CN112104653A - Charging system trusted computing management method and device and storage medium - Google Patents
Charging system trusted computing management method and device and storage medium Download PDFInfo
- Publication number
- CN112104653A CN112104653A CN202010970342.1A CN202010970342A CN112104653A CN 112104653 A CN112104653 A CN 112104653A CN 202010970342 A CN202010970342 A CN 202010970342A CN 112104653 A CN112104653 A CN 112104653A
- Authority
- CN
- China
- Prior art keywords
- node
- trusted
- management
- terminal node
- access gateway
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention provides a trusted computing management method, a trusted computing management device and a storage medium of a charging system, wherein the method is applied to a trusted management node, the trusted management node is in communication connection with a terminal node and a service node, and the service node provides data transmission service for the terminal node through a security access gateway, and the method comprises the following steps: when an access request of the terminal node is received, determining an access strategy of the terminal node according to the state credible information uploaded by the terminal node; and sending the access strategy to the security access gateway, so that the security access gateway controls the data transmission between the terminal node and the service node according to the access strategy. By implementing the method and the device, the trusted access of the terminal node is realized, the safety problem of the computing environment of the charging system is guaranteed, and the safety of the computing environment is improved.
Description
Technical Field
The invention relates to the technical field of trusted networks, in particular to a trusted computing management method and device of a charging system and a storage medium.
Background
The energy consumption revolution makes the electric automobile develop rapidly, and the country greatly promotes the construction of the electric automobile and the charging facilities thereof, and the charging infrastructure safety is concerned with the property safety of people, the operation safety of a power grid and the traffic safety. With the increasing scale of charging infrastructure construction, the influence of network security problems is also increasing.
In recent years, along with the development of network technology, malicious attacks, system information tampering and the like sometimes occur in a charging system, and a very high challenge is provided for solving the problem of computing environment security of the charging system, so that a trusted computing management method of the charging system is urgently needed to guarantee the problem of computing environment security of the charging system.
Disclosure of Invention
In view of this, embodiments of the present invention provide a trusted computing management method and apparatus for a charging system, and a storage medium, so as to solve the problem of insecurity of a computing environment caused by malicious behaviors such as malicious attacks and system information tampering in the charging system.
According to a first aspect, an embodiment of the present invention provides a trusted computing management method for a charging system, which is applied to a trusted management node, where the trusted management node is in communication connection with a terminal node and a service node, and the service node provides a data transmission service for the terminal node through a secure access gateway, where the method includes the following steps: when an access request of the terminal node is received, determining an access strategy of the terminal node according to the state credible information uploaded by the terminal node; and sending the access strategy to the security access gateway, so that the security access gateway controls the data transmission between the terminal node and the service node according to the access strategy.
Optionally, the determining an access policy of the terminal node according to the state trusted information uploaded by the terminal node includes: acquiring state credible information uploaded by the service node; and determining an access strategy of the terminal node according to the state credible information uploaded by the terminal node and the state credible information uploaded by the service node.
Optionally, the trusted management node is communicatively connected to the secure access gateway, and the method further includes: when the access strategy is issued to the security access gateway, judging whether the security access gateway is trusted or not according to the received state trusted information uploaded by the security access gateway; and when the safe access gateway is not credible, issuing a network connection cutting instruction, so that the safe access gateway cuts off the network connection with the service node according to the instruction.
Optionally, the method further includes: when the access strategy is issued to the security access gateway and first identity authentication information of the security access gateway sent by the terminal node and the service node and second identity authentication information of the terminal node and the service node sent by the security access gateway are received, a communication authentication certificate is issued to the terminal node, the service node and the security access gateway and is used for establishing a communication pipeline between communication parties in a communication validity period, wherein the first identity authentication information is obtained according to state credibility information of the security access gateway, and the second identity authentication information is obtained according to state credibility information of the terminal node and state credibility information of the service node.
Optionally, the method further comprises: and counting and recording malicious behavior data in the state credible information, wherein the malicious behavior data comprise malicious attack data and data of which the access strategy actually executed by the security access gateway does not meet the issued access strategy.
Optionally, the method further comprises: performing first offline management and first online management on the terminal node and the security access gateway, where the first offline management includes: BIOS measurement, system kernel recovery, system kernel boot, system kernel measurement and system boot measurement; the first online management includes: an application metric; performing a second offline management and a second online management on the service node, wherein the second offline management comprises: system kernel metrics, system boot metrics; the second online management includes: enforcement control, trusted network connectivity, program version management, application metrics.
