CN117879905A - Zero trust-based Internet of things safety control platform - Google Patents

Zero trust-based Internet of things safety control platform Download PDF

Info

Publication number
CN117879905A
CN117879905A CN202311797306.XA CN202311797306A CN117879905A CN 117879905 A CN117879905 A CN 117879905A CN 202311797306 A CN202311797306 A CN 202311797306A CN 117879905 A CN117879905 A CN 117879905A
Authority
CN
China
Prior art keywords
security
internet
things
management
module
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202311797306.XA
Other languages
Chinese (zh)
Inventor
吴飞舟
雷通
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Si Tech Information Technology Co Ltd
Original Assignee
Beijing Si Tech Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Si Tech Information Technology Co Ltd filed Critical Beijing Si Tech Information Technology Co Ltd
Priority to CN202311797306.XA priority Critical patent/CN117879905A/en
Publication of CN117879905A publication Critical patent/CN117879905A/en
Pending legal-status Critical Current

Links

Landscapes

  • Computer And Data Communications (AREA)

Abstract

The invention discloses an internet of things safety control platform based on zero trust, which relates to the technical field of internet of things safety, and comprises a safety authentication center and an internet of things safety unified portal; the security authentication center is used for: verifying the identity information of operators; the internet of things safety unified portal is used for: and after the identity information of the operator passes the verification, providing corresponding associated operation control data and interfaces corresponding to the associated operation control data for the operator according to the authority of the operator. The cloud network side security management method based on the zero trust concept can provide security management capability of the cloud network side of the Internet of things system.

