WO2009155849A1 - Method for monitoring and updating security status of terminal and system thereof - Google Patents

Abstract

A method for monitoring and updating the security status of a terminal and the system thereof are provided. The method comprises the following steps: a requesting party acquires the metadata related to the security status of the terminal from a providing party; and the requesting party monitors and/or updates the security status of the terminal, according to the metadata related to the security status of the terminal. Among others, the requesting party is a provider of a third party service or is in a security status requesting domain; and the providing party is in a security status providing domain.

Description

 Method and system for monitoring and updating terminal security status This application claims a Chinese patent application filed on June 25, 2008 by the Chinese Patent Office, application number 200810029005.1, and the invention titled "Monitoring and Updating Method and System for Terminal Security Status" Priority is hereby incorporated by reference in its entirety.

Technical field

 The present invention relates to communication technologies, and in particular, to a method and system for monitoring and updating a terminal security state. Background technique

 In the existing Trusted Network Connect (TNC) architecture, the evaluation of terminal security status information is performed by a TNC server in the same security domain as the terminal. The security status information of the terminal refers to some information reflecting the security status of the terminal, for example, the operating system version, the patch information, the firewall version, the anti-virus software version, and the version of the browser. The TNC architecture can also provide metadata from other security devices to correlate stateful runtimes associated with the TNC client. The metadata indicates some information about the current state of installation in the network, adding additional data sources for security-related decisions. Metadata sharing is also used only in a single security domain to support the sharing of gesture information, ie the publisher and subscriber of TNC data and metadata belong to the same organization.

 When the terminal accesses services in other security domains across the security domain, the server in the Relying Security Domain (RSD) can request the corresponding security status information of the terminal from the server in the Asserting Security Domain (ASD). Conduct a security assessment so that access control can be performed.

When a terminal accesses across a security domain, the new security domain not only needs to perform access control on the terminal, but also needs real-time monitoring of the security state of the terminal. For example, when a terminal wants to access a service provided by a third-party service provider, the server providing the service needs not only the end of the service. The terminal performs security status assessment and performs access control. At the same time, it also needs to know the changes of the security status information of the terminal during the entire service process, so that adjustments can be made in time.

 In the process of implementing the present invention, the inventors have found that in the current joint trusted network connection

(FTNC, Federated Trusted Network Connect), only how to exchange the security status information of the terminal and the security assessment result between different domains when the terminal crosses the domain, how to perform metadata interaction when inter-domain, and cross-domain access of the terminal After that, there is no corresponding solution for how ASD or RSD can monitor the security status of the terminal in real time.

Summary of the invention

 The embodiments of the present invention provide a method and system for monitoring and updating a security state of a terminal, and monitoring and/or updating the security state of the terminal by performing metadata interaction between different domains.

 The embodiment of the present invention provides a method for monitoring and updating a security state of a terminal, including: the requesting party obtains metadata related to the security state of the terminal from the provider; the requesting party is a third-party service provider, or the security state information a request domain; the provider provides a security status information providing domain; the requesting party monitors and/or updates the security state of the terminal according to the metadata related to the security state of the terminal.

 The embodiment of the invention further provides a system for monitoring and updating the security status of the terminal, comprising: a requesting party and a provider;

 The requesting party is configured to obtain, from the provider, metadata related to a security status of the terminal; the requesting party is a third-party service provider, or in a security status information request domain; the party is in a security status information providing domain;

 The requesting party monitors and/or updates the security status of the terminal according to the metadata related to the terminal security status.

Implement monitoring and/or updating of the terminal's security status. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are used in the description of the embodiments of the present invention, are briefly described, and the drawings in the following description are in some embodiments of the present invention, Other drawings can also be obtained from these drawings on the premise of creative labor.

 1 is a schematic flowchart of a first embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 2 is a schematic flowchart of a second embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 3 is a schematic flowchart of a third embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 4 is a schematic flowchart of a fourth embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 5 is a schematic flowchart of a fifth embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 6 is a schematic flowchart of a sixth embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 7 is a schematic flowchart of a seventh embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 FIG. 8 is a schematic structural diagram of a first embodiment of a monitoring and updating system for a terminal security state according to an embodiment of the present invention; FIG.

 9 is a schematic structural diagram of a second embodiment of a monitoring and updating system for a terminal security state according to an embodiment of the present invention;

 FIG. 10 is a schematic structural diagram of a third embodiment of a monitoring and updating system for a terminal security state according to an embodiment of the present invention; FIG.

