WO2023159994A1

WO2023159994A1 - Operation and maintenance processing method, and terminal device

Info

Publication number: WO2023159994A1
Application number: PCT/CN2022/127819
Authority: WO
Inventors: 韩科科; 郭志强; 韩东; 焦成伟
Original assignee: 华为技术有限公司
Priority date: 2022-02-28
Filing date: 2022-10-27
Publication date: 2023-08-31
Also published as: CN116708210A

Abstract

Disclosed in the embodiments of the present application are an operation and maintenance processing method, and a terminal device, which are used for reducing the security risk of an operation and maintenance user. The operation and maintenance processing method provided in the embodiments of the present application comprises: receiving a service access request sent by an operation and maintenance user by means of an operation and maintenance terminal; performing multi-factor identity authentication on the operation and maintenance user on the basis of the service access request; once the operation and maintenance user passes the multi-factor identity authentication, acquiring, from a work order system, a work order task to be executed by the operation and maintenance user, acquiring identity data of the operation and maintenance user from an identity authentication management system, acquiring terminal risk data of the operation and maintenance terminal from a terminal risk perception system, and acquiring service security data from a service providing system; performing trust evaluation on the operation and maintenance user on the basis of the work order task, the identity data, the terminal risk data and the service security data, so as to obtain a trust evaluation result; and generating an access control policy on the basis of the trust evaluation result.

Description

An operation and maintenance processing method and terminal equipment

This application claims the priority of the Chinese patent application with the application number 202210191834.X and the title of the invention "an operation and maintenance processing method and terminal equipment" submitted to the China Patent Office on February 28, 2022, the entire contents of which are incorporated by reference in this application.

technical field

The present application relates to the technical field of computer networks, and in particular to an operation and maintenance processing method and terminal equipment.

Background technique

The current network of operators is becoming more and more complex. The coexistence of multiple standards on the existing network and the larger network scale make business management more complex and difficult, which brings new challenges to network security operation and maintenance management. The operation and maintenance management plane is the core network hub of the operator's network infrastructure. On the operation and maintenance management plane, the operator's network can be managed, such as going online and configuring new equipment, changing the existing infrastructure, and monitoring the running equipment. or modification of the service, etc. The operation and maintenance management plane has become the primary target of malicious attacks by attackers to disrupt the operation of the operator's network. Attackers use the operation and maintenance management plane to launch potential attacks, which may cause great security risks to the operator's business.

In order to ensure that the operation and maintenance users can safely access the network, the identity of the operation and maintenance user needs to be authenticated. After the authentication is passed, the user is granted the corresponding operation and maintenance operation authority according to the role, and the operation and maintenance user can log in to the network management system and network elements. Perform corresponding operation and maintenance operations. At present, the static authorization of operation and maintenance users can include, for example: when the operation and maintenance users log in to the network management system or network elements, the user identity is authenticated in the form of user name and password. certified. Faced with an increasingly complex network environment, the current static authorization scheme for operation and maintenance users has a problem of high network security risks.

Contents of the invention

Embodiments of the present application provide an operation and maintenance processing method and a terminal device, which are used to reduce security risks of operation and maintenance users.

In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

In the first aspect, the embodiment of the present application provides an operation and maintenance processing method. The method includes: receiving a service access request sent by an operation and maintenance user through an operation and maintenance terminal; Identity authentication: after the operation and maintenance user passes the multi-factor identity authentication, obtain the work order task of the operation and maintenance user to be executed from the work order system, and obtain the identity of the operation and maintenance user from the identity authentication management system data, and obtain the terminal risk data of the operation and maintenance terminal from the terminal risk awareness system, and obtain the service security data from the service provision system; according to the work order task, the identity data, the terminal risk data and the service The security data conducts a trust assessment on the operation and maintenance user to obtain a trust assessment result; an access control policy is generated according to the trust assessment result.

In the above scheme, multi-factor identity authentication is performed on the operation and maintenance user according to the business access request; after the operation and maintenance user passes the multi-factor authentication, the work order task to be executed by the operation and maintenance user is obtained from the work order system, and The management system obtains the identity data of the operation and maintenance user, obtains the terminal risk data of the operation and maintenance terminal from the terminal risk perception system, and obtains the business security data from the service provision system; according to the work order task, identity data, terminal risk data and business security data Conduct trust assessment for operation and maintenance users, and generate access control policies based on the results of the trust assessment. The access control policies include the control methods for operation and maintenance operations of operation and maintenance users, so that the operation and maintenance operations of operation and maintenance users can be accurately controlled To ensure the safe access of operation and maintenance users and reduce the security risks of operation and maintenance users.

In a possible implementation manner, the method further includes: performing dynamic access control on the operation and maintenance operations performed by the operation and maintenance user according to the access control policy. In the above solution, after the access control policy is generated, dynamic access control is performed on the operation and maintenance operations performed by the operation and maintenance users according to the access control policy, which can ensure the safe access of the operation and maintenance users and reduce the security risks of the operation and maintenance users.

In a possible implementation manner, the performing dynamic access control on the operation and maintenance operation performed by the operation and maintenance user according to the access control policy includes: For each session, an authorization instruction is generated according to the access control policy and the work order task, and the authorization instruction is used to instruct the operation and maintenance user to perform the task content according to the authorization set and prohibit the operation and maintenance user from executing the work order. Task content other than a single task; perform authority monitoring on the operation and maintenance operations performed by the operation and maintenance user according to the authorization instruction. In the above scheme, the policy execution point monitors the task content of the operation and maintenance user in each session and the operation and maintenance operation performed by the operation and maintenance user according to the authorization instruction, so that the operation and maintenance user performs the task content according to the authorization set, and Operation and maintenance users are prohibited from performing tasks other than work order tasks to ensure safe access of operation and maintenance users and reduce security risks for operation and maintenance users.

In a possible implementation, the authorization set includes at least one of the following: the account of the operation and maintenance user, the role of the operation and maintenance user to perform operation and maintenance operations, and the role of the operation and maintenance user to perform operation and maintenance operations. time, the operation instruction for the operation and maintenance user to perform the operation and maintenance operation, and the operation and maintenance user has the authority to access the service provision system. In the above solution, the authorization set can control roles, time, instructions, permissions, etc., so that the operation and maintenance users can only perform specific tasks according to the authorization set. Execution time, user, type of NE and operation command in the order. The policy execution point starts the scheduled task according to the work order task, and when the task execution time is reached, the corresponding operation command authority is given to the execution role and user.

In a possible implementation, the method further includes: generating the access control policy to a policy enforcement point, so that the operation and maintenance operation performed by the policy enforcement point on the operation and maintenance user according to the access control policy Perform dynamic access control. In the above solution, the policy decision point can send the access control policy to the policy enforcement point through the transmission channel between the policy decision point and the policy enforcement point, so that the policy enforcement point can implement the operation and maintenance operation performed by the operation and maintenance user according to the access control policy. Dynamic access control.

In a possible implementation manner, the trust assessment is performed on the operation and maintenance user according to the work order task, the identity data, the terminal risk data and the business security data, and a trust assessment result is obtained, including : Generate a trust evaluation model of the operation and maintenance user according to the work order task, the identity data, the terminal risk data and the business security data; acquire the abnormal behavior of the operation and maintenance user according to the trust evaluation model ; determining the operation and maintenance operation risk parameters of the operation and maintenance user according to the abnormal behavior of the operation and maintenance user and the predetermined user historical behavior baseline; generating the trust evaluation result according to the operation and maintenance operation risk parameters. In the above scheme, after the operation and maintenance operation risk parameters are generated by the policy decision point, the operation and maintenance operation risk parameters can be used as the trust evaluation result, or the operation and maintenance users can be scored according to the operation and maintenance operation risk parameters, so as to generate the trust evaluation result . In the embodiment of this application, the policy decision point can identify the abnormal behavior of the operation and maintenance user through the trust evaluation model, and generate the trust evaluation result of the operation and maintenance user through the abnormal behavior and the user's historical behavior baseline, which can realize accurate evaluation of the operation and maintenance user and improve The evaluation accuracy and evaluation efficiency of operation and maintenance users.

In a possible implementation manner, the access control policy includes: a user risk level and a corresponding access control method; wherein, when the user risk level is a low-level risk, the corresponding access control method includes at least one of the following : bubbling reminder, report alarm; or, when the user risk level is a medium level risk, the corresponding access control method includes at least one of the following: secondary identity authentication, prohibiting execution of high-risk operations; or, when the user risk level The level is high-level risk, and the corresponding access control methods include at least one of the following: forced logout of users, deactivation of users. In the above solution, access control policies are dynamically generated based on the trust evaluation results of operation and maintenance users, such as the trust score and risk level for each access session of operation and maintenance users, combined with context information, different levels of risk correspond to different levels of Access control methods to achieve precise control over O&M operations.

In a possible implementation manner, the service security data includes: operation and maintenance security logs, operation logs, and security events of the service provision system. In the above solution, the service provision system can provide service access functions to operation and maintenance users, and the service provision system can also record service security data when providing service access. The operation and maintenance security logs, operation logs and security events of the service provision system can all be As business security data, it depends on the application scenario.

In a possible implementation manner, the service providing system includes at least one of the following: a network management and control unit, and a service access network element. In the above solution, the service provision system has multiple implementation methods for different types of services performed by the operation and maintenance users. For example, the network management and control unit can provide service access functions to the operation and maintenance users. Provide business access functions to operation and maintenance users.

In the second aspect, the embodiment of the present application also provides an operation and maintenance processing method, the method comprising: obtaining an access control policy from a policy decision point; performing dynamic access to the operation and maintenance operation performed by the operation and maintenance user according to the access control policy control.

In the above solution, the access control policy from the policy decision point is obtained; and the operation and maintenance operations performed by the operation and maintenance user are dynamically accessed according to the access control policy. The access control strategy includes the control method for the operation and maintenance operation of the operation and maintenance user, so that the operation and maintenance operation of the operation and maintenance user is within the precise controllable range, ensuring the safe access of the operation and maintenance user, and reducing the security risk of the operation and maintenance user .

In a possible implementation manner, the dynamic access control of the operation and maintenance operation performed by the operation and maintenance user according to the access control policy includes: obtaining the work order task to be executed by the operation and maintenance user; For each session generated when the operation and maintenance user performs the operation and maintenance operation, an authorization instruction is generated according to the access control policy and the work order task, and the authorization instruction is used to instruct the operation and maintenance user to execute according to the authorization set The content of the task and prohibit the operation and maintenance user from performing the task content other than the task of the work order; perform authority monitoring on the operation and maintenance operation performed by the operation and maintenance user according to the authorization instruction. In the above scheme, the policy execution point monitors the task content of the operation and maintenance user in each session and the operation and maintenance operation performed by the operation and maintenance user according to the authorization instruction, so that the operation and maintenance user performs the task content according to the authorization set, and Operation and maintenance users are prohibited from performing tasks other than work order tasks to ensure safe access of operation and maintenance users and reduce security risks for operation and maintenance users.

In a possible implementation, the authorization set includes at least one of the following: the account of the operation and maintenance user, the role of the operation and maintenance user to perform operation and maintenance operations, and the role of the operation and maintenance user to perform operation and maintenance operations. time, the operation instruction for the operation and maintenance user to perform the operation and maintenance operation, and the operation and maintenance user has the authority to access the service provision system. In the above scheme,

In a possible implementation manner, the access control policy includes: a user risk level and a corresponding access control method; wherein, when the user risk level is a low-level risk, the corresponding access control method includes at least one of the following : bubbling reminder, report alarm; or, when the user risk level is a medium level risk, the corresponding access control method includes at least one of the following: secondary identity authentication, prohibiting execution of high-risk operations; or, when the user risk level The level is high-level risk, and the corresponding access control methods include at least one of the following: forced logout of users, deactivation of users. In the above solution, the authorization set can control roles, time, instructions, permissions, etc., so that the operation and maintenance users can only perform specific tasks according to the authorization set. Execution time, user, type of NE and operation command in the order. The policy execution point starts the scheduled task according to the work order task, and when the task execution time is reached, the corresponding operation command authority is given to the execution role and user.

In a third aspect, the embodiment of the present application further provides a terminal device, where the terminal device is specifically a policy decision point, and the terminal device includes:

The receiving module is used to receive the service access request sent by the operation and maintenance user through the operation and maintenance terminal;

An authentication module, configured to perform multi-factor identity authentication on the operation and maintenance user according to the service access request;

An acquisition module, configured to acquire the work order tasks of the operation and maintenance user from the work order system after the operation and maintenance user passes the multi-factor identity authentication, and acquire the operation and maintenance user from the identity authentication management system identity data, and obtain terminal risk data of the operation and maintenance terminal from the terminal risk awareness system, and obtain service security data from the service provision system;

An evaluation module, configured to perform trust evaluation on the operation and maintenance user according to the work order task, the identity data, the terminal risk data and the business security data, and obtain a trust evaluation result;

A policy generating module, configured to generate an access control policy according to the trust evaluation result.

In the third aspect of the present application, the component modules of the terminal device can also perform the steps described in the aforementioned first aspect and various possible implementations. For details, refer to the aforementioned first aspect and various possible implementations. illustrate.

In a fourth aspect, the embodiment of the present application further provides a terminal device, the terminal device is specifically a policy enforcement point, and the terminal device includes:

An acquisition module, configured to acquire an access control policy from a policy decision point;

A control module, configured to perform dynamic access control on the operation and maintenance operations performed by the operation and maintenance user according to the access control policy.

In the fourth aspect of the present application, the constituent modules of the terminal device can also perform the steps described in the aforementioned first aspect and various possible implementations. For details, refer to the aforementioned first aspect and various possible implementations. illustrate.

In the fifth aspect, the embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when it is run on a computer, the computer executes the above-mentioned first aspect or the second aspect. described method.

In a sixth aspect, the embodiment of the present application provides a computer program product containing instructions, which when run on a computer, causes the computer to execute the method described in the first aspect above.

In the seventh aspect, the embodiment of the present application provides a communication device, which may include entities such as terminal equipment or chips, and the communication device includes: a processor and a memory; the memory is used to store instructions; the processor is used to Executing the instructions in the memory causes the communication device to execute the method as described in any one of the aforementioned first aspect or second aspect.

In the first aspect, the present application provides a chip system, the chip system includes a processor, used to support the policy decision point or the policy execution point to realize the functions involved in the above aspects, for example, send or process the information involved in the above method data and/or information. In a possible design, the chip system further includes a memory, and the memory is used for storing necessary program instructions and data of a policy decision point or a policy execution point. The system-on-a-chip may consist of chips, or may include chips and other discrete devices.

It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

In the embodiment of this application, multi-factor identity authentication is performed on the operation and maintenance user according to the service access request; after the operation and maintenance user passes the multi-factor identity authentication, the work order task to be executed by the operation and maintenance user is obtained from the work order system, and from The identity authentication management system obtains the identity data of the operation and maintenance user, obtains the terminal risk data of the operation and maintenance terminal from the terminal risk awareness system, and obtains the business security data from the service provision system; according to the work order task, identity data, terminal risk data and business The security data evaluates the trust of the operation and maintenance users, and generates an access control policy based on the trust evaluation results. Within the scope of control, the safe access of operation and maintenance users is guaranteed, and the security risk of operation and maintenance users is reduced.

In the embodiment of the present application, the access control policy from the policy decision point is obtained; and the operation and maintenance operations performed by the operation and maintenance user are dynamically accessed according to the access control policy. The access control strategy includes the control method for the operation and maintenance operation of the operation and maintenance user, so that the operation and maintenance operation of the operation and maintenance user is within the precise controllable range, ensuring the safe access of the operation and maintenance user, and reducing the security risk of the operation and maintenance user .

Description of drawings

FIG. 1 is a schematic diagram of the composition and structure of an operation and maintenance processing system provided by an embodiment of the present application;

FIG. 2 is a schematic diagram of an interaction flow between a policy decision point and a policy enforcement point provided in an embodiment of the present application;

FIG. 3 is a schematic diagram of a scene where an operation and maintenance user accesses a network management and control unit according to an embodiment of the present application;

FIG. 4 is a schematic diagram of a scene where an operation and maintenance user accesses a network element provided by an embodiment of the present application;

FIG. 5 is a schematic diagram of a scene for preventing an attacker from impersonating an administrator provided by an embodiment of the present application;

FIG. 6 is a schematic diagram of a scenario for preventing hidden attacks provided by the embodiment of the present application;

FIG. 7 is a schematic diagram of the scene of preventing human misoperation accidents provided by the embodiment of the present application;

FIG. 8 is a schematic diagram of a scenario for preventing near-end access bypassing management and control loopholes provided by the embodiment of the present application;

FIG. 9 is a schematic diagram of the composition and structure of a policy decision point provided by the embodiment of the present application;

FIG. 10 is a schematic diagram of the composition and structure of a policy enforcement point provided by the embodiment of the present application;

FIG. 11 is a schematic diagram of the composition and structure of another policy decision point provided by the embodiment of the present application;

FIG. 12 is a schematic diagram of the composition and structure of another policy enforcement point provided by the embodiment of the present application.

Detailed ways

Embodiments of the present application are described below in conjunction with the accompanying drawings.

The terms "first", "second" and the like in the specification and claims of the present application and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence. It should be understood that the terms used in this way can be interchanged under appropriate circumstances, and this is merely a description of the manner in which objects with the same attribute are described in the embodiments of the present application. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, product, or apparatus comprising a series of elements is not necessarily limited to those elements, but may include elements not expressly included. Other elements listed explicitly or inherent to the process, method, product, or apparatus.

The current operator network is becoming more and more complex, multi-standard networks coexist, the network scale is larger, and business management becomes more complicated and difficult. The operation and maintenance processing system can be used to operate and maintain the operator network. The operation and maintenance processing system Being the target of malicious attacks by attackers to disrupt the operation of the operator's network may cause great security risks to the operator's business, including long-term impacts on the availability and confidentiality of its key services.

Operation and maintenance users can control the operation and maintenance terminal, remotely access the operator's network through the local management network or from the Internet through a virtual private network (virtual private network, VPN), and perform operation and maintenance tasks. The operation and maintenance user can operate and maintain the service access network element (referred to as the network element) by accessing the network management and control unit (referred to as the network management unit), or the operation and maintenance user can directly log in to the network element to perform operation and maintenance.

In order to cope with the new continuously open and complex security environment, solve the problem of safe access of operation and maintenance users in an untrusted network environment, and reduce the security risks of operation and maintenance users, the embodiment of this application provides an operation and maintenance processing system, which adopts More flexible and diverse ways to establish new logical boundaries for dynamically changing users, terminals, and systems to ensure safe access and safe access operations for operation and maintenance users. During the operation and maintenance process, real-time perception of the operation and maintenance environment and user behavior, Continuously conduct trust evaluation, and perform dynamic authorization based on the generated trust evaluation results, effectively mitigating the theft of identity information of operation and maintenance users, attackers sneaking into the network by controlling operation and maintenance terminals, advanced persistent threat (APT) advanced threats, insider It eliminates security risks such as ghost attacks and human misoperation accidents, and realizes continuous credible and self-adaptive security of operation and maintenance management.

Next, the operation and maintenance processing system and the operation and maintenance processing method provided in the embodiments of the present application will be described in detail.

First, please refer to FIG. 1, as shown, the embodiment of the present application provides an operation and maintenance processing system 100. The operation and maintenance processing system 100 can perform dynamic access control on the operation and maintenance operations of the operation and maintenance users, so as to reduce the security risks of the operation and maintenance users. . The operation and maintenance processing system 100 includes: a policy decision point (policy decision point, PDP) 101 and a policy enforcement point (policy enforcement point, PEP) 102, and the policy decision point 101 and the policy enforcement point 102 can communicate. Specifically, the operation and maintenance user sends a service access request through the operation and maintenance terminal, and the policy decision point 101 can perform multi-factor authentication on the operation and maintenance user according to the service access request, so as to ensure that the identity of the operation and maintenance user is safe and reliable. Trustworthy, the policy decision point 101 can also collect various data, such as collecting operation and maintenance user, terminal, environment, behavior and other data, so that the policy decision point 101 can continue to conduct trust evaluation, and then generate access control policies, policy decision point 101 can send the access control policy to the policy enforcement point 102, and the policy enforcement point 102 updates the policy based on the access control policy, and accurately authorizes the access operation of the operation and maintenance user to realize dynamic access control and ensure the security of the operation and maintenance user's access and access believable.

In this embodiment of the application, the policy decision point can also be connected to the work order system, the identity authentication management system, the terminal risk perception system and the service provision system, so during the access process of the operation and maintenance user, the policy decision point can be connected to the work order system , the identity authentication management system, the terminal risk perception system and the service provision system obtain a variety of security-related data, so that dynamic trust evaluation can be performed based on the above-mentioned various security-related data to generate access control policies. Policies can be used to indicate how to control the O&M operations of O&M users. The above-mentioned work order system, identity authentication management system, terminal risk awareness system and service provision system can all be called third-party systems.

Among them, work order tasks are stored in the work order system, and operation and maintenance users need to perform operation and maintenance operations according to work order tasks.

The identity authentication management system provides the identity data of operation and maintenance users. The identity authentication management system may be an authentication authorization audit (Authentication Authorization Audit, 3A) or an authentication authorization audit account (Authentication Authorization Audit Account, 4A) server.

The terminal risk awareness system can be used to provide terminal risk data of the operation and maintenance terminal, which can also be called terminal security data, and the terminal risk data can include the environmental security data of the operation and maintenance terminal logged in by the operation and maintenance user. Such as operating system (operating system OS) patches, terminal registration information, browser security status, etc.

The service provision system can provide service access functions to operation and maintenance users, and the service provision system can also record service security data when providing service access. The content of the business security data can be various, and the examples are as follows. The business security data includes: operation and maintenance security logs, operation logs and security events of the service provision system.

The service provision system can provide service access functions to operation and maintenance users. According to different service access functions, the service provision system includes at least one of the following: a network management and control unit, and a service access network element. For example, the service provision system has various implementation methods for different types of operations performed by operation and maintenance users. For example, the network management and control unit can provide service access functions to operation and maintenance users. Users provide business access functions. The specific operation and maintenance operations performed by the operation and maintenance user in the embodiment of the present application are not limited.

In the embodiment of the present application, the policy decision point and the policy execution point may be set on the same device, or the policy decision point and the policy execution point may be set on different devices. As an example, the operation and maintenance user can access the network management and control unit through the operation and maintenance terminal. Both the policy decision point and the policy enforcement point can be set on the network management and control unit. The policy decision point can generate an access control policy, and the policy enforcement point is based on the access control policy Perform dynamic access control on the operation and maintenance operations of operation and maintenance users. For another example, the operation and maintenance users can access the service access network element through the operation and maintenance terminal, the policy decision point can be set on the network management and control unit, the policy execution point can be set on the service access network element, the policy decision point can generate access control policies, policy The execution point performs dynamic access control on the operation and maintenance operations of the operation and maintenance users according to the access control policy.

Based on the aforementioned operation and maintenance processing system, the operation and maintenance processing method provided by the embodiment of the present application is introduced next. As shown in Figure 2, it mainly includes the interaction process between the policy decision point and the policy execution point. Specifically, it may include the following steps :

201. The policy decision point receives a service access request sent by an operation and maintenance user through an operation and maintenance terminal.

When the operation and maintenance user needs to initiate access to the service provision system, the operation and maintenance user can control the operation and maintenance terminal to generate a service access request, and the operation and maintenance terminal can send the service access request, for example, the operation and maintenance terminal sends a service access request to the policy execution point, The policy enforcement point sends the service access request to the policy decision point, so that the policy decision point can receive the service access request. The embodiment of the present application does not limit the specific content of the service access initiated by the operation and maintenance user.

202. The policy decision point performs multi-factor identity authentication on the operation and maintenance user according to the service access request.

Among them, after the policy decision point receives the service access request, it needs to perform identity authentication on the operation and maintenance user who initiates the service access request, so as to confirm that the identity of the operation and maintenance user is credible. In the embodiment of the present application, the policy decision point needs to perform multi-factor identity authentication on the operation and maintenance user according to the business access request, and the security of identity authentication can be improved through the multi-factor identity authentication. In the embodiment of this application, multi-factor identity authentication has multiple implementation methods. The policy decision-making point uses identity as the cornerstone to construct a logical boundary, and adopts multi-factor identity authentication, such as user password, digital certificate, SMS verification code, fingerprint and other technologies. The user performs mandatory identity authentication, and the identity authentication result is used as the basis of access control trust to ensure that the identity of the operation and maintenance user is credible. If the identity of the operation and maintenance user is feasible, the subsequent step 203 is triggered, and if the identity of the operation and maintenance user is untrustworthy, the service access request of the operation and maintenance user is rejected, that is, the subsequent step 203 is not executed.

203. After the operation and maintenance user passes the multi-factor identity authentication, the policy decision point obtains the work order task to be executed by the operation and maintenance user from the work order system, obtains the identity data of the operation and maintenance user from the identity authentication management system, and obtains the operation and maintenance user's identity data from the terminal risk The perception system obtains the terminal risk data of the operation and maintenance terminal, and obtains the service security data from the service provision system.

In the embodiment of the present application, the operation and maintenance user performs multi-factor identity authentication according to the service access request through the aforementioned step 202. After the operation and maintenance user passes the multi-factor identity authentication, the aforementioned step 203 can be executed. If the operation and maintenance user does not pass the multi-factor identity authentication, Then step 203 cannot be executed.

After the operation and maintenance user passes the multi-factor identity authentication, the strategic decision point can obtain a variety of security-related data. Based on the above description of the connection relationship of the strategic decision point, it can be seen that the strategic decision point can also be connected to the work order system and the identity authentication management system. , terminal risk awareness system and service provision system, the policy decision point can obtain relevant security data from the above systems respectively. Specifically, the policy decision point can conduct continuous trust assessment for the operation and maintenance users. In the embodiment of this application, the access and access of all operation and maintenance users is untrusted by default. User trust assessment and dynamic policies can be constructed on the policy decision point Management capabilities that enable the policy decision point to perform one or more of the various data acquisition functions:

Obtain the pending work order tasks of the operation and maintenance user from the work order system, and,

Obtain the identity data of the operation and maintenance user from the identity authentication management system, and,

Obtain the terminal risk data of the operation and maintenance terminal from the terminal risk awareness system, and,

The service security data is obtained from the service providing system.

Among them, the work order system stores a variety of work order tasks. The work order system can send the work order tasks to be executed by the operation and maintenance user to the policy decision point. The policy decision point analyzes the input work order tasks and analyzes the work order tasks Execution time, execution user, NE type and operation command.

The identity authentication management system can send the identity data of the operation and maintenance user to the policy decision point, so that the policy decision point can continuously authenticate the identity data of the operation and maintenance user.

The terminal risk awareness system can send the terminal risk data of the operation and maintenance terminal to the policy decision point, and the policy decision point can continuously monitor and evaluate the security environment of the operation and maintenance terminal through the terminal risk data, such as OS patches, terminal registration information, browser security status, etc.

The service provision system can send service security data to the policy decision point, and the policy decision point can perform security detection on the service provision system that the operation and maintenance user will access based on the service security data. For example, the policy decision point can obtain the network management and control unit and network element Operation and maintenance operation logs, security events of network management and control units, etc.

204. The policy decision point evaluates the trust of the operation and maintenance user according to the work order task, identity data, terminal risk data, and business security data, and obtains a trust evaluation result.

Among them, after the policy decision point obtains work order tasks, identity data, terminal risk data, and business security data, the policy decision point can comprehensively analyze the above data, evaluate the security level of the operation and maintenance user through the above data, and the policy decision point can generate A trust assessment result, the trust assessment result may include security level information obtained after trust assessment is performed on the operation and maintenance user. The content of the trust evaluation result is related to the work order task, identity data, terminal risk data, and business security data, and the specific content of the trust evaluation result is not limited in this embodiment of the application.

In some embodiments of the present application, the policy decision point in step 204 conducts a trust assessment on the operation and maintenance user according to the work order task, identity data, terminal risk data and business security data, and obtains the trust assessment result, including:

A1. Generate a trust evaluation model for operation and maintenance users based on work order tasks, identity data, terminal risk data, and business security data.

Among them, the policy decision point can obtain multi-dimensional data such as work order tasks, identity data, terminal risk data, and business security data, and continuously and comprehensively evaluate the security credibility of operation and maintenance users. Specifically, the policy decision point can input work order tasks, identity data, terminal risk data, and business security data into the attack chain model, and combine the actual operation and maintenance business scenarios to generate a trust evaluation model, which can identify users behavior trajectory.

A2. Obtain the abnormal behavior of operation and maintenance users according to the trust evaluation model.

After the trust evaluation model is generated at the policy decision point, the abnormal behavior of the operation and maintenance user is identified through the trust evaluation model. For example, the abnormal behavior of the operation and maintenance user can be the request to perform tasks other than work order tasks, or the abnormal behavior of the operation and maintenance user has risky data on the operation and maintenance terminal, or the abnormal behavior of the operation and maintenance user Yuan generates security incidents, etc.

A3. Determine the operation risk parameters of the operation and maintenance users according to the abnormal behavior of the operation and maintenance users and the pre-determined user historical behavior baseline.

Among them, the policy decision point can pre-determine the user's historical behavior baseline, and the user's historical behavior can be used as a reference. After identifying the abnormal behavior of the operation and maintenance user, the policy decision point generates the operation and maintenance operation risk parameters of the operation and maintenance user, and the operation and maintenance operation The risk parameter can indicate the risk level corresponding to the operation and maintenance operation performed by the operation and maintenance user. For example, the policy decision point is based on comprehensive factors such as the stage of the abnormal behavior of the operation and maintenance user, context information, occurrence times, risk and impact, etc., to carry out risk discrimination, and Refer to the user's historical behavior baseline, and finally obtain the operation and maintenance operation risk parameters of the operation and maintenance user.

A4. Generate trust assessment results based on operational risk parameters of operation and maintenance.

After the operation and maintenance operation risk parameters are generated at the policy decision point, the operation and maintenance operation risk parameters can be used as the trust evaluation result, or the operation and maintenance users can be scored according to the operation and maintenance operation risk parameters to generate the trust evaluation results. In the embodiment of this application, the policy decision point can identify the abnormal behavior of the operation and maintenance user through the trust evaluation model, and generate the trust evaluation result of the operation and maintenance user through the abnormal behavior and the user's historical behavior baseline, which can realize accurate evaluation of the operation and maintenance user and improve The evaluation accuracy and evaluation efficiency of operation and maintenance users.

As an example, the policy decision point is untrustworthy by default for the access and access of all operation and maintenance users. Build user trust evaluation and dynamic policy management capabilities on the policy decision point, specifically:

Analyze the work order tasks entered by the work order system, realize precise authorization of users based on work order tasks, perform fine-grained authorization through account, role, time, operation instructions and other elements, and prohibit users from performing high-risk operations other than work order tasks Unexpected results occur, avoiding the risk of human misoperation and illegal access; analyze the input work order task, analyze the execution time, execution user, network element type of operation and operation command in the work order. Start the scheduled task according to the work order task, and when the task execution time is reached, the corresponding operation command authority is given to the execution role and user.

For the diversified access of operation and maintenance terminals, based on the terminal risk data input by the terminal risk awareness system, the security environment of the login terminal is continuously monitored and evaluated, such as OS patches, terminal registration information, browser security status, etc., once an abnormality is found Immediately lower user trust levels and dynamically adjust access rights to prevent attackers from pretending to be administrators or attacking by infecting operation and maintenance terminals. For example, there are vulnerabilities in the terminal operating system that have not been patched, security vulnerabilities in browser-related components have not been patched, illegal or pirated software is installed on the terminal, and viruses and Trojan horses are installed on the terminal, etc. If there is a security problem at the software level, the operation and maintenance terminal will be identified as abnormal.

During the user's operation and maintenance operation, based on the multi-dimensional data such as user identity data input by the identity authentication management system, operation and maintenance operation logs of network management and control units and network elements, and security events of network management and control units, all access to operation and maintenance users The operation conducts continuous security monitoring and evaluation. For abnormal behaviors and threat events that deviate from the daily access baseline, once an abnormality is found, the user's trust level is immediately reduced and access rights are dynamically adjusted to minimize the impact of intrusion.

205. The policy decision point generates an access control policy according to the trust evaluation result.

Specifically, after the policy decision point evaluates the trust of the operation and maintenance users, the policy decision point generates an access control policy according to the trust assessment results. The operation and maintenance operations are within the precise and controllable range to ensure the safe access of operation and maintenance users.

In some embodiments of the present application, the access control policy includes: user risk levels and corresponding access control methods;

Wherein, when the user risk level is a low-level risk, the corresponding access control method includes at least one of the following: bubbling reminder, reporting an alarm; or,

When the user risk level is a medium level risk, the corresponding access control methods include at least one of the following: secondary identity authentication, prohibiting high-risk operations; or,

When the user risk level is a high-level risk, the corresponding access control methods include at least one of the following: forced logout of the user, deactivation of the user.

For example, the access control policy is dynamically generated based on the trust evaluation results of operation and maintenance users, such as the trust score and risk level for each access session of operation and maintenance users, combined with context information, different levels of risk correspond to different levels of access Control methods, so as to achieve precise control of operation and maintenance operations. For example, "bubble reminder" and "report to alarm" are used for low-level risks. Among them, bubble reminder refers to sending a reminder box through bubbling, so that users can receive reminders of low-level risks. For medium-risk risks, "secondary identity authentication" and "prohibition of high-risk operations" are adopted, and for high-risk risks, strategies such as "forced logout of users" and "deactivation of users" are adopted. In the embodiment of this application, in the access control policy, different user risk levels are combined with corresponding access control methods, so that the safe access of operation and maintenance users can be guaranteed and the security risk of operation and maintenance users can be reduced.

In the following embodiments of the present application, if the policy decision point for performing the aforementioned steps 201 to 205 is set on the network management and control unit, and the policy enforcement point is also set on the network management and control unit, then the network management and control unit can also generate access control After the policy, perform the following steps:

B1. The network management and control unit performs dynamic access control on the operation and maintenance operations performed by the operation and maintenance users according to the access control policy.

Wherein, the network management and control unit can perform the aforementioned steps 201 to 205. After the network management and control unit generates the access control policy, if the operation and maintenance user needs to access the network management and control unit, the network management and control unit performs the operation and maintenance of the operation and maintenance user according to the access control policy. Dynamic access control for operations can ensure the safe access of operation and maintenance users and reduce the security risks of operation and maintenance users.

206. The policy decision point generates an access control policy to the policy execution point.

Wherein, after the policy decision point executes step 205, the policy decision point can send the access control policy to the policy enforcement point through the transmission channel between the policy decision point and the policy enforcement point, so that the policy enforcement point executes the operation and maintenance user according to the access control policy Dynamic access control for O&M operations. Specifically, for the specific method of execution by the policy enforcement point, refer to the descriptions of subsequent steps 207 and 208.

207. The policy enforcement point obtains the access control policy from the policy decision point.

Among them, the policy enforcement point can receive the access control policy through the transmission channel between the policy decision point and the policy enforcement point, and the policy enforcement point can analyze the access control policy, so as to obtain the control mode of the operation and maintenance operation of the operation and maintenance user.

208. The policy enforcement point performs dynamic access control on the operation and maintenance operations performed by the operation and maintenance user according to the access control policy.

The policy enforcement point performs dynamic access control on the operation and maintenance operations of the operation and maintenance users. Secure access for operation and maintenance users.

In some embodiments of the present application, the policy enforcement point in step 208 performs dynamic access control on the operation and maintenance operations performed by the operation and maintenance user according to the access control policy, including:

C1. The policy enforcement point generates an authorization instruction for each session generated when the operation and maintenance user performs the operation and maintenance operation according to the access control policy and the work order task. Dimension users perform tasks other than work order tasks.

Among them, the policy enforcement point determines each session generated when the operation and maintenance user performs the operation and maintenance operation, and the policy enforcement point determines the authorization set for the operation and maintenance user to perform tasks in the session according to the access control policy, and an authorization instruction can be generated for the session.

C2. The policy execution point monitors the authority of the operation and maintenance operations performed by the operation and maintenance users according to the authorization instructions.

Among them, the policy execution point monitors the task content of the operation and maintenance user in each session and the operation and maintenance operation performed by the operation and maintenance user according to the authorization instruction, so that the operation and maintenance user performs the task content according to the authorization set, and prohibits the operation and maintenance Users perform tasks other than work order tasks to ensure safe access for operation and maintenance users and reduce security risks for operation and maintenance users.

In some embodiments of the present application, the authorization set includes at least one of the following: the account of the operation and maintenance user, the role of the operation and maintenance user to perform the operation and maintenance operation, the time when the operation and maintenance user performs the operation and maintenance operation, and the time when the operation and maintenance user performs the operation and maintenance operation. Operational instructions and operation and maintenance users have the authority to access the service provision system.

Among them, the authorization set can control roles, time, instructions, permissions, etc., so that the operation and maintenance users can only perform specific tasks according to the authorization set. Time, user performing the operation, type of network element and operation command. The policy execution point starts the scheduled task according to the work order task, and when the task execution time is reached, the corresponding operation command authority is given to the execution role and user.

For example, analyze the work order tasks to achieve precise authorization of users based on the work order tasks, perform fine-grained authorization through account, role, time, operation instructions and other elements, and prohibit users from performing high-risk operations other than work order tasks. Unexpected results, avoiding the risk of human misoperation and illegal access, so as to ensure the safe access of operation and maintenance users and reduce the security risks of operation and maintenance users.

Through the examples of the foregoing embodiments, it can be seen that multi-factor identity authentication is performed on the operation and maintenance user according to the service access request; after the operation and maintenance user passes the multi-factor identity authentication, the work order task to be executed by the operation and maintenance user is obtained from the work order system, And obtain the identity data of the operation and maintenance user from the identity authentication management system, obtain the terminal risk data of the operation and maintenance terminal from the terminal risk perception system, and obtain the business security data from the service provision system; according to the work order task, identity data, terminal risk data and business security data to evaluate the trust of operation and maintenance users, and generate an access control policy based on the trust evaluation results. Within the controllable range, the safe access of operation and maintenance users is guaranteed, and the security risk of operation and maintenance users is reduced.

In order to facilitate a better understanding and implementation of the above-mentioned solutions in the embodiments of the present application, the corresponding application scenarios are exemplified below for specific description.

As shown in FIG. 3 , it is a schematic diagram of a scene where an operation and maintenance user accesses a network management and control unit provided in the embodiment of the present application. Among them, the operation and maintenance user sends a service access request to the network management unit (referred to as network management) through the operation and maintenance terminal, and the network management and control unit performs multi-factor identity authentication on the operation and maintenance user according to the service access request, and obtains the information from the third party. The system acquires multi-dimensional third-party data, and generates an access control policy based on the above-mentioned multi-dimensional third-party data; according to the access control policy, dynamic access control is performed on the operation and maintenance operations of the operation and maintenance user. For example, the operation and maintenance user can access the network management and control unit applications and data, or access network elements. Network elements include: wireless base stations, routers, switches, and cloud network elements.

Next, various devices and functional modules shown in FIG. 3 will be described.

Wherein, the operation and maintenance terminal has a risk-aware agent function, and the operation and maintenance terminal sends a service access request to the network management and control unit, and the service access request is untrustworthy to the network management and control unit. For example, the risk awareness agent can be either a personal computer terminal or a mobile terminal, which is not limited here.

Network management and control unit, including: policy decision point, policy enforcement point, application and data.

When the operation and maintenance user logs in to the network management and control unit, the operation and maintenance user sends a service access request to the policy enforcement point in the network management and control unit through the operation and maintenance terminal, and the policy decision point in the network management and control unit can force multi-factor authentication on the operation and maintenance user , to identify the legal identity of the user, such as through user password, SMS verification code, digital certificate, etc., if the user fails to pass the authentication, he cannot log in to the network management and control unit.

The third-party system includes at least one of the following: a work order system, an identity authentication management system, and a terminal risk awareness system. Third-party systems can provide data query functions to policy decision points. For example, the work order system provides work order tasks, the identity authentication management system provides the identity data of operation and maintenance users, and the terminal risk awareness system provides terminal risk data of operation and maintenance terminals.

After the operation and maintenance user has passed the multi-factor identity authentication, the policy decision point obtains the work order tasks to be executed by the operation and maintenance user from the work order system, obtains the identity data of the operation and maintenance user from the identity authentication management system, and obtains the operation and maintenance user’s identity data from the terminal risk awareness system Obtain the terminal risk data of the operation and maintenance terminal. In addition, the policy decision point can also obtain service security data, for example, the service security data includes: security logs, operation logs, security events and other data of the network management and network elements.

The policy decision point evaluates the trust of operation and maintenance users based on work order tasks, identity data, terminal risk data, and business security data, obtains the trust evaluation results, and generates access control policies based on the trust evaluation results.

Policy decision point, in the process of user operation and maintenance, realizes precise authorization based on work order tasks, and based on security logs, operation logs, and security events of network management and network elements, as well as terminal risk data and user identity data input by third parties Continuously and comprehensively evaluate the security credibility of access users and access objects (including network management and control units and network elements), form user credibility scores, and generate access control policies for users based on credibility scores. Examples are as follows:

Precise authorization based on work order tasks: In the process of performing O&M tasks in the carrier network, the work order application process is involved, and the work order tasks can only be executed as planned after being inspected and approved by all parties. On the network management and control unit, through the analysis of the input work order tasks, a specific authorization set is formed to grant user permissions, and precise authorization is performed through factors such as account number, role, time, operation instructions, and whether they have access to the network management and control unit. Operations within the scope of the task cannot be performed.

Continuous evaluation of user trust and dynamic policies: Set up policy decision points on the network management and control unit, collect multi-dimensional data such as operation logs, security logs, and security events of the network management and control unit, as well as terminal risk data and user identity risk information input by third-party systems, Conduct continuous and comprehensive evaluation of the security credibility of access users and access objects (network management and control units).

The policy decision point identifies the user's behavior track based on the user's behavior log (including security log, operation log, etc.), terminal risk log, and security event input, combined with the attack chain model. Combined with actual operation and maintenance business scenarios, a trust evaluation model is formed. The trust evaluation model conducts risk discrimination based on comprehensive factors such as the stage of the attack behavior trajectory, context information, occurrence times, risks, and impacts, and refers to historical behavior over a period of time to finally obtain a trust score for each user access session.

The access control policy is dynamically generated based on the trust score and risk level of each user's access session, combined with context information. Different levels of risk correspond to different levels of access control methods. For example, "bubble reminder" and "up report For medium-risk risks, "secondary identity authentication" and "prohibition of high-risk operations" are adopted, and for high-risk risks, strategies such as "forced logout of users" and "deactivation of users" are adopted.

In addition, the policy decision point also supports sending the trust evaluation result to the third-party trust evaluation engine, so that the third-party trust evaluation engine can perform trust evaluation.

Among them, the trust evaluation model and evaluation method involved in the embodiment of this application are as follows:

First, the operational risk assessment method based on user portraits is explained. Starting from the dimensions of user login and operation and maintenance operations, comprehensive security logs, security events, work order tasks, business security data and other multi-dimensional data, construct user portraits, learn the historical behavior baseline of users and user groups, and multi-dimensional correlation analysis deviate from the normal behavior baseline Abnormal user behavior, timely detection of operational risks, and a trust score for the user's operation and maintenance operations based on the risk. Wherein, the user group includes multiple users with the same role.

Next, the generation method of the trust evaluation model is explained. First, evaluate user risks based on security events, and obtain event risk coefficients, attack stage coefficients, and attack times. According to the event risk coefficient, attack stage coefficient, and attack times, the user risk degree is obtained. For example, the event risk coefficient includes multiple risk levels, such as low risk, medium risk, high risk, and urgent risk. The attack chain corresponding to the attack stage coefficient includes: reconnaissance, infiltration, intrusion, implantation, diffusion, and destruction.

Specific user risk assessment methods include:

The initial value of the security event risk coefficient is related to the event threat level, which is divided into 5 levels. The higher the threat level, the greater the initial risk factor.

Based on the classification of threat levels, the risk factor is affected by the attack stage of the incident, and there are 6 attack stages in total. Attackers will follow the behavior track to carry out continuous and in-depth attacks (lateral movement) until they finally achieve the purpose of stealing data and so on. Therefore, on the behavior trajectory, the later behavior is more risky than the previous one.

The event risk coefficient is affected by the number of events, and the risk coefficient increases with the increase of the number of events. When the risk coefficient is close to 1, the growth rate will slow down and tend to 1.

The current threat rate of the user is related to the threat rate before the event, and the threat rate is the highest when the user is abnormal for the first time during the evaluation period.

An example is as follows. Firstly, the credibility rate of the current user and the credibility rate of the previous moment are obtained. Each behavior has a corresponding abnormal probability, which is used to indicate the possibility that this behavior is a real attack. Although the abnormal probability of each behavior is determined by the risk level of the event, the threat level of the event is different in different attack stages. Attackers will follow the behavior track to carry out continuous and in-depth attacks (lateral movement) until they finally achieve the purpose of stealing data and so on. Therefore, on the behavior trajectory, the later behavior is more risky than the previous one. In order to distinguish different attack stages, a kill-chain coefficient is introduced, which is the abnormal probability of events occurring following the user behavior trajectory. Assign a risk factor to each behavior, which is used to represent the possibility that the current behavior is a malicious behavior. For example, a failed authentication may be an accidental password input error by the user, and a risk factor of 0.1 can be assigned. However, if there have been 5 consecutive login failures before the current login failure, then this is likely to be a malicious blasting behavior. At this time, 0.1 is no longer used as the risk factor, and the risk factor should be increased accordingly, such as 0.7. It can be seen from the previous examples that the risk coefficient is related to the number of repetitions of abnormal events, and the higher the number of times, the higher the risk coefficient.

The following describes the evaluation of user risk based on user behavior. First, user operation behaviors and user behavior baselines are obtained, for example, user behavior baselines are established based on user operation logs. Then, according to the user behavior baseline, the proportion of abnormal behavior and the abnormal degree of a single behavior can be calculated. Next, calculate the risk degree of a single behavior according to the proportion of abnormal behavior and the degree of abnormal behavior. Finally, the user risk is calculated based on the single behavior risk and historical risk.

After the policy enforcement unit generates the access policy in the above manner, it can send the access control policy to the policy enforcement point.

The policy enforcement point controls all business access requests of operation and maintenance users based on the access control policy generated by the policy decision point, such as deciding whether to issue an access token or execute other policies according to the access control policy.

In the embodiment of this application, the policy decision point generates an access control policy according to the trust evaluation result, and the access control policy includes the control mode for the operation and maintenance operation of the operation and maintenance user, so that the operation and maintenance operation of the operation and maintenance user can be accurately controlled. Within the scope, the safe access of operation and maintenance users is guaranteed, and the security risks of operation and maintenance users are reduced.

As shown in FIG. 4 , it is a schematic diagram of a scenario where an operation and maintenance user accesses a network element provided in the embodiment of the present application. The access scenario for an operation and maintenance user to access a network element is similar to the access scenario for accessing a network management and control unit.

The operation and maintenance user sends a service access request to the network element through the operation and maintenance terminal, and the network element requests the network management and control unit to perform multi-factor authentication on the operation and maintenance user according to the service access request, and the network management and control unit obtains multi-dimensional third-party data from the third-party system, Generate access control policies based on the above-mentioned multi-dimensional third-party data; network elements perform dynamic access control on the operation and maintenance operations of operation and maintenance users according to the access control policies generated by the network management and control unit, for example, operation and maintenance users can access network elements. Network elements include: wireless base stations, routers, switches, and cloud network elements.

Next, various devices and functional modules shown in FIG. 4 will be described.

Among them, the operation and maintenance terminal has a risk-aware proxy function, and the operation and maintenance terminal sends a service access request to the policy enforcement point in the network element, and the service access request is untrustworthy to the network element. For example, the risk awareness agent can be either a personal computer terminal or a mobile terminal, which is not limited here. In Fig. 4, four policy enforcement points are deployed on network elements as an example for illustration.

When the operation and maintenance user logs in to the network element, the operation and maintenance user sends a service access request to the policy enforcement point in the network element through the operation and maintenance terminal, and the policy enforcement point triggers the policy decision point in the network management and control unit to force the multi-factor identity of the operation and maintenance user Authentication, to identify the legal identity of the user, such as through user password, SMS verification code, digital certificate, etc. If the user fails to pass the authentication, he cannot log in to the network management and control unit.

Policy decision point, in the process of user operation and maintenance, realizes precise authorization based on work order tasks, and based on security logs, operation logs, and security events of network management and network elements, as well as terminal risk data and user identity data input by third parties Continuously and comprehensively evaluate the security credibility of access users and access objects (including network management and control units and network elements), form user credibility scores, and generate access control policies for users based on credibility scores.

The specific instructions are as follows:

Precise authorization based on work order tasks: On the network management and control unit, through the analysis of the input work order tasks, a specific authorization set is formed to grant network element user rights, through account number, role, time, operation instructions, and whether they have access to network elements. Precise authorization is carried out on such factors as operations that are not within the scope of work order tasks cannot be performed.

Continuous evaluation of user trust and dynamic policies: set policy decision points on the network management and control unit, collect network element operation and maintenance operation logs, security logs, network element operation and maintenance operation security detection events, and terminal risk data input by third-party systems, user Multi-dimensional data such as identity data, continuously and comprehensively evaluate user risks, and support user trust evaluation based on user historical behavior, evaluate and form user trust score, and dynamically generate access control policies based on user trust score, such as "bubble reminder", " Report to the police”, “Second identity authentication”, “Prohibition of performing high-risk operations”, “Forced logout of users”, “Deactivation of users”, etc. Different levels of risk correspond to different levels of access control methods, such as "bubble reminder" and "report to alarm" for low-level risks, and "secondary identity authentication" and "prohibit high-risk operations" for medium-risk risks. For high-risk risks, use "forced logout of users", "deactivation of users", etc.

Through the foregoing examples, it can be seen that the dynamic access control capability based on the zero trust architecture is built on the network management and control unit and network elements. Trust evaluation, real-time policy update and precise authorization based on trust level, realize dynamic access control, ensure safe and reliable operation and maintenance user access and access, and effectively alleviate various risks of operators' network operation and maintenance management, such as the risk of external advanced penetration attacks , users' illegal access to resources and the risk of insider ghosts, etc. For the diversified access of users and terminals, the legality of user identities is verified through multi-factor authentication, and the OS patches, terminal registration information, and browser security status of login terminals are continuously checked. Once abnormalities are found, user trust is immediately reduced level and dynamically adjust access rights to prevent attackers from pretending to be administrators or attacking by infecting operation and maintenance terminals. In order to avoid the risk of human misoperation, fine-grained authorization can be combined with work order tasks to prohibit users from performing unexpected results in high-risk operations other than work order tasks. In addition, during the process of user operation and maintenance management, continuous security detection is performed on all user access operations, and abnormal behaviors and threat events that deviate from the daily access baseline are detected in time and dynamic policy control is performed on user access to minimize the impact of intrusions. minimized.

Construct access control policies based on work order tasks on network management and control units and network elements, realize dynamic fine-grained authorization based on work order tasks, and realize real-time authorization of operation and maintenance users to network management and control unit operations according to approved work order task requirements , Real-time authorization of network element commands issued by the network management and control unit, and finally withdraw user rights after the end of the task time. By minimizing authorization, it can effectively avoid the risk of human misoperation or external intrusion caused by excessive user authorization.

Next, the application scenario of the embodiment of the present application is illustrated. As shown in FIG. 5, it is a schematic diagram of the scenario of preventing an attacker from pretending to be an administrator provided by the embodiment of the present application. The attacker logs in as an administrator, such as obtaining the Network administrator ID and password information, or obtain administrator identity information by attacking terminal devices. The embodiment of the present application can achieve the following technical effects. When a user logs in, by continuously sensing the security risk of the terminal device, preventing the terminal from entering the network with a disease, and identifying the user through multi-factor authentication, the attacker only obtains the password of the administrator account, It is also impossible to log in to the system without providing other auxiliary identity information such as biometrics.

As shown in FIG. 6 , it is a schematic diagram of a scenario of preventing hidden attacks provided by the embodiment of the present application. In the face of advanced threats such as APT, attackers have successfully passed terminal and identity verification, penetrated into the target system and launched malicious operations. The embodiment of the present application can achieve the following technical effects. Through continuous risk perception and trust evaluation of the user's operation behavior, when it is found that the user's operation behavior deviates from the daily behavior baseline, there is an exception. For example, the user requests to execute command x, and the access at this moment deviates from the daily If the behavior baseline is not met, access will be denied, relevant access control will be carried out in a timely manner, and user permissions will be controlled in a timely manner to prevent a major impact on the business.

As shown in FIG. 7 , it is a schematic diagram of a scene for preventing human misoperation accidents provided by the embodiment of the present application. When normal operation and maintenance personnel are working on the live network, due to human negligence, they use commands or parameters that have not been reported in the work order during the operation of the network management and control unit or network element, causing human safety accidents on the live network. The embodiment of the present application can achieve the following technical effects. The network management and control unit connects to the work order task, analyzes the work order task, and accurately authorizes the user according to the authority applied in the work order. For example, the user uses account a and executes command x during period b, If the user does not have the work order task during this period, the access will be denied, and the user can only execute the authority within the scope of the work order task, so as to avoid human misoperation accidents.

As shown in FIG. 8 , it is a schematic diagram of a scenario of preventing local access bypassing management and control loopholes provided by the embodiment of the present application. The attacker obtains the network element login account password, accesses the network element through local login (network cable directly connected to the management port or serial port), and performs malicious operations. The embodiment of the present application can achieve the following technical effects: on the network management and control unit, continuous risk perception and trust assessment are performed on the operation behavior of the network element login user, and when the user's operation behavior is found to be abnormal, a control strategy is generated and delivered to the network element , carry out relevant access control in a timely manner, control the authority of network element users in a timely manner, and prevent major impacts on services.

It should be noted that for the foregoing method embodiments, for the sake of simple description, they are expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described action sequence. Depending on the application, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by this application.

In order to facilitate better implementation of the above solutions in the embodiments of the present application, related devices for implementing the above solutions are also provided below.

Please refer to FIG. 9 , a terminal device provided by an embodiment of the present application, the terminal device is specifically a policy decision point 900, and may include: a receiving module 901, an authentication module 902, an acquisition module 903, an evaluation module 904, and a policy generation module 905, of which,

Please refer to FIG. 10 , a terminal device provided by an embodiment of the present application, the terminal device is specifically a policy enforcement point 1000, and may include: an acquisition module 1001 and a control module 1002, wherein,

It should be noted that the information interaction and execution process between the modules/units of the above-mentioned device are based on the same concept as the method embodiment of the present application, and the technical effect it brings is the same as that of the method embodiment of the present application. The specific content can be Refer to the descriptions in the foregoing method embodiments of the present application, and details are not repeated here.

The embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a program, and the program executes some or all of the steps described in the above method embodiments.

Next, another policy decision point provided by the embodiment of this application is introduced. Please refer to FIG. 11, the policy decision point 1100 includes:

A receiver 1101, a transmitter 1102, a processor 1103, and a memory 1104 (the number of processors 1103 in the policy decision point 1100 can be one or more, one processor is taken as an example in FIG. 11 ). In some embodiments of the present application, the receiver 1101 , the transmitter 1102 , the processor 1103 and the memory 1104 may be connected through a bus or in other ways, wherein connection through a bus is taken as an example in FIG. 11 .

The memory 1104 may include read-only memory and random-access memory, and provides instructions and data to the processor 1103 . A part of the memory 1104 may also include a non-volatile random access memory (non-volatile random access memory, NVRAM). The memory 1104 stores operating systems and operating instructions, executable modules or data structures, or their subsets, or their extended sets, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic services and processing hardware-based tasks.

The processor 1103 controls the operation of the policy decision point, and the processor 1103 may also be called a central processing unit (central processing unit, CPU). In a specific application, various components of the policy decision point are coupled together through a bus system, where the bus system may include not only a data bus, but also a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the various buses are referred to as bus systems in the figures.

The methods disclosed in the foregoing embodiments of the present application may be applied to the processor 1103 or implemented by the processor 1103 . The processor 1103 may be an integrated circuit chip and has a signal processing capability. In the implementation process, each step of the above method may be implemented by an integrated logic circuit of hardware in the processor 1103 or instructions in the form of software. The above-mentioned processor 1103 may be a general-purpose processor, a digital signal processor (digital signal processing, DSP), an application specific integrated circuit (application specific integrated circuit, ASIC), a field-programmable gate array (field-programmable gate array, FPGA) or Other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Various methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like. The steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory 1104, and the processor 1103 reads the information in the memory 1104, and completes the steps of the above method in combination with its hardware.

The receiver 1101 can be used to receive input digital or character information, and generate signal input related to the relevant setting of policy decision points and function control. The transmitter 1102 can include a display device such as a display screen, and the transmitter 1102 can be used to output through an external interface. Numeric or character information.

In the embodiment of the present application, the processor 1103 is configured to execute the operation and maintenance processing method performed by the policy decision point shown in FIG. 2 of the foregoing embodiment.

Next, another policy enforcement point provided by the embodiment of this application is introduced. Please refer to FIG. 12, the policy enforcement point 1200 includes:

A receiver 1201, a transmitter 1202, a processor 1203, and a memory 1204 (the number of processors 1203 in the policy enforcement point 1200 may be one or more, one processor is taken as an example in FIG. 12 ). In some embodiments of the present application, the receiver 1201 , the transmitter 1202 , the processor 1203 and the memory 1204 may be connected through a bus or in other ways, wherein connection through a bus is taken as an example in FIG. 12 .

The memory 1204 may include read-only memory and random-access memory, and provides instructions and data to the processor 1203 . A portion of memory 1204 may also include NVRAM. The memory 1204 stores operating systems and operating instructions, executable modules or data structures, or their subsets, or their extended sets, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic services and processing hardware-based tasks.

The processor 1203 controls the operation of the policy enforcement point, and the processor 1203 may also be called a CPU. In a specific application, various components of the policy enforcement point are coupled together through a bus system, where the bus system may include not only a data bus, but also a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the various buses are referred to as bus systems in the figures.

The methods disclosed in the foregoing embodiments of the present application may be applied to the processor 1203 or implemented by the processor 1203 . The processor 1203 may be an integrated circuit chip, which has a signal processing capability. During implementation, each step of the above-mentioned method may be implemented by an integrated logic circuit of hardware in the processor 1203 or instructions in the form of software. The aforementioned processor 1203 may be a general processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Various methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like. The steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory 1204, and the processor 1203 reads the information in the memory 1204, and completes the steps of the above method in combination with its hardware.

In the embodiment of the present application, the processor 1203 is configured to execute the operation and maintenance processing method performed by the policy enforcement point shown in FIG. 2 of the foregoing embodiment.

In another possible design, when the decoding terminal, transmission terminal, or policy enforcement point is a chip in the terminal, the chip includes: a processing unit and a communication unit, where the processing unit may be a processor, for example, and the communication unit is, for example, It can be an input/output interface, a pin or a circuit, etc. The processing unit may execute the computer-executable instructions stored in the storage unit, so that the chip in the terminal executes the operation and maintenance processing method of any one of the first aspect to the second aspect above. Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit may also be a storage unit in the terminal located outside the chip, such as a read-only memory (read -only memory, ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM), etc.

Wherein, the processor mentioned in any of the above-mentioned places may be a general-purpose central processing unit, a microprocessor, an ASIC, or one or more integrated circuits for controlling the program execution of the above-mentioned methods from the first aspect to the second aspect.

In addition, it should be noted that the device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be A physical unit can be located in one place, or it can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. In addition, in the drawings of the device embodiments provided in the present application, the connection relationship between the modules indicates that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software plus necessary general-purpose hardware, and of course it can also be realized by special hardware including application-specific integrated circuits, dedicated CPUs, dedicated memories, Special components, etc. to achieve. In general, all functions completed by computer programs can be easily realized by corresponding hardware, and the specific hardware structure used to realize the same function can also be varied, such as analog circuits, digital circuits or special-purpose circuit etc. However, for this application, software program implementation is a better implementation mode in most cases. Based on this understanding, the essence of the technical solution of this application or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, such as a floppy disk of a computer , U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, etc., including several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the method described in each embodiment of the present application .

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product.

The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server, or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be stored by a computer, or a data storage device including a server, a data center, and the like integrated with one or more available media. The available medium may be a magnetic medium (such as a floppy disk, a hard disk, or a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (Solid State Disk, SSD)), etc.

Claims

An operation and maintenance processing method, characterized in that the method comprises:

Receive service access requests sent by operation and maintenance users through the operation and maintenance terminal;

performing multi-factor identity authentication on the operation and maintenance user according to the service access request;

After the operation and maintenance user passes the multi-factor identity authentication, obtain the work order task of the operation and maintenance user to be executed from the work order system, and obtain the identity data of the operation and maintenance user from the identity authentication management system, and Obtain terminal risk data of the operation and maintenance terminal from a terminal risk awareness system, and obtain service security data from a service provision system;

performing a trust assessment on the operation and maintenance user according to the work order task, the identity data, the terminal risk data and the business security data, and obtaining a trust assessment result;

An access control policy is generated according to the trust evaluation result.
The method according to claim 1, further comprising:

Dynamic access control is performed on the operation and maintenance operations performed by the operation and maintenance user according to the access control policy.
The method according to claim 2, wherein the dynamic access control of the operation and maintenance operation performed by the operation and maintenance user according to the access control policy includes:

For each session generated when the operation and maintenance user performs the operation and maintenance operation, an authorization instruction is generated according to the access control policy and the work order task, and the authorization instruction is used to instruct the operation and maintenance user to follow the authorization set The content of the task to be performed and the operation and maintenance user is prohibited from performing tasks other than the task of the work order;

Perform authority monitoring on the operation and maintenance operations performed by the operation and maintenance user according to the authorization instruction.
The method according to claim 3, wherein the authorization set includes at least one of the following: the account number of the operation and maintenance user, the role of the operation and maintenance user to perform the operation and maintenance operation, the The time of the operation and maintenance operation, the operation instruction for the operation and maintenance user to perform the operation and maintenance operation, and the authorization of the operation and maintenance user to access the service provision system.
The method according to claim 1, further comprising:

The access control policy is sent to the policy enforcement point, so that the policy enforcement point performs dynamic access control on the operation and maintenance operation performed by the operation and maintenance user according to the access control policy.
The method according to any one of claims 1 to 5, characterized in that, the operation and maintenance user is identified according to the work order task, the identity data, the terminal risk data and the business security data Conduct trust assessment and get trust assessment results, including:

generating a trust evaluation model for the operation and maintenance user according to the work order task, the identity data, the terminal risk data, and the business security data;

Obtaining the abnormal behavior of the operation and maintenance user according to the trust evaluation model;

determining the operation risk parameters of the operation and maintenance user according to the abnormal behavior of the operation and maintenance user and the predetermined user historical behavior baseline;

The trust evaluation result is generated according to the operation and maintenance operation risk parameters.
The method according to any one of claims 1 to 6, wherein the access control policy includes: user risk levels and corresponding access control methods;

Wherein, when the user risk level is a low-level risk, the corresponding access control method includes at least one of the following: bubbling reminder, reporting an alarm; or,

When the user risk level is a medium-level risk, the corresponding access control method includes at least one of the following: secondary identity authentication, prohibiting high-risk operations; or,

When the user risk level is a high-level risk, the corresponding access control method includes at least one of the following: forced logout of the user, deactivation of the user.
The method according to any one of claims 1 to 7, wherein the service security data includes: operation and maintenance security logs, operation logs and security events of the service provision system.
The method according to any one of claims 1 to 8, wherein the service providing system includes at least one of the following: a network management and control unit, and a service access network element.
A terminal device, characterized in that the terminal device is specifically a policy decision point, and the terminal device includes:

The receiving module is used to receive the service access request sent by the operation and maintenance user through the operation and maintenance terminal;

An authentication module, configured to perform multi-factor identity authentication on the operation and maintenance user according to the service access request;

An acquisition module, configured to acquire the work order tasks of the operation and maintenance user from the work order system after the operation and maintenance user has passed the multi-factor identity authentication, and obtain the operation and maintenance user from the identity authentication management system identity data, and obtain terminal risk data of the operation and maintenance terminal from the terminal risk awareness system, and obtain service security data from the service provision system;

An evaluation module, configured to perform trust evaluation on the operation and maintenance user according to the work order task, the identity data, the terminal risk data and the business security data, and obtain a trust evaluation result;

A policy generating module, configured to generate an access control policy according to the trust evaluation result.
A terminal device, wherein the terminal device is specifically a policy decision point, and the terminal device includes: a processor and a memory; the processor and the memory communicate with each other;

The memory is used to store instructions;

The processor is configured to execute the instructions in the memory, and execute the method according to any one of claims 1-9.
A computer-readable storage medium, including instructions, which, when run on a computer, cause the computer to execute the method according to any one of claims 1-9.
A computer program product comprising instructions, when run on a computer, causes the computer to execute the method according to any one of claims 1-9.