According to a second aspect, an embodiment of the present invention provides a trusted computing management system of a charging system, including: the terminal node is connected with the trusted management node; the service node is connected with the trusted management node and used for providing service for the terminal node; a trusted management node, communicatively connected to the terminal node, the service node, and the secure access gateway, and configured to execute the trusted computing management method of the charging system according to any one of the first aspect and the first aspect; and the security access gateway is connected with the trusted management node and used for controlling data transmission between the terminal node and the service node according to the access strategy.
Optionally, the terminal node/service node/secure access gateway includes: the virtual machine comprises a physical entity layer and a virtual mapping layer, wherein the physical entity layer comprises a trusted software base and a trusted platform control module, and the virtual mapping layer comprises a virtual monitor, a container, a virtual trusted root and a virtual trusted software base.
According to a third aspect, an embodiment of the present invention provides a trusted computing management apparatus for a charging system, which is applied to a trusted management node, where the trusted management node is in communication connection with a terminal node and a service node, and the service node provides a data transmission service for the terminal node through a secure access gateway, and includes: the access strategy determining module is used for determining the access strategy of the terminal node according to the state credible information uploaded by the terminal node when the access request of the terminal node is received; and the control module is used for sending the access strategy to the security access gateway, so that the security access gateway controls the data transmission between the terminal node and the service node according to the access strategy.
According to a fourth aspect, an embodiment of the present invention provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor implements the steps of the method for trusted computing management of a charging system according to the first aspect or any implementation manner of the first aspect when executing the program.
According to a fifth aspect, an embodiment of the present invention provides a storage medium, on which computer instructions are stored, and the instructions, when executed by a processor, implement the steps of the method for trusted computing management of a charging system according to the first aspect or any implementation manner of the first aspect.
The technical scheme of the invention has the following advantages:
according to the trusted computing management method of the charging system, the trusted management node controls the secure access gateway to realize trusted connection of the terminal node and the service node, and the trusted management node issues different access strategies according to the state trusted information of the terminal node, so that trusted access of the terminal node is realized, the security problem of the computing environment of the charging system is guaranteed, and the security of the computing environment is improved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and other drawings can be obtained by those skilled in the art without creative efforts.
Fig. 1 is a flowchart of a specific example of a trusted computing management method of a charging system according to an embodiment of the present invention;
fig. 2 is a diagram illustrating an exemplary trusted computing management method of a charging system according to an embodiment of the present invention;
FIG. 3 is a diagram illustrating an exemplary embodiment of a trusted computing management system of a charging system;
fig. 4 is a schematic block diagram of a specific example of a trusted computing management device of a charging system according to an embodiment of the present invention;
fig. 5 is a schematic block diagram of a specific example of an electronic device in the embodiment of the present invention.
Detailed Description
The technical solutions of the present invention will be described clearly and completely with reference to the accompanying drawings, and it should be understood that the described embodiments are some, but not all embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicate orientations or positional relationships based on the orientations or positional relationships shown in the drawings, and are only for convenience of description and simplicity of description, but do not indicate or imply that the device or element being referred to must have a particular orientation, be constructed and operated in a particular orientation, and thus, should not be construed as limiting the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance.
In the description of the present invention, it should be noted that, unless otherwise explicitly specified or limited, the terms "mounted," "connected," and "connected" are to be construed broadly, e.g., as meaning either a fixed connection, a removable connection, or an integral connection; can be mechanically or electrically connected; the two elements may be directly connected or indirectly connected through an intermediate medium, or may be communicated with each other inside the two elements, or may be wirelessly connected or wired connected. The specific meanings of the above terms in the present invention can be understood in specific cases to those skilled in the art.
In addition, the technical features involved in the different embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.
The embodiment provides a trusted computing management method of a charging system, which is applied to a trusted management node as shown in fig. 1, where the trusted management node is in communication connection with a terminal node and a service node, and the service node provides data transmission service for the terminal node through a secure access gateway, and in this embodiment, the terminal node is used as an electric vehicle charging pile, and the service node is used as an internet-of-vehicles platform, for example, the method includes the following steps:
s101, when receiving an access request of a terminal node, determining an access strategy of the terminal node according to the state credible information uploaded by the terminal node.
Illustratively, the state trusted information uploaded by the electric vehicle charging pile may include trusted computing security protection capability and operation data of the electric vehicle charging pile, and the specific content of the state trusted information is not limited in this embodiment, and can be determined by a person skilled in the art as needed. The state credible information uploaded by the terminal node may be the state credible information of the terminal node acquired by an information acquisition module of the terminal node and periodically sent to the credible management node, or the state credible information of the terminal node itself may be sent together when the terminal node sends an access request.