FIG. 11 is a fourth embodiment of a monitoring and updating system for a terminal security state according to an embodiment of the present invention; Schematic diagram of the structure. detailed description

 The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

 The embodiments of the present invention provide a method and system for monitoring and updating a security state of a terminal, which implements monitoring and/or updating the security state of the terminal by performing metadata interaction between different domains. It should be noted that the terminal security state information described in the embodiment of the present invention refers to some information that can reflect the security state of the terminal, such as the operating system version, the patch information, the firewall version, the version of the antivirus software, and the browser of the terminal. Version and other related information;

 The metadata described in the embodiment of the present invention may include: terminal security status information; and/or status information indicating devices, users, and traffic in the network where the terminal is currently located, where the status information includes registered address binding and authentication. Information such as status, terminal policy compliance status, terminal behavior, and authorization status.

 1 is a schematic flowchart of a first embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 The method provided in this embodiment includes:

 Step 100: The requesting party obtains metadata related to the security status of the terminal from the provider; the requesting party is a third-party service provider, or requests the domain provider to provide a domain in the security state information in the security state information;

 In this embodiment and the following embodiments, the requesting party is a terminal security state information requesting party, and the providing party is a terminal security state information providing party.

Step 101: The requesting party monitors and/or updates the security status of the terminal according to the metadata related to the security status of the terminal. It should be noted that, the requesting party obtains metadata related to the security state of the terminal from the provider by connecting the connection interface of the server in the security state information providing domain;

 In the embodiment and the following embodiments, the server is specifically a trusted network connection server, and the connection interface is specifically an Interface for Federated Trusted Network Connection (IF-FTNC).

 Method for Monitoring and Updating Terminal Security Status In the first embodiment, metadata interaction between different domains can be implemented to monitor and/or update the security status of the terminal.

 2 is a schematic flowchart of a second embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 In the embodiment of the present invention, the domain in which the terminal is located before the domain is used as the security state information providing domain, and the domain in which the terminal crosses the domain is the security state information requesting domain, and the terminal security state information requesting party is the third-party service provider. Or the security status information requests an application server in the domain, and the terminal security status information provider provides a metadata access point in the domain for the security status information.

 The method for monitoring and updating the security status of the terminal provided in this embodiment includes:

 Step 200: The third-party service provider or the application server in the security status information request domain sends a metadata request message to the trusted network connection server in the security state information providing domain through the joint trusted network connection interface.

 Step 201: After receiving the metadata request message, the trusted network connection server in the security state information providing domain forwards the metadata access point to the security state information providing domain.

 Step 202: After receiving the metadata request message, the metadata access point in the security status information providing domain sends a element related to the terminal security status to the trusted network connection server in the security status information request domain. Data

 Step 203: The trusted network connection server in the security status information providing domain returns the metadata to the third party service provider or the application server in the security state information request domain through the joint trusted network connection interface.

Step 204: The third party service provider or the security status information request application service in the domain The device monitors and/or updates the security status of the terminal according to the metadata.

 The second embodiment for implementing the monitoring and updating method of the terminal security state is provided by the joint trusted network connection interface between the third-party service provider and the security state information providing domain, or the security state information requesting domain and the security state information providing domain. Metadata interaction enables third-party service providers or application servers in the security status information request domain to monitor and/or update the security status of the terminal.

 3 is a schematic flowchart of a second embodiment of a method for monitoring and updating a terminal security state according to an embodiment of the present invention;

 First, in this implementation, the domain in which the terminal crosses the domain is the assertion security domain (ASD). The so-called ASD, as the home domain of the terminal, has the right to assert whether the terminal is secure and can provide security status information or security status of the terminal. Evaluation results or security credentials and metadata, etc.; the domain after the terminal cross-domain is the assertion dependent security domain (RSD), the so-called RSD, as the visited domain of the terminal, it does not know whether the terminal is secure or not, and depends on the security state provided by ASD. The information or the security status assessment result of the terminal or the security certificate and the metadata can be used to determine whether the terminal is secure.

 When a terminal accesses a service provided by a third-party service provider or an application server in the RSD, the third-party service provider or the application server not only needs to perform access control through the security assessment when the terminal accesses. Moreover, it is also necessary to complete the mastering of the security state of the terminal in real time after the terminal is accessed, so that corresponding measures can be taken in time after the security state of the terminal changes.

 In this embodiment, the domain in which the terminal crosses the domain, that is, the ASD is used as the security state information providing domain, and the domain in which the terminal crosses the domain, that is, the RSD is used as the security state information requesting domain, and the terminal security state information requesting party The third party service provider or the application server in the RSD, where the terminal security status information provider is a metadata access point (MAP, Metadata Access Point) in the ASD;

It should be noted that, in the embodiment of the present invention, the terminal is a TNC client that supports the TNC function. The following is described by the TNC client. The MAP is implemented by the MAP server in the embodiment, and the following will be described by the MAP server;

 The specific method flow is as follows:

 Step 300: The TNC client sends a request for a certain service to a third-party service provider or an application server in the RSD.

 Step 301: The third-party service provider or the application server in the RSD determines the provider of the appropriate security status or security assessment result. The assertion here may be only the security status information of the TNC client or the security status assessment result or security of the terminal. Credentials and metadata, etc., may also be an assertion containing all the information of the above terminal; the process of determining the appropriate assertion by the third-party service provider or the application server in the RSD is the discovery process of the ASD. It should be noted that the discovery of the ASD may be the result of mutual negotiation between the TNC client and the third-party service provider or the application server in the RSD, and the TNC client may directly notify the third-party service provider or the application server in the RSD. .

 Step 302: The third-party service provider or the application server in the RSD sends a request message to the TNC server in the ASD, requesting the assertion of the TNC client;

 Step 303: The TNC server performs information exchange with the MAP server in the ASD to obtain the metadata of the TNC client. As shown in FIG. 3, the TNC server in the ASD sends an IF-MAP query message to the MAP server to obtain the metadata of the terminal.

 Step 304: The TNC server returns a response message to the third-party service provider in the RSD or the application server in the RSD, and provides a corresponding assertion to the TNC client.

 Step 305: According to the assertion of the TNC client provided by the TNC server in the ASD, the third-party service provider or the application server in the RSD returns a response message to the TNC client, and allows access to the service request of the TNC client. Of course, if the assertion of the TNC client cannot meet the security state requirements of the service provider, the third-party service provider or the application server in the RSD can respond to the TNC client's service request by denying access.

Step 306, the TNC client accesses the service to the third-party service provider or the application in the RSD. The server provides the service service provided by the third-party service provider or the application server in the RSD. Step 307: For the third-party service provider or the application server in the RSD, not only the security status of the TNC client during access is required. Moreover, it is necessary to further grasp the real-time security status of the TNC client in enjoying the business service provided by it, so as to avoid threat to its own service after the security status of the TNC client changes. Therefore, the third-party service provider or the application server in the RSD sends a metadata subscribe message to the TNC server of the ASD where the TNC client is located through the IF-FTNC;

 Step 308: After receiving the metadata subscribe message, the TNC server in the ASD sends the message to the MAP server in the ASD.

 Step 309, when the MAP server in the ASD where the TNC client is located receives the security status change of the TNC client, sending a metadata result message to the TNC server in the ASD;

 Step 310: The TNC server in the ASD informs the third-party service provider or the application server in the RSD of the result of the TNC client security state change by using the IF-FTNC in time by the metadata result message.

 At this time, the third-party service provider or the application server in the RSD can perform corresponding operations on the terminal according to the metadata result message, and further implement monitoring and/or updating of the security state of the terminal.

 4 is a schematic flowchart of a fourth embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 In the embodiment of the present invention, the domain in which the terminal is located before the domain is used as the security state information requesting domain, and the domain in which the terminal is located after the domain is the security state information providing domain, and the terminal security state information requesting party is the security state information requesting domain. a trusted network connection server, wherein the terminal security status information provider provides a metadata access point in the domain for the security status information;

 The method provided in this embodiment includes:

Step 400: When the terminal security status changes or an abnormal situation, provide the security status information When the security status of the terminal changes, or when the terminal is abnormal with the terminal, the sensors (IDS, Inbreak Detect System)/Intrusion Prevention System (IPS) in the domain of the security status information are provided. Inbreak Protect System) issues terminal security status change or abnormal situation information to a metadata access point in the security status information providing domain;

 Step 401: The metadata access point in the security status information providing domain issues the terminal security status change or abnormal situation information to the trusted network connection server in the security status information providing domain;

 Step 402: The trusted network connection server in the security status information providing domain sends the metadata related to the terminal security status to the trusted network connection server in the security status information request domain through the joint trusted network connection interface.

 Step 403: The trusted network connection server in the security status information request domain sends the metadata to a metadata access point in the security state information request domain.

 Step 404: After the metadata access point in the security status information request domain summarizes and analyzes the metadata, the analysis result is notified to the trusted network connection server in the security status information request domain;

 Step 405: The trusted network connection server in the security status information request domain monitors and/or updates the terminal according to the metadata analysis result.

 The fourth embodiment uses the joint trusted network connection interface to perform metadata interaction between the security state information request domain and the security state information providing domain to implement trustedness in the security state information request domain. The network connection server monitors and updates the security status of the terminal in real time.

 5 is a schematic flowchart of a fifth embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

First, in this implementation, the domain in which the terminal crosses the domain is the assertion security domain (ASD). The so-called ASD, as the home domain of the terminal, has the right to assert whether the terminal is secure and can provide security status information or security status of the terminal. Evaluation results or security credentials and metadata, etc.; terminal cross-domain The domain that is located is the assertion dependent security domain (RSD). The so-called RSD, as the visited domain of the terminal, does not know whether the terminal is secure or not. It depends on the security status information provided by the ASD or the security status assessment result or security certificate of the terminal. Metadata, can be clear whether the terminal is safe.

 After the terminal is connected to the RSD, the terminal is not currently in the ASD. However, for the ASD, the security status of the terminal needs to be known in real time to implement real-time monitoring of the terminal. At the same time, the security status of the terminal (such as software version, system patch, etc.) is updated in real time. In this case, the metadata associated with the terminal, such as Sensors /IDS/IPS in the RSD, is required to be transmitted to the MAP server in the ASD. After the metadata is analyzed and processed by the MAP server in the ASD, the generated metadata result is sent to the TNC server in the ASD, thereby allowing the TNC server in the ASD to update and upgrade the security status of the terminal in time.

 In this embodiment, the domain ASD in which the terminal crosses the domain is used as the security state information requesting domain, and the domain RSD in which the terminal crosses the domain is used as the security state information providing domain, and the terminal security state information requesting party is the TNC in the ASD. a server, the terminal security status information provider is a MAP in the RSD;

 It should be noted that, in the embodiment of the present invention, the terminal is a TNC client that supports the TNC function. The following describes the TNC client. The MAP is implemented by the MAP server in the embodiment, and the MAP server is used for the following description;

 The specific method flow is as follows:

 Steps 500 to 506 are basically the same as steps 300 to 306 in the third embodiment. The TNC server in the RSD is responsible for the access evaluation of the TNC client, and is not described here.

Step 507: The TNC client accesses the RSD. When the Sensor/IDS/IPS in the RSD finds that some state of the TNC client changes, or finds that the TNC client has an abnormal situation, it sends the message to the MAP server in the RSD. A metadata publisher message, which announces that the state of the TNC client has changed or that the TNC client has an abnormal condition; Step 508: After receiving the information, the MAP server in the RSD sends the information to the TNC server in the RSD.

 Step 509: The TNC server in the RSD uses the IF-FTNC interface to advertise the metadata related to the TNC client security status information to the TNC server in the ASD where the TNC client is located by using a metadata publisher message;

 Step 510: The TNC server in the ASD also issues the information to the MAP server in the ASD through a metadata publisher message;

 Step 511: After collecting, summarizing, and analyzing the metadata, the MAP server in the ASD notifies the TNC server in the ASD of the final result;

 Step 512: The TNC server in the ASD monitors and/or updates the TNC client according to the analysis and summary result of the metadata.

 6 is a schematic flowchart of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention;

 In the embodiment of the present invention, the domain in which the terminal is located before the domain is used as the security state information providing domain, and the domain in which the terminal crosses the domain is used as the security state information requesting domain, and the terminal security state information requesting party is the security state information requesting domain. In the trusted network connection server, the terminal security status information provider provides a metadata access point in the domain for the security status information. The method provided in this embodiment includes:

 Step 600: The trusted network connection server in the security status information requesting domain sends a metadata request message to the trusted network connection server in the security state information providing domain through the joint trusted network connection interface;

 Step 601: The trusted network connection server in the security status information providing domain sends the metadata request message to a metadata access point in the security state information providing domain;

Step 602: The metadata access point in the security status information providing domain receives the metadata request message, and when the security information of the terminal needs to be updated, the security information of the terminal needs to be updated to notify the security status information providing domain. Trusted network connection server; Step 603: The trusted network connection server in the security state information providing domain sends metadata to the trusted network connection server in the security state information requesting domain through the joint trusted network connection interface, and informs the terminal that the security information needs to be updated. ;

 Step 604: The trusted network connection server in the security status information request domain sends the metadata to the metadata access point in the security state information request domain, and informs the metadata access point that the security information of the terminal needs Update

 Step 605: The metadata access point in the security status information request domain monitors and/or updates the terminal according to the metadata.

 The method for monitoring and updating the terminal security state is as follows: In the sixth embodiment, the metadata interaction between the security state information request domain and the security state information providing domain is performed through the joint trusted network connection interface, and the terminal security state information may request the element in the domain. The data access point monitors and/or updates the security status of the terminal.

 FIG. 7 is a schematic flowchart diagram of a seventh embodiment of a method for monitoring and updating a security state of a terminal according to an embodiment of the present invention.

 First, in this implementation, the domain in which the terminal crosses the domain is the assertion security domain (ASD). The so-called ASD, as the home domain of the terminal, has the right to assert whether the terminal is secure and can provide security status information or security status of the terminal. Evaluation results or security credentials and metadata, etc.; the domain after the terminal cross-domain is the assertion dependent security domain (RSD), the so-called RSD, as the visited domain of the terminal, it does not know whether the terminal is secure or not, and depends on the security state provided by ASD. The information or the security status assessment result of the terminal or the security certificate and the metadata can be used to determine whether the terminal is secure.

 When the terminal accesses from the ASD to another security domain RSD, once the terminal's ASD discovers that one or some security states of the terminal need to be updated or upgraded, the ASD must promptly inform the terminal of the current RSD, so that Real-time update of terminal security status information.

In the embodiment of the present invention, the domain in which the terminal crosses the domain, that is, the ASD is used as the security state information providing domain, and the domain in which the terminal crosses the domain, that is, the RSD is used as the security state information request domain, The terminal security status information requester is a TNC server in the RSD, and the terminal security status information provider is a MAP in the ASD;

 It should be noted that, in the embodiment of the present invention, the terminal is a TNC client that supports the TNC function. The following describes the TNC client. The MAP is implemented by the MAP server in the embodiment, and the MAP server is used for the following description;

 The specific method flow is as follows:

 Steps 700 to 706 are substantially the same as steps 300 to 306 in the third embodiment, and details are not described herein again.

 In order to be able to update and update the security status information of the TNC client, the TNC server in the RSD needs to receive the metadata published by the MAP server in the ASD.

 First, in step 707, the TNC server in the RSD sends a metadata subscribe message to the TNC server in the ASD through the IF-FTNC;

 Step 708: The TNC server in the ASD forwards the metadata subscribe message to the MAP server in the ASD.

 Step 709: When the ASD finds that a certain security information of the TNC client needs to be upgraded, the MAP server in the ASD sends a metadata result message to the TNC server in the ASD, and informs the terminal that a certain security information needs to be upgraded. Update

 Step 710: The TNC server in the ASD sends the metadata result message to the TNC server in the RSD through the IF-FTNC, and informs the terminal that a certain security information needs to be upgraded and updated.

 Step 711: The TNC server in the RSD sends a metadata publish message to the MAP server in the RSD, and the security information of the TNC client needs to be updated to update the information to the MAP server.

 After receiving the metadata publish message, the MAP server in the RSD can update and update a certain security information of the TNC client.

FIG. 8 is a first embodiment of a monitoring and updating system for a terminal security state according to an embodiment of the present invention; FIG. Schematic diagram of the structure;

 Requester 200 and provider 100;

 The requesting party 200 is configured to obtain metadata related to a terminal security state from the provider 100; the requesting party 200 is a third-party service provider 4, or in a security state information requesting domain; the provider 100 is Security status information is provided in the domain;

 The requesting party 200 monitors and/or updates the security status of the terminal according to the metadata related to the terminal security status.

 In this embodiment and the following embodiments, the requesting party 200 is a terminal security state information requesting party, and the provider 100 is a terminal security state information providing party.

 The security status information providing domain further includes: a server, in the embodiment and the following embodiments, the server is specifically a trusted network connection server;

 The requesting party 200 obtains metadata related to the security status of the terminal from the provider 100 through the trusted state network connection server in the security state information providing domain;

 The trusted network connection server in the security state information providing domain is further connected with the connection interface 3, and in the embodiment and the following embodiments, the connection interface 3 is specifically a joint trusted network connection interface;

 The requesting party 200 obtains metadata related to the terminal security status from the provider 100 by connecting the connection interface 3 of the trusted network connection server in the security status information providing domain.

 By implementing the system provided by the embodiment of the present invention, real-time control of the security status of the terminal and/or timely update of the security information of the terminal can be implemented by performing metadata interaction between different domains.

 9 is a schematic structural diagram of a second embodiment of a monitoring and updating system for a terminal security state according to an embodiment of the present invention;

In this embodiment, the domain in which the terminal crosses the domain before, that is, the asserted security domain (ASD) 1 serves as the security state information providing domain, and the domain in which the terminal crosses the domain, that is, relies on the asserted security domain (RSD) 2 as security. The status information request domain, the terminal security status information requester is the third party service provider 4 or the application server 20 in the RSD 2, and the terminal security status information provider is ASD1 MAP (implemented by the MAP server 11 in this implementation); the ASD1 further includes a TNC server 10;

 The third-party service provider 4 or the application server 20 in the RSD 2 is configured to send a metadata request message to the TNC server 10 in the ASD1 through the joint trusted network connection interface (IF-FTNC) 3;

 The TNC server 10 in the ASD1 is configured to forward the metadata request message to the MAP server 11 in the ASD1 after receiving the metadata customization message;

 The MAP server 11 is configured to send the metadata related to the security status of the terminal to the TNC server 10 in the ASD1 after receiving the metadata request message;

 The TNC server 10 in the ASD1 is configured to return the metadata to the third-party service provider 4 or the application server 20 in the RSD2 through the IF-FTNC3, and notify the third-party service provider 4 of the security status information of the terminal. Or the application server 20 in the RSD 2;

 The third party service provider 4 or the application server 20 in the RSD 2 monitors and/or updates the security status of the terminal according to the metadata related to the security status of the terminal returned by the TNC server 10.

 The second embodiment of the monitoring and updating system for implementing the security status of the terminal can implement the metadata interaction between the third-party service provider and the ASD, or between the RSD and the ASD through the IF-FTNC, so that the third-party service provider or the application in the RSD can be implemented. The server monitors and/or updates the security status of the terminal.

 FIG. 10 is a schematic structural diagram of a third embodiment of a monitoring and updating system for a terminal security state according to an embodiment of the present invention; FIG.

In this embodiment, the domain in which the terminal crosses the domain, that is, the asserted security domain (ASD) 1 as the security state information request domain, and the domain in which the terminal crosses the domain, that is, the assertion security domain (RSD) 2 is used as security. The status information provides a domain, the terminal security status information requester is the TNC server 10 in the ASD1, and the terminal security status information provider is the MAP in the RSD2 (implemented by the MAP server 22 in this embodiment); TNC Server 21 and Sensor/Intrusion Detection System System/Intrusion Prevention System (Sersor/IDS/IPS) 23;

 The Sersor/IDS/IPS23 of the RSD2 is used to issue terminal security status change or abnormal situation information to the MAP server 22 in the RSD2 when the terminal security status changes or the terminal abnormality occurs;

 The MAP server 22 of the RSD2 is configured to release the security status change or abnormal situation information of the terminal to the TNC server 21 in the RSD2;

 The TNC server 21 in the RSD2 is configured to release the metadata related to the security status of the terminal to the TNC server 10 in the ASD1 through the joint trusted network connection interface (IF-FTNC) 3;

 The TNC server 10 in the ASD1 is configured to monitor and/or update the terminal according to the metadata.

 The third embodiment of the monitoring and updating system for implementing the terminal security status, the metadata interaction between the RSD and the ASD through the IF-FTNC interface enables the TNC server in the ASD to monitor and/or update the security status of the terminal.

 11 is a schematic structural diagram of a fourth embodiment of a monitoring and updating system for a terminal security state according to an embodiment of the present invention;

 In this embodiment, the domain in which the terminal crosses the domain, that is, the asserted security domain (ASD) 1 serves as the security state information providing domain, and the domain in which the terminal crosses the domain, that is, the asserted security domain (RSD) 2 is used as the security state. The information request domain, the terminal security state information requester is the TNC server 21 in the RSD2, and the terminal security state information provider is the MAP in the ASD1 (implemented by the MAP server 11 in this embodiment), and the RSD2 is also Including MAP (implemented by the MAP server 22 in this implementation), the ASD1 further includes a TNC server 10:

 The TNC server 21 in the RSD2 is configured to send a metadata request message to the TNC server 10 in the ASD1 through the joint trusted network connection interface (IF-FTNC) 3;

The TNC server 10 in the ASD1 sends the metadata request message to the MAP server 11 in the ASD1; The MAP server 11 in the ASD1 is configured to receive the metadata request message, and notify the TNC server 10 in the ASD1 that the security information of the terminal needs to be updated when the security information of the terminal needs to be updated;

 The TNC server 10 in the ASD1 is configured to send metadata to the TNC server 21 in the RSD2 through the IF-FTNC3, and inform the terminal that the security information needs to be updated;

 The TNC server 21 in the RSD2 is configured to send the metadata to the MAP server 22 in the RSD2, and notify the MAP server 22 that the security information of the terminal needs to be updated;

 The MAP server 22 in the RSD 2 monitors and/or updates the terminal according to the metadata.

 Implementation of Monitoring and Updating System of Terminal Security Status In the fourth embodiment, metadata interaction between ASD and RSD is performed through the IF-FTNC interface, so that the MAP server in the RSD can monitor and/or update the security status of the terminal. The apparatus or device for controlling and updating the method, or the device or device constituting the monitoring and updating system of the terminal security state provided by the embodiment of the present invention, should belong to the protection scope of the present invention.

 The method and system for monitoring and updating the security state of the terminal provided by the embodiment of the present invention can implement monitoring and/or updating the security state of the terminal by performing metadata interaction between different domains.

 Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary hardware platform, and of course, can also be implemented entirely by hardware. Based on such understanding, all or part of the technical solution of the present invention contributing to the background art may be embodied in the form of a software product, which may be stored in a storage medium such as a ROM/RAM, a magnetic disk, an optical disk, or the like. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention or portions of the embodiments.

The above disclosure is only a preferred embodiment of the present invention, and of course, the present invention cannot be limited thereto. The scope of the invention, therefore, equivalent changes made in the claims of the invention are still within the scope of the invention.

Claims

Claim

 A method for monitoring and updating a terminal security state, comprising:

 The requesting party obtains metadata related to the security status of the terminal from the provider;

 The requesting party is a third party service provider, or in a security status information request domain; the provider is in a security status information providing domain;

 The requesting party monitors and/or updates the security status of the terminal according to the metadata related to the security status of the terminal.

 2. The method for monitoring and updating a security status of a terminal according to claim 1, wherein the requesting party obtains metadata related to the terminal security status information from the provider through the server in the security status information providing domain.

 The method for monitoring and updating the security status of the terminal according to claim 2, wherein the requesting party obtains the security status of the terminal from the provider by connecting the connection interface of the server in the security state information providing domain. Information related metadata.

 The method for monitoring and updating the security status of the terminal according to claim 3, wherein the domain in which the terminal crosses the domain before is used as the security state information providing domain, and the domain in which the terminal crosses the domain is used as the security state information request. The requesting party is a third-party service provider or an application server in the domain for the security state information requesting, the provider provides a metadata access point in the domain for the security state information, the method includes:

 The third-party service provider or the application server in the security status information request domain sends a metadata request message to the server in the security state information providing domain through the connection interface;

 After receiving the metadata request message, the server in the security status information providing domain forwards the metadata access point to the security status information providing domain;

 After receiving the metadata request message, the metadata access point in the security status information providing domain sends a metadata related to the terminal security status to the server in the security status information providing domain;

Providing, by the server in the security status information providing domain, the third party service through the connection interface The application server in the security status information request domain returns the metadata;

 The third-party service provider or the application server in the security status information request domain monitors and/or updates the security status of the terminal according to the metadata.

 The method for monitoring and updating the security status of the terminal according to claim 3, wherein the domain in which the terminal is located before the domain is used as the security state information request domain, and the domain in which the terminal is located after the domain is provided as the security state information. The domain, the requesting party is a server in the security state information requesting domain, and the provider provides a metadata access point in the domain for the security state information, the method includes:

 When the terminal security state changes or an abnormal situation, the terminal security state change or abnormal situation information is issued to the metadata access point in the security state information providing domain;

 The metadata access point in the security status information providing domain releases the terminal security status change or abnormal situation information to a server in the security status information providing domain;

 The server in the security status information providing domain sends the metadata related to the security status of the terminal to the server in the security status information requesting domain through the connection interface;

 The server in the security status information request domain monitors and/or updates the terminal according to the metadata.

 The method for monitoring and updating a terminal security state according to claim 5, wherein, when the terminal security state changes or an abnormal situation, the metadata access point is issued to the security state information providing domain. Security status changes or abnormal situation information, including:

 When the terminal security status changes or an abnormal situation occurs, the sensor/intrusion detection system/intrusion prevention system in the security status information providing domain issues a terminal security status change or abnormal situation information to the metadata access point in the security status information providing domain. .

 The method for monitoring and updating the security status of the terminal according to claim 5, wherein the server in the security status information requesting domain monitors and/or updates the terminal according to the metadata, including:

The server in the security status information request domain sends the metadata to a metadata access point in the security status information request domain; After the metadata access point in the security status information request domain summarizes and analyzes the metadata, the analysis result is notified to the server in the security status information request domain;

 The server in the security status information request domain monitors and/or updates the terminal according to the metadata analysis result.

 The method for monitoring and updating the security status of the terminal according to claim 3, wherein the domain in which the terminal is located before the domain serves as the security state information providing domain, and the domain in which the terminal crosses the domain as the security state information request The domain, the requesting party is a server in the security state information requesting domain, and the provider provides a metadata access point in the domain for the security state information, the method includes:

 The server in the security status information request domain sends a metadata request message to the server in the security status information providing domain through the connection interface;

 The server in the security status information providing domain sends the metadata request message to a metadata access point in the security status information providing domain;

 The metadata access point in the security state information providing domain receives the metadata request message, and when the security information of the terminal needs to be updated, notifies the server in the security state information providing domain that the security information of the terminal needs to be updated. ;

 The server in the security status information providing domain sends metadata to the server in the security status information request domain through the connection interface, and informs the terminal that the security information needs to be updated;

 Sending, by the server in the security status information request domain, the metadata to the metadata access point in the security status information requesting domain, informing the metadata access point that the security information of the terminal needs to be updated; the security status information The metadata access point in the request domain monitors and/or updates the terminal based on the metadata.

 9. A network system, comprising:

 Requester and provider;

The requesting party is configured to obtain metadata related to a terminal security state from the provider; the requesting party is a third-party service provider, or in a security state information requesting domain; the provider is in a security state information providing domain in; The requesting party monitors and/or updates the security status of the terminal according to the metadata related to the security status of the terminal.

 The network system according to claim 9, wherein the security status information providing domain further comprises: a server;

 The requestor provides a server in the domain through the security status information, and obtains metadata related to the terminal security status from the provider.

 The network system according to claim 10, wherein the server in the security status information providing domain is further connected with a connection interface;

 The requesting party obtains metadata related to the terminal security status from the provider by connecting the connection interface of the server in the security status information providing domain.

 The network system according to claim 11, wherein the domain in which the terminal crosses the domain is provided as a security state information providing domain, and the domain in which the terminal crosses the domain as a security state information requesting domain, the requesting party Providing a metadata access point in the domain for the security status information for the third-party service provider or the application server of the security status information requesting domain; the security status information providing domain further includes a server;

 The third-party service provider or the application server in the security status information request domain is configured to send a metadata request message to the server in the security state information providing domain through the connection interface;

 The security status information is provided by the server in the domain, and after receiving the metadata request message, is forwarded to the metadata access point in the security status information providing domain;

 The security status information providing a metadata access point in the domain, after receiving the metadata request message, sending, to the security status information, a server in the request domain to send metadata related to the security status of the terminal;

 The security status information providing a server in the domain, configured to return the metadata to a third-party service provider or an application server in a security state information request domain through a connection interface;

The third-party service provider or the application server in the security status information request domain monitors and/or updates the security status of the terminal according to the metadata.

The network system according to claim 11, wherein the domain in which the terminal crosses the domain is used as the security state information requesting domain, and the domain in which the terminal crosses the domain as the security state information providing domain, the requesting party The security status information request server in the domain, the provider provides a metadata access point in the domain for the security status information; the security status information providing domain further includes a server and any one of the following terminal security status information reporting devices:

 a sensor, or an intrusion detection system, or an intrusion prevention system;

 The terminal security status information reporting device in the security status information is used to issue terminal security status change or abnormal situation information to the metadata access point in the security status information providing domain when the terminal security status changes or abnormal conditions;

 The security status information provides a metadata access point in the domain, and is used to issue the terminal security status change or abnormal situation information to a server in the security status information providing domain;

 The security status information provides a server in the domain, configured to send, by using a connection interface, metadata related to the security status of the terminal to a server in the security status information request domain;

 The security status information request server in the domain is configured to monitor and/or update the terminal according to the metadata.

 The network system according to claim 13, wherein the security status information request domain further includes a metadata access point;

 The metadata access point in the security status information request field is configured to receive metadata sent by a server in the security status information request domain, summarize the metadata, analyze the metadata, and notify the analysis result. Request security status information for the server in the domain.

 The network system according to claim 11, wherein the domain in which the terminal is located before the domain is used as the security state information providing domain, and the domain in which the terminal crosses the domain is used as the security state information requesting domain, and the requesting party Requesting, by the security status information, a server in the domain, the provider provides a metadata access point in the domain for the security status information, and the security status information request domain further includes a metadata access point, where the security status information is provided in the domain. Also includes a server;

The security status information requesting a server in the domain for using the connection interface to provide security status information Providing a server in the domain to send a metadata request message;

 The security status information providing a server in the domain, configured to send the metadata request message to a metadata access point in a security status information providing domain;

 The security status information provides a metadata access point in the domain, and is used to receive the metadata request message. When the security information of the terminal needs to be updated, the security information of the terminal needs to be updated to notify the security status information providing domain. Server in ;

 The security status information is provided by the server in the domain, and is further configured to send metadata to the server in the security status information request domain through the connection interface, and notify the terminal that the security information needs to be updated;

 The security status information requesting server in the domain is further configured to send the metadata to the metadata access point in the security status information request domain, to notify the metadata access point, and the security information of the terminal needs to be updated;

 The metadata access point in the security status information request domain is further configured to monitor and/or update the terminal according to the metadata.