Description

Zero trust-based Internet of things safety control platform
Technical Field
The invention relates to the technical field of Internet of things safety, in particular to an Internet of things safety management and control platform based on zero trust.
Background
At present, the safety of the Internet of things has the following development trends:
1) The number of devices expands rapidly, resulting in an expansion of the application scenario and security boundaries. IDC predicts that at 2025, there will be over 400 million devices worldwide accessing the internet, while data of nearly 80ZB will be produced. Suppliers have gradually introduced related internet of things security tools, but are not mature enough and still in the fumbling stage on the market.
2) The large amount of equipment brings about a large amount of data. With the development of 5G technology, the influence of the internet of things will be amplified again. Before considering how to utilize such data, how to store massive amounts of data has been a matter of controversy. Whether edge storage, data center, or cloud storage is utilized, it is necessary to ensure that the data is secure.
3) In front of mass devices and data, automated solutions are becoming urgent to efficiently locate and separate anomalies from these daily data. Machine learning has been used to initially develop fists in the areas of risk management, threat intelligence, and Security Information and Event Management (SIEM), but automation will play a vital role when the magnitude of events is increased to the billions level.
4) Massive devices and scenes can become a park for an attacker. The internet of things provides a large number of new attack points, and a large number of potential risks are brought when the internet of things gradually penetrates into traffic systems, intelligent homes, smart cities, key infrastructure construction, industrial systems, medical systems and the like.
5) The need for standardization is also critical. A large number of devices are implemented in different ways by different vendors in a large number of different scenarios, and lack of standards will lead to confusion in security development, risk assessment and security protection. When facing the scene with a large number of vulnerabilities and attack surfaces, the system lacks unified standards, and can be used for attackers to find vulnerabilities and break the vulnerabilities one by one for each war, so that great hidden danger is brought to the safety of the whole Internet of things.
Under the tide of digital transformation, the traditional security architecture of enterprises faces challenges:
1) Technological transformation such as cloud uploading of data and business, application architecture upgrading and the like brings new security risks;
2) The coordinated digitization of the workspace and supply chain exposes more attack surfaces;
3) The novel application scenes such as remote office, internet of things, smart city, industrial manufacturing, internet of vehicles, smart retail and the like gradually blur the physical network security boundary.
Traditional boundary security defense strategies gradually fail, and new ideas are needed to guide the security products to market. The novel network security architecture constructed by the zero trust is considered as an effective way for improving the overall security of an informationized system and a network in the digital age, and the creation of an Internet of things security management and control platform based on the zero trust network security architecture is urgent.
Disclosure of Invention
Aiming at the defects of the prior art, the invention provides a zero-trust-based internet of things safety control platform, which comprises the following steps:
1) In a first aspect, the invention provides an internet of things safety control platform based on zero trust, which has the following specific technical scheme:
the system comprises a security authentication center and an Internet of things security unified portal;
the security authentication center is used for: verifying the identity information of operators;
the internet of things safety unified portal is used for: and after the identity information of the operator passes the verification, providing corresponding associated operation control data and interfaces corresponding to the associated operation control data for the operator according to the authority of the operator.
Based on the scheme, the Internet of things safety management and control platform based on zero trust can be improved as follows.
Further, the security authentication center comprises an identity security authentication module;
the identity security authentication module is used for: and verifying the identity information of the operator through a multi-factor authentication mode and/or an SSO single sign-on mode.
Further, the identity security authentication module is further configured to: and continuously monitoring the user access state and the equipment access running state associated with the identity information after passing the verification, and implementing dynamic verification.
Further, the security authentication center further includes: the policy engine module is used for: according to a specific scene, the security control strategy for performing the pass operation, the blocking operation and the upgrade authentication operation is managed and maintained.
Further, the security authentication center also comprises a trust engine module;
the trust engine module is used for: based on the user identity, the equipment state, the access behavior and the weblog, and combining situation awareness and a UEBA technology, analyzing whether risks exist in real time, and calculating the credibility level of the login user and the access equipment.
Further, the system also comprises a security agent module, and the policy engine module is further used for: the policy decision corresponding to the risk analysis result of the trust engine module is issued to the security proxy module, and the security proxy module is used for: and executing the received policy decision.
Further, the security proxy module is deployed on the terminal device or gateway node, providing encrypted connection from the terminal to the authorized resource.
Further, the security agent module is further configured to: and acquiring and sending the terminal equipment information to an identity security authentication module.
Further, the terminal management module is further included, and the terminal management module is used for: according to the baseline configuration, application reinforcement, patch pushing, vulnerability scanning and health physical examination are performed on the terminal equipment periodically or in an immediate manual mode.
Further, the interface corresponding to the associated operation management and control data includes: at least one of a security situation display interface, a security event display and disposition interface, a terminal device management interface, a policy management interface, a baseline configuration interface, and an operation report display interface.
The internet of things safety control platform based on zero trust has the following beneficial effects:
1) Based on the zero trust concept, the security management capability of the cloud network side crossing can be provided for the Internet of things system;
