WO2016180134A1 - 管理信息安全规范库的方法和装置 - Google Patents
管理信息安全规范库的方法和装置 Download PDFInfo
- Publication number
- WO2016180134A1 WO2016180134A1 PCT/CN2016/078990 CN2016078990W WO2016180134A1 WO 2016180134 A1 WO2016180134 A1 WO 2016180134A1 CN 2016078990 W CN2016078990 W CN 2016078990W WO 2016180134 A1 WO2016180134 A1 WO 2016180134A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- information
- verification
- library
- configuration information
- security
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Definitions
- This document relates to, but is not limited to, the field of communications, and relates to a method and apparatus for managing an information security specification library.
- the complete network system security policy covers a lot of content.
- anti-virus, backup, content filtering, firewall, endpoint encryption, anti-malware tools and other technical controls should refer to the control of these technologies in the security policy, and should describe how Implement these controls to protect your organization's resources.
- the problem is that some enterprises do not pay attention to security management or lack of knowledge about the security domain of the network security administrator. As a result, the security policy of the entire enterprise is imperfect, and there are loopholes that may be exploited by hackers, which seriously threatens enterprise network security.
- the related technologies are mostly the verification and improvement of the configuration, and the management of the policy specification library is lacking. Therefore, how to manage the related security policy specification library is an urgent problem to be solved.
- Embodiments of the present invention provide a method and apparatus for managing an information security specification library, and implement management of an information security specification library.
- Embodiments of the present invention provide a method for managing an information security specification library, including: utilizing information The first specification and the second specification in the security specification library check the same configuration information to obtain a first verification result and a second verification result; comparing the first verification result and the second verification result, obtaining a comparison result; Comparing the results, determining difference information of the first specification and the second specification; and outputting management information about the first specification and the second specification in the information security specification library according to the difference information.
- the determining, according to the comparison result, the difference information of the first specification and the second specification including:
- difference information of the first specification and the second specification is obtained.
- the method further includes:
- the verification item is evaluated to determine the reason why the configuration information causes different degrees of compliance when the verification item is not complied with;
- the suggestion information is output.
- the method further includes:
- the notification updates the received verification entry to the template of the information security specification library; or,
- the notification corrects the verification items already in the information security specification library.
- the configuration information is pre-stored configuration information or randomly collected configuration information.
- An embodiment of the present invention provides an apparatus for managing an information security specification library, including: a verification module, configured to perform verification of the same configuration information by using the first specification and the second specification in the information security specification library, to obtain a first verification result and a first Second verification result; comparison module, set to compare the first core Checking the result and the second verification result to obtain a comparison result; the first determining module is configured to determine difference information of the first specification and the second specification according to the comparison result; the first output module is set according to the difference And outputting management information to the first specification and the second specification in the information security specification library.
- the first determining module includes:
- an obtaining unit configured to acquire, according to the comparison result, a verification item that the configuration information is not in the first specification and the second specification, respectively;
- the determining unit is configured to obtain difference information of the first specification and the second specification according to the obtained verification item.
- the device further includes:
- a second determining module configured to use the pre-stored evaluation template to evaluate the verification item, and determine a reason why the configuration information causes different compliance levels when the verification item is not complied with;
- the finding module is configured to search for the suggestion information corresponding to the reason according to the obtained reason;
- the second output module is configured to: output the suggestion information.
- the device further includes:
- a notification module configured to notify that the received verification item is updated into a template of the information security specification library; or, notify the deletion of an existing verification item in the template of the information security specification library; or, notify the pair The verification items existing in the information security specification library are modified.
- the configuration information is pre-stored configuration information or randomly collected configuration information.
- an embodiment of the present invention further provides a computer readable storage medium, where the computer readable storage medium stores computer executable instructions, and the method for implementing the management information security specification library when the computer executable instructions are executed .
- the same configuration information is checked by using the first specification and the second specification, and the first verification result and the second verification result are obtained, and the first verification result and the second verification result are compared, and the comparison result is obtained, and then Determining, according to the comparison result, difference information of the first specification and the second specification, and outputting, according to the difference information, the first specification and the information in the information security specification library
- the management information of the second specification facilitates the user to know the difference between the specifications, and provides a basis for further perfecting the specification in the future.
- FIG. 1 is a flowchart of a method for managing an information security specification library according to Embodiment 1 of the present invention
- FIG. 2 is a flowchart of a method for managing an information security specification library according to Embodiment 2 of the present invention
- FIG. 3 is a flowchart of a method for managing an information security specification library according to Embodiment 3 of the present invention.
- FIG. 4 is a flowchart of a method for managing an information security specification library according to Embodiment 4 of the present invention.
- FIG. 5 is a structural diagram of an apparatus for managing an information security specification library according to Embodiment 5 of the present invention.
- FIG. 6 is another structural diagram of an apparatus for managing an information security specification library according to Embodiment 5 of the present invention.
- FIG. 1 is a flowchart of a method for managing an information security specification library according to Embodiment 1 of the present invention.
- the method shown in Figure 1 includes:
- Step 101 Perform verification on the same configuration information by using the first specification and the second specification in the information security specification library to obtain a first verification result and a second verification result;
- Step 102 Compare the first verification result with the second verification result to obtain a comparison result
- Step 103 Determine difference information of the first specification and the second specification according to the comparison result
- Step 104 Output management information about the first specification and the second specification in the information security specification library according to the difference information.
- the method provided in this embodiment uses the first specification and the second specification to respectively check the same configuration information, obtains a first verification result and a second verification result, and compares the first verification result with the second verification result to obtain a comparison result. And determining, according to the comparison result, difference information of the first specification and the second specification, and outputting, according to the difference information, management of the first specification and the second specification in the information security specification library.