According to the state credibility information uploaded by the terminal node, the access strategy of the terminal node can be determined in a mode that the state credibility information uploaded by the terminal node is matched with the preset safety level divided by the standard to obtain the safety level of the terminal node, then, the corresponding access strategy is obtained according to the safety level of the terminal node, the access strategy is also preset and completed according to different safety levels, and the access strategy can include whether the electric automobile charging pile currently has the authority to access the Internet of vehicles platform and the resource content which can be accessed by the Internet of vehicles platform. The state credible information is divided into a first safety level, a second safety level, a third safety level and the like according to the safety levels from high to low according to the preset standard, and for the state credible information of the first safety level, the access strategy can be that the electric automobile charging pile acquires all resource contents of the Internet of vehicles platform. In this embodiment, the access policy of the terminal node determined by the trusted information in different states is not limited, and those skilled in the art may determine the access policy as needed.
S102, the access strategy is sent to the security access gateway, so that the security access gateway controls data transmission between the terminal node and the service node according to the access strategy.
Illustratively, the trusted management node issues the determined access policy to the secure access gateway, and the secure access gateway may execute the received access policy to control data transmission between the terminal node and the service node. For example, when the access strategy is that electric automobile fills electric pile and can acquire the data in all car networking platforms, so the safety access gateway does not limit the data transmission of electric automobile fills electric pile and car networking platforms, when the access strategy is that electric automobile fills electric pile and can acquire the data in some car networking platforms, so the safety access gateway monitors the data that electric automobile fills electric pile transmission to the car networking platform for electric automobile fills electric pile can only receive the data in corresponding some car networking platforms.
According to the trusted computing management method of the charging system, the trusted management node controls the secure access gateway to realize trusted connection of the terminal node and the service node, and the trusted management node issues different access strategies according to the state trusted information of the terminal node, so that trusted access of the terminal node is realized, the security problem of the computing environment of the charging system is guaranteed, and the security of the computing environment is improved.
As an optional implementation manner of this embodiment, the determining, according to the state trusted information uploaded by the terminal node, an access policy of the terminal node includes:
acquiring state credible information uploaded by the service node; and determining an access strategy of the terminal node according to the state credible information uploaded by the terminal node and the state credible information uploaded by the service node.
Illustratively, the state trusted information uploaded by the vehicle networking platform may also include trusted computing security protection capability and operation data of the vehicle networking platform, and the specific content of the state trusted information uploaded by the vehicle networking platform is not limited in this embodiment, and can be determined by a person skilled in the art as needed. The state credible information uploaded by the service node can be acquired by an information acquisition module of the service node and is periodically uploaded to the credible management node.
According to the state credible information uploaded by the terminal node and the state credible information uploaded by the service node, the access strategy of the terminal node is determined in a mode that whether the service node meets the credible requirement is judged according to the state credible information uploaded by the service node, and when the service node is not credible, the access strategy is that the terminal node is not allowed to be accessed into the service node. According to the trusted computing management method for the charging system, the access strategy considers the state trusted information uploaded by the service node, the computing environment security problem of the charging system is further guaranteed, and the security of the computing environment is improved.
As an optional implementation manner of this embodiment, the trusted management node is communicatively connected to the secure access gateway, and the method further includes:
firstly, when the access strategy is issued to the security access gateway, whether the security access gateway is credible is judged according to the received state credible information uploaded by the security access gateway.
For example, the state trusted information uploaded by the secure access gateway may also include a trusted computing security protection capability and operation data of the secure access gateway, and a person skilled in the art may determine the specific content of the state trusted information uploaded by the secure access gateway according to needs without limitation in this embodiment. The state credible information uploaded by the security access gateway can be acquired through an information acquisition module of the security access gateway and is periodically sent to the credible management node. When the trusted management node issues the access strategy to the security access gateway, whether the state trusted information meets a preset security condition or not is judged according to the received state trusted information uploaded by the security access gateway, when the preset security condition is met, the security access gateway is represented to be trusted, the preset security condition can be that the trusted computing security protection capability reaches three levels, and the state trusted information of the security access gateway is not abnormal. The embodiment does not limit the manner for judging whether the secure access gateway is trusted, and a person skilled in the art can determine the manner as required.
And secondly, when the safe access gateway is not credible, issuing a network connection cutting instruction, so that the safe access gateway cuts off the network connection with the service node according to the instruction.
Illustratively, when the security access gateway is not trusted, the trusted management node issues a network connection disconnection instruction, and after receiving the instruction, the security access gateway performs network connection disconnection between itself and the service node.
The trusted computing management method for the charging system provided by the embodiment monitors the security access gateway, and disconnects the network connection between the security access gateway and the service node when the security access gateway is not trusted, so that the computing environment security of the charging system is improved.
As an optional implementation manner of this embodiment, the method for trusted computing management of a charging system further includes:
when an access strategy is issued to a security access gateway and first identity authentication information of the security access gateway sent by a terminal node and a service node and second identity authentication information of the terminal node and the service node sent by the security access gateway are received, a communication authentication certificate is issued to the terminal node, the service node and the security access gateway and is used for establishing a communication pipeline between communication parties in a communication validity period, wherein the first identity authentication information is obtained according to state credible information of the security access gateway, and the second identity authentication information is obtained according to state credible information of the terminal node and state credible information of the service node.
Exemplarily, when the access policy is issued to the security access gateway, a communication connection between the car networking platform, the security access gateway, and the electric vehicle charging pile needs to be established, and the process may specifically be: the vehicle networking platform and the electric vehicle charging pile respectively send state credible information of the vehicle networking platform and the electric vehicle charging pile to the security access gateway through the credible management node, so that the security access gateway can perform identity authentication on the vehicle networking platform and the electric vehicle charging pile, and when the identity authentication is completed, first identity authentication information is generated and sent; meanwhile, the safety access gateway sends self state credible information to the Internet of vehicles platform and the electric automobile charging pile through the credible management node so that the Internet of vehicles platform and the electric automobile charging pile can authenticate the safety access gateway, and when identity authentication is completed, second identity authentication information is generated and sent. In addition, self-state credible information can be sent between the Internet of vehicles platform and the electric vehicle charging pile through the credible management node, identity authentication between the Internet of vehicles platform and the electric vehicle charging pile is completed, and third identity authentication information is generated and sent.
After receiving the first identity authentication information, the second identity authentication information and the third identity authentication information, the trusted management node indicates that the multiple communication parties complete mutual identity authentication, and at the moment, the trusted management node generates a communication authentication certificate of the multiple communication parties and issues the generated communication authentication certificate to the security access gateway, the electric vehicle charging pile and the vehicle networking platform.
The security access gateway, the electric vehicle charging pile and the vehicle networking platform comprise a security control layer and a credible authentication layer which are virtually mapped with each other, as shown in fig. 2, after a communication authentication certificate is packaged through the security control layer, the credible authentication layer and a transmission layer, a transmission layer credible communication pipeline is established by communication parties in the current session validity period, the communication pipeline is released after the session connection is completed, and the credible pipeline connection is reestablished in the next session.
According to the trusted computing management method of the charging system, the identity information of the communication party is verified on the aspect of communication connection, and after the identity information passes the identity authentication, a communication pipeline is established for the communication party to communicate, so that the security of a computing environment is further improved.
As an optional implementation manner of this embodiment, the method for trusted computing management of a charging system further includes:
and counting and recording malicious behavior data in the state credible information, wherein the malicious behavior data comprise malicious attack data and data of which the access strategy actually executed by the security access gateway does not meet the issued access strategy.
Illustratively, the state trusted information includes operation data, and the state trusted information may be that the terminal node, the service node, and the secure access gateway periodically send to the trusted management node, so that the trusted management node performs statistics and recording on the operation data of the terminal node, the service node, and the secure access gateway. The statistical data comprises malicious attack data and data of an access strategy issued by a trusted management node which is not executed by the security access gateway.
The trusted computing management method for the charging system provided by the embodiment audits malicious behaviors, is convenient for analyzing the malicious behaviors, finds weak points in the system, and checks whether an implemented access policy meets an issued access policy, so as to forward guide the security problem of the system, realize virtuous circle, and improve the security of the computing environment of the system.
As an optional implementation manner of this embodiment, the method for trusted computing management of a charging system further includes: performing first offline management and first online management on the terminal node and the security access gateway, where the first offline management includes: BIOS measurement, system kernel recovery, system kernel boot, system kernel measurement and system boot measurement; the first online management includes: an application metric;
performing a second offline management and a second online management on the service node, wherein the second offline management comprises: system kernel metrics, system boot metrics; the second online management includes: enforcement control, trusted network connectivity, program version management, application metrics.
Illustratively, a terminal node, a security access gateway and a service node are divided into a physical entity layer and a virtual mapping layer according to an entity bearing computing service, and a physical entity layer object comprises a Trusted Software Base (TSB), a Trusted Platform Control Module (TPCM) and the like; the virtual mapping layer objects comprise management templates such as a virtual machine monitor (Hypervisor) and a container (Docker), a virtual trusted root (vTPCM), a virtual trusted software base (vTSB) and the like. And a reference library configuration module of a trusted management (service) node manages a centralized trusted reference value facing to a Trusted Platform Control Module (TPCM) and a virtual trusted root (vTPCM) which supports mapping. The method comprises the steps that management templates such as a Trusted Software Base (TSB), a virtual trusted software base (vTSB), a virtual machine monitor (Hypervisor), a container (Docker) and the like are oriented, a trusted management node performs centralized policy configuration, state monitoring and audit management on the management templates, the audit management indicates that computing environment data of a terminal node, a security access gateway and a service node are audited, malicious behavior data in state trusted information are counted and recorded, and the malicious behavior data comprise malicious attack data and data of an access policy which is actually executed by the security access gateway and does not meet a issued access policy.
And the management of the physical entity layer distinguishes credible centralized management facing the Internet of vehicles platform entity and credible centralized management facing the security access gateway and the electric automobile charging pile according to the difference between the type of the computing node and the environment. The system is supported by an offline release module and an online operation and maintenance module in a trusted management node set, a Trusted Platform Control Module (TPCM) facing a service node performs system kernel measurement, system boot measurement, kernel measurement centralized management and policy configuration, and a Trusted Software Base (TSB) facing the service node performs online application measurement, mandatory execution control, trusted network connection, program version management and policy configuration; and a Trusted Platform Control Module (TPCM) facing the security access gateway and the terminal node performs offline BIOS measurement, system kernel recovery, system kernel guidance, system kernel measurement and system guidance measurement, and performs online application measurement management and policy configuration facing the security access gateway and the Trusted Software Base (TSB) of the terminal node.
An embodiment of the present invention provides a trusted computing management system of a charging system, as shown in fig. 3, including:
the terminal node 201 is connected with the trusted management node; for details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
The service node 202 is connected with the trusted management node and used for providing services for the terminal node; for details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
The trusted management node 203 is in communication connection with the terminal node, the service node and the secure access gateway, and is configured to execute a trusted computing management method of any charging system in the above method embodiments; for details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
And the security access gateway 204 is connected with the trusted management node and is used for controlling data transmission between the terminal node and the service node according to the access policy. For details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
According to the trusted computing management method of the charging system, the trusted management node controls the secure access gateway to realize trusted connection of the terminal node and the service node, and the trusted management node issues different access strategies according to the state trusted information of the terminal node, so that trusted access of the terminal node is realized, the security problem of the computing environment of the charging system is guaranteed, and the security of the computing environment is improved.
As an optional implementation manner of this embodiment, the terminal node/serving node/secure access gateway includes: the virtual machine comprises a physical entity layer and a virtual mapping layer, wherein the physical entity layer comprises a trusted software base and a trusted platform control module, and the virtual mapping layer comprises a virtual monitor, a container, a virtual trusted root and a virtual trusted software base. For details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
An embodiment of the present invention provides a trusted computing management device of a charging system, which is applied to a trusted management node, where the trusted management node is in communication connection with a terminal node and a service node, and the service node provides a data transmission service for the terminal node through a secure access gateway, as shown in fig. 4, where the trusted computing management device includes:
an access policy determining module 301, configured to determine, when an access request of the terminal node is received, an access policy of the terminal node according to the state trusted information uploaded by the terminal node; for details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
A control module 302, configured to issue the access policy to the security access gateway, so that the security access gateway controls data transmission between the terminal node and the service node according to the access policy. For details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
As an optional implementation manner of this embodiment, the determining, according to the state trusted information uploaded by the terminal node, an access policy of the terminal node includes:
the state credible information acquisition module is used for acquiring the state credible information uploaded by the service node; for details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
And the access strategy determining module is used for determining the access strategy of the terminal node according to the state credible information uploaded by the terminal node and the state credible information uploaded by the service node. For details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
As an optional implementation manner of this embodiment, the trusted management node is communicatively connected to the secure access gateway, and the apparatus further includes:
the gateway credibility judging module is used for judging whether the security access gateway is credible or not according to the received state credibility information uploaded by the security access gateway when the access strategy is issued to the security access gateway; for details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
And the cutting instruction sending module is used for issuing a cutting network connection instruction when the security access gateway is not credible, so that the security access gateway cuts off the network connection with the service node according to the instruction. For details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
As an optional implementation manner of this embodiment, the apparatus further includes:
and the identity authentication module is used for issuing a communication authentication certificate to the terminal node, the service node and the security access gateway when issuing the access policy to the security access gateway and receiving first identity authentication information of the terminal node and the service node and second identity authentication information of the terminal node and the service node, which are sent by the terminal node and the service node, wherein the communication authentication certificate is used for establishing a communication pipeline between communication parties in a communication validity period, the first identity authentication information is obtained according to state credible information of the security access gateway, and the second identity authentication information is obtained according to state credible information of the terminal node and state credible information of the service node. For details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
As an optional implementation manner of this embodiment, the apparatus further includes:
the state trusted information receiving module is used for receiving state trusted information sent by the terminal node, the service node and the security access gateway; for details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
And the auditing module is used for counting and recording malicious behavior data in the state credible information, wherein the malicious behavior data comprise malicious attack data and data of an access strategy which is actually executed by the security access gateway and does not meet the issued access strategy. For details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
As an optional implementation manner of this embodiment, the apparatus further includes: a management module, configured to perform a first offline management and a first online management on the terminal node and the security access gateway, where the first offline management includes: BIOS measurement, system kernel recovery, system kernel boot, system kernel measurement and system boot measurement; the first online management includes: an application metric; performing a second offline management and a second online management on the service node, wherein the second offline management comprises: system kernel metrics, system boot metrics; the second online management includes: enforcement control, trusted network connectivity, program version management, application metrics. For details, reference is made to the corresponding parts of the above method embodiments, which are not described herein again.