2) The system is an omnibearing depth monitoring system, and covers baseline safety, file safety, login safety, flow safety, behavior safety and the like;
3) And (3) unified management: terminal equipment outside the boundary protection of an enterprise IT system is managed in a unified and centralized mode, and safety upgrading from the boundary protection of the traditional information safety era to the boundary protection of the Internet of things equipment is achieved.
4) Active defense, safety management and control: the active defense can be performed against abnormal attack behaviors through the linkage with the safety platform, so that real-time safety control to each device is accurately realized.
Drawings
Other features, objects and advantages of the present invention will become more apparent upon reading of the detailed description of non-limiting embodiments, made with reference to the following drawings in which:
fig. 1 is a schematic structural diagram of an internet of things security management and control platform based on zero trust according to an embodiment of the present invention;
fig. 2 is a second schematic structural diagram of an internet of things security management and control platform based on zero trust according to an embodiment of the present invention.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the present invention more apparent, the embodiments of the present invention will be described in further detail with reference to the accompanying drawings.
As shown in fig. 1, the internet of things security management and control platform based on zero trust in the embodiment of the invention comprises a security authentication center and an internet of things security unified portal;
the security authentication center is used for: verifying the identity information of operators;
wherein the operators are loT system operators or safety operators.
The internet of things safety unified portal is used for: after the identity information of the operator passes the verification, providing corresponding associated operation management and control data and interfaces corresponding to the associated operation management and control data for the operator according to the authority of the operator, and specifically:
1) When the operator is a loT system operator, providing loT the system operator with corresponding associated operation management data includes: displaying the assets of the Internet of things, managing terminal equipment, and displaying a security situation large screen; and can be divided into different vertical industries and/or fields according to the landing: government user data oriented to government industry, public user data oriented to public, and enterprise user data oriented to enterprise.
2) When the operator is a security operator, providing the security operator with corresponding associated operation management and control data includes: security situation display data, security event operation display data, event response handling process data, and various types of baseline management data such as security identity baselines, application security baselines, terminal security baselines, monitoring alarms, patrol scanning reports and the like.
3) The unified portal module is used as a unified command center of the safety operation and is used for managing equipment assets, displaying safety situation, configuring various baselines, checking monitoring alarms, handling emergency events and generating operation reports, and according to role authorities of different operators, interfaces corresponding to corresponding associated operation management and control data are provided for the operators, wherein the interfaces corresponding to the associated operation management and control data comprise: at least one of a security situation display interface, a security event display and disposition interface, a terminal device management interface, a policy management interface, a baseline configuration interface, and an operation report display interface.
Optionally, in the above technical solution, the security authentication center includes an identity security authentication module;
the identity security authentication module is used for: and verifying the identity information of the operator through a multi-factor authentication mode and/or an SSO single sign-on mode.
The identity security authentication module gathers multi-source identity big data from endpoints, networks and channels of a service system, defines a model of entities such as users, organizations, equipment, resources and the like, and centrally manages the life cycle of the identity. And verifying the identity information by means of multi-factor authentication, SSO single sign-on and the like. And (3) authorizing and releasing legal users and equipment, and blocking and/or upgrading and verifying suspicious users and equipment.
Optionally, in the above technical solution, the identity security authentication module is further configured to: continuously monitoring the user access state and the equipment access running state associated with the identity information after passing the verification, and implementing dynamic verification, specifically: and after the verification is passed, continuously monitoring the access of the user and the access running state of the equipment, receiving the trust level data provided by the trust engine module, and timely implementing dynamic verification.
Optionally, in the above technical solution, the security authentication center further includes: the policy engine module is used for: according to a specific scene, the security control strategy for performing the pass operation, the blocking operation and the upgrade authentication operation is managed and maintained.
Optionally, in the above technical solution, the security authentication center further includes a trust engine module;
the trust engine module is used for: based on user identity, equipment state, access behavior and weblog, and combining situation awareness and UEBA (user entity behavior analysis) technology, analyzing whether the whole Internet of things system has risks or not in real time, calculating the credibility level of login users and access equipment, and providing a key basis for authorization decision judgment of a policy engine.
Optionally, in the above technical solution, the system further includes a security agent module, and the policy engine module is further configured to: the policy decision corresponding to the risk analysis result of the trust engine module is issued to the security proxy module, and the security proxy module is used for: and executing the received policy decision.
Optionally, in the above technical solution, the security proxy module is deployed on a terminal device or a gateway node, and provides encrypted connection from the terminal to the authorized resource.
Optionally, in the above technical solution, the security agent module is further configured to: and acquiring and sending the terminal equipment information to an identity security authentication module.
Optionally, in the above technical solution, the terminal management module is further included, where the terminal management module is configured to: according to the baseline configuration, application reinforcement, patch pushing, vulnerability scanning and health physical examination are performed on the terminal equipment periodically or in an immediate manual mode.
