infrastructure environment consisting of a domestic central processing unit using the Loongson architecture instruction set system and a supporting domestic operating system. The register width of the processor in this hardware infrastructure environment is 64 bits and it adopts a self-defined instruction set architecture. For example, the C processor and D operating system used in the second server together constitute the domestic processor platform based on the LoongArch architecture.

[0052] Among them, the domestic processor platform based on x86 architecture refers to the hardware infrastructure environment consisting of a domestic central processing unit using the x86 instruction set architecture and a supporting domestic operating system. The register width of the processor in this hardware infrastructure environment is 64 bits and it adopts a complex instruction set computing architecture. For example, the E processor and F operating system used in the third server together constitute a domestic processor platform based on x86 architecture.

[0053] The architecture feature mapping table refers to a data structure established for a single architecture platform to record the correspondence between hardware register addresses and logical resource addresses in the standardized resource object model under that architecture platform. This data structure includes a hardware register address segment, a logical resource address segment, and an address translation rule segment. For example, in the architecture feature mapping table established for a domestic processor platform based on the ARM architecture, the hardware register address segment 0x40000000-0x4000FFFF is mapped to the logical resource address segment " / arm / memory / region0". The address translation rule segment records the offset calculation method as follows: the logical address equals the hardware address minus the base address 0x40000000.

[0054] In the above-mentioned optional methods, the architecture platform to which the security resource node belongs is further identified by the runtime environment identifier, and architecture feature mapping tables are established for ARM, LoongArch and x86 architecture domestic processor platforms respectively, so that the security resource nodes of heterogeneous platforms can obtain accurate architecture classification and feature matching before resource modeling.

[0055] In an alternative embodiment, the unified resource modeling module 120 is specifically used for:

[0056] The architecture feature mapping table maps the hardware register addresses in the resource description information of security resource nodes of different architecture platforms to logical resource addresses in the standardized resource object model. The standardized resource object model is generated according to the predefined unified metadata description specification. The standardized resource object model includes a resource identifier field, a resource type field, a resource attribute set field, a logical resource address field, and an access interface field.

[0057] The hardware register address refers to the physical storage unit number in the central processing unit of the heterogeneous domestic software and hardware platform where the security resource node resides, used to store hardware status and control information. This physical storage unit number is represented by a hexadecimal value. For example, the hardware register address of processor A where the firewall device instance resides is 0x40001000, and this address stores the interrupt status information of the firewall device instance. The logical resource address refers to the abstract path identifier used to uniquely identify a specific resource attribute of the security resource node in the standardized resource object model. This abstract path identifier adopts a hierarchical path format and is independent of the hardware register address of the specific architecture platform. For example, the logical resource address of the interrupt status information corresponding to the hardware register address 0x40001000 of the firewall device instance in the standardized resource object model is " / arm / interrupt / status".

[0058] The resource identifier field refers to a globally unique code field in the standardized resource object model used to uniquely identify a single security resource node. This globally unique code field is not repeated within the same acquisition system. For example, the resource identifier field of a firewall device instance in the standardized resource object model is FW-001, and this code is not assigned to other security resource nodes within the same acquisition system. The resource type field refers to a classification field in the standardized resource object model used to record the category of network security protection functions undertaken by the security resource node. The value of this classification field corresponds to the security resource type. For example, the resource type field of a firewall device instance in the standardized resource object model is "firewall". The resource attribute set field refers to a composite field in the standardized resource object model used to store the operating status parameters and performance index parameters of the security resource node. This composite field contains multiple key-value pairs, and each key-value pair records a specific parameter name and its value. For example, the resource attribute set field of a firewall device instance in the standardized resource object model contains the key-value pair {maximum number of connections: 10000, throughput: 5Gbps, current number of connections: 1520}. The logical resource address field refers to the set of fields in the standardized resource object model used to store the logical resource addresses corresponding to each resource attribute of a security resource node. This set of fields includes the name of each resource attribute and its corresponding hierarchical path format address. For example, the logical resource address field of a firewall device instance in the standardized resource object model includes {interrupt status: " / arm / interrupt / status", memory status: " / arm / memory / region0"}. The access interface field refers to the field in the standardized resource object model used to record the Uniform Resource Locator or interface path of the security service interface provided by the security resource node. The value of this field is used to construct the target address of the collection command. For example, the access interface field of a firewall device instance in the standardized resource object model is " / api / v1 / firewall".

[0059] In the above optional methods, the hardware register addresses of security resource nodes of different architecture platforms are further converted into logical resource addresses by using an architecture feature mapping table, and a standardized resource object model with a multi-field structure is generated according to the unified metadata description specification, so that the security resources of heterogeneous platforms can be uniformly expressed at the data level.

[0060] In an alternative embodiment, the adaptive acquisition strategy generation module 130 is specifically used for:

[0061] Based on the resource attribute set field and access interface field in the standardized resource object model, the collection field set parameter and collection time window parameter in the collection strategy are generated. The collection strategy also includes collection frequency parameter and collection timeout threshold parameter.

[0062] The collection field set parameter refers to the set of parameters in the collection policy that limits the dynamic scheduling execution module 140 to obtain specific security resource data fields from the security resource nodes. This parameter set lists the names of the fields to be collected. For example, if the collection field set parameter in the collection policy of the firewall device instance is {connection count, CPU utilization, memory utilization}, it means that the dynamic scheduling execution module 140 only collects security resource data for these three fields. The collection time window parameter refers to the pair of parameters in the collection policy that limits the allowed start and end times for the dynamic scheduling execution module 140 to issue collection commands to the security resource nodes. This parameter pair includes a start time value and an end time value. For example, if the collection time window parameter in the collection policy of the firewall device instance is a start time of 0:00 and an end time of 12:00, it means that the dynamic scheduling execution module 140 only issues collection commands to the firewall device instance between 0:00 and 12:00.

[0063] The collection frequency parameter refers to the parameter in the collection strategy used to limit the maximum number of collection commands that the dynamic scheduling execution module 140 can send to the same security resource node per unit time. This parameter is measured in units of times. For example, if the collection frequency parameter in the collection strategy of the firewall device instance is once every 60 seconds, it means that the dynamic scheduling execution module 140 can send a collection command to the firewall device instance at most once within a 60-second time period. The collection timeout threshold parameter refers to the parameter in the collection strategy used to limit the maximum time that the dynamic scheduling execution module 140 can wait for the security resource node to return security resource data. This parameter is measured in milliseconds or seconds. For example, if the collection timeout threshold parameter in the collection strategy of the firewall device instance is 5 seconds, it means that the waiting time after the dynamic scheduling execution module 140 sends a collection command to the firewall device instance will reach 5 seconds and then the waiting will terminate.

[0064] In the above-mentioned optional methods, resource attribute sets and access interface information are further extracted from the standardized resource object model. Based on this, collection field set parameters and collection time window parameters are generated, and a complete strategy is formed by combining collection frequency parameters and timeout threshold parameters, so that the strategy matches the actual resource characteristics and access conditions of the security resource node.

[0065] In an alternative embodiment, the adaptive acquisition strategy generation module 130 is specifically used for:

[0066] The acquisition time window parameters of each acquisition strategy are compared one by one. Acquisition strategies with overlapping time intervals in their acquisition time window parameters are marked as time window conflict strategies. The authentication mechanism types of each acquisition strategy corresponding to the same security resource node are compared one by one. Acquisition strategies with incompatible authentication mechanism types are marked as authentication mutual exclusion strategies. The resolution process performed by the acquisition strategy adaptive generation module 130 includes reallocating the acquisition time window parameters of the time window conflict strategies according to a preset priority, and serializing the authentication mutual exclusion strategies to stagger the effective time periods of authentication credentials.

[0067] It should be noted that the preset priority is calculated by weighting the security level value of each security resource node with the real-time requirement level value of the data collection task. The higher the security level value and the higher the real-time requirement level value of the data collection task, the higher the preset priority of the security resource node.

[0068] The overlapping time interval refers to the time period where the allowed acquisition time ranges defined by the acquisition time window parameters of two acquisition strategies intersect. This time interval begins at the later start time of the two acquisition time windows and ends at the earlier end time. For example, if the acquisition time window parameters of the first acquisition strategy are 0:00 to 12:00 and the acquisition time window parameters of the second acquisition strategy are 8:00 to 18:00, the overlapping time interval is from 8:00 to 12:00. A time window conflict strategy refers to an acquisition strategy pair marked as having a time window conflict when there is an overlapping time interval between the acquisition time window parameters of two acquisition strategies. For example, if the acquisition time window parameters of acquisition strategy A are 0:00 to 12:00 and the acquisition time window parameters of acquisition strategy B are 8:00 to 18:00, acquisition strategies A and B are marked as having a time window conflict because of the overlapping time interval from 8:00 to 12:00.

[0069] The authentication mutual exclusion policy refers to the following: when two collection policies corresponding to the same security resource node use authentication mechanism types that are incompatible, they are marked as having authentication mutual exclusion. For example, collection policy C and collection policy D correspond to the same firewall device instance. Collection policy C uses password authentication and collection policy D uses certificate authentication. Because password authentication and certificate authentication are incompatible in the same access session, collection policy C and collection policy D are marked as authentication mutual exclusion policies.

[0070] The preset priority refers to a numerical level pre-set for each security resource node, used to determine the execution order of collection policies when time window conflicts are resolved. The higher the numerical level, the higher the priority. Collection policies with higher priority retain their original collection time window parameters when conflicts are resolved, while the collection time window parameters of collection policies with lower priority are adjusted to be outside the collection time window of higher priority collection policies. For example, the preset priority of the firewall device instance is level 2, and the preset priority of the intrusion detection system instance in the same security resource collection environment is level 1. When there is a time window conflict between the collection policies of the two, the collection policy of the firewall device instance retains its original collection time window parameters, while the collection time window parameters of the collection policy of the intrusion detection system instance are adjusted to be outside the collection time window of the firewall device instance. The serialization method refers to a time allocation method that arranges the effective periods of authentication credentials for multiple authentication mutual exclusion policies in chronological order, so that at any given time, at most one authentication credential of an authentication mutual exclusion policy is in an effective state. For example, the effective period of password authentication credentials for policy C is from 0:00 to 12:00, and the effective period of certificate authentication credentials for policy D is from 12:00 to 24:00. The effective periods of the two authentication credentials are arranged in chronological order and do not overlap. This method is the serialization method.

[0071] In the above-mentioned optional methods, the time window overlap interval of the collection strategy and the compatibility of the authentication mechanism of the same security resource node are further tested, and two resolution methods, priority reallocation and serialization time-sharing, are adopted to resolve the time conflict and authentication conflict that occur in the multi-source concurrent collection process.

[0072] In an optional manner, the dynamic scheduling execution module 140 is specifically used to: issue collection instructions to each security resource node according to the collection frequency parameters and collection time window parameters in the conflict-free collection strategy; call the protocol adapter in the resource adaptation framework module 110 corresponding to the access protocol type of each security resource node to encapsulate the collection instructions into a request message that conforms to the access protocol type; call the authentication component corresponding to the authentication mechanism type of each security resource node to embed authentication credentials into the request message; receive the response message returned by the security resource node and extract security resource data from it.

[0073] The request message refers to a structured message constructed by the dynamic scheduling execution module 140 according to the access protocol type and authentication mechanism type of the security resource node, used to request security resource data from the security resource node. The structured message contains three parts: protocol header, authentication credentials, and request data. For example, in the SNMP GET request message sent by the dynamic scheduling execution module 140 to the firewall device instance, the protocol header contains the version number and community name, the authentication credentials contain the username and password embedded in the community name field, and the request data contains the field identifiers ifInOctets and ifOutOctets to be collected.

[0074] The normalization processing module 150 is specifically used to: fill the security resource data of each security resource node into the corresponding field of the standardized resource object model one by one according to the data structure field of the standardized resource object model, and output the standardized format security resource data after completing the data type conversion.

[0075] When the normalization processing module 150 performs data type conversion, it converts the unsigned integer type in the security resource data into the signed long integer type in the standardized resource object model, rounds the floating-point type in the security resource data to the fixed-point type according to the precision bits predefined in the standardized resource object model, and converts the enumeration type string in the security resource data into the integer encoding type according to the correspondence between the enumeration value and the encoding value predefined in the standardized resource object model.

[0076] In the above-mentioned optional methods, collection instructions are further issued to each security resource node according to the conflict-free collection strategy. The message encapsulation and credential embedding are completed with the help of protocol adapters and authentication components, and data filling and type conversion are completed according to the standardized resource object model, so that the security resource data from heterogeneous sources can be converted into standardized data in a unified format.

[0077] In one alternative embodiment, the incremental linkage module 160 is specifically used for:

[0078] When detecting changes in resource data of each security resource node, the difference between the security resource data at the current collection time and the security resource data at the previous collection time is obtained. The ratio of the difference to the security resource data at the previous collection time is calculated as the resource base change rate. The number of non-numerical fields that changed between the current collection time and the previous collection time is counted. The resource data change amount is calculated based on the resource base change rate and the number of changed fields. When the resource data change amount is greater than a preset change threshold, it is determined that a change has been detected and an update request is sent to the collection strategy adaptive generation module 130.

[0079]

[0080] in, Indicates the first The amount of resource data change for each secure resource node. Indicates the first Each security resource node at the current data collection time The numerical vector in the returned security resource data, Indicates the first Each security resource node at the previous data collection time The numerical vector in the returned security resource data, The Euclidean norm of a vector. It is the regularization constant and , Indicates the first Each security resource node at the current data collection time Compared with the previous data collection time The number of fields whose non-numeric fields changed between the two. Indicates the first Total number of non-numeric fields in each security resource node This indicates the time interval between the current data acquisition time and the previous data acquisition time. The change range adjustment coefficient and , The time decay coefficient and .

[0081] It should be noted that the principle behind the resource data change calculation formula is as follows: the resource data changes of a secure resource node consist of two forms of changes: numerical type fields and non-numerical type fields. The changes in numerical type fields are measured by dividing the Euclidean norm of the difference between the numerical vector at the current acquisition time and the previous acquisition time by the sum of the Euclidean norm of the numerical vector at the previous acquisition time and the regularization constant. The changes in non-numerical type fields are measured by multiplying the proportion of the number of non-numerical fields that have changed to the total number of non-numerical fields by the time decay coefficient. Multiplying the two change measures together yields the comprehensive resource data change.

[0082] The above formula provides a quantitative basis for the incremental linkage unit to determine whether it has detected changes in resource data. This allows the incremental linkage unit to decide whether to send an update request to the adaptive generation unit of the acquisition strategy based on whether the amount of change in resource data is greater than a preset change threshold. This avoids unnecessary strategy regeneration responses to minor changes or transient fluctuations, while ensuring that changes in both numerical and non-numerical fields are taken into consideration, thereby improving the accuracy and sensitivity of incremental acquisition triggering.

[0083] In the above-mentioned optional methods, when detecting changes in resource data, the resource base change rate is calculated by combining the Euclidean norm difference of the numerical vector, and a weighted statistical analysis of the number of changes in non-numerical fields is introduced to form a comprehensive judgment index. When the change exceeds the threshold, the strategy is updated and incremental collection is triggered, so that the detection takes into account both numerical fluctuations and state changes.

[0084] In one alternative approach, when the acquisition strategy adaptive generation module 130 performs conflict detection on the generated acquisition strategies, it calculates the conflict coefficient between any two acquisition strategies according to the following formula to determine whether there is an acquisition strategy conflict:

[0085]

[0086] in, Indicates the first The first collection strategy and the second The conflict coefficient between various acquisition strategies Indicates the first The set of acquisition times defined by the acquisition time window parameter of each acquisition strategy. Indicates the first The set of acquisition times defined by the acquisition time window parameter of each acquisition strategy. Indicates the first The first collection strategy and the second The length of the intersection of the collection time sets of each collection strategy. Indicates the first The total duration of the acquisition time window for each acquisition strategy. Indicates the first The total duration of the acquisition time window for each acquisition strategy. The time overlap sensitivity index and , To prevent division by zero constant and , Indicates the first The set of resource attributes of the security resource nodes corresponding to each collection strategy. Indicates the first The set of resource attributes of the security resource nodes corresponding to each collection strategy. This represents the size of the intersection of two sets of resource attributes. This represents the size of the union of two sets of resource attributes. The time conflict weighting coefficient and , The resource attribute difference weighting coefficient and , To authenticate the mutually exclusive identifier variable, when the first... The first collection strategy and the second When two collection strategies correspond to the same security resource node and their authentication mechanism types are incompatible... The value is 1, and in other cases... The value is 0 when the conflict coefficient is... When the conflict exceeds a preset threshold, the adaptive generation module 130 of the acquisition strategy determines the first... The first collection strategy and the second There are conflicts between the various data collection strategies.

[0087] It should be noted that the principle behind the above conflict coefficient calculation formula is as follows: the degree of conflict between any two acquisition strategies is composed of two weighted factors: time dimension conflict and resource attribute dimension conflict. Time dimension conflict is measured by the sum of the overlap sensitivity index power of the intersection time length of the acquisition time sets of the two acquisition strategies divided by the half power of the overlap sensitivity index of the product of the total acquisition time window length of the two acquisition strategies and the zero constant. Resource attribute dimension conflict is measured by the product of the Jaccard distance of the resource attribute sets of the security resource nodes corresponding to the two acquisition strategies and the authentication mutual exclusion identifier variable. The conflict coefficient is obtained by weighted summation of the two factors.

[0088] The above formula provides a quantitative basis for the acquisition strategy adaptive generation module 130 to determine whether there is a conflict between any two acquisition strategies. This enables the acquisition strategy adaptive generation module 130 to determine whether there is a conflict between two acquisition strategies based on whether the conflict coefficient is greater than a preset conflict threshold. This avoids misjudgment or omission caused by simple comparison based on a single dimension. At the same time, it incorporates conflict factors in both the time dimension and the resource attribute dimension into a unified calculation framework, improving the comprehensiveness and accuracy of conflict detection.

[0089] Among the above-mentioned optional methods, a multi-dimensional conflict coefficient calculation formula that includes time overlap, resource attribute difference, and authentication mutual exclusion identifier is further introduced, so that the conflict judgment between collection strategies is transformed from qualitative comparison to quantitative evaluation. The conflict identification results are more objective and refined, providing a quantifiable decision basis for subsequent resolution processing.

[0090] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. An automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment, characterized in that, include: The resource adaptation framework module is used to connect with various security resource nodes deployed on heterogeneous domestic software and hardware platforms, obtain resource description information, access protocol type and authentication mechanism type of each security resource node, and provide protocol adapters corresponding to each access protocol type and authentication components corresponding to each authentication mechanism type. The unified resource modeling module is used to receive the resource description information, perform resource object modeling on the security resource nodes of different architecture platforms, and generate a standardized resource object model. The adaptive acquisition strategy generation module is used to dynamically generate acquisition strategies for each security resource node based on the standardized resource object model, the access protocol type, and the authentication mechanism type, and to perform conflict detection on each generated acquisition strategy, resolve conflicting acquisition strategies, and output conflict-free acquisition strategies. The dynamic scheduling execution module is used to call the protocol adapter and authentication component corresponding to each security resource node in the resource adaptation framework module according to the conflict-free acquisition strategy, issue acquisition instructions to each security resource node, and receive security resource data returned by each security resource node. The normalization processing module is used to receive the security resource data and convert the security resource data into security resource data in a standardized format according to the standardized resource object model. The incremental linkage module is used to detect changes in the resource data of each security resource node. When a change is detected, it sends an update request to the adaptive generation module of the acquisition strategy to regenerate the acquisition strategy of the changed resource node, and drives the dynamic scheduling execution module to perform incremental acquisition, outputting the updated standardized security resource data to the zero-trust policy decision end.

2. The automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment according to claim 1, characterized in that, The resource description information includes the security resource type, software version number, network address information, service port number, running status identifier, and running environment identifier of each security resource node.

3. The automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment according to claim 2, characterized in that, The protocol adapter parses the data interaction format using a data parsing template corresponding to the security resource type, based on the security resource type and the access protocol type.

4. The automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment according to claim 3, characterized in that, The unified resource modeling module is specifically used for: The architecture platform to which each security resource node belongs is identified based on the runtime environment identifier. The architecture platform includes a domestic processor platform based on ARM architecture, a domestic processor platform based on LoongArch architecture, and a domestic processor platform based on x86 architecture. The unified resource modeling module establishes an architecture feature mapping table for each of the architecture platforms.

5. The automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment according to claim 4, characterized in that, The unified resource modeling module is specifically used for: The architecture feature mapping table maps the hardware register addresses in the resource description information of security resource nodes of different architecture platforms to logical resource addresses in the standardized resource object model. The standardized resource object model is generated according to the predefined unified metadata description specification. The standardized resource object model includes a resource identifier field, a resource type field, a resource attribute set field, a logical resource address field, and an access interface field.

6. The automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment according to claim 5, characterized in that, The adaptive generation module for the acquisition strategy is specifically used for: Based on the resource attribute set field and access interface field in the standardized resource object model, the collection field set parameter and collection time window parameter in the collection strategy are generated. The collection strategy also includes collection frequency parameter and collection timeout threshold parameter.

7. The automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment according to claim 6, characterized in that, The adaptive generation module for the acquisition strategy is specifically used for: The acquisition time window parameters of each acquisition strategy are compared one by one. Acquisition strategies with overlapping time intervals in their acquisition time window parameters are marked as time window conflict strategies. The authentication mechanism types of each acquisition strategy corresponding to the same security resource node are also compared one by one. Acquisition strategies with incompatible authentication mechanism types are marked as authentication mutual exclusion strategies. The resolution process performed by the acquisition strategy adaptive generation module includes reallocating the acquisition time window parameters of the time window conflict strategies according to a preset priority, and serializing the authentication mutual exclusion strategies to stagger the effective time periods of authentication credentials.

8. The automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment according to claim 7, characterized in that, The dynamic scheduling execution module is specifically used for: issuing collection instructions to each security resource node according to the collection frequency parameters and collection time window parameters in the conflict-free collection strategy; calling the protocol adapter in the resource adaptation framework module corresponding to the access protocol type of each security resource node to encapsulate the collection instructions into a request message that conforms to the access protocol type; calling the authentication component corresponding to the authentication mechanism type of each security resource node to embed authentication credentials into the request message; receiving the response message returned by the security resource node and extracting security resource data from it. The normalization processing module is specifically used to: fill the security resource data of each security resource node into the corresponding field of the standardized resource object model one by one according to the data structure field of the standardized resource object model, and output the standardized format security resource data after completing the data type conversion.

9. The automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment according to claim 8, characterized in that, The incremental linkage module is specifically used for: When detecting changes in resource data of each security resource node, the difference between the security resource data at the current collection time and the security resource data at the previous collection time is obtained. The ratio of the difference to the security resource data at the previous collection time is calculated as the resource base change rate. The number of non-numerical fields that changed between the current collection time and the previous collection time is counted. The resource data change amount is calculated based on the resource base change rate and the number of changed fields. When the resource data change amount is greater than a preset change threshold, it is determined that a change has been detected and an update request is sent to the collection strategy adaptive generation module. in, Indicates the first The amount of resource data change for each secure resource node. Indicates the first Each security resource node at the current data collection time The numerical vector in the returned security resource data, Indicates the first Each security resource node at the previous data collection time The numerical vector in the returned security resource data, The Euclidean norm of a vector. It is the regularization constant and , Indicates the first Each security resource node at the current data collection time Compared with the previous data collection time The number of fields whose non-numeric fields changed between the two. Indicates the first Total number of non-numeric fields in each security resource node This indicates the time interval between the current data acquisition time and the previous data acquisition time. The change range adjustment coefficient and , The time decay coefficient and .

10. The automatic acquisition system for multi-source heterogeneous security resources based on a zero-trust information technology innovation environment according to claim 1, characterized in that, When the adaptive acquisition strategy generation module performs conflict detection on the generated acquisition strategies, it calculates the conflict coefficient between any two acquisition strategies according to the following formula to determine whether there is an acquisition strategy conflict: in, Indicates the first The first collection strategy and the second The conflict coefficient between various acquisition strategies Indicates the first The set of acquisition times defined by the acquisition time window parameter of each acquisition strategy. Indicates the first The set of acquisition times defined by the acquisition time window parameter of each acquisition strategy. Indicates the first The first collection strategy and the second The length of the intersection of the collection time sets of each collection strategy. Indicates the first The total duration of the acquisition time window for each acquisition strategy. Indicates the first The total duration of the acquisition time window for each acquisition strategy. The time overlap sensitivity index and , To prevent division by zero constant and , Indicates the first The set of resource attributes of the security resource nodes corresponding to each collection strategy. Indicates the first The set of resource attributes of the security resource nodes corresponding to each collection strategy. This represents the size of the intersection of two sets of resource attributes. This represents the size of the union of two sets of resource attributes. The time conflict weighting coefficient and , The resource attribute difference weighting coefficient and , To authenticate the mutually exclusive identifier variable, when the first... The first collection strategy and the second When two collection strategies correspond to the same security resource node and their authentication mechanism types are incompatible... The value is 1, and in other cases... The value is 0 when the conflict coefficient is... When the conflict exceeds a preset threshold, the adaptive generation module of the acquisition strategy determines the first... The first collection strategy and the second There are conflicts between the various data collection strategies.

Images