The embodiment of the present application also provides an electronic device, as shown in fig. 5, including a processor 410 and a memory 420, where the processor 410 and the memory 420 may be connected by a bus or in other manners.
Processor 410 may be a Central Processing Unit (CPU). The Processor 410 may also be other general purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components, or combinations thereof.
The memory 420, which is a non-transitory computer readable storage medium, may be used to store non-transitory software programs, non-transitory computer executable programs, and modules, such as program instructions/modules corresponding to the trusted computing management method of the charging system in the embodiments of the present invention. The processor executes various functional applications and data processing of the processor by executing non-transitory software programs, instructions, and modules stored in the memory.
The memory 420 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function; the storage data area may store data created by the processor, and the like. Further, the memory may include high speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid state storage device. In some embodiments, memory 420 may optionally include memory located remotely from the processor, which may be connected to the processor via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
The one or more modules are stored in the memory 420 and, when executed by the processor 410, perform a trusted computing management method of a charging system as in the embodiment shown in fig. 1.
The details of the electronic device may be understood with reference to the corresponding related description and effects in the embodiment shown in fig. 1, and are not described herein again.
The present embodiment also provides a computer storage medium, where computer-executable instructions are stored, where the computer-executable instructions may execute the trusted computing management method of the charging system in any method embodiment 1. The storage medium may be a magnetic Disk, an optical Disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a Flash Memory (Flash Memory), a Hard Disk (Hard Disk Drive, abbreviated as HDD), a Solid State Drive (SSD), or the like; the storage medium may also comprise a combination of memories of the kind described above.
It should be understood that the above examples are only for clarity of illustration and are not intended to limit the embodiments. Other variations and modifications will be apparent to persons skilled in the art in light of the above description. And are neither required nor exhaustive of all embodiments. And obvious variations or modifications therefrom are within the scope of the invention.
Claims (11)
1. A trusted computing management method of a charging system is applied to a trusted management node, the trusted management node is in communication connection with a terminal node and a service node, and the service node provides data transmission service for the terminal node through a secure access gateway, and the method is characterized by comprising the following steps:
when an access request of the terminal node is received, determining an access strategy of the terminal node according to the state credible information uploaded by the terminal node;
and sending the access strategy to the security access gateway, so that the security access gateway controls the data transmission between the terminal node and the service node according to the access strategy.
2. The method of claim 1, wherein the determining the access policy of the terminal node according to the state trust information uploaded by the terminal node comprises:
acquiring state credible information uploaded by the service node;
and determining an access strategy of the terminal node according to the state credible information uploaded by the terminal node and the state credible information uploaded by the service node.
3. The method of claim 1, wherein the trusted management node is communicatively coupled to the secure access gateway, the method further comprising:
when the access strategy is issued to the security access gateway, judging whether the security access gateway is trusted or not according to the received state trusted information uploaded by the security access gateway;
and when the safe access gateway is not credible, issuing a network connection cutting instruction, so that the safe access gateway cuts off the network connection with the service node according to the instruction.
4. The method of claim 1, further comprising:
when the access strategy is issued to the security access gateway and first identity authentication information of the security access gateway sent by the terminal node and the service node and second identity authentication information of the terminal node and the service node sent by the security access gateway are received, a communication authentication certificate is issued to the terminal node, the service node and the security access gateway and is used for establishing a communication pipeline between communication parties in a communication validity period, wherein the first identity authentication information is obtained according to state credibility information of the security access gateway, and the second identity authentication information is obtained according to state credibility information of the terminal node and state credibility information of the service node.
5. The method of claim 1, further comprising:
and counting and recording malicious behavior data in the state credible information, wherein the malicious behavior data comprise malicious attack data and data of which the access strategy actually executed by the security access gateway does not meet the issued access strategy.
6. The method of claim 1, further comprising: performing first offline management and first online management on the terminal node and the security access gateway, where the first offline management includes: BIOS measurement, system kernel recovery, system kernel boot, system kernel measurement and system boot measurement; the first online management includes: an application metric;
performing a second offline management and a second online management on the service node, wherein the second offline management comprises: system kernel metrics, system boot metrics; the second online management includes: enforcement control, trusted network connectivity, program version management, application metrics.