Optionally, in the above technical solution, as shown in fig. 2, the method further includes a PKI public key infrastructure, a CL-PKC certificateless public key cryptosystem, and an SM2 cryptographic algorithm, specifically:
1) Public key infrastructure (Public Key Infrastructure, PKI) is a security framework and architecture for managing public key encryption and the creation, distribution, storage and verification of digital certificates. It provides a mechanism for establishing and managing a chain of trust for secure communications. Public key infrastructure plays a key role in many security applications, such as encrypted communications, digital signatures, identity authentication, and security access control. It provides a reliable mechanism to ensure confidentiality, integrity and trustworthiness of communications and interactions.
2) CL-PKC (Certificateless Public Key Cryptography) is a certificateless public key cryptosystem that is an extension and improvement to the traditional Public Key Infrastructure (PKI). In conventional public key cryptography, in order to establish secure communications, both parties typically need to obtain and verify the digital certificates of the other party. However, the management and distribution of certificates requires reliance on a trusted Certificate Authority (CA), and there are problems with single point of failure and certificate revocation of the certificate authority. CL-PKC solves the problem of certificates in conventional PKI by introducing a trusted entity (called key generation center, key Generation Center, KGC). The KGC generates a private key and a public key parameter of the user in a key generation stage and distributes the public key parameter to the user. The user can generate the private key by himself without relying on the certificate issued by the CA.
3) The SM2 cryptographic algorithm is an asymmetric encryption algorithm and is based on an elliptic curve cryptography mechanism. The key length is 256 bits. The SM2 algorithm includes digital signature, key exchange and public key encryption, with a key length of 256 bits. The SM2 algorithm includes digital signature, key exchange, and public key encryption, which is a public key cryptographic algorithm based on elliptic curve cryptography. Compared with international algorithms such as RSA/DH/ECDSA/ECDH, the SM2 national encryption algorithm has higher security intensity and faster operation speed.
The system architecture designed by the invention takes a unified portal module as a core, and the identity security authentication module, the policy engine module, the trust engine module, the terminal management module and the security agent module jointly realize the life cycle management of the terminal equipment in the environment of the Internet of things through cooperative communication, data analysis and operation management and control.
The invention provides the security management capability aiming at the cloud network side of the Internet of things system by providing a unified portal and an Internet of things terminal security authentication center/zero trust control center, wherein the Internet of things security unified portal provides different gate interfaces based on roles such as an Internet of things system operator user view, a security operation view and the like, the Internet of things terminal security authentication center provides the back end foundation capability, and a core component comprises modules such as identity management, authority management, terminal management and situation analysis.
The zero trust control center adopts a zero trust capability core technology IAM+SDP architecture. The specific functions comprise constructing a system core function module by a zero trust concept, and realizing zero trust access control through three core modules of a trust evaluation engine, a policy decision engine and a policy execution point/trusted agent. And risk measurement is carried out on the basis of as many data sources as possible according to users, equipment, network environments, access behaviors and the like, and dynamic security access control based on identity authentication is achieved through persistent data collection, verification and evaluation.
The internet of things safety management and control platform provides safety management capability aiming at cloud network side crossing of an internet of things system by providing a unified portal and an internet of things terminal safety authentication center, the internet of things safety unified portal provides different gate interfaces based on roles such as user views of an internet of things system operator, safety operation views and the like, the internet of things terminal safety authentication center provides back end foundation capability, and a core component comprises identity management, authority management, terminal management, situation analysis and other modules, and the specific process is as follows:
1) The user accesses the management and control platform;
2) IoT system operators observe the overall operation chart by displaying a large screen;
3) The safety operators manage through a safety unified portal;
4) The zero trust control center finely controls the identity access and the dynamic authority adjustment through identity authentication, policy decision and trust evaluation.
The internet of things safety control platform based on zero trust has the following beneficial effects:
1) Based on the zero trust concept, the security management capability of the cloud network side crossing can be provided for the Internet of things system;
2) The system is an omnibearing depth monitoring system, and covers baseline safety, file safety, login safety, flow safety, behavior safety and the like;
3) And (3) unified management: terminal equipment outside the boundary protection of an enterprise IT system is managed in a unified and centralized mode, and safety upgrading from the boundary protection of the traditional information safety era to the boundary protection of the Internet of things equipment is achieved.
4) Active defense, safety management and control: the active defense can be performed against abnormal attack behaviors through the linkage with the safety platform, so that real-time safety control to each device is accurately realized.
Those skilled in the art will appreciate that the invention may be embodied as a system, method or computer program product, and that the invention may therefore be embodied in the form of: either entirely hardware, entirely software (including firmware, resident software, micro-code, etc.), or entirely software, or a combination of hardware and software, referred to herein generally as a "circuit," module "or" system. Furthermore, in some embodiments, the invention may also be embodied in the form of a computer program product in one or more computer-readable media, which contain computer-readable program code.
Any combination of one or more computer readable media may be employed. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium can be, for example, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of the computer-readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
While embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and not to be construed as limiting the invention, and that variations, modifications, alternatives and variations may be made to the above embodiments by one of ordinary skill in the art within the scope of the invention.

Claims (10)

1. The internet of things safety control platform based on zero trust is characterized by comprising a safety authentication center and an internet of things safety unified portal;
the security authentication center is used for: verifying the identity information of operators;
the internet of things security unified portal is used for: and after the identity information of the operator passes verification, providing corresponding associated operation control data and interfaces corresponding to the associated operation control data for the operator according to the authority of the operator.
2. The internet of things security management and control platform based on zero trust according to claim 1, wherein the security authentication center comprises an identity security authentication module;
the identity security authentication module is used for: and verifying the identity information of the operator through a multi-factor authentication mode and/or an SSO single sign-on mode.
3. The internet of things security management and control platform based on zero trust according to claim 2, wherein the identity security authentication module is further configured to: and continuously monitoring the user access state and the equipment access running state associated with the identity information after passing the verification, and implementing dynamic verification.
4. The internet of things security management and control platform based on zero trust according to claim 3, wherein the security authentication center further comprises: a policy engine module, the policy engine module configured to: according to a specific scene, the security control strategy for performing the pass operation, the blocking operation and the upgrade authentication operation is managed and maintained.
5. The zero trust based internet of things security management platform of claim 4, wherein the security authentication center further comprises a trust engine module;
the trust engine module is configured to: based on the user identity, the equipment state, the access behavior and the weblog, and combining situation awareness and a UEBA technology, analyzing whether risks exist in real time, and calculating the credibility level of the login user and the access equipment.
6. The zero trust based internet of things security management and control platform of claim 5, further comprising a security proxy module, the policy engine module further configured to: and issuing a policy decision corresponding to the risk analysis result of the trust engine module to the security proxy module, wherein the security proxy module is used for: and executing the received policy decision.
7. The zero trust based internet of things security management and control platform of claim 6, wherein the security proxy module is deployed on a terminal device or gateway node to provide encrypted connection from a terminal to an authorized resource.
8. The internet of things security management and control platform based on zero trust of claim 7, wherein the security proxy module is further configured to: and acquiring and sending the terminal equipment information to the identity security authentication module.
9. The internet of things security management and control platform based on zero trust according to claim 8, further comprising a terminal management module, wherein the terminal management module is configured to: according to the baseline configuration, application reinforcement, patch pushing, vulnerability scanning and health physical examination are performed on the terminal equipment periodically or in an immediate manual mode.
10. The internet of things security management and control platform based on zero trust according to any one of claims 1 to 9, wherein the interface corresponding to the associated operation management and control data comprises: at least one of a security situation display interface, a security event display and disposition interface, a terminal device management interface, a policy management interface, a baseline configuration interface, and an operation report display interface.
CN202311797306.XA 2023-12-25 2023-12-25 Zero trust-based Internet of things safety control platform Pending CN117879905A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202311797306.XA CN117879905A (en) 2023-12-25 2023-12-25 Zero trust-based Internet of things safety control platform

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202311797306.XA CN117879905A (en) 2023-12-25 2023-12-25 Zero trust-based Internet of things safety control platform

Publications (1)

Publication Number Publication Date
CN117879905A true CN117879905A (en) 2024-04-12

Family

ID=90585738

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202311797306.XA Pending CN117879905A (en) 2023-12-25 2023-12-25 Zero trust-based Internet of things safety control platform

Country Status (1)

Country Link
CN (1) CN117879905A (en)

Similar Documents

Publication Publication Date Title
Tselios et al. Enhancing SDN security for IoT-related deployments through blockchain
Khatoun et al. Cybersecurity and privacy solutions in smart cities
CN116881981B (en) Digital signature system and method based on certificate
CN110069918A (en) A kind of efficient double factor cross-domain authentication method based on block chain technology
CN117040896A (en) Internet of things management method and Internet of things management platform
CN111447067A (en) Encryption authentication method for power sensing equipment
CN114553537A (en) Abnormal flow monitoring method and system for industrial Internet
CN112214544A (en) Ubiquitous power Internet of things edge data safe storage method based on permission block chain
CN113114632A (en) Can peg graft formula intelligence financial audit platform
Zhang et al. An adaptive encryption-as-a-service architecture based on fog computing for real-time substation communications
CN117313122A (en) Data sharing and exchanging management system based on block chain
Aladwan et al. Common security criteria for vehicular clouds and internet of vehicles evaluation and selection
CN116980175A (en) Enterprise privacy analysis and anomaly discovery method, device, equipment and storage medium
AbuEmera et al. Security framework for identifying threats in smart manufacturing systems using STRIDE approach
CN112015111A (en) Industrial control equipment safety protection system and method based on active immunity mechanism
Feng et al. Autonomous vehicles' forensics in smart cities
CN117938502A (en) Processing system and method for network security event
CN116684875A (en) Communication security authentication method for electric power 5G network slice
CN117201077A (en) Internet of things access scene identity modeling and trust evaluation method
Ganguly et al. Analysis of the security anomalies in the smart metering infrastructure and its impact on energy profiling and measurement
CN117879905A (en) Zero trust-based Internet of things safety control platform
Ma et al. Security of edge computing based on trusted computing
Sukiasyan Secure data exchange in IIoT
Alhawamdeh et al. Enabling Security as a Service for IoT Emerging Technologies: A Survey
CN117240495A (en) Method and device for remotely controlling remote RPC (remote control of Internet of things) safety

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination