Data security protection selection method and apparatus, and storage medium

Abstract

The embodiments of the present disclosure relate to the technical field of mobile communication. Provided are a data security protection selection method and apparatus, and a storage medium. The method comprises: obtaining information of a target application or a target model and information of target data required by the target application or the target model, and determining first security information and / or second security information; determining DTN data security requirements on the basis of the first security information and / or the second security information; determining a candidate data source capable of providing the target data, and on the basis of a data security protection mechanism supported by the candidate data source and a correspondence between each data security protection mechanism and a data security performance, determining a target data source capable of meeting the DTN data security requirements and a target security protection mechanism with which the target data source needs to be configured; and configuring the target security protection mechanism for the target data source and a relevant security entity.

Description

Data security protection selection method, device and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application No. 202311029613.3 filed in China on August 16, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure relates to the field of mobile communication technology, and in particular to a data security protection selection method, device, and storage medium. Background Art

[0004] Digital twins, the real-time mirroring of physical entities in the digital world, are becoming a new focus of global information technology development and industrial digital transformation. In the future network, digital twin technology will be widely used in fields such as intelligent manufacturing, smart cities, and scientific research, leading society as a whole towards a "digital twin" world that blends virtual and real life.

[0005] A digital twin network (DTN) is a network system with a physical network entity and a virtual twin, and the two can be interactively mapped in real time. In this system, various network management and applications can use the network virtual twin built by digital twin technology to efficiently analyze, diagnose, simulate and control the physical network based on data and models. The network virtual twin can help the physical network achieve low-cost trial and error, intelligent decision-making, high-efficiency innovation and predictive maintenance. Using the digital twin network as a key enabling platform for future mobile communication networks can help mobile communication networks achieve the goal of distributed autonomy. At the same time, the digital twin network can help users clearly perceive the network status, efficiently mine valuable network information, and explore innovative network applications with a more friendly immersive interactive interface through capability exposure and twin copying.

[0006] Figure 1 shows the decomposition of a digital twin network. Data is the cornerstone of building a digital twin. The functional implementation of a digital twin network is closely related to data processing, specifically encompassing data acquisition, data transmission, data storage, data preprocessing, and data utilization. Data acquisition enables the efficient collection of heterogeneous data from multiple sources in the physical network; data transmission involves near-real-time transmission of collected data via the data transmission network; data storage and preprocessing categorize and store heterogeneous data, using various methods to clean "dirty" data, compress storage space, and improve data quality. Open data access refers to providing application models with access to data through a unified format and interface.

[0007] While some data collection methods currently under study support establishing secure transmission channels, they lack security protection for data from the data source to the model level, and lack the ability to select and dynamically adjust security mechanisms. These methods are unable to meet the diverse models and precise protection requirements of data sources in digital twin networks, as well as the dynamic changes in the network, and may not be able to meet the real-time requirements of digital twin networks.

[0008] Summary of the Invention

[0009] At least one embodiment of the present disclosure provides a data security protection selection method, device and storage medium, which provides a data security protection mechanism for the data of the digital twin network that is adapted to the upper-layer applications and the underlying network to meet the security and real-time requirements of the digital twin network.

[0010] In order to solve the above technical problems, the present disclosure is implemented as follows:

[0011] In a first aspect, an embodiment of the present disclosure provides a data security protection selection method in a digital twin network, which is applied to a security policy management function. The method includes:

[0012] Obtaining information of a target application or target model and information of target data required by the target application or target model, and determining first security information and / or second security information, wherein the first security information is security information of the target application or target model, and the second security information is security information of the target data required by the target application or target model;

[0013] Determining a digital twin network DTN data security requirement based on the first security information and / or the second security information, where the DTN data security requirement includes at least one of a confidentiality requirement, a privacy requirement, a trust requirement, and a real-time requirement;

[0014] Determine, based on the data that can be provided by each pre-maintained data source, a candidate data source that can provide the target data; and determine, based on the data security protection mechanisms supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance, a target data source that can meet the DTN data security requirements and a target security protection mechanism that needs to be configured for the target data source;

[0015] The target security protection mechanism is configured for the target data source and related security entities.

[0016] Optionally, determining the first security information and / or the second security information includes:

[0017] analyzing information of a target application or a target model, determining security information of the target application or the target model, and obtaining the first security information; and / or analyzing information of target data required by the target application or the target model, determining security information of the target data, and obtaining the second security information;

[0018] or,

[0019] Receive security information of target data required by the target application or target model and / or security information of the target application or target model sent by the target application or target model; obtain the first security information based on the security information of the target application or target model, and / or obtain the second security information based on the security information of the target data.

[0020] Optionally, the above method further includes:

[0021] Establish and maintain in advance the data that each data source can provide and the data security protection mechanisms supported by each data source;

[0022] Establish and maintain the correspondence between various data security protection mechanisms and data security performance in advance.

[0023] Optionally, the above method further includes:

[0024] Obtaining network status and determining whether it is necessary to update the target data source and / or update the target security protection mechanism;

[0025] In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements;

[0026] In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured.

[0027] Optionally, obtaining the network status includes at least one of the following:

[0028] Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators;

[0029] Monitor the network and obtain the network indicators.

[0030] Optionally, the determining whether it is necessary to update the target data source and / or update the target security protection mechanism includes at least one of the following:

[0031] Analyze whether the network indicators affect the data security performance that can be achieved by the target security protection mechanism of the target data source. If so, determine whether the target data source and / or the target security protection mechanism need to be updated;

[0032] Analyze whether it is necessary to update the digital twin network (DTN) data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and / or update the target security protection mechanism.

[0033] In a second aspect, an embodiment of the present disclosure provides a data security protection selection method in a digital twin network, which is applied to a data source node and a corresponding security entity. The method includes:

[0034] receiving configuration information sent by the security policy management function, the configuration information including a target security protection mechanism;

[0035] According to the target security protection mechanism, the data source node and related security entities are configured.

[0036] In a third aspect, an embodiment of the present disclosure provides a data security protection selection device in a digital twin network, which is applied to security policy management functions and includes a transceiver and a processor, wherein:

[0037] The transceiver is configured to obtain information about a target application or target model and information about target data required by the target application or target model, and determine first security information and / or second security information, wherein the first security information is security information about the target application or target model, and the second security information is security information about the target data required by the target application or target model;

[0038] The processor is used to determine the digital twin network DTN data security requirements based on the first security information and / or the second security information, where the DTN data security requirements include at least one of confidentiality requirements, privacy requirements, trust requirements and real-time requirements; determine the candidate data source that can provide the target data based on the data that can be provided by each pre-maintained data source, and determine the target data source that can meet the DTN data security requirements and the target security protection mechanism that needs to be configured for the target data source based on the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance; and configure the target security protection mechanism for the target data source and related security entities.

[0039] Optionally, the transceiver is further configured to:

[0040] analyzing information of a target application or a target model, determining security information of the target application or the target model, and obtaining the first security information; and / or analyzing information of target data required by the target application or the target model, determining security information of the target data, and obtaining the second security information;

[0041] or,

[0042] Receive security information of target data required by the target application or target model and / or security information of the target application or target model sent by the target application or target model; obtain the first security information based on the security information of the target application or target model, and / or obtain the second security information based on the security information of the target data.

[0043] Optionally, the processor is further configured to:

[0044] Establish and maintain in advance the data that each data source can provide and the data security protection mechanisms supported by each data source;

[0045] Establish and maintain the correspondence between various data security protection mechanisms and data security performance in advance.

[0046] Optionally, the transceiver is further configured to: obtain a network status, and determine whether it is necessary to update a target data source and / or update a target security protection mechanism;

[0047] The processor is further configured to:

[0048] In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements;

[0049] In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured.

[0050] Optionally, the transceiver is further configured to obtain the network status by at least one of the following methods:

[0051] Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators;

[0052] Monitor the network and obtain the network indicators.

[0053] Optionally, the processor is further configured to determine whether it is necessary to update the target data source and / or update the target security protection mechanism by at least one of the following methods:

[0054] Analyze whether the network indicators affect the data security performance that can be achieved by the target security protection mechanism of the target data source. If so, determine whether the target data source and / or the target security protection mechanism need to be updated;

[0055] Analyze whether it is necessary to update the digital twin network (DTN) data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and / or update the target security protection mechanism.

[0056] In the fourth aspect, an embodiment of the present disclosure provides a data security protection selection device in a digital twin network, which is applied to security policy management functions, including: a processor, a memory, and a program stored on the memory and runnable on the processor, and when the program is executed by the processor, the steps of the method described in the first aspect are implemented.

[0057] In a fifth aspect, an embodiment of the present disclosure provides a data security protection selection device in a digital twin network, which is applied to a data source node and a corresponding security entity, including a transceiver and a processor, wherein:

[0058] The transceiver is configured to receive configuration information sent by the security policy management function, wherein the configuration information includes a target security protection mechanism;

[0059] The processor is used to configure the data source node and related security entities according to the target security protection mechanism

[0060] In the sixth aspect, an embodiment of the present disclosure provides a data security protection selection device in a digital twin network, which is applied to data source nodes and corresponding security entities, including: a processor, a memory, and a program stored on the memory and runnable on the processor, and when the program is executed by the processor, the steps of the method described in the second aspect are implemented.

[0061] In a seventh aspect, an embodiment of the present disclosure provides a computer-readable storage medium, on which a program is stored. When the program is executed by a processor, the steps of the method described above are implemented.

[0062] Compared with the existing technology, the data security protection selection method, device and storage medium provided by the embodiments of the present invention provide a data security protection mechanism for the data of the digital twin network that is adapted to the upper-layer applications and underlying networks. It can meet the precise protection requirements of the diverse models and data sources in the digital twin network and the dynamic changes of the network. With data as the granularity, it can meet the real-time and security requirements of the digital twin network and reduce human intervention. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present disclosure. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0064] Figure 1 is an example diagram of digital twin network deconstruction in related technology;

[0065] FIG2 is a flow chart of a data security protection selection method according to an embodiment of the present disclosure;

[0066] FIG3 is another flow chart of a data security protection selection method according to an embodiment of the present disclosure;

[0067] FIG4 is a flowchart of an example of a data security protection selection method according to an embodiment of the present disclosure;

[0068] FIG5 is a schematic structural diagram of a data security protection selection device according to an embodiment of the present disclosure;

[0069] FIG6 is another structural diagram of the data security protection selection device according to an embodiment of the present disclosure;

[0070] FIG7 is another structural diagram of the data security protection selection device according to an embodiment of the present disclosure;

[0071] FIG8 is another structural diagram of the data security protection selection device according to an embodiment of the present disclosure;

[0072] FIG9 is another structural diagram of the data security protection selection device according to an embodiment of the present disclosure;

[0073] FIG10 is another structural diagram of the data security protection selection device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0074] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0075] The terms "first", "second", etc. in the specification and claims of the present disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or that are inherent to these processes, methods, products or devices. "And / or" in the specification and claims represents at least one of the connected objects.

[0076] The following description provides examples and does not limit the scope, applicability, or configuration set forth in the claims. Changes may be made to the function and arrangement of the elements discussed without departing from the spirit and scope of this disclosure. Various examples may appropriately omit, substitute, or add various procedures or components. For example, the described methods may be performed in an order different from that described, and various steps may be added, omitted, or combined. In addition, features described with reference to certain examples may be combined in other examples.

[0077] In related technologies, common data collection methods include:

[0078] 1. Collect network device data (Simple Network Management Protocol (SNMP), Network Configuration Protocol (NETCONF)), including:

[0079] (1) Geometric data, such as the physical form data of the device, including device size, number of ports, device image, device deployment location, etc.

[0080] (2) Status data, such as the device's operating status data, including port up / down status, central processing unit (CPU) utilization, memory utilization, etc.

[0081] (3) Event data: data triggered by events such as device configuration changes, abnormal status, and failures, such as alarms and logs;

[0082] (4) Topological data; such as data indicating the connection relationship between network elements, including device identification, number of links, port names, etc.

[0083] 2. Collect network performance data (Telemetry). This data includes network latency, jitter, packet loss, bandwidth, and other performance data. This includes performance data for different network types, such as wireless networks, transport networks, and data center networks. Telemetry is a network monitoring technology.

[0084] 3. Collect network traffic data (Sflow, Netflow, IPFIX, Netstream, eBPF, and external probes). Network traffic data refers to traffic data running on the network, including traffic quintuples, packet length, priority, and payload. Sflow is a network monitoring technology, Netflow is a network monitoring function, IPFIX refers to IP Flow Information Export, Netstream is a statistical technology based on network flow information, and eBPF refers to the Extended Berkeley Packet Filter.

[0085] 4. Obtain data from the network management system or the Network Data Analytics Function (NWDAF) (such as the RESTful service interface);

[0086] 5. Get data from the unified database and external database (Restful service interface or File Transfer Protocol (FTP) or Kafka).

[0087] DTN generates and stores large amounts of device information, user information, interaction information, and management information. External leakage or unauthorized access by applications can lead to privacy breaches of users or networks. Data tampering or corruption during transmission or storage, or unreliable collected data, can make it difficult to meet the application and analysis requirements of DTN data. The multi-level collaboration of heterogeneous networks and the need for cross-domain twin generation and sharing of DTN data complicate the security of these data. Therefore, digital twin network systems must provide security mechanisms to ensure data confidentiality, integrity, reliability, and traceability.

[0088] The real-time, replication, and scalability characteristics of digital twins put forward more requirements for data security mechanisms.

[0089] First, because digital twins need to track the state changes of real networks, dynamic application scenarios have higher requirements for the real-time and accuracy of data collection and synchronization. However, some scenarios do not require high real-time performance, and therefore have different tolerances for the time overhead and information loss of the data security mechanisms used.

[0090] Secondly, network twins pursue a comprehensive and accurate representation of the network, involving the collection of various types of data from various network devices and external libraries such as threat intelligence. Each data source may have different security requirements for its own data. For example, the User Data Management (UDM) in the core security domain and the Network Slice Management Function (NSMF) in the management security domain have different access restrictions on their respective traffic data. At the same time, each type of data has its own privacy requirements, such as different privacy requirements for user data and device status data. In addition, different types of devices have different computing and storage bandwidth resource capabilities and different data volumes, so they may have different choices for security mechanism equipment and transmission resource consumption, as well as software and hardware support.

[0091] Third, digital twin networks support multi-scale, multi-physics, and multi-level application models. These diverse application models may have different security restrictions and requirements. For example, network element data may require that data be available but invisible for cross-operator or cross-domain application models, while visible for models in the local domain. Another example is that application models with high network interaction (such as autonomous operation and maintenance) require high data credibility, while those with low interaction (such as artificial intelligence (AI) model training and optimization) require less data credibility.

[0092] Finally, security mechanisms have different security and non-security effects, such as security assurance, efficiency, overhead, information loss, software and hardware support, and availability. This means that appropriate security mechanisms must be selected based on these different security and non-security requirements. See Table 1.

[0093] Table 1

[0094] Another thing to consider is that the network is changing dynamically. The twin network supports model updates, expansions, and autonomous construction. The collected content of the twin data may also change dynamically according to network bandwidth conditions, failures, security attacks, etc. to meet the balance between real-time accuracy and overhead. For example, in order to reduce resource overhead, only high-value data needs to be identified in some scenarios and network states. For example, a small amount of data is uploaded in normal status and more data is uploaded in problem status for analysis. Accordingly, the security mechanism may need to be dynamically adjusted. Therefore, it is necessary to provide a framework that supports the selection of security protection mechanisms and can be dynamically adjusted.

[0095] While some data collection methods in related technologies support the establishment of secure transmission channels, they lack security protection for data from the data source to the model level, and lack the ability to select and dynamically adjust security mechanisms. This fails to meet the precise protection requirements of the diverse models and data sources in digital twin networks, as well as the dynamic changes in the network, and may not meet the real-time requirements of digital twin networks.

[0096] To solve at least one of the above problems, the embodiment of the present disclosure provides a data security protection selection method to provide a data security protection mechanism adapted to upper-layer applications and underlying networks for the data of the digital twin network, so as to meet the security and real-time requirements of the digital twin network. Figure 2 is a flow chart of the data security protection selection method provided by the embodiment of the present disclosure applied to the security policy management function. The security policy management function can specifically be the security management function in the network twin management of the twin network layer shown in Figure 1, or it can be the security management function in the existing network. As shown in Figure 2, the method includes:

[0097] Obtain information about the target application or target model and the target data it needs. Here, the information about the target application or target model may generally include: description, type, user, etc. of the target application or target model, such as "model optimization application", "security deduction application", "slice security operation and maintenance", "core network slice resource configuration", "wireless network optimization", etc. The information about the target data indicates the type, collection time, collection period, etc. of the target data, such as "the five-tuple (source IP, source port, destination IP, destination port, layer 4 protocol, etc.) of the data packets flowing through the user plane function (UPF) of the network element at all times", periodically collected network element logs, information about network element processes at all times, etc.

[0098] Step 201, obtain information about the target application or target model and the target data it needs, and determine first security information and / or second security information, where the first security information is the security information of the target application or target model, and the second security information is the security information of the target data required by the target application or target model.

[0099] Here, the security information of the target application or target model indicates the security limitations of the target application or target model (for example, the model can only use data from network elements in the same security domain, the model cannot use user privacy data, etc.) or security requirements. The security requirements may be one or more of confidentiality requirements, privacy requirements, trust requirements, and real-time requirements. For example, application models with high interaction with the network (such as autonomous operation and maintenance) have high trust and high real-time requirements, and application models with low interaction (such as AI model training and optimization) do not have high requirements for data trustworthiness. The security information of the target data indicates the security limitations of the target data (for example, the data can only be read by models or applications in the same security domain / core security domain / management security domain, etc.) or security requirements. The security requirements may be one or more of confidentiality requirements, privacy requirements, trust requirements, and real-time requirements. For example, the privacy requirements for user data and device status data are different.

[0100] The target application or target model information refers to the descriptive information of the target application or target model, which may specifically include but is not limited to at least one of the following: (1) the purpose of the target application or target model, such as "AI model training and optimization"; (2) the characteristics of the target application or target model, such as "high interactivity with the network"; (3) the field of the target application or target model, such as "core network" or "wireless network"; (4) the requirements of the target application or target model, such as "high reliability and high real-time" and so on.

[0101] The target data information refers to descriptive information about the target data, including but not limited to at least one of the following: (1) information indicating the data content of the target data, such as "user credentials", "login and logout time", "Internet Protocol (IP) address", "port number", "domain name requested by the user", "host version number", "number of processes", "vulnerabilities", "network risk / real-time / bandwidth occupancy indicators", etc.; (2) the name of the object containing the data, so that the data can be parsed and obtained from the object, for example, "Virtual Private Network (VPN) / proxy / Network Address Translation (NAT) / system / service log", "intrusion detection system (IDS) alarm information", "netflow log and captured data packets", "nmap information", "threat intelligence", etc.

[0102] After the security policy management function receives the target data and the information of the model or application, it analyzes and determines the security information of the target application or target model or target data based on this. For example, based on the pre-trained AI model or preset conditions, the information of the model or application and the target data is analyzed to determine the security information of the model or application, thereby obtaining the first security information, and / or analyzing the security information of the target data to obtain the second security information.

[0103] As another implementation method, the security policy management function can also directly receive the security information of the target data required by the target application or target model and / or the security information of the target application or target model; obtain the first security information based on the security information of the target application or target model, and / or obtain the second security information based on the security information of the target data.

[0104] Step 202: Determine the digital twin network DTN data security requirements based on the first security information and / or the second security information, where the DTN data security requirements include at least one of confidentiality requirements, privacy requirements, trust requirements, and real-time requirements.

[0105] Here, confidentiality refers to the requirement that information not be disclosed to unauthorized users, entities, or processes; privacy protection refers to the protection of information obtained through observing network behavior; credibility refers to the trustworthiness of evidence or the degree to which it can be trusted; and real-time requirements refer to the time required from data generation to acquisition. These characteristics can have different levels, as shown in Table 2.

[0106] Table 2

[0107] The security policy management function determines DTN data security requirements based on the first security information and / or the second security information, thereby converting the unstructured security requirements from the model (or application) and data sides into structured security requirements for DTN data protection. The DTN data security requirements may include at least one of confidentiality requirements, privacy protection requirements, trust requirements, and real-time requirements. For example, based on the model requirement of high-trust data and the data requirement of user data being non-readable, the security requirements for DTN data protection are: high trust, privacy protection, and repository invisibility.

[0108] Step 203: Determine a candidate data source that can provide the target data based on the data that can be provided by each pre-maintained data source, and determine a target data source that can meet the DTN data security requirements and a target security protection mechanism that needs to be configured for the target data source based on the data security protection mechanisms supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance.

[0109] Here, in the embodiments of the present disclosure, the data that each data source can provide and the data security protection mechanisms supported by each data source can be pre-established and maintained. In addition, the correspondence between various data security protection mechanisms and data security performance can also be pre-established and maintained. For example, multiple different levels of data security performance can be pre-defined, and for each level of data security performance, a corresponding data security protection mechanism can be determined. Specifically, it can include one or more of a confidentiality security protection mechanism, a privacy security protection mechanism, a trusted security protection mechanism, and a real-time security protection mechanism.

[0110] In the embodiments of the present disclosure, data security performance refers to the security effect or security performance that can be achieved by the data security protection mechanism, and its specific indicators can also be referred to Table 2. DTN data security requirements refer to the security requirements of the data involved.

[0111] In this way, in step 203, the security policy management function can determine the candidate data sources that can provide the target data based on the data that can be provided by each pre-maintained data source, and then screen out the target data source that meets the DTN data security requirements from the candidate data sources based on the data security protection mechanisms supported by the candidate data sources and the correspondence between each pre-maintained data security protection mechanism and data security performance, and determine the target security protection mechanism that needs to be configured for the target data source, for example, determining a security protection mechanism that meets at least one of confidentiality requirements, privacy requirements, trust requirements and real-time requirements.

[0112] Step 204: configure the target security protection mechanism for the target data source and related security entities.

[0113] Here, the security policy management function can configure the target security protection mechanism for the target data source and related security entities, for example, by sending a configuration message to configure the target data source and related security entities to use the target security protection mechanism to protect data. The related security entities are security entities related to the target data source and used to implement security protection for the data source.

[0114] Through the above steps, the embodiment of the present disclosure provides a data security protection mechanism for the data of the digital twin network that is adapted to the upper-layer applications and the underlying network, thereby meeting the security and real-time requirements of the digital twin network.

[0115] Taking into account changes in network status and changes in model requirements, the embodiments of the present disclosure can timely update the data source and its security protection mechanism according to the above changes to ensure that the security and real-time requirements of the digital twin network are met.

[0116] Specifically, in an embodiment of the present disclosure, the security policy management function can obtain the network status. For example, the security policy management function can obtain the network status by subscribing to network indicators that indicate the network status and changes in the network status; and, receiving the network indicators. For another example, the security policy management function can obtain the network indicators by monitoring the network.

[0117] After obtaining the network status, the security policy management function can determine whether it is necessary to update the target data source and / or the target security protection mechanism. For example, the security policy management function can analyze whether the network indicators affect the data security performance that can be achieved by the target security protection mechanism of the target data source. If so, it determines that it is necessary to update the target data source and / or update the target security protection mechanism. For another example, the security policy management function can analyze whether it is necessary to update the digital twin network (DTN) data security requirements based on the network indicators. If so, it determines that it is necessary to update the target data source and / or update the target security protection mechanism.

[0118] Thus, when it is determined that the target data source needs to be updated, the security policy management function can re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements. For example, a new target data source and a new target security protection mechanism that can meet the DTN data security requirements can be re-determined, and the new target security protection mechanism can be configured for the new target data source and related security entities.

[0119] In the event that the target security protection mechanism needs to be updated, the security policy management function can redefine and configure a new target security protection mechanism that can meet the DTN data security requirements, for example, redefine a new target security protection mechanism that can meet the DTN data security requirements, and configure the new target security protection mechanism for the target data source and related security entities.

[0120] Referring to FIG3 , the data security protection selection method in a digital twin network provided by an embodiment of the present disclosure, when applied to a data source node and a corresponding security entity, includes:

[0121] Step 301: Receive configuration information sent by the security policy management function, where the configuration information includes a target security protection mechanism.

[0122] Step 302: Configure the data source node and related security entities according to the target security protection mechanism.

[0123] Through the above steps, the security policy management function configures the target security protection mechanism for the data source node and the corresponding security entity to meet the security and real-time requirements of the digital twin network.

[0124] The present disclosure also provides a data security protection selection method in a digital twin network, which is applied to a network indicator monitoring function. The method includes:

[0125] Step a, receiving a subscription request sent by a network indicator monitoring function, wherein the subscription request is used to subscribe to network indicators indicating network status and network status changes;

[0126] Step b: sending the network indicator to the network indicator monitoring function according to the subscription request.

[0127] FIG4 further provides an example process of interaction between multiple entities in the data security protection selection method of the embodiment of the present disclosure. In this example, the relevant functional entity functions are logical entities, which can be combined with other network element functions or deployed independently.

[0128] (1) Security policy management entity: responsible for receiving data security requirements or performing data security requirements analysis based on models and data; responsible for obtaining data sources; responsible for generating the initial list or changes of DTN data security mechanisms based on security requirements, network indicators, differences in security protection mechanisms, and support of data sources for security mechanisms.

[0129] (2) Network indicator monitoring function: responsible for collecting and analyzing network indicators; responsible for notifying network indicators and changes based on subscriptions.

[0130] (3) Data sources and related security entities: Data sources refer to entities that provide or collect data. They can be network elements or NWDAFs in the network, network / network element management entities, or unified data warehouses or external databases of digital twin networks (such as threat intelligence libraries or other digital twin networks). Related security entities refer to supporting entities required by the security mechanisms supported by the data source, such as key distribution entities or certificate issuing entities.

[0131] The process of this example mainly includes:

[0132] 1) Model registration data - the online application or model reports the data it needs to the security policy management function; registers the data of each data source, including network elements and external data sources (such as threat intelligence libraries, etc.), reporting the data that can be collected by themselves or other network elements and the supported security mechanisms; the security policy management function establishes and maintains the correspondence between data security protection mechanisms and data security performance.

[0133] 2) The security policy management function obtains security information about data and applications or models, and based on this, makes static judgments on DTN data requirements, including confidentiality, privacy, trustworthiness, and real-time performance, thereby obtaining security information about the data;

[0134] 3) Based on the data that can be collected by the registered network elements, candidate data sources are identified. Based on the candidate data sources' support for security mechanisms and the corresponding relationship between data security protection mechanisms and data security performance, a DTN data security mechanism list is generated. The DTN data security mechanism list includes the selected target data sources and their corresponding target security protection mechanisms. If the candidate data source security mechanism does not meet the security requirements, another data source is selected or the model is notified to replace the data.

[0135] 4) Configure DTN data security mechanisms for the target data source and related security entities. This may require adding protocol bits to indicate confidentiality, privacy, trustworthiness, and real-time mechanisms or configuring through existing service interfaces. The security entity refers to the functions necessary to implement the security mechanism, such as the Certificate Authority (CA) entity (issuing certificates) or the key management entity (distributing keys).

[0136] 5) The security policy management function collects network status, analyzes changes in network metrics or obtains changes through network metric monitoring, determines whether the target data source and / or target security protection mechanism need to be updated, identifies the data source and security mechanism to be updated, and configures the DTN data security mechanism for the data source and related security entities. Because network status changes (such as bandwidth, failures, and security attacks) may make the original data source unavailable, or because the data source's security mechanism may not meet real-time requirements due to bandwidth fluctuations or other reasons, it may be necessary to replace the data source or update the security mechanism.

[0137] From the above, it can be seen that the embodiments of the present disclosure provide a method and framework that supports the selection of security protection mechanisms and can be dynamically adjusted, providing a data security protection mechanism for the data of the digital twin network that is adapted to the upper-layer applications and underlying networks. It can meet the precise protection requirements of diverse models and data sources in the digital twin network and the dynamic changes of the network. With data as the granularity, it can meet the real-time and security requirements of the digital twin network and reduce human intervention.

[0138] The above describes various methods of the embodiments of the present disclosure. The following further provides apparatuses for implementing the above methods.

[0139] Referring to FIG5 , an embodiment of the present disclosure further provides a data security protection selection device in a digital twin network, which is applied to a security policy management function. The device includes:

[0140] A first obtaining module 501 is configured to obtain information about a target application or target model and information about target data required by the target application or target model, and determine first security information and / or second security information, wherein the first security information is security information about the target application or target model, and the second security information is security information about the target data required by the target application or target model;

[0141] A first determining module 502 is configured to determine a digital twin network (DTN) data security requirement based on the first security information and / or the second security information, where the DTN data security requirement includes at least one of a confidentiality requirement, a privacy requirement, a trust requirement, and a real-time requirement;

[0142] The second determining module 503 is configured to determine, based on the data that can be provided by each pre-maintained data source, a candidate data source that can provide the target data, and determine, based on the data security protection mechanisms supported by the candidate data source and the pre-maintained correspondence between each data security protection mechanism and data security performance, a target data source that can meet the DTN data security requirements and a target security protection mechanism that needs to be configured for the target data source;

[0143] The first configuration module 504 is configured to configure the target security protection mechanism for the target data source and related security entities.

[0144] Through the above modules, the disclosed embodiments provide a data security protection mechanism for the digital twin network data that is adapted to upper-layer applications and underlying networks, meeting the security and real-time requirements of the digital twin network.

[0145] Optionally, the first obtaining module is further configured to:

[0146] analyzing information of a target application or a target model, determining security information of the target application or the target model, and obtaining the first security information; and / or analyzing information of target data required by the target application or the target model, determining security information of the target data, and obtaining the second security information;

[0147] or,

[0148] Receive security information of target data required by the target application or target model and / or security information of the target application or target model sent by the target application or target model; obtain the first security information based on the security information of the target application or target model, and / or obtain the second security information based on the security information of the target data.

[0149] Optionally, the above device further includes:

[0150] The maintenance module is used to pre-establish and maintain the data that each data source can provide and the data security protection mechanism supported by each data source; pre-establish and maintain the correspondence between various data security protection mechanisms and data security performance.

[0151] Optionally, the above device further includes:

[0152] A third determination module is used to obtain the network status and determine whether it is necessary to update the target data source and / or update the target security protection mechanism;

[0153] In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements;

[0154] In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured.

[0155] Optionally, the third determining module includes:

[0156] The second obtaining module is used to obtain the network status by at least one of the following methods:

[0157] Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators;

[0158] Monitor the network and obtain the network indicators.

[0159] Optionally, the third determining module includes:

[0160] The fourth determining unit is configured to determine whether it is necessary to update the target data source and / or update the target security protection mechanism by at least one of the following methods:

[0161] Analyze whether the network indicators affect the data security performance that can be achieved by the target security protection mechanism of the target data source. If so, determine whether the target data source and / or the target security protection mechanism need to be updated;

[0162] Analyze whether it is necessary to update the digital twin network (DTN) data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and / or update the target security protection mechanism.

[0163] It should be noted that the device in this embodiment corresponds to the method for security policy management functions described above. The implementation methods in the above embodiments are applicable to the embodiments of this device and can achieve the same technical effects. The above-mentioned device provided in the embodiments of the present disclosure can implement all the method steps implemented in the above-mentioned method embodiments and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as those in the method embodiments will not be described in detail here.

[0164] Referring to FIG6 , an embodiment of the present disclosure further provides a data security protection selection device 600 in a digital twin network, comprising: a transceiver 601 and a processor 602 ;

[0165] The transceiver 601 is configured to obtain information about a target application or target model and information about target data required by the target application or target model, and determine first security information and / or second security information, where the first security information is security information about the target application or target model and the second security information is security information about the target data required by the target application or target model;

[0166] The processor 602 is used to: determine the digital twin network DTN data security requirements based on the first security information and / or the second security information, where the DTN data security requirements include at least one of confidentiality requirements, privacy requirements, trust requirements and real-time requirements; determine the candidate data source that can provide the target data based on the data that can be provided by each pre-maintained data source, and determine the target data source that can meet the DTN data security requirements and the target security protection mechanism that the target data source needs to be configured according to the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance; configure the target security protection mechanism for the target data source and related security entities.

[0167] Optionally, the transceiver is further configured to: analyze information of a target application or a target model, determine security information of the target application or the target model, and obtain the first security information; and / or analyze information of target data required by the target application or the target model, determine security information of the target data, and obtain the second security information;

[0168] or,

[0169] Receive security information of target data required by the target application or target model and / or security information of the target application or target model sent by the target application or target model; obtain the first security information based on the security information of the target application or target model, and / or obtain the second security information based on the security information of the target data.

[0170] Optionally, the processor is further configured to:

[0171] Establish and maintain in advance the data that each data source can provide and the data security protection mechanisms supported by each data source;

[0172] Establish and maintain the correspondence between various data security protection mechanisms and data security performance in advance.

[0173] Optionally, the processor is further configured to:

[0174] Obtaining network status and determining whether it is necessary to update the target data source and / or update the target security protection mechanism;

[0175] In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements;

[0176] In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured.

[0177] Optionally, the processor is further configured to:

[0178] Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators;

[0179] Monitor the network and obtain the network indicators.

[0180] Optionally, the processor is further configured to determine whether it is necessary to update the target data source and / or update the target security protection mechanism by at least one of the following methods:

[0181] Analyze whether the network indicators affect the data security performance that can be achieved by the target security protection mechanism of the target data source. If so, determine whether the target data source and / or the target security protection mechanism need to be updated;

[0182] Analyze whether it is necessary to update the digital twin network (DTN) data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and / or update the target security protection mechanism.

[0183] It should be noted that the device in this embodiment corresponds to the method applied to the security policy management function side. The implementation methods in the above embodiments are all applicable to the embodiments of this device and can achieve the same technical effects. The above-mentioned device provided in the embodiments of the present disclosure can implement all the method steps implemented in the above-mentioned method embodiments and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as those in the method embodiments will not be detailed here.

[0184] Referring to FIG7 , an embodiment of the present disclosure further provides a data security protection selection device in a digital twin network, which is applied to a data source node and a corresponding security entity, including:

[0185] A first receiving module 701 is configured to receive configuration information sent by the security policy management function, wherein the configuration information includes a target security protection mechanism;

[0186] The first configuration module 702 is used to configure the data source node and related security entities according to the target security protection mechanism.

[0187] It should be noted that the device in this embodiment corresponds to the method applied to the data source node and the corresponding security entity. The implementation methods in the above embodiments are all applicable to the embodiments of this device and can achieve the same technical effects. The above-mentioned device provided by the embodiment of the present disclosure can implement all the method steps implemented by the above-mentioned method embodiment and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be detailed here.

[0188] Referring to FIG8 , an embodiment of the present disclosure further provides a data security protection selection device 800 in a digital twin network, which is applied to a data source node and a corresponding security entity, including: a transceiver 801 and a processor 802;

[0189] The transceiver 801 is configured to receive configuration information sent by the security policy management function, wherein the configuration information includes a target security protection mechanism;

[0190] The processor 802 is configured to configure the data source node and related security entities according to the target security protection mechanism.

[0191] It should be noted that the device in this embodiment corresponds to the method applied to the data source node and the corresponding security entity. The implementation methods in the above embodiments are all applicable to the embodiments of this device and can achieve the same technical effects. The above-mentioned device provided by the embodiment of the present disclosure can implement all the method steps implemented by the above-mentioned method embodiment and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be detailed here.

[0192] Please refer to Figure 9. The embodiment of the present disclosure also provides a data security protection selection device 900 in a digital twin network, which is applied to the security policy management function, including a processor 901, a memory 902, and a computer program stored on the memory 902 and capable of running on the processor 901. When the computer program is executed by the processor 901, it implements the various processes of the above-mentioned data security protection selection method embodiment executed by the terminal, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0193] Please refer to Figure 10. The embodiment of the present disclosure also provides a data security protection selection device 1000 in a digital twin network, which is applied to a data source node and a corresponding security entity, including a processor 1001, a memory 1002, and a computer program stored on the memory 1002 and capable of running on the processor 1001. When the computer program is executed by the processor 1001, the various processes of the data security protection selection method embodiment executed by the network device are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0194] The present disclosure also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the computer program implements the various processes of the above-mentioned data security protection selection method embodiment and can achieve the same technical effect. To avoid repetition, the details are not described here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0195] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0196] Through the description of the above embodiments, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present disclosure.

[0197] The embodiments of the present disclosure are described above in conjunction with the accompanying drawings, but the present disclosure is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present disclosure, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present disclosure and the claims, all of which are protected by the present disclosure.

Claims

1. A data security protection selection method in a digital twin network, applied to a security policy management function, the method comprising: Obtain information of a target application or a target model and information of target data required by the target application or the target model, and determine first security information and / or second security information, wherein the first security information is security information of the target application or the target model, and the second security information is security information of the target data required by the target application or the target model; Determine, according to the first security information and / or the second security information, a digital twin network DTN data security requirement, wherein the DTN data security requirement includes at least one of a confidentiality requirement, a privacy requirement, a trust requirement, and a real-time requirement; Determine a candidate data source that can provide the target data based on the data that can be provided by each pre-maintained data source, and determine a target data source that can meet the DTN data security requirements and a target security protection mechanism that needs to be configured for the target data source based on the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance; The target security protection mechanism is configured for the target data source and related security entities.

2. The method of claim 1, wherein: Determining the first security information and / or the second security information includes: Analyze information of a target application or a target model, determine security information of the target application or the target model, and obtain the first security information; and / or analyze information of target data required by the target application or the target model, determine security information of the target data, and obtain the second security information; or, Receive security information of target data required by the target application or target model and / or security information of the target application or target model; obtain the first security information based on the security information of the target application or target model, and / or obtain the second security information based on the security information of the target data.

3. The method of claim 1, wherein: The method further comprises: Establish and maintain in advance the data that each data source can provide and the data security protection mechanism supported by each data source; Establish and maintain the correspondence between various data security protection mechanisms and data security performance in advance.

4. The method of claim 1, wherein: The method further comprises: Obtaining the network status and determining whether it is necessary to update the target data source and / or update the target security protection mechanism; In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements; In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured.

5. The method of claim 4, wherein: The obtaining of the network status includes at least one of the following: Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators; Monitor the network and obtain the network indicators.

6. The method of claim 4, wherein: The determining whether it is necessary to update the target data source and / or update the target security protection mechanism includes at least one of the following: Analyze whether the network indicator affects the data security performance that can be achieved by the target security protection mechanism of the target data source, and if so, determine whether it is necessary to update the target data source and / or update the target security protection mechanism; Analyze whether it is necessary to update the digital twin network DTN data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and / or update the target security protection mechanism.

7. A data security protection selection method in a digital twin network, applied to a data source node and a corresponding security entity, the method comprising: Receiving configuration information sent by the security policy management function, the configuration information including a target security protection mechanism; According to the target security protection mechanism, the data source node and related security entities are configured.

8. A data security protection selection device in a digital twin network, applied to security policy management functions, including a transceiver and a processor, wherein: The transceiver is used to obtain information of a target application or a target model and information of target data required by the target application or the target model, and determine first security information and / or second security information, wherein the first security information is security information of the target application or the target model, and the second security information is security information of the target data required by the target application or the target model; The processor is used to determine the digital twin network DTN data security requirements based on the first security information and / or the second security information, and the DTN data security requirements include at least one of confidentiality requirements, privacy requirements, trust requirements and real-time requirements; determine the candidate data source that can provide the target data based on the data that can be provided by each pre-maintained data source, and determine the target data source that can meet the DTN data security requirements and the target security protection mechanism that needs to be configured for the target data source based on the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance; configure the target security protection mechanism for the target data source and related security entities.

9. The device of claim 8, wherein: The transceiver is further used for: Analyze information of a target application or a target model, determine security information of the target application or the target model, and obtain the first security information; and / or analyze information of target data required by the target application or the target model, determine security information of the target data, and obtain the second security information; or, Receiving security information of target data required by the target application or target model and / or security information of the target application or target model; The first security information is obtained according to the security information of the target application or target model, and / or the second security information is obtained according to the security information of the target data.

10. The device of claim 8, wherein: The processor is further configured to: Establish and maintain in advance the data that each data source can provide and the data security protection mechanism supported by each data source; Establish and maintain the correspondence between various data security protection mechanisms and data security performance in advance.

11. The device of claim 8, wherein: The transceiver is also used to: obtain the network status, determine whether it is necessary to update the target data source and / or update the target Safety protection mechanism; The processor is further configured to: In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements; In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured.

12. The device of claim 11, wherein: The transceiver is further configured to obtain the network status by at least one of the following methods: Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators; Monitor the network and obtain the network indicators.

13. The device of claim 11, wherein: The processor is further configured to determine whether it is necessary to update the target data source and / or update the target security protection mechanism by at least one of the following methods: Analyze whether the network indicator affects the data security performance that can be achieved by the target security protection mechanism of the target data source, and if so, determine whether it is necessary to update the target data source and / or update the target security protection mechanism; Analyze whether it is necessary to update the digital twin network DTN data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and / or update the target security protection mechanism.

14. A data security protection selection device in a digital twin network, applied to security policy management functions, comprising: A processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the method according to any one of claims 1 to 6 are implemented.

15. A data security protection selection device in a digital twin network, applied to a data source node and a corresponding security entity, including a transceiver and a processor, wherein: The transceiver is used to receive configuration information sent by the security policy management function, wherein the configuration information includes a target security protection mechanism; The processor is used to configure the data source node and related security entities according to the target security protection mechanism.

16. A data security protection selection device in a digital twin network, applied to a data source node and a corresponding security entity, comprising: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program implements the steps of the method according to claim 7 when executed by the processor.

17. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.

Images