- the information is convenient for users to know the difference between the specifications, which provides a basis for further improving the information security specification library in the future.
- the information security specification includes a variety of knowledge specification libraries, including standard specification libraries, such as various risk libraries, compliance libraries, baseline libraries, etc., as well as user-defined specification libraries, such as security management policies. Libraries, etc., these checklists and checklists can provide verification of different requirements for devices, devices or systems from different dimensions.
- the configuration information mentioned above includes configuration information of the device, device or system.
- the configuration information may be obtained by, for example, a configuration command remote acquisition device, device, or system, or obtained from a maintenance management device of the device, device, or system, or locally configured or generated a configuration information file of the device, device, or system.
- Multiple different information security specification libraries can be selected for configuration information for configuration verification. For example, select two different specifications for configuration information for configuration verification.
- the configuration information is checked according to the configuration check entry in the specification 1, and the configuration verification result is generated by detecting the compliance degree of the relevant configuration information according to the configuration check entry.
- the configuration information is checked according to the configuration check entry in the specification 2, and the compliance check result of the configuration check information is detected according to the configuration check entry, and another configuration check result is generated.
- the configuration check items included in different specifications may be different. Therefore, the same configuration information has different compliance levels for different specifications.
- the security policy management device can analyze the causes of different compliance levels and find differences between different specifications. For example, no Compliance with the decision is based on whether there is a wide range between entries, whether certain items are more risky, and whether there are more vulnerabilities.
- the verification item is updated to the specification library template according to actual network security requirements.
- the specification library template may include a standard specification template, and may also include a customized specification template to improve the specification library function.
- FIG. 2 is a flowchart of a method for managing an information security specification library according to Embodiment 2 of the present invention.
- the security policy management device can not only provide reasonable suggestions for verification comparison analysis, but also support configuration changes, as shown in Figure 2:
- Step 202 Compare the foregoing configuration verification results, and compare the compliance degree of the same configuration information with respect to two different specifications.
- the step 202 may include: obtaining, according to the comparison result, a verification item that the configuration information is not in the first specification and the second specification respectively; and obtaining, according to the obtained verification item, the first specification and the second specification.
- Difference information For example, different specifications may contain different configuration check entries, so the same configuration information will have different levels of compliance for different specifications, and non-compliance items can be displayed.
- the security policy management device evaluation analysis function is based on the reason why the evaluation template causes different compliance levels for non-compliance analysis, and finds differences between different specifications. For example, if there is a wide range between non-compliance, some items have corresponding content. Higher risks, whether there are more vulnerabilities, etc., presented to the user for reference decisions.
- the verification item is evaluated to determine a reason why the configuration information causes different degrees of compliance when the verification item is not complied; according to the obtained reason, the recommendation information corresponding to the reason is searched; and the recommendation information is output.
- Step 204 Send an update specification library request to the security policy management device locally.
- a request to add an information security specification library entry can be sent to the security policy management device, the request content includes: add opcode + specification library ID to be operated + add entry sequence number + added specific entry Content;
- the security policy management device may send a request to modify the information security specification library entry, the request content includes: modify the operation code + the specification library ID to be operated + the modified entry number + the modified specific The content of the entry; also delete the check entry in the original specification library, and send a request to the security policy management device to delete the information security specification library entry, the request content includes: delete the operation code + the specification library ID to be operated + the deleted entry number (this The serial number is a unique identification number).
- the security policy management device parses the received request. If the content is required to add an entry to any information security specification library, the security policy management device invokes the information security specification library and performs an add operation.
- the specification library template that needs to be improved here can be either a standard specification template or a custom specification template.
- this embodiment supports an improvement of the information security specification library.
- the above-mentioned higher-risk verification items may be updated to the information security specification library template according to actual network security requirements, or unnecessary verification items in the specification library template may be deleted, and of course, the information security specification library module may be checked.
- the entry is changed.
- Support configuration information change function For example, for the configuration item whose verification result is non-compliant, the security policy management device supports the change of the configuration information according to the recommendation in the verification result, and may add, modify, or delete the configuration information. It also supports the delivery of the changed configuration information.
- the configuration file can be locally sent to the device, the device, or the system, or the configuration command can be sent to the remote device, device, or system to change the configuration information of the check entry.
- the method provided in the second embodiment of the present invention uses the first specification and the second specification to respectively check the same configuration information, obtains the first verification result and the second verification result, and compares the first verification result with the second verification result to obtain a comparison.
- sending according to the comparison result, determining difference information of the first specification and the second specification, and outputting, according to the difference information, the first specification and the second specification in the information security specification library Management information, which is convenient for users to know the difference between the specifications, and provides a basis for further improvement of the specification in the future; by determining the difference between the first specification and the second specification
- Different, according to the difference to make recommendations, to facilitate users to further improve the specification, in addition, through the change of configuration information, can effectively improve the accuracy of the configuration information.
- FIG. 3 is a flowchart of a method for managing an information security specification library according to Embodiment 3 of the present invention. As shown in FIG. 3, the method includes:
- Step 301 Select multiple different knowledge bases for configuration, and perform configuration verification.
- the specification template for selecting verification here may or may not include a template that needs to be improved.
- the configuration information is checked according to the configuration check entry in the specification 1, and the compliance check degree of the configuration check information is detected according to the configuration check entry, and the configuration check result is generated.
- the configuration information is checked according to the configuration check entry in the specification 2, and the compliance check degree of the configuration check information is detected according to the configuration check entry, and another configuration check result is generated.
- the security policy management device can support the method for checking and comparing the collected configuration information, and the collected configuration information includes configuration information of the device, the device, or the system. For example, you can remotely log in to the device, device, or system through the configuration command, or obtain it from the maintenance device of the device, device, or system.