7. A trusted computing management system for a charging system, comprising:
the terminal node is connected with the trusted management node;
the service node is connected with the trusted management node and used for providing service for the terminal node;
the trusted management node is in communication connection with the terminal node, the service node and the secure access gateway and is used for executing the trusted computing management method of the charging system in any one of claims 1 to 6;
and the security access gateway is connected with the trusted management node and used for controlling data transmission between the terminal node and the service node according to the access strategy.
8. The trusted computing management system of claim 7, wherein the end node/service node/secure access gateway comprises: the virtual machine comprises a physical entity layer and a virtual mapping layer, wherein the physical entity layer comprises a trusted software base and a trusted platform control module, and the virtual mapping layer comprises a virtual monitor, a container, a virtual trusted root and a virtual trusted software base.
9. A trusted computing management device of a charging system is applied to a trusted management node, the trusted management node is in communication connection with a terminal node and a service node, and the service node provides data transmission service for the terminal node through a secure access gateway, and the trusted computing management device is characterized by comprising:
the access strategy determining module is used for determining the access strategy of the terminal node according to the state credible information uploaded by the terminal node when the access request of the terminal node is received;
and the control module is used for sending the access strategy to the security access gateway, so that the security access gateway controls the data transmission between the terminal node and the service node according to the access strategy.
10. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the steps of the method for trusted computing management of a charging system according to any of claims 1 to 6 are implemented when the program is executed by the processor.
11. A storage medium having stored thereon computer instructions, which when executed by a processor, carry out the steps of the method for trusted computing management of a charging system according to any of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010970342.1A CN112104653B (en) | 2020-09-15 | 2020-09-15 | Trusted computing management method and device for charging system and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010970342.1A CN112104653B (en) | 2020-09-15 | 2020-09-15 | Trusted computing management method and device for charging system and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112104653A true CN112104653A (en) | 2020-12-18 |
| CN112104653B CN112104653B (en) | 2023-03-14 |
Family
ID=73760140
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010970342.1A Active CN112104653B (en) | 2020-09-15 | 2020-09-15 | Trusted computing management method and device for charging system and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112104653B (en) |
Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040199768A1 (en) * | 2003-04-04 | 2004-10-07 | Nail Robert A. | System and method for enabling enterprise application security |
| CN101350721A (en) * | 2007-07-20 | 2009-01-21 | 华为技术有限公司 | Network system, network access method and network appliance |
| CN101778099A (en) * | 2009-12-31 | 2010-07-14 | 郑州信大捷安信息技术有限公司 | Architecture accessing trusted network for tolerating untrusted components and access method thereof |
| CN101951607A (en) * | 2010-10-14 | 2011-01-19 | 中国电子科技集团公司第三十研究所 | Reliability-based wireless local area network trusted accessing method and system |
| CN102355467A (en) * | 2011-10-18 | 2012-02-15 | 国网电力科学研究院 | Power transmission and transformation equipment state monitoring system security protection method based on trust chain transmission |
| US20130133030A1 (en) * | 2010-07-30 | 2013-05-23 | China Iwncomm Co., Ltd. | Platform authentication strategy management method and device for trusted connection architecture |
| CN103152350A (en) * | 2013-03-14 | 2013-06-12 | 中国科学院软件研究所 | Credible network access method and system for protecting terminal configuration privacy |
| CN103559591A (en) * | 2013-11-20 | 2014-02-05 | 北京可信华泰信息技术有限公司 | Software management system and management method based on trusted computing |
| CN103581203A (en) * | 2013-11-20 | 2014-02-12 | 北京可信华泰信息技术有限公司 | Trusted network connection method based on trusted computing |
| CN103780395A (en) * | 2014-01-24 | 2014-05-07 | 广东电网公司电力科学研究院 | Method and system for proving bidirectional measurement through network access |
| CN104038478A (en) * | 2014-05-19 | 2014-09-10 | 瑞达信息安全产业股份有限公司 | Embedded platform identity authentication trusted network connection method and system |
| CN106027518A (en) * | 2016-05-19 | 2016-10-12 | 中国人民解放军装备学院 | Trusted network connection method based on quasi real-time state feedback |
| CN109768967A (en) * | 2018-12-18 | 2019-05-17 | 北京可信华泰信息技术有限公司 | A kind of credible platform connection system |
| CN110875930A (en) * | 2019-11-21 | 2020-03-10 | 山东超越数控电子股份有限公司 | Method, equipment and medium for monitoring trusted state |
-
2020
- 2020-09-15 CN CN202010970342.1A patent/CN112104653B/en active Active
Patent Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040199768A1 (en) * | 2003-04-04 | 2004-10-07 | Nail Robert A. | System and method for enabling enterprise application security |
| CN101350721A (en) * | 2007-07-20 | 2009-01-21 | 华为技术有限公司 | Network system, network access method and network appliance |
| CN101778099A (en) * | 2009-12-31 | 2010-07-14 | 郑州信大捷安信息技术有限公司 | Architecture accessing trusted network for tolerating untrusted components and access method thereof |
| US20130133030A1 (en) * | 2010-07-30 | 2013-05-23 | China Iwncomm Co., Ltd. | Platform authentication strategy management method and device for trusted connection architecture |
| CN101951607A (en) * | 2010-10-14 | 2011-01-19 | 中国电子科技集团公司第三十研究所 | Reliability-based wireless local area network trusted accessing method and system |
| CN102355467A (en) * | 2011-10-18 | 2012-02-15 | 国网电力科学研究院 | Power transmission and transformation equipment state monitoring system security protection method based on trust chain transmission |
| CN103152350A (en) * | 2013-03-14 | 2013-06-12 | 中国科学院软件研究所 | Credible network access method and system for protecting terminal configuration privacy |
| CN103559591A (en) * | 2013-11-20 | 2014-02-05 | 北京可信华泰信息技术有限公司 | Software management system and management method based on trusted computing |
| CN103581203A (en) * | 2013-11-20 | 2014-02-12 | 北京可信华泰信息技术有限公司 | Trusted network connection method based on trusted computing |
| CN103780395A (en) * | 2014-01-24 | 2014-05-07 | 广东电网公司电力科学研究院 | Method and system for proving bidirectional measurement through network access |
| CN104038478A (en) * | 2014-05-19 | 2014-09-10 | 瑞达信息安全产业股份有限公司 | Embedded platform identity authentication trusted network connection method and system |
| CN106027518A (en) * | 2016-05-19 | 2016-10-12 | 中国人民解放军装备学院 | Trusted network connection method based on quasi real-time state feedback |
| CN109768967A (en) * | 2018-12-18 | 2019-05-17 | 北京可信华泰信息技术有限公司 | A kind of credible platform connection system |
| CN110875930A (en) * | 2019-11-21 | 2020-03-10 | 山东超越数控电子股份有限公司 | Method, equipment and medium for monitoring trusted state |
Non-Patent Citations (3)
| Title |
|---|
| 李炜等: "基于可信计算的可信认证模型研究", 《计算机安全》 * |
| 杨凌等: "可信网络接入认证系统设计", 《指挥信息系统与技术》 * |
| 秦晰等: "一种新的可信网络接入架构ETNA", 《小型微型计算机系统》 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112104653B (en) | 2023-03-14 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP5522307B2 (en) | System and method for remote maintenance of client systems in electronic networks using software testing with virtual machines | |
| CN101778099B (en) | Architecture accessing trusted network for tolerating untrusted components and access method thereof | |
| US9026595B2 (en) | Intelligent connection manager | |
| CN100581170C (en) | Trusted network management method based on ternary peer-to-peer identification trusted network connections | |
| CN103581203A (en) | Trusted network connection method based on trusted computing | |
| US20140215207A1 (en) | Provisioning and managing certificates for accessing secure services in network | |
| CN111355684A (en) | Internet of things data transmission method, device and system, electronic equipment and medium | |
| CN112104653B (en) | Trusted computing management method and device for charging system and storage medium | |
| US20200280858A1 (en) | Radio access resource sharing | |
| KR20200012375A (en) | Block chain system in d2d communication environments and constructing method thereof | |
| CN112866210A (en) | Industrial control equipment access control method and device and electronic equipment | |
| CN112035844A (en) | System and method for acquiring trust state of terminal and computer equipment | |
| US20140351903A1 (en) | Authentication mechanism | |
| EP4197158A1 (en) | Establishment of secure communication | |
| CN104079570A (en) | Trusted network connecting method based on IPsec | |
| CN116614312B (en) | Security verification method and system for cloud computing system | |
| CN113992420B (en) | Authority management method, system, electronic equipment and storage medium | |
| CN116545775B (en) | NFV-based remote trusted network connection method, device and system | |
| CN113872802B (en) | Method and device for detecting network element | |
| CN107196905B (en) | Trusted network access client and access method for Windows platform | |
| CN113986266A (en) | Method and device for safely unloading Internet of things terminal and computer equipment | |
| CN118069180A (en) | Device OTA management system and method | |
| CN116996878A (en) | Equipment networking method, device, equipment and medium based on digital twin platform | |
| CN116112214A (en) | Method and device for accessing resources crossing network boundary and electronic equipment | |
| CN115460013A (en) | Data security access method and device and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |