Security risk control method, device, equipment, storage medium and program product

Abstract

This application relates to a security risk control method, apparatus, device, storage medium, and program product. The method includes: receiving an authentication request from an Internet of Things (IoT) device, the authentication request including a target certificate and first multi-dimensional fingerprint data of the IoT device; if the target certificate is valid, and the first multi-dimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device, then determining a security and trust quantification value of the IoT device based on the first multi-dimensional fingerprint data; and performing security risk control on the IoT device based on the security and trust quantification value. This method improves the security of IoT devices.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) security technology, and in particular to a security risk control method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the large-scale deployment of IoT devices, the types of IoT devices are becoming increasingly diverse, including smart gateways, sensors, controllers, and more. These IoT devices are often in physically exposed environments, making them vulnerable to hijacking, tampering, or counterfeiting.

[0003] In related technologies, authentication methods based on certificates or passwords are used to control security risks of IoT devices, but this method still has the problem of low security. Summary of the Invention

[0004] Therefore, it is necessary to provide a security risk control method, device, equipment, storage medium, and program product that can improve the security of IoT devices in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a security risk control method, including:

[0006] Receive authentication requests from IoT devices, including the target certificate and first multidimensional fingerprint data of the IoT device;

[0007] If the target certificate is a valid certificate, and the first multi-dimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device, then the security and trust quantification value of the IoT device is determined based on the first multi-dimensional fingerprint data.

[0008] Security risk control is carried out on IoT devices based on security and trust quantification values.

[0009] In some embodiments, security risk control of IoT devices is performed based on a security and trust quantification value, including:

[0010] If the security and trust quantification value is less than the first threshold, then the first alarm message will be output.

[0011] If the security and trust quantification value is less than the second threshold, communication with the IoT device will be blocked and a second alarm message will be output. If the first threshold is greater than the second threshold, the first alarm message and the second alarm message will be different.

[0012] In some embodiments, blocking communication between IoT devices includes one or more of the following:

[0013] Send a connection error message to the IoT device. The connection error message is used to instruct the IoT device to disconnect the communication connection.

[0014] Refuse to forward all traffic from IoT devices;

[0015] Control the offline access of the device port corresponding to the IoT device.

[0016] In some embodiments, determining the security and trustworthiness quantification value of an IoT device based on first multidimensional fingerprint data includes:

[0017] Based on the first multidimensional fingerprint data and the weights corresponding to each fingerprint data in the first multidimensional fingerprint data, a security risk quantification value is calculated, and a security trust quantification value is calculated based on the security risk quantification value; or...

[0018] The first multidimensional fingerprint data is input into a machine learning model or a rule engine-based expert system to obtain a secure and reliable quantitative value.

[0019] In some embodiments, the method further includes:

[0020] Receive registration requests from IoT devices, the registration requests carrying the initial certificate of the IoT devices and second multi-dimensional fingerprint data;

[0021] If the initial certificate authentication is successful, the second multidimensional fingerprint data is stored in the fingerprint baseline database as fingerprint baseline data.

[0022] In some embodiments, the method further includes:

[0023] If the initial certificate authentication is successful, an update certificate is sent to the IoT device; the target certificate is related to the update certificate.

[0024] Secondly, this application provides a security risk control device, comprising:

[0025] The receiving module is used to receive authentication requests from IoT devices. The authentication requests include the target certificate and first multi-dimensional fingerprint data of the IoT device.

[0026] The determination module is used to determine the security and trustworthiness quantification value of the IoT device based on the first multi-dimensional fingerprint data if the first multi-dimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device when the target certificate is a valid certificate.

[0027] The risk control module is used to control the security risks of IoT devices based on the security and trust quantification value.

[0028] Thirdly, this application provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the methods in the first aspect above.

[0029] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in any of the first aspects above.

[0030] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in any of the first aspects above.

[0031] The aforementioned security risk control methods, devices, equipment, storage media, and program products receive authentication requests from IoT devices. These requests include a target certificate and first multi-dimensional fingerprint data of the IoT device. If the target certificate is valid, and the first multi-dimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device, a security and trust quantification value for the IoT device is determined based on the first multi-dimensional fingerprint data. Based on this security and trust quantification value, security risk control is performed on the IoT device. Thus, by jointly controlling security risks of the IoT device using the target certificate and multi-dimensional fingerprint data (first multi-dimensional fingerprint data), the security of the IoT device is improved. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a flowchart illustrating a security risk control method in one embodiment;

[0034] Figure 2 This is a flowchart illustrating a security risk control method in another embodiment;

[0035] Figure 3 This is a flowchart illustrating a security risk control method in another embodiment;

[0036] Figure 4 This is an exemplary system architecture diagram in another embodiment;

[0037] Figure 5 This is an exemplary network topology diagram in another embodiment;

[0038] Figure 6 This is an exemplary data processing flowchart in another embodiment;

[0039] Figure 7 This is a flowchart illustrating a security risk control method in another embodiment;

[0040] Figure 8 This is a schematic diagram illustrating an exemplary process for calculating a security and trust quantification value in another embodiment;

[0041] Figure 9 This is a structural block diagram of a safety risk control device in one embodiment;

[0042] Figure 10 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0044] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0045] The security risk control method provided in this application can be applied to computer devices, which can be gateways (such as security authentication gateways), identity authentication platforms, or operation and maintenance management platforms. In some embodiments, the security risk control method provided in this application can also be applied to a system composed of a security authentication gateway, an identity authentication platform, and an operation and maintenance management platform, without specific limitations.

[0046] In some embodiments, the computer device may also be a terminal or a server. The terminal may be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, and portable wearable devices. Portable wearable devices may be smartwatches, smart bracelets, head-mounted displays, etc. Head-mounted displays may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server may be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0047] In one exemplary embodiment, such as Figure 1As shown, a security risk control method is provided. Taking the application of this method to a computer device as an example, the method includes the following steps 101 to 103:

[0048] Step 101: Receive the authentication request from the IoT device. The authentication request includes the target certificate of the IoT device and the first multi-dimensional fingerprint data.

[0049] For example, IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc., and of course, they can also be other types of IoT devices.

[0050] IoT devices, also known as edge devices or IoT terminals, are capable of generating raw device identifiers and operational status data, providing the source of device identity. In some embodiments, a security proxy component is deployed in the IoT device, responsible for the collection and reporting of multi-dimensional fingerprints, reporting authentication requests, etc.

[0051] The IoT device collects and reports (either automatically or through a security proxy component) first multidimensional fingerprint data, which can be referred to as real-time fingerprint. For example, the IoT device can periodically collect and report the first multidimensional fingerprint data according to a preset time period, which can be a default period or a configured period, such as 5 minutes. The authentication request can be a timed access authentication request.

[0052] In this embodiment of the application, the first multidimensional fingerprint data may include multidimensional fingerprint information of the IoT device, such as hardware, software, and network. For example, the first multidimensional fingerprint data may include one or more of the IoT device's SN (Serial Number), MAC (Media Access Control), CPU (Central Processing Unit) serial number, motherboard model, OS (Operating System) version, firmware version, driver information, IP (Internet Protocol) address, and gateway information.

[0053] After an IoT device collects the first multidimensional fingerprint data, it can format and encapsulate the first multidimensional fingerprint data. After encapsulation, the target certificate and the first multidimensional fingerprint data are sent to the gateway (such as a security authentication gateway) in the authentication request.

[0054] Taking a computer device as a gateway as an example, the computer device receives the authentication request. Taking a computer device as an identity authentication platform as an example, the gateway receives the authentication request and forwards it to the identity authentication platform.

[0055] Step 102: If the target certificate is a valid certificate, and the first multi-dimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device, then the security and trust quantification value of the IoT device is determined based on the first multi-dimensional fingerprint data.

[0056] After receiving an authentication request from an IoT device, the computer device verifies the validity of the target certificate and compares the first multidimensional fingerprint data with the IoT device's fingerprint baseline data.

[0057] Verifying the validity of a target certificate can involve checking its expiration date, signature, and other information. It can also involve comparing the target certificate's identifier with the identifiers of revoked certificates in a certificate revocation list. If the target certificate's signature is valid, it is within its validity period, and it is not a revoked certificate, then the target certificate is determined to be valid. In some embodiments, the identity authentication platform can manage the certificate lifecycle, handling certificate issuance, revocation, and status synchronization. When the computer device acts as a gateway, the validity of the target certificate can be verified through interaction with the identity authentication platform.

[0058] Comparing the first multidimensional fingerprint data with the fingerprint baseline data can be done by comparing each data item in the first multidimensional fingerprint data with the corresponding data in the fingerprint baseline data. If there is a discrepancy between the two data items, it is determined that the first multidimensional fingerprint data and the fingerprint baseline data are inconsistent.

[0059] If the target certificate is valid and the first multidimensional fingerprint data is completely consistent with the fingerprint baseline data of the IoT device, the authentication is successful and the IoT device can access the business normally.

[0060] If the target certificate is a valid certificate, but the first multidimensional fingerprint data is completely inconsistent with the fingerprint baseline data of the IoT device (i.e., at least one of the two is inconsistent), then the security and trust quantification value of the IoT device is determined based on the first multidimensional fingerprint data.

[0061] In some embodiments, the range of the security and trust quantification value is [0, 1]. The security and trust level can be positively correlated with the size of the security and trust quantification value. For example, if the target certificate is a valid certificate and the first multidimensional fingerprint data is completely consistent with the fingerprint baseline data of the IoT device, then the security and trust quantification value of the IoT device is 1; otherwise, the security and trust quantification value of the IoT device is less than 1.

[0062] Step 103: Based on the security and trust quantification value, perform security risk control on IoT devices.

[0063] If the first multidimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device (such as partial or significant changes to the fingerprint), security risk control is carried out on the IoT device based on the security and trust quantification value. For example, an alarm can be issued or the communication of the IoT device can be blocked.

[0064] This application embodiment improves the security of IoT devices by jointly controlling security risks through target certificates and multi-dimensional fingerprint data (first multi-dimensional fingerprint data).

[0065] In some embodiments, see Figure 2 Step 103 may include Figure 2 Steps 201 and 202 are shown below:

[0066] Step 201: If the security and trust quantification value is less than the first threshold, then output the first alarm information.

[0067] If the fingerprint is partially changed, the security and trust quantification value is less than the first threshold. This first threshold can be set by the user during implementation, for example, to 0.8.

[0068] For example, if the security and trust quantification value is less than the first threshold, and the fingerprint part of the IoT device changes due to firmware version upgrades, driver updates, etc., the computer device determines the IoT device as "low risk", records the change alarm (such as the first alarm information) and pushes it to the operation and maintenance platform.

[0069] Step 202: If the security and trust quantification value is less than the second threshold, then the communication of the IoT device is blocked and the second alarm information is output.

[0070] If the first threshold is greater than the second threshold, the first alarm message and the second alarm message are different.

[0071] If a significant change occurs to the fingerprint, the security and trust quantification value will be less than the second threshold. This second threshold can be set by the user during implementation, and the first threshold will be greater than the second threshold.

[0072] For example, if the security and trust quantification value is less than the second threshold, such as a major change in the MAC address or CPU serial number of the IoT device, the computer device determines the IoT device as "high risk" or "illegal identity", triggers the IoT device to block communication and generates a serious alarm (such as the second alarm information).

[0073] In this way, different security risk control strategies are adopted under different security risks, which improves the flexibility and reliability of security risk control.

[0074] For example, the operation and maintenance management platform can receive fingerprint change alarms and risk events (such as receiving first alarm information or second alarm information), display the alarms, and provide audit queries.

[0075] In some embodiments, blocking communication for an IoT device includes one or more of the following: sending a connection error message to the IoT device, the connection error message being used to instruct the IoT device to disconnect the communication connection; refusing to forward all traffic of the IoT device; and controlling the device port corresponding to the IoT device to go offline.

[0076] For example, the computer device can be a bypass-deployed gateway. In the event of communication disruption to an IoT device, the computer device sends a connection exception message (TCP RESET message) to the IoT device, forcibly disconnecting the device connection. Alternatively, the gateway can directly refuse to forward all traffic from the IoT device, or the SDN (Software-Defined Network) controller can coordinate with the switch to take the device port offline, adapting to different network deployment architectures.

[0077] This application embodiment achieves rapid network layer denial of unauthorized identities. For IoT devices with mutated identity information, TCP RESET messages can be sent in real time to block them at the network layer. The response speed is fast (e.g., it can reach the second level or even finer granularity), effectively curbing the spread of risks. Compared with the traditional log alarm response mode, the security protection capability is greatly improved.

[0078] Based on any of the above embodiments, the following is an exemplary description of the process by which a computer device determines the security and trustworthiness quantification value of an Internet of Things device based on first multidimensional fingerprint data.

[0079] For example, a computer device can calculate a security risk quantification value based on the first multidimensional fingerprint data and the weights corresponding to each fingerprint data in the first multidimensional fingerprint data, and calculate a security trust quantification value based on the security risk quantification value; or, the first multidimensional fingerprint data can be input into a machine learning model or an expert system based on a rule engine to obtain a security trust quantification value.

[0080] In this embodiment of the application, each data item in the multidimensional fingerprint data (such as the first multidimensional fingerprint data, etc.) can correspond to a different weight (or security risk weight). Different weights correspond to different security importance, reflecting their contribution to the overall risk.

[0081] For example, changes to MAC addresses and CPU serial numbers are of higher security importance than firmware version upgrades and driver updates. Therefore, the weight given to changes to MAC addresses and CPU serial numbers is different from that given to firmware version upgrades and driver updates.

[0082] For example, a computer device can calculate the security risk quantification value R using the following formula 1:

[0083] Formula 1

[0084] Where R is the quantification value of safety risk. For example, the higher the value, the greater the risk, and the value range is [0,1].

[0085] n represents the number of risk dimensions, i.e., the data dimensions involved in calculating the security risk quantification value in the first multi-dimensional fingerprint data. For example, n ≥ 9 satisfies the project's indicator requirements. For example, data dimensions include: certificate validity, certificate status, hardware fingerprint consistency (CPU / motherboard), software fingerprint consistency (OS / firmware / driver), network fingerprint consistency (MAC / IP), historical authentication failure rate, abnormal behavior index, device online duration stability, and communication frequency anomaly, etc.

[0086] Let be the weight of the fingerprint data in the i-th dimension, reflecting the contribution of that dimension to the overall risk. The weights can be dynamically configured by the operation and maintenance strategy center.

[0087] The risk factor for the i-th dimension of the fingerprint data, for example, takes values ​​in the range [0,1]. When the certificate is invalid... =1; when fingerprints match perfectly =0, when there is a complete mismatch =1.

[0088] After the computer equipment calculates the security risk quantification value, it calculates the security and trust quantification value based on the security risk quantification value.

[0089] For example, a computer device can calculate the security and trust quantification value T using the following formula 2:

[0090] T = 1 − min(1, R) Formula 2

[0091] Where T is the security and trust quantification value, or device trust score, and its value range can be [0,1]. The closer T is to 1, the more trustworthy the device is.

[0092] min(1, R) is used to truncate the risk score (a quantitative value of security and trustworthiness) to ensure that T is not negative.

[0093] The above embodiments describe how to calculate the security and trustworthiness quantification value using Formulas 1 and 2 (weighted summation model). In some embodiments, in addition to the weighted summation model, risk quantification can also be achieved using rule-based expert systems or anomaly detection models based on machine learning models (such as Isolation Forest, Decision Tree, and Random Forest) to calculate the security and trustworthiness quantification value. Taking machine learning as an example, in some embodiments, supervised learning classifiers such as Random Forest (RF) perform well in device fingerprint recognition.

[0094] This application's embodiments achieve precise quantification of equipment risk status. Based on a multi-dimensional (e.g., 9 or more categories) risk quantification model, the abstract equipment security status is transformed into a specific security and reliability quantification value T, providing a quantitative basis for subsequent policy control. The risk dimensions can be dynamically configured to adapt to the security needs of different business scenarios.

[0095] In some embodiments, based on any of the above embodiments, see Figure 3 Before step 101, it also includes Figure 3 Steps 301 and 302 are shown below:

[0096] Step 301: Receive the registration request from the IoT device. The registration request carries the initial certificate of the IoT device and the second multi-dimensional fingerprint data.

[0097] After the IoT device is online, it collects the device's unique identifier (SN, MAC) and multi-dimensional fingerprint (CPU serial number, motherboard model, OS version, firmware version) as the second multi-dimensional fingerprint data, carries the initial certificate, and initiates a self-registration authentication request (i.e., registration request) to the gateway.

[0098] The computer device receives the registration request.

[0099] Step 302: If the initial certificate authentication is successful, the second multidimensional fingerprint data is stored in the fingerprint baseline database as fingerprint baseline data.

[0100] The computer device receives the registration request and verifies the validity of the initial certificate (such as verifying the signature, validity period, revocation status, etc.). After the verification is successful, the computer device stores the reported multidimensional fingerprint information (second multidimensional fingerprint data) into the fingerprint baseline database to form the initial fingerprint baseline of the device.

[0101] In this embodiment of the application, the fingerprint baseline data can be dynamically updated.

[0102] In some embodiments, if the initial certificate authentication is successful, an updated certificate is sent to the IoT device, and the target certificate is related to the updated certificate.

[0103] The process described in the above embodiments can be recorded in the certificate management log and authentication log for later review.

[0104] In this embodiment, the fingerprint collection dimensions can be expanded or reduced according to the type and capabilities of the IoT device, as long as the core requirement of multi-dimensional risk quantification is met. For example, for resource-constrained IoT devices, the frequency of software fingerprint collection can be reduced; for high-security IoT devices, behavioral fingerprints (such as communication frequency and traffic characteristics) can be added to improve the flexibility of security risk control.

[0105] This application's embodiments enhance the ability to identify illegitimate identities and risky devices (IoT devices). Through continuous verification using a combination of "certificate + multi-dimensional fingerprint," it effectively solves the problem of identity misuse involving "legitimate certificates + illegitimate devices." Real-time monitoring of fingerprint changes and baseline comparison improve the ability to detect software and hardware tampering, enabling the identification of various risk scenarios such as firmware version changes, hardware replacements, and MAC address forgery.

[0106] See Figure 4 , Figure 4 This is an exemplary system architecture diagram. The security authentication gateway can be deployed in a bypass configuration and supports TCP RESET; the identity authentication platform can be deployed in the cloud, and the operation and maintenance management platform can be deployed on the intranet; the security authentication gateway, identity authentication platform, risk quantification engine, and illegal identity denial module can be deployed independently or centrally. For example, the security authentication gateway, identity authentication platform, risk quantification engine, and illegal identity denial module can be centrally deployed and used as functional modules in the computer device described in the above embodiment.

[0107] See Figure 5 , Figure 5 This is an exemplary network topology diagram. The security authentication gateway can be deployed in bypass mode, and IoT devices can connect to the security authentication gateway. The security authentication gateway can perform bypass monitoring of the IoT devices. The security authentication gateway can also block communication between IoT devices by blocking channels.

[0108] See Figure 6 , Figure 6 This is an exemplary data processing flowchart.

[0109] The following, combined with Figure 4 , Figure 5 and Figure 6 The following are examples illustrating the technical solutions provided in the embodiments of this application.

[0110] See Figure 7 The safety risk control method includes the following steps:

[0111] During the self-registration and authentication phase of IoT devices:

[0112] Step 701: The IoT device sends a self-registration request (i.e., the registration request in the above embodiment) to the security authentication gateway, carrying the IoT device's initial certificate and second multi-dimensional fingerprint data.

[0113] Step 702: The security authentication gateway forwards the registration request to the identity authentication platform.

[0114] Step 703: The identity authentication platform calls the risk quantification engine.

[0115] Step 704: The risk quantification engine determines the security and trustworthiness quantification value (trust score) of the IoT device based on the second multi-dimensional fingerprint data and returns it to the identity authentication platform.

[0116] Step 705: The identity authentication platform sends the registration result and updated certificate to the security authentication gateway. If the initial certificate authentication is successful and the trust score is low-risk, the security authentication gateway stores the second multi-dimensional fingerprint data as the fingerprint baseline data in the fingerprint baseline database.

[0117] Step 706: The security authentication gateway sends an updated certificate to the IoT device.

[0118] During the periodic certification phase of IoT devices:

[0119] Step 707: The IoT device sends a periodic authentication request (i.e., the authentication request in the above embodiment) to the security authentication gateway. The authentication request includes the IoT device's target certificate and first multi-dimensional fingerprint data. The target certificate can be an updated certificate, or it can be an updated certificate that has undergone one or more rounds of updates.

[0120] Step 708: The security authentication gateway forwards the authentication request to the identity authentication platform.

[0121] Step 709: The identity authentication platform calls the risk quantification engine.

[0122] Step 710: The risk quantification engine determines the security and trustworthiness quantification value (trust score) of the IoT device based on the first multi-dimensional fingerprint data and returns it to the identity authentication platform.

[0123] When the security and trust quantification value is below a threshold (such as the second threshold):

[0124] Step 711: The identity authentication platform triggers a block on the illegal identity denial module.

[0125] Step 712: The illegal identity denial module sends a blocking command to the security authentication gateway.

[0126] Step 713: The security authentication gateway sends a connection error message to the IoT device (the connection error message is used to instruct the IoT device to disconnect the communication connection), or the security authentication gateway refuses to forward all traffic of the IoT device, or the security authentication gateway controls the device port corresponding to the IoT device to go offline, so that the IoT device disconnects.

[0127] Under the condition that the security and reliability quantification value is normal:

[0128] Step 711: The identity authentication platform sends an authentication success message to the security authentication gateway.

[0129] Step 712: The security authentication gateway maintains a normal communication connection with the IoT device.

[0130] In some embodiments, see Figure 8 , Figure 8 This is an exemplary flowchart for calculating a security and trust quantification value (trust score).

[0131] Taking the first multi-dimensional fingerprint data as an example, the risk quantification engine analyzes various fingerprint data (such as...) within the first multi-dimensional fingerprint data. Figure 8 The hardware fingerprint, software fingerprint, behavioral fingerprint, and environmental fingerprint shown are normalized. The security risk quantification value is obtained by weighted summation based on the normalized first multidimensional fingerprint data and the weights of each fingerprint data in the first multidimensional fingerprint data. The security trust quantification value is then calculated based on the security risk quantification value.

[0132] In some embodiments, a confidence score greater than or equal to 0.8 is determined to be low risk, a confidence score greater than or equal to 0.6 and less than 0.8 is determined to be medium risk, and a confidence score less than 0.6 is determined to be high risk, thereby achieving accurate calculation of the confidence score and precise quantification of security risks.

[0133] In related technologies, the continuity of trusted status assessment for IoT devices is insufficient. These technologies prioritize initial authentication over continuous verification, failing to quantify the risk status of IoT devices throughout their operation. After legitimate authentication, if the hardware or software of an IoT device is tampered with (e.g., firmware version changes, hardware replacement), the system cannot detect it. The certificate lifecycle is disconnected from the IoT device status; certificate management (generation, update, revocation) is not linked to the real-time fingerprint baseline of the IoT device, resulting in a lack of coordinated response capabilities when certificate status is abnormal or the IoT device status changes. Methods for blocking unauthorized identities are limited; the identification of identity information mutations (e.g., MAC forgery, certificate cloning) relies heavily on post-event log analysis, lacking rapid and accurate blocking mechanisms at the network layer (e.g., bypassing TCP RESET). Risk quantification dimensions are insufficient; existing solutions often assess risk based on a single or limited number of dimensions, lacking a comprehensive quantitative model integrating identity identifiers, static attributes, and business behaviors (requiring at least 9 categories of indicators), making it difficult to accurately classify the risks of IoT devices.

[0134] This application's embodiments construct a three-in-one continuous trust assessment system centered on a security authentication gateway, integrating "identity + fingerprint + behavior":

[0135] 1. Multi-dimensional fingerprint baseline management: Collects multi-dimensional fingerprints such as hardware (CPU serial number, motherboard model), software (operating system version, firmware version), and network (MAC address, IP address) through security agent components, and forms a dynamic baseline database on the gateway side to realize continuous verification of the consistency between the "digital identity" and "physical entity" of IoT devices.

[0136] 2. Risk Quantification Model: Based on multi-dimensional information (≥9 categories) such as certificate status, fingerprint consistency, historical authentication behavior, and abnormal events, a weighted risk quantification model is established on the gateway side to transform the abstract security status of IoT devices into specific trust scores T (0~1), providing a quantitative basis for subsequent policy control.

[0137] 3. Precise denial of unauthorized identities: The gateway compares fingerprints in real time during the authentication process. When a significant change in identity information is detected (such as a sudden change in MAC or CPU serial number), it is determined to be an unauthorized identity and can trigger a rapid network layer block (such as sending a TCPRESET message in a bypass mode), achieving a response time of seconds.

[0138] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0139] Based on the same inventive concept, this application also provides a security risk control device for implementing the security risk control method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more security risk control device embodiments provided below can be found in the limitations of the security risk control method described above, and will not be repeated here.

[0140] In one exemplary embodiment, such as Figure 9 As shown, a safety risk control device is provided, comprising:

[0141] The receiving module 901 is used to receive an authentication request from an IoT device, the authentication request including the target certificate of the IoT device and the first multi-dimensional fingerprint data.

[0142] The determination module 902 is used to determine the security and trust quantification value of the IoT device based on the first multi-dimensional fingerprint data if the first multi-dimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device when the target certificate is a valid certificate.

[0143] The risk control module 903 is used to control the security risks of IoT devices based on the security and trust quantification value.

[0144] In some embodiments, the risk control module 903 is specifically used to output a first alarm message if the security and trust quantification value is less than a first threshold; and to block communication between the IoT device and output a second alarm message if the security and trust quantification value is less than a second threshold. The first threshold is greater than the second threshold, and the first alarm message is different from the second alarm message.

[0145] In some embodiments, the risk control module 903 is specifically used for one or more of the following: sending a connection error message to the Internet of Things (IoT) device, wherein the connection error message is used to instruct the IoT device to disconnect the communication connection;

[0146] Refuse to forward all traffic from IoT devices; disconnect the device ports corresponding to IoT devices.

[0147] In some embodiments, the determining module 902 is specifically used to calculate a security risk quantification value based on the first multidimensional fingerprint data and the weights corresponding to each fingerprint data in the first multidimensional fingerprint data, and to calculate a security trust quantification value based on the security risk quantification value; or, to input the first multidimensional fingerprint data into a machine learning model or an expert system based on a rule engine to obtain a security trust quantification value.

[0148] In some embodiments, the receiving module 901 is further configured to receive a registration request from an IoT device, the registration request carrying the initial certificate of the IoT device and second multi-dimensional fingerprint data;

[0149] The device also includes:

[0150] The storage module is used to store the second multidimensional fingerprint data as fingerprint baseline data into the fingerprint baseline database after the initial certificate authentication is successful.

[0151] In some embodiments, the device further includes:

[0152] The sending module is used to send an updated certificate to the IoT device after the initial certificate authentication is successful. The target certificate is related to the updated certificate.

[0153] Each module in the aforementioned security risk control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0154] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 10As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores security risk control data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a security risk control method.

[0155] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0156] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0157] Receive authentication requests from IoT devices, including the target certificate and first multidimensional fingerprint data of the IoT device;

[0158] If the target certificate is a valid certificate, and the first multi-dimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device, then the security and trust quantification value of the IoT device is determined based on the first multi-dimensional fingerprint data.

[0159] Security risk control is carried out on IoT devices based on security and trust quantification values.

[0160] In some embodiments, when a processor executes a computer program, it specifically implements the following steps:

[0161] If the security and trust quantification value is less than the first threshold, then the first alarm message will be output.

[0162] If the security and trust quantification value is less than the second threshold, communication with the IoT device will be blocked and a second alarm message will be output. If the first threshold is greater than the second threshold, the first alarm message and the second alarm message will be different.

[0163] In some embodiments, when a processor executes a computer program, it specifically implements one or more of the following steps:

[0164] Send a connection error message to the IoT device. The connection error message is used to instruct the IoT device to disconnect the communication connection.

[0165] Refuse to forward all traffic from IoT devices;

[0166] Control the offline access of the device port corresponding to the IoT device.

[0167] In some embodiments, when a processor executes a computer program, it specifically implements the following steps:

[0168] Based on the first multidimensional fingerprint data and the weights corresponding to each fingerprint data in the first multidimensional fingerprint data, a security risk quantification value is calculated, and a security trust quantification value is calculated based on the security risk quantification value; or...

[0169] The first multidimensional fingerprint data is input into a machine learning model or a rule engine-based expert system to obtain a secure and reliable quantitative value.

[0170] In some embodiments, when the processor executes a computer program, it further performs the following steps:

[0171] Receive registration requests from IoT devices, the registration requests carrying the initial certificate of the IoT devices and second multi-dimensional fingerprint data;

[0172] If the initial certificate authentication is successful, the second multidimensional fingerprint data is stored in the fingerprint baseline database as fingerprint baseline data.

[0173] In some embodiments, when the processor executes a computer program, it further performs the following steps:

[0174] If the initial certificate authentication is successful, an update certificate is sent to the IoT device; the target certificate is related to the update certificate.

[0175] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0176] Receive authentication requests from IoT devices, including the target certificate and first multidimensional fingerprint data of the IoT device;

[0177] If the target certificate is a valid certificate, and the first multi-dimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device, then the security and trust quantification value of the IoT device is determined based on the first multi-dimensional fingerprint data.

[0178] Security risk control is carried out on IoT devices based on security and trust quantification values.

[0179] In some embodiments, when a computer program is executed by a processor, it specifically implements the following steps:

[0180] If the security and trust quantification value is less than the first threshold, then the first alarm message will be output.

[0181] If the security and trust quantification value is less than the second threshold, communication with the IoT device will be blocked and a second alarm message will be output. If the first threshold is greater than the second threshold, the first alarm message and the second alarm message will be different.

[0182] In some embodiments, when a computer program is executed by a processor, it specifically implements one or more of the following steps:

[0183] Send a connection error message to the IoT device. The connection error message is used to instruct the IoT device to disconnect the communication connection.

[0184] Refuse to forward all traffic from IoT devices;

[0185] Control the offline access of the device port corresponding to the IoT device.

[0186] In some embodiments, when a computer program is executed by a processor, it specifically implements the following steps:

[0187] Based on the first multidimensional fingerprint data and the weights corresponding to each fingerprint data in the first multidimensional fingerprint data, a security risk quantification value is calculated, and a security trust quantification value is calculated based on the security risk quantification value; or...

[0188] The first multidimensional fingerprint data is input into a machine learning model or a rule engine-based expert system to obtain a secure and reliable quantitative value.

[0189] In some embodiments, when a computer program is executed by a processor, it further performs the following steps:

[0190] Receive registration requests from IoT devices, the registration requests carrying the initial certificate of the IoT devices and second multi-dimensional fingerprint data;

[0191] If the initial certificate authentication is successful, the second multidimensional fingerprint data is stored in the fingerprint baseline database as fingerprint baseline data.

[0192] In some embodiments, when a computer program is executed by a processor, it further performs the following steps:

[0193] If the initial certificate authentication is successful, an update certificate is sent to the IoT device; the target certificate is related to the update certificate.

[0194] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0195] Receive authentication requests from IoT devices, including the target certificate and first multidimensional fingerprint data of the IoT device;

[0196] If the target certificate is a valid certificate, and the first multi-dimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device, then the security and trust quantification value of the IoT device is determined based on the first multi-dimensional fingerprint data.

[0197] Security risk control is carried out on IoT devices based on security and trust quantification values.

[0198] In some embodiments, when a computer program is executed by a processor, it specifically implements the following steps:

[0199] If the security and trust quantification value is less than the first threshold, then the first alarm message will be output.

[0200] If the security and trust quantification value is less than the second threshold, communication with the IoT device will be blocked and a second alarm message will be output. If the first threshold is greater than the second threshold, the first alarm message and the second alarm message will be different.

[0201] In some embodiments, when a computer program is executed by a processor, it specifically implements one or more of the following steps:

[0202] Send a connection error message to the IoT device. The connection error message is used to instruct the IoT device to disconnect the communication connection.

[0203] Refuse to forward all traffic from IoT devices;

[0204] Control the offline access of the device port corresponding to the IoT device.

[0205] In some embodiments, when a computer program is executed by a processor, it specifically implements the following steps:

[0206] Based on the first multidimensional fingerprint data and the weights corresponding to each fingerprint data in the first multidimensional fingerprint data, a security risk quantification value is calculated, and a security trust quantification value is calculated based on the security risk quantification value; or...

[0207] The first multidimensional fingerprint data is input into a machine learning model or a rule engine-based expert system to obtain a secure and reliable quantitative value.

[0208] In some embodiments, when a computer program is executed by a processor, it further performs the following steps:

[0209] Receive registration requests from IoT devices, the registration requests carrying the initial certificate of the IoT devices and second multi-dimensional fingerprint data;

[0210] If the initial certificate authentication is successful, the second multidimensional fingerprint data is stored in the fingerprint baseline database as fingerprint baseline data.

[0211] In some embodiments, when a computer program is executed by a processor, it further performs the following steps:

[0212] If the initial certificate authentication is successful, an update certificate is sent to the IoT device; the target certificate is related to the update certificate.

[0213] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0214] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0215] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A safety risk control method, characterized in that, The method includes: Receive an authentication request from an Internet of Things (IoT) device, the authentication request including the target certificate of the IoT device and first multi-dimensional fingerprint data; If the target certificate is a valid certificate, and the first multidimensional fingerprint data is inconsistent with the fingerprint baseline data of the IoT device, then the security and trust quantification value of the IoT device is determined based on the first multidimensional fingerprint data. Based on the aforementioned security and trust quantification value, security risk control is performed on the IoT device.

2. The method according to claim 1, characterized in that, The step of controlling security risks of the IoT device based on the security and trust quantification value includes: If the security and trust quantification value is less than the first threshold, then the first alarm message is output; If the security and trust quantification value is less than the second threshold, then the communication of the IoT device is blocked and a second alarm message is output. The first threshold is greater than the second threshold, and the first alarm message is different from the second alarm message.

3. The method according to claim 2, characterized in that, The communication blocking of the IoT device includes one or more of the following: Send a connection error message to the IoT device, the connection error message being used to instruct the IoT device to disconnect the communication connection; Refuse to forward all traffic from the aforementioned IoT device; Control the device port corresponding to the IoT device to go offline.

4. The method according to claim 1, characterized in that, The step of determining the security and trustworthiness quantification value of the IoT device based on the first multidimensional fingerprint data includes: Based on the first multidimensional fingerprint data and the weights corresponding to each fingerprint data in the first multidimensional fingerprint data, a security risk quantification value is calculated, and a security trust quantification value is calculated based on the security risk quantification value; or... The first multidimensional fingerprint data is input into a machine learning model or a rule engine-based expert system to obtain the security and trust quantification value.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: Receive the registration request from the IoT device, the registration request carrying the initial certificate of the IoT device and the second multi-dimensional fingerprint data; If the initial certificate authentication is successful, the second multidimensional fingerprint data will be stored in the fingerprint baseline database as the fingerprint baseline data.

6. The method according to claim 5, characterized in that, The method further includes: If the initial certificate authentication is successful, an update certificate is sent to the IoT device, and the target certificate is related to the update certificate.

7. A safety risk control device, characterized in that, The device includes: A receiving module is configured to receive an authentication request from an IoT device, the authentication request including the target certificate of the IoT device and first multi-dimensional fingerprint data; The determination module is used to determine the security and trust quantification value of the Internet of Things device based on the first multidimensional fingerprint data if the first multidimensional fingerprint data is inconsistent with the fingerprint baseline data of the Internet of Things device when the target certificate is a valid certificate. The risk control module is used to perform security risk control on the IoT device based on the security and trust quantification value.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images