- Step 302 Compare the two configuration verification results to compare the compliance of the same configuration information with two different specifications.
- different specifications may contain different configuration check entries, so the same configuration information will have different levels of compliance for different specifications, and non-compliance items can be displayed.
- Step 303 evaluating and analyzing
- the security policy management device evaluation analysis function is based on the reason why the evaluation template causes different compliance levels for non-compliance analysis, and finds differences between different specifications. For example, if there is a wide range between non-compliance, some items have corresponding content. Higher risks, whether there are more vulnerabilities, etc., presented to the user for reference decisions.
- Step 304 Send an update specification library request to the security policy management device.
- a request to add an information security specification library entry can be sent to the security policy management device, the request content includes: adding an opcode + to operate The specification library ID + add the item serial number + the specific item content added;
- the security policy management device may send a request to modify the information security specification library entry, the request content includes: modify the operation code + to operate Specification library ID + modified entry sequence number + modified specific entry content; also delete the original specification entry, you can send a request to the security policy management device to delete the information security specification library entry, the request content includes: delete operation code + to operate Specification library ID + deleted item number (the serial number is a unique identification number).
- Step 305 Receive and respond to the change request.
- the security policy management device parses the received request, and the content needs to add an entry to a specification library, and the security policy management device invokes the specification library and performs an add operation.
- the specification library template that needs to be improved here can be either a standard specification template or a custom specification template.
- this embodiment supports an improvement of the information security specification library.
- the above-mentioned higher-risk verification items may be updated to the information security specification library template according to actual network security requirements, or unnecessary verification items in the specification library template may be deleted, and of course, the information security specification library module may be checked. The entry is changed.
- the same configuration information is checked by using the first specification and the second specification, and the first verification result and the second verification result are obtained, and the first verification result and the second verification result are compared, and the comparison result is obtained. And determining, according to the comparison result, difference information of the first specification and the second specification, and outputting, according to the difference information, the first specification and the second specification in the information security specification library.
- Management information which is convenient for users to know the difference between the specifications, and provides a basis for further perfecting the specification in the future; by determining the difference between the first specification and the second specification, the suggestion information is proposed according to the difference, so that the user can further improve the specification, and By changing the configuration information, the accuracy of the configuration information can be effectively improved; the collected configuration information is used for verification, which improves the randomness of the data and provides assistance for subsequent acquisition of management data.
- FIG. 4 is a flowchart of a method for managing an information security specification library according to Embodiment 4 of the present invention. As shown in FIG. 4, the method includes:
- Step 401 Select a plurality of different knowledge bases for configuration information, and perform configuration verification.
- the specification template for selecting verification here may or may not include a template that needs to be improved.
- the configuration information is checked according to the configuration check entry in the specification 1, and the compliance check degree of the configuration check information is detected according to the configuration check entry, and the configuration check result is generated.
- the configuration information is checked according to the configuration check entry in the specification 2, and the compliance check degree of the configuration check information is detected according to the configuration check entry, and another configuration check result is generated.
- Step 404 Send an update specification library request to the security policy management device.
- a request to add an information security specification library entry may be sent to the security policy management device, the request content includes: adding an opcode + a specification repository ID to be operated + adding an entry sequence number + added Specific entry content; to modify the entry in the original specification, the security policy management device may send a request to modify the information security specification library entry, the request content includes: modify the operation code + the specification library ID to be operated + the modified entry sequence number + the modified specific The content of the entry; also delete the entry in the original specification, and send a request to the security policy management device to delete the information security specification library entry.
- the content of the request includes: delete the operation code + the specification library ID to be operated + the deleted entry number (the serial number is Unique identification number).
- Step 405 The security policy management device receives and responds to the change request.
- this embodiment supports an improvement of the information security specification library.
- the above-mentioned higher-risk verification items may be updated to the information security specification library template according to actual network security requirements, or unnecessary verification items in the information security specification library template may be deleted, and of course, the information security specification library module may be Check the entry to make changes.
- the steps can be as follows:
- FIG. 5 is a structural diagram of an apparatus for managing an information security specification library according to an embodiment of the present invention.
- the device shown in Figure 5 includes:
- the verification module 501 is configured to separately check the same configuration information by using the first specification and the second specification in the information security specification library to obtain a first verification result and a second verification result;
- the first determining module 503 is configured to determine difference information of the first specification and the second specification according to the comparison result;
- the first output module 504 is configured to output management information of the first specification and the second specification in the information security specification library according to the difference information.
- the first determining module includes:
- the obtaining unit 5031 is configured to acquire, according to the comparison result, a check item that the configuration information is not in the first specification and the second specification, respectively;
- the determining unit 5032 is configured to obtain difference information of the first specification and the second specification according to the obtained verification entry.
- the device further includes:
- the second determining module 505 is configured to use the pre-stored evaluation template to evaluate the verification condition, and determine the reason why the configuration information causes different compliance levels when the verification item is not complied with;
- the searching module 506 is configured to search for the suggestion information corresponding to the reason according to the obtained reason;
- the second output module 507 is configured to: output the suggestion information.
- the device further includes:
- the configuration information is pre-stored configuration information or randomly collected configuration information.
- the device for managing the information security specification library uses the first specification and the second specification to check the same configuration information, obtains the first verification result and the second verification result, and compares the first verification result with the second verification. As a result, a comparison result is obtained, and according to the comparison result, difference information of the first specification and the second specification is determined, and according to the difference information, the first specification and the location in the information security specification library are output.
- the management information of the second specification is convenient for the user to know the difference between the specifications, and provides a basis for further perfecting the specification in the future.
- an embodiment of the present invention further provides a computer readable storage medium, where the computer readable storage medium stores computer executable instructions, and the method for implementing the management information security specification library when the computer executable instructions are executed .
- all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the application is not limited to any particular combination of hardware and software.
- the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
- each device/function module/functional unit in the above embodiment When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
- the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
一种管理信息安全规范库的方法，包括：利用信息安全规范库中的第一规范和第二规范分别对同一配置信息进行核查，得到第一核查结果和第二核查结果；对比所述第一核查结果和第二核查结果，得到比较结果；根据所述比较结果，确定所述第一规范和第二规范的差异信息；根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息。
Description
本文涉及但不限于通信领域，涉及一种管理信息安全规范库的方法和装置。
目前，网络安全性正受到越来越普遍的关注，一方面因为网络入侵事件经常发生，另一方面由于网络安全性技术的大量涌现。如何利用网络安全性技术保护企业网络系统的安全成为大家所关心的问题。网络的安全性不是单纯的技术问题，它和系统的管理维护制度等方面密切相关。整个网络系统的安全性不仅依赖于安全可靠的网络操作、应用系统和网络设备的安全性，还依赖制定完整的安全策略。
完整的网络系统安全策略涵盖的内容很多，例如反病毒、备份、内容过滤、防火墙、端点加密、反恶意软件工具等技术控制手段应当在安全策略中涉及到对这些技术的控制，并应当描述如何实施这些控制来保护单位的资源。问题是一些企业存在对安全管理不重视或者网络安全管理员自身安全领域相关知识匮乏，导致整个企业安全策略不完善，存在可能被黑客利用的漏洞，严重威胁到企业网络安全。
相关技术多为对配置的核查与改进，缺乏对策略规范库的管理，因此如何管理相关安全策略规范库是亟待解决的问题。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供一种管理信息安全规范库的方法和装置，实现了对信息安全规范库的管理。
本发明实施例提供了一种管理信息安全规范库的方法，包括：利用信息
安全规范库中的第一规范和第二规范对同一配置信息进行核查，得到第一核查结果和第二核查结果；对比所述第一核查结果和第二核查结果，得到比较结果；根据所述比较结果，确定所述第一规范和第二规范的差异信息；根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息。
可选地，所述根据所述比较结果，确定所述第一规范和第二规范的差异信息，包括：
根据所述比较结果，获取所述配置信息分别在所述第一规范和第二规范中不遵从的核查条目；
根据得到的核查条目，得到所述第一规范和第二规范的差异信息。
可选地，所述根据得到的核查条目，得到所述第一规范和第二规范的差异信息之后，所述方法还包括：
利用预先存储的评估模板，对所述核查条目进行评估，确定所述配置信息对不遵从所述核查条目时造成不同遵从程度的原因；
根据得到的原因，查找所述原因对应的建议信息；
输出所述建议信息。
可选地，根据所述比较结果，确定所述第一规范和第二规范的差异信息之后，所述方法还包括：
通知将接收到的核查条目更新到所述信息安全规范库的模板中；或者，
通知对所述信息安全规范库的模板中已有的核查条目进行删除操作；或者，
通知对所述信息安全规范库中已有的核查条目进行修改操作。
可选地，所述配置信息为预先存储的配置信息或者随机采集得到的配置信息。
本发明实施例提供一种管理信息安全规范库的装置，包括：核查模块，设置为利用信息安全规范库中的第一规范和第二规范对同一配置信息进行核查，得到第一核查结果和第二核查结果；对比模块，设置为对比所述第一核
查结果和第二核查结果，得到比较结果；第一确定模块，设置为根据所述比较结果，确定所述第一规范和第二规范的差异信息；第一输出模块，设置为根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息。
可选地，所述第一确定模块包括：
获取单元，设置为根据所述比较结果，获取所述配置信息分别在所述第一规范和第二规范中不遵从的核查条目；
确定单元，设置为根据得到的核查条目，得到所述第一规范和第二规范的差异信息。
可选地，所述装置还包括：
第二确定模块，设置为利用预先存储的评估模板，对所述核查条目进行评估，确定所述配置信息对不遵从所述核查条目时造成不同遵从程度的原因；
查找模块，设置为根据得到的原因，查找所述原因对应的建议信息；
第二输出模块，设置为：输出所述建议信息。
可选地，所述装置还包括：
通知模块，设置为通知将接收到的核查条目更新到所述信息安全规范库的模板中；或者，通知对所述信息安全规范库的模板中已有的核查条目进行删除操作；或者，通知对所述信息安全规范库中已有的核查条目进行修改操作。
可选地，所述配置信息为预先存储的配置信息或者随机采集得到的配置信息。
此外，本发明实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机可执行指令，所述计算机可执行指令被执行时实现所述管理信息安全规范库的方法。
在本发明实施例中，利用第一规范和第二规范对同一配置信息进行核查，得到第一核查结果和第二核查结果，并对比第一核查结果和第二核查结果，得到比较结果，再根据所述比较结果，确定所述第一规范和第二规范的差异信息，根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和
所述第二规范的管理信息，方便用户获知规范之间的差异，为日后进一步完善规范提供了依据。
在阅读并理解了附图和详细描述后，可以明白其它方面。
图1为本发明实施例一提供的管理信息安全规范库的方法的流程图；
图2为本发明实施例二提供的管理信息安全规范库的方法的流程图；
图3为本发明实施例三提供的管理信息安全规范库的方法的流程图；
图4为本发明实施例四提供的管理信息安全规范库的方法的流程图；
图5为本发明实施例五提供的管理信息安全规范库的装置的结构图；
图6为本发明实施例五提供的管理信息安全规范库的装置的另一结构图。
下面将结合附图及具体实施例对本发明实施例的技术方案作进一步的详细描述。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
实施例一
图1为本发明实施例一提供的管理信息安全规范库的方法的流程图。图1所示方法包括：
步骤101、利用信息安全规范库中的第一规范和第二规范分别对同一配置信息进行核查，得到第一核查结果和第二核查结果；
步骤102、对比所述第一核查结果和第二核查结果，得到比较结果；
步骤103、根据所述比较结果，确定所述第一规范和第二规范的差异信息；
步骤104、根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息。
本实施例提供的方法，利用第一规范和第二规范分别对同一配置信息进行核查，得到第一核查结果和第二核查结果，并对比第一核查结果和第二核查结果，得到比较结果，再根据所述比较结果，确定所述第一规范和第二规范的差异信息，根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息，方便用户获知规范之间的差异，为日后进一步完善信息安全规范库提供了依据。
在实际应用中，信息安全规范包含各种丰富的知识规范库，既包含标准规范库，例如各种风险库、合规库、基线库等，也包含用户自定义的规范库，例如安全管理策略库等，这些核查库和核查条目可以从不同维度为设备、装置或系统提供不同需求的核查。
上文所说的配置信息包括设备、装置或系统的配置信息。配置信息可以通过例如配置命令远程采集设备、装置或系统获取，或者从设备、装置或系统的维护管理设备上获取，或者本地构建或生成设备、装置或系统的配置信息文件。
可以为配置信息选择多个不同的信息安全规范库，进行配置核查。例如，为配置信息选择两种不同的规范进行配置核查。将配置信息根据规范1中的配置核查条目进行核查，依据配置核查条目检测相关配置信息的遵从程度，生成配置核查结果。同样，将该配置信息根据规范2中的配置核查条目进行核查，依据配置核查条目检测相关配置信息的遵从程度，生成另一个配置核查结果。
将上述两个配置核查结果进行对比，比较同一配置信息针对两种不同规范的遵从程度。不同规范包含的配置核查条目可能会不同，因此同一配置信息对不同规范的核查有不同的遵从程度，安全策略管控设备可以分析造成不同遵从程度的原因，找出不同规范间的差异，例如，不遵从条目间是否存在范围太宽、某些条目对应内容是否有更高风险、是否存在更大漏洞等，展示给用户参考决策。可选地，支持根据实际网络安全需求将核查条目更新到规范库模版中，这里的规范库模版可以包括标准规范模版，也可以包括自定义的规范模版，从而完善规范库功能。
实施例二
下面对本发明实施例提供的方法作进一步说明：
图2为本发明实施例二提供的管理信息安全规范库的方法的流程图。在此实施例中，安全策略管控设备不仅可以对核查对比分析给出合理建议，同时还支持配置的变更，如图2所示：
步骤201、配置信息选择多个不同的知识库，进行配置核查；
例如，为配置选择两种不同的规范进行配置核查，这里选择核查用的规范模版既可以包含需要改进更新的模版，也可以不包含。将配置信息，根据规范1中的配置核查条目进行核查，依据配置核查条目检测相关配置信息的遵从程度，生成配置核查结果。同样，将配置信息，根据规范2中的配置核查条目进行核查，依据配置核查条目检测相关配置信息的遵从程度，生成另一个配置核查结果。
步骤202、对比上述配置核查结果，比较同一配置信息针对两种不同规范的遵从程度；
步骤202可以包括：根据所述比较结果，获取所述配置信息分别在所述第一规范和第二规范中不遵从的核查条目；根据得到的核查条目，得到所述第一规范和第二规范的差异信息。例如，不同规范包含的配置核查条目可能会不同，因此同一配置信息对不同规范的核查会有不同的遵从程度，可以将不遵从条目整理展示。安全策略管控设备评估分析功能是根据评估模版对不遵从条目分析造成不同遵从程度的原因，找出不同规范间的差异，例如，不遵从条目间是否存在范围太宽，某些条目对应内容是否有更高风险、是否存在更大漏洞等，展示给用户参考决策。
步骤203、利用预先存储的评估模板，对所述核查条目进行评估；
对所述核查条目进行评估从而确定所述配置信息对不遵从所述核查条目时造成不同遵从程度的原因；根据得到的原因，查找所述原因对应的建议信息；输出所述建议信息。
其中，建议信息可以是预先存储的，在确定原因后，通过查找对应建议信息，并将查找到的建议信息输出给用户，为用户进一步完善信息安全规范库提供了帮助。
步骤204、向本地给安全策略管控设备发送更新规范库请求；
例如，要添加核查条目到规范库中，可以给安全策略管控设备发送一个添加信息安全规范库条目的请求，请求内容包含：添加操作码+要操作的规范库ID+添加条目序号+添加的具体条目内容；要修改原规范库中核查条目，可以给安全策略管控设备发送一个修改信息安全规范库条目的请求，请求内容包含：修改操作码+要操作的规范库ID+修改的条目序号+修改的具体条目内容；同样要删除原规范库中核查条目，可以给安全策略管控设备发送一个删除信息安全规范库条目的请求，请求内容包含：删除操作码+要操作的规范库ID+删除的条目序号(该序号为唯一标识号)。
步骤205、安全策略管控设备接收并响应更新规范库请求。
例如，安全策略管控设备对收到的请求进行解析，如果得到内容是需要添加条目到任一信息安全规范库中，则安全策略管控设备会调用该信息安全规范库并执行添加操作。这里需要改进的规范库模版既可以是标准规范模版，也可以是自定义的规范模版。
可选地，本实施例支持信息安全规范库的改进。例如，可以根据实际网络安全需求，将上述存在更高风险的核查条目更新到信息安全规范库模版中，或者删除规范库模版中不必要的核查条目，当然还可以对信息安全规范库模块中核查条目进行变更。支持配置信息变更功能。例如，对于上述核查结果为不遵从的配置项，安全策略管控设备根据核查结果中的建议，支持对配置信息的变更，可以是添加、修改、删除配置信息等。还支持将变更后的配置信息下发。例如可以本地构建配置文件下发到设备、装置或系统上，也可以直接远程设备、装置或系统，下发配置命令，使其变更为符合核查条目的配置信息。
本发明实施例二提供的方法，利用第一规范和第二规范分别对同一配置信息进行核查，得到第一核查结果和第二核查结果，并对比第一核查结果和第二核查结果，得到比较结果，再根据所述比较结果，确定所述第一规范和第二规范的差异信息，根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息，方便用户获知规范之间的差异，为日后进一步完善规范提供了依据；通过确定第一规范和第二规范之间的差
异，根据该差异提出建议信息，方便用户进一步完善规范，另外，通过对配置信息的变更，可以有效提高配置信息的准确性。
实施例三
图3为本发明实施例三提供的管理信息安全规范库的方法的流程图。如图3所示，所述方法包括：
步骤301、为配置选择多个不同的知识库，进行配置核查；
例如，为配置信息选择两种不同的规范进行配置核查，这里选择核查用的规范模版既可以包含需要改进更新的模版，也可以不包含。将配置信息，根据规范1中的配置核查条目进行核查，依据配置核查条目检测相关配置信息的遵从程度，生成配置核查结果。同样，将配置信息，根据规范2中的配置核查条目进行核查，依据配置核查条目检测相关配置信息的遵从程度，生成另一配置核查结果。
在本实施例中，安全策略管控设备可以支持通过采集的配置信息进行核查对比分析的方法，采集的配置信息包括设备、装置或系统的配置信息。例如，可以通过配置命令远程登录设备、装置或系统采集获取，或者从设备、装置或系统的维护管理设备上获取。
步骤302、对比上述两个配置核查结果，比较同一配置信息针对两种不同规范的遵从程度；
例如，不同规范包含的配置核查条目可能会不同，因此同一配置信息对不同规范的核查会有不同的遵从程度，可以将不遵从条目整理展示。
步骤303、评估分析；
安全策略管控设备评估分析功能是根据评估模版对不遵从条目分析造成不同遵从程度的原因，找出不同规范间的差异，例如，不遵从条目间是否存在范围太宽，某些条目对应内容是否有更高风险、是否存在更大漏洞等，展示给用户参考决策。
步骤304、给安全策略管控设备发送更新规范库请求；
例如，要添加核查条目到信息安全规范库中，可以给安全策略管控设备发送一个添加信息安全规范库条目的请求，请求内容包含：添加操作码+要操
作的规范库ID+添加条目序号+添加的具体条目内容；要修改原规范中条目，可以给安全策略管控设备发送一个修改信息安全规范库条目的请求，请求内容包含：修改操作码+要操作的规范库ID+修改的条目序号+修改的具体条目内容；同样要删除原规范中条目，可以给安全策略管控设备发送一个删除信息安全规范库条目的请求，请求内容包含：删除操作码+要操作的规范库ID+删除的条目序号(该序号为唯一标识号)。
步骤305、接收并响应变更请求。
例如，安全策略管控设备对收到的请求进行解析，得到内容是需要添加条目到某规范库中，安全策略管控设备会调用该规范库并执行添加操作。这里需要改进的规范库模版既可以是标准规范模版，也可以是自定义的规范模版。
可选地，本实施例支持信息安全规范库的改进。例如，可以根据实际网络安全需求，将上述存在更高风险的核查条目更新到信息安全规范库模版中，或者删除规范库模版中不必要的核查条目，当然还可以对信息安全规范库模块中核查条目进行变更。
本发明实施例三提供的方法，利用第一规范和第二规范对同一配置信息进行核查，得到第一核查结果和第二核查结果，并对比第一核查结果和第二核查结果，得到比较结果，再根据所述比较结果，确定所述第一规范和第二规范的差异信息，根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息，方便用户获知规范之间的差异，为日后进一步完善规范提供了依据；通过确定第一规范和第二规范之间的差异，根据该差异提出建议信息，方便用户进一步完善规范，另外，通过对配置信息的变更，可以有效提高配置信息的准确性；利用采集得到的配置信息进行核查，提高了数据的随机性，为后续获取管理数据提供了帮助。
实施例四
图4为本发明实施例四提供的管理信息安全规范库的方法的流程图。如图4所示，所述方法包括：
步骤401、为配置信息选择多个不同的知识库，进行配置核查；
例如，为配置选择两种不同的规范进行配置核查，这里选择核查用的规范模版既可以包含需要改进更新的模版，也可以不包含。将配置信息，根据规范1中的配置核查条目进行核查，依据配置核查条目检测相关配置信息的遵从程度，生成配置核查结果。同样，将配置信息，根据规范2中的配置核查条目进行核查，依据配置核查条目检测相关配置信息的遵从程度，生成另一个配置核查结果。
在此实施例中，安全策略管控设备可以支持通过计划配置进行核查对比分析，从而增强安全策略规范的方法，配置信息为设备、装置或系统的配置信息文件。例如，可以通过本地构建或生成设备、装置或系统的计划配置信息文件。
步骤402、将上述两个配置核查结果进行对比，比较同一配置信息针对两种不同规范的遵从程度；
例如，不同规范包含的配置核查条目可能会不同，因此同一配置信息对不同规范的核查会有不同的遵从程度，可以将不遵从条目整理展示。
步骤403、评估分析；
安全策略管控设备评估分析功能是根据评估模版对不遵从条目分析造成不同遵从程度的原因，找出不同规范间的差异，例如，不遵从条目间是否存在范围太宽，某些条目对应内容是否有更高风险、是否存在更大漏洞等，展示给用户参考决策。
步骤404、给安全策略管控设备发送更新规范库请求；
例如，要添加核查条目到信息安全规范库中，可以给安全策略管控设备发送一个添加信息安全规范库条目的请求，请求内容包含：添加操作码+要操作的规范库ID+添加条目序号+添加的具体条目内容；要修改原规范中条目，可以给安全策略管控设备发送一个修改信息安全规范库条目的请求，请求内容包含：修改操作码+要操作的规范库ID+修改的条目序号+修改的具体条目内容；同样要删除原规范中条目，可以给安全策略管控设备发送一个删除信息安全规范库条目的请求，请求内容包含：删除操作码+要操作的规范库ID+删除的条目序号(该序号为唯一标识号)。
步骤405、安全策略管控设备接收并响应变更请求。
例如，安全策略管控设备对收到的请求进行解析，得到内容是需要添加条目到任一规范库中，安全策略管控设备会调用该信息安全规范库并执行添加操作。这里需要改进的信息安全规范库模版既可以是标准规范模版，也可以是自定义的规范模版。
可选地，本实施例支持信息安全规范库的改进。例如，可以根据实际网络安全需求，将上述存在更高风险的核查条目更新到信息安全规范库模版中，或者删除信息安全规范库模版中不必要的核查条目，当然还可以对信息安全规范库模块中核查条目进行变更。步骤可以如下：
本发明实施例四提供的方法，利用第一规范和第二规范分别对同一配置信息进行核查，得到第一核查结果和第二核查结果，并对比第一核查结果和第二核查结果，得到比较结果，再根据所述比较结果，确定所述第一规范和第二规范的差异信息，根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息，方便用户获知规范之间的差异，为日后进一步完善规范提供了依据；通过确定第一规范和第二规范之间的差异，根据该差异提出建议信息，方便用户进一步完善规范，另外，通过对配置信息的变更，可以有效提高配置信息的准确性；通过预先存储的配置信息进行检测，减少了配置数据的采集流程，减少了前期的准备时间，提高了处理速度。
实施例五
图5为本发明实施例提供的管理信息安全规范库的装置的结构图。图5所示装置包括：
核查模块501，设置为利用信息安全规范库中的第一规范和第二规范分别对同一配置信息进行核查，得到第一核查结果和第二核查结果；
对比模块502，设置为对比所述第一核查结果和第二核查结果，得到比较结果；
第一确定模块503，设置为根据所述比较结果，确定所述第一规范和第二规范的差异信息；
第一输出模块504，设置为根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息。
可选地，如图6所示，所述第一确定模块包括：
获取单元5031，设置为根据所述比较结果，获取所述配置信息分别在所述第一规范和第二规范中不遵从的核查条目；
确定单元5032，设置为根据得到的核查条目，得到所述第一规范和第二规范的差异信息。
可选的，所述装置还包括：
第二确定模块505，设置为利用预先存储的评估模板，对所述核查条件进行评估，确定所述配置信息对不遵从所述核查条目时造成不同遵从程度的原因；
查找模块506，设置为根据得到的原因，查找所述原因对应的建议信息；
第二输出模块507，设置为：输出所述建议信息。
可选的，所述装置还包括：
通知模块508，设置为通知将接收到的核查条目更新到所述信息安全规范库的模板中；或者，通知对所述信息安全规范库的模板中已有的核查条目进行删除操作；或者，通知对所述信息安全规范库中已有的核查条目进行修改操作。
可选的，所述配置信息为预先存储的配置信息或者随机采集得到的配置信息。
本发明实施例提供的管理信息安全规范库的装置，利用第一规范和第二规范对同一配置信息进行核查，得到第一核查结果和第二核查结果，并对比第一核查结果和第二核查结果，得到比较结果，再根据所述比较结果，确定所述第一规范和第二规范的差异信息，根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息，方便用户获知规范之间的差异，为日后进一步完善规范提供了依据。
此外，本发明实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机可执行指令，所述计算机可执行指令被执行时实现所述管理信息安全规范库的方法。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本申请不限制于任何特定的硬件和软件结合。
上述实施例中的各装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的各装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求所述的保护范围为准。
上述技术方案可以方便用户获知规范之间的差异，为日后进一步完善规范提供了依据；同时可以有效提高配置信息的准确性，减少配置数据的采集流程，减少前期的准备时间，提高处理速度。
Claims (11)
- 一种管理信息安全规范库的方法，包括：利用信息安全规范库中的第一规范和第二规范分别对同一配置信息进行核查，得到第一核查结果和第二核查结果；对比所述第一核查结果和第二核查结果，得到比较结果；根据所述比较结果，确定所述第一规范和第二规范的差异信息；根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息。
- 根据权利要求1所述的方法，其中，所述根据所述比较结果，确定所述第一规范和第二规范的差异信息，包括：根据所述比较结果，获取所述配置信息分别在所述第一规范和第二规范中不遵从的核查条目；根据得到的核查条目，得到所述第一规范和第二规范的差异信息。
- 根据权利要求2所述的方法，所述根据得到的核查条目，得到所述第一规范和第二规范的差异信息之后，所述方法还包括：利用预先存储的评估模板，对所述核查条目进行评估，确定所述配置信息对不遵从所述核查条目时造成不同遵从程度的原因；根据得到的原因，查找所述原因对应的建议信息；输出所述建议信息。
- 根据权利要求2所述的方法，根据所述比较结果，确定所述第一规范和第二规范的差异信息之后，所述方法还包括：通知将得到的核查条目更新到所述信息安全规范库的模板中；或者，通知对所述信息安全规范库的模板中已有的核查条目进行删除操作；或者，通知对所述信息安全规范库中已有的核查条目进行修改操作。
- 根据权利要求1所述的方法，其中，所述配置信息为预先存储的配置 信息或者随机采集得到的配置信息。
- 一种管理信息安全规范库的装置，包括：核查模块，设置为利用信息安全规范库中的第一规范和第二规范分别对同一配置信息进行核查，得到第一核查结果和第二核查结果；对比模块，设置为对比所述第一核查结果和第二核查结果，得到比较结果；第一确定模块，设置为根据所述比较结果，确定所述第一规范和第二规范的差异信息；第一输出模块，设置为根据所述差异信息，输出对所述信息安全规范库中的所述第一规范和所述第二规范的管理信息。
- 根据权利要求6所述的装置，其中，所述第一确定模块包括：获取单元，设置为根据所述比较结果，获取所述配置信息分别在所述第一规范和第二规范中不遵从的核查条目；确定单元，设置为根据得到的核查条目，得到所述第一规范和第二规范的差异信息。
- 根据权利要求7所述的装置，所述装置还包括：第二确定模块，设置为利用预先存储的评估模板，对所述核查条目进行评估，确定所述配置信息对不遵从所述核查条目时造成不同遵从程度的原因；查找模块，设置为根据得到的原因，查找所述原因对应的建议信息；第二输出模块，设置为：输出所述建议信息。
- 根据权利要求6所述的装置，所述装置还包括：通知模块，设置为通知将得到的核查条目更新到所述信息安全规范库的模板中；或者，通知对所述信息安全规范库的模板中已有的核查条目进行删除操作；或者，通知对所述信息安全规范库中已有的核查条目进行修改操作。
- 根据权利要求6所述的装置，其中，所述配置信息为预先存储的配置信息或者随机采集得到的配置信息。
- 一种计算机可读存储介质，所述计算机可读存储介质中存储有计算 机可执行指令，所述计算机可执行指令被执行时实现权利要求1～5任一项所述的方法；规范库中的所述第一规范和所述第二规范的管理信息。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510236503.3 | 2015-05-11 | ||
| CN201510236503.3A CN106302304A (zh) | 2015-05-11 | 2015-05-11 | 管理信息安全规范库的方法和装置 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2016180134A1 true WO2016180134A1 (zh) | 2016-11-17 |
Family
ID=57248846
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2016/078990 WO2016180134A1 (zh) | 2015-05-11 | 2016-04-11 | 管理信息安全规范库的方法和装置 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN106302304A (zh) |
| WO (1) | WO2016180134A1 (zh) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112737818A (zh) * | 2020-12-17 | 2021-04-30 | 南京方东通信系统工程有限公司 | 一种网络安全的自动配置管理系统及方法 |
| CN113241180A (zh) * | 2021-06-01 | 2021-08-10 | 北京京东拓先科技有限公司 | 健康管理方法和装置 |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102341808A (zh) * | 2009-03-04 | 2012-02-01 | 皇家飞利浦电子股份有限公司 | 指定访问控制策略 |
| EP2819346A1 (en) * | 2013-06-28 | 2014-12-31 | Kaspersky Lab, ZAO | System and method for automatically configuring application control rules |
| WO2015040456A1 (en) * | 2013-09-19 | 2015-03-26 | Telefonaktiebolaget Lm Ericsson (Publ) | System and method for priority-based rule generation with consistency check and policy enforcement |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101309177B (zh) * | 2008-07-11 | 2012-01-11 | 中国移动通信集团云南有限公司 | 一种网络资源数据管理方法及系统 |
| WO2011144109A2 (zh) * | 2011-05-27 | 2011-11-24 | 华为技术有限公司 | 核查网元配置的业务规则的方法和核查系统 |
| CN104363107B (zh) * | 2014-10-21 | 2017-11-17 | 中国联合网络通信集团有限公司 | 一种安全基线核查方法和设备 |
-
2015
- 2015-05-11 CN CN201510236503.3A patent/CN106302304A/zh active Pending
-
2016
- 2016-04-11 WO PCT/CN2016/078990 patent/WO2016180134A1/zh active Application Filing
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102341808A (zh) * | 2009-03-04 | 2012-02-01 | 皇家飞利浦电子股份有限公司 | 指定访问控制策略 |
| EP2819346A1 (en) * | 2013-06-28 | 2014-12-31 | Kaspersky Lab, ZAO | System and method for automatically configuring application control rules |
| WO2015040456A1 (en) * | 2013-09-19 | 2015-03-26 | Telefonaktiebolaget Lm Ericsson (Publ) | System and method for priority-based rule generation with consistency check and policy enforcement |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106302304A (zh) | 2017-01-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11755974B2 (en) | Computer augmented threat evaluation | |
| US20200137097A1 (en) | System and method for securing an enterprise computing environment | |
| US11727143B2 (en) | Live discovery of enterprise threats based on security query activity | |
| US10291637B1 (en) | Network anomaly detection and profiling | |
| US20220232040A1 (en) | Advanced cybersecurity threat mitigation using software supply chain analysis | |
| US20230114821A1 (en) | Incremental enrichment of threat data | |
| Ali et al. | Trust in IoT: dynamic remote attestation through efficient behavior capture | |
| EP2880579A1 (en) | Conjoint vulnerability identifiers | |
| WO2023064007A1 (en) | Augmented threat investigation | |
| WO2016180134A1 (zh) | 管理信息安全规范库的方法和装置 | |
| WO2016180088A1 (zh) | 一种配置信息的合规检测方法和装置 | |
| CN114268481A (zh) | 内网终端违规外联信息处理方法、装置、设备和介质 | |
| Grojek et al. | Ontology-driven artificial intelligence in IoT forensics | |
| US11592811B2 (en) | Methods and apparatuses for defining authorization rules for peripheral devices based on peripheral device categorization | |
| CN115801620A (zh) | 一种终端安全管理系统及方法 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16791984 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 16791984 Country of ref document: EP Kind code of ref document: A1 |