WO2023160010A1

WO2023160010A1 - Security detection method and apparatus, electronic device and storage medium

Info

Publication number: WO2023160010A1
Application number: PCT/CN2022/130436
Authority: WO
Inventors: 刘小辉
Original assignee: 中兴通讯股份有限公司
Priority date: 2022-02-28
Filing date: 2022-11-07
Publication date: 2023-08-31
Also published as: CN116709335A

Abstract

The present application relates to a security detection method and apparatus, an electronic device and a storage medium. The method comprises: acquiring the operation state data of a system; inputting the operation state data into a pre-created secure container, and carrying out security detection on the system by means of the secure container, the secure container being established in a lightweight platform deployed on an operating system kernel; and reporting an alarm when it is detected that the system has a security problem.

Description

Safety detection method, device, electronic equipment and storage medium

related application

This application claims priority to a Chinese patent application with application number 202210191549.8 filed on February 28, 2022, the entire contents of which are incorporated herein by reference.

technical field

The embodiments of the present application relate to the field of communication technologies, and in particular, to a security detection method, device, electronic equipment, and storage medium.

Background technique

With the continuous development and progress of communication technology, the fifth generation mobile communication system (5th Generation Wireless Systems, 5G) has become the mainstream communication system. Wide range of applications. With the application of microservice technology, the complexity of each communication system is increasing, and the system security is also facing more and more challenges. Taking the 5G access network system as an example, in order to support complex services, the 5G access network system runs hundreds of micro-service applications, and the micro-service applications of each business face a very large security risk detection and management work.

The current security risk detection and governance solution is that each microservice application is independently security tested and governed by the domain that maintains and develops the microservice application. However, on the one hand, the rapid iteration and changes of the system have increased various security risks. The traditional security risk detection and management has the problem of incomplete security detection coverage, or repetitive and complicated security detection work; on the other hand, each microservice application Developed and maintained by different fields, due to the inconsistency of security specifications, it is very prone to loopholes.

Contents of the invention

The main purpose of the embodiment of the present application is to propose a security detection method, device, electronic equipment and storage medium, aiming to improve the coverage of security detection as much as possible, and alleviate the problems of a large number of repetitions and complex detection in security detection work.

In order to achieve the above purpose, an embodiment of the present application provides a security detection method, including: obtaining the operating status data of the system; inputting the operating status data into a pre-created security container, and performing security on the system through the security container detection; wherein, the security container is built on a lightweight platform deployed on the operating system kernel; and reporting an alarm when a security problem is detected in the system.

In order to achieve the above purpose, the embodiment of the present application also provides a safety detection device, including: an acquisition module, used to obtain the running status data of the system; a detection module, used to input the running status data into a pre-created security container, Perform security detection on the system through the security container; wherein, the security container is built on a lightweight platform deployed on the operating system kernel; an alarm module is used to detect that there is a security problem in the system Next, report to the police.

To achieve the above purpose, an embodiment of the present application further provides an electronic device, the device includes: at least one processor; and a memory connected to the at least one processor in communication; wherein, the memory stores information that can be Instructions executed by the at least one processor, the instructions are executed by the at least one processor, so that the at least one processor can execute the security detection method as described above.

In order to achieve the above purpose, the embodiment of the present application also proposes a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above-mentioned security detection method is implemented.

In the security detection method provided by the embodiment of the present application, a security container is pre-created on a lightweight platform deployed on the kernel of the operating system of the 5G access network system, before the 5G access network system is put into use or during use , to obtain the operating status data of the 5G access network system, and input the obtained operating status data into the security container, and perform security detection on the system through the security container, and report to the operation and maintenance personnel if a security problem is detected in the system Or the management personnel report the alarm, or directly display the detected security problems on the detection result interface. By creating a security container on a lightweight platform deployed on the kernel of the operating system of the 5G access network system, and performing security testing on the system based on the operating status data of the system through the security container, the process of security risk detection management is managed , without the help of external detection means, through the automation of the security container inside the system, the coverage of security testing is improved, the complexity and possible repetition of security testing are reduced, and the purpose of endogenous security in the system is achieved.

Description of drawings

One or more embodiments are exemplified by pictures in the accompanying drawings, and these exemplifications are not intended to limit the embodiments.

Fig. 1 is a flow chart of the safety detection method in the embodiment of the present application;

Fig. 2 is a schematic structural diagram of a safety detection device in another embodiment of the present application;

Fig. 3 is a schematic structural diagram of an electronic device in another embodiment of the present application.

Detailed ways

It can be seen from the background technology that each microservice application is developed and maintained by different fields. Due to the inconsistency of security specifications, loopholes are prone to occur. In addition, the system is rapidly iterated and changed, and various security risks are also increasing. The traditional security risk detection and governance There are problems that the coverage of security testing is not comprehensive, or the work of security testing is repetitive and complicated. Therefore, how to simply and efficiently implement system security detection with relatively comprehensive coverage is a technical problem that needs to be solved urgently.

In order to solve the above problems, the embodiment of the present application provides a security testing method, including: obtaining the running status data of the system; inputting the running status data into a pre-created security container, and performing security testing on the system through the security container; wherein, the security container Built on a lightweight platform deployed on the operating system kernel; when a security problem is detected in the system, an alarm is reported.

In the security detection method provided by the embodiment of the present application, a security container is pre-created on a lightweight platform deployed on the kernel of the operating system of the 5G access network system, before the 5G access network system is put into use or during use , to obtain the operating status data of the 5G access network system, and input the obtained operating status data into the security container, and perform security detection on the system through the security container, and report to the operation and maintenance personnel if a security problem is detected in the system Or the management personnel report the alarm, or directly display the detected security problems on the detection result interface. By creating a security container on a lightweight platform deployed on the kernel of the operating system of the 5G access network system, and performing security testing on the system based on the operating status data of the system through the security container, the process of security risk detection management is managed , without the help of external detection means, through the automation of the security container inside the system, the coverage of security testing is improved, the complexity and possible repetition of security testing are reduced, and the purpose of generating security in the system is achieved.

In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. However, those of ordinary skill in the art can understand that in each embodiment of the application, many technical details are provided for readers to better understand the application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in this application can also be realized. The division of each of the following embodiments is for the convenience of description, and should not constitute any limitation to the specific implementation of the present application, and each embodiment can be combined and referenced to each other on the premise of no contradiction.

The implementation details of the security detection method described in the present application will be described in detail below in conjunction with specific embodiments. The following content is only the implementation details provided for easy understanding, and is not necessary for the implementation of this solution.

The first aspect of the embodiment of the present application provides a security detection method, the specific flow of the security detection method can refer to Figure 1, in some embodiments, the security detection method is applied to the baseband processing unit in the 5G access network system, or A terminal device that can perform data transmission with a baseband processing unit. The terminal device has communication, data storage, and processing capabilities. This embodiment uses the baseband processing unit as an example for illustration. The security detection method includes the following steps:

Step 101, acquiring system operation status data.

Specifically, after the 5G access network system is built or put into use, the baseband processing unit (Building Base band Unit, BBU) communicates with the operating system kernel and lightweight Each hardware resource in the service platform and the business container (micro-service application) carrying different services interact with each other, collect the current operating data or usage data of the operating system kernel, hardware resources, and each business container, and obtain the 5G access network system operating status data.

In an example, the baseband processing unit acquires the operating state data of the system, including: periodically acquiring the current operating state data of the system according to a preset time interval. Specifically, the baseband processing unit collects the running status data of the 5G access network system at regular intervals according to the administrator's instructions or the preset time interval preset by the operation and maintenance personnel, and according to the obtained current Running status data for subsequent security testing of the system. Through periodic operation status data acquisition and security risk detection, the security problems existing in the system can be detected and dealt with in time to the greatest extent, and the security during system operation can be improved.

Step 102, input the running state data into the pre-created security container, and perform security detection on the system through the security container; wherein, the security container is established in a lightweight platform deployed on the operating system kernel.

Specifically, after the baseband processing unit obtains the running status data of the 5G access network system through data interaction, it transmits the running status data to a secure container pre-created on a lightweight platform deployed on the operating system kernel, The security detection of the 5G access network system is carried out according to the obtained operation status data through the security container. By using the security container pre-created on the system's internal lightweight platform to perform automated security testing, it avoids the need to use external testing methods during the security testing process, reduces the complexity and repetition of security testing, and improves the efficiency of security testing.

It is worth mentioning that the security problems that may exist in the system include one or any combination of the following: operating system kernel exceptions, external intrusion exceptions, and business container exceptions. This embodiment only lists several common security issues in the 5G access network system, and other uncommon security issues can also be detected during actual use.

In one example, when the security problem includes an abnormal operating system kernel, the baseband processing unit performs security detection on the system through the security container, including: obtaining the configuration data in the configuration files of each public component in the system according to the configuration data Configuration items; when it is detected that there are public components whose configuration items do not meet the preset security criteria, it is determined that the system has an operating system kernel exception. Specifically, the baseband processing unit fetches and occupies corresponding resources on the lightweight platform in advance according to the control instructions of the container management process of the lightweight platform, such as communication ports, storage addresses, and computing resources, etc. Complete the creation of secure containers on an order-of-magnitude platform. In the case of security issues including operating system kernel exceptions, the security container is used to check the compliance of the configuration of each public component in the 5G access network system according to the configuration data in the running status data, and detect the configuration files contained in the configuration files of each public component. Whether all configuration items comply with the industry's general security guidelines. When it is detected that there are public components containing illegal configuration items in the corresponding configuration file, it is determined that there is an operating system kernel exception in the 5G access network system. Wherein, the configuration data in the running state data is obtained by the baseband processing unit by scanning the configuration of the operating system kernel at the operating system level. According to whether the configuration items in the configuration file in the public components are legal, it can accurately and efficiently detect whether there is an operating system kernel in the system, and improve the ability to detect and identify abnormalities in the operating system kernel.

It is worth mentioning that when the security detection of the operating system kernel is performed through the security container, it can be performed directly through the local shell program of the Lunix operating system pre-deployed in the security container, or it can be detected by other methods, which is not discussed in this embodiment. Do limit.

In another example, when the security problem includes an abnormal external intrusion, the baseband processing unit performs security detection on the system through the security container, including: obtaining the resource occupancy information of each hardware resource according to the resource call information in the running state data; When it is detected that there is a hardware resource whose resource occupation exceeds the preset threshold, it is determined that the system has an external intrusion exception. Specifically, when the security issues that need to be detected include external intrusion exceptions, the baseband processing unit detects the resource invocation information in the running status data through the security container, and obtains the resource occupancy information of each hardware resource in the 5G access network system , for example, the usage of the processing power of the central processing unit (central processing unit, CPU), the usage of the storage space of the memory, and the like. Then detect whether the resource occupancy of each hardware resource exceeds the preset threshold, and determine that the system has an external intrusion abnormality when it is detected that there is a hardware resource whose resource occupancy exceeds the preset threshold. The resource invocation information of the hardware resources may be obtained through interaction between the baseband processing unit and the resource management process in the lightweight platform, or may be obtained through direct detection of the occupancy of the hardware resources by invocation detection software. By detecting and monitoring the resource occupancy of hardware resources, it is possible to avoid situations where resource occupancy exceeds a preset threshold, thereby avoiding damage to hardware devices due to excessive occupancy of hardware resources.

It is worth mentioning that the resource occupancy preset threshold of each hardware resource can be set individually, or a threshold value of an occupancy ratio can be set uniformly. The specific setting method can be based on the size of the hardware resource and the business that needs to be carried. The specific needs of hardware resources are determined, and this embodiment does not limit the specific setting of the resource occupation threshold of each hardware resource.

In addition, in order to avoid security problems caused by external intrusion, firewall policies can also be pre-deployed in the security container. After the security container is created, the firewall policy can be directly activated to monitor the external ports and port service status in the 5G access network system in real time. When an abnormal request is detected, the detected abnormal request is directly intercepted; or, when an abnormal external intrusion is detected in the system, the external port of the abnormal resource is blocked to avoid further damage to the system by external intrusion . This embodiment does not limit the firewall policy deployed in the security container.

In another example, when the security problem includes abnormality of the service container, the baseband processing unit conducts security detection on the system through the security container, including: performing operation detection on each service container according to the operation data of each service container in the operation status data ; In the case of detecting that there is a business container running abnormally, it is determined that the system has an abnormal business container. Specifically, the baseband processing unit detects the operation of each service container through the security container according to the operation data of each service container in the operation state data, and detects whether there is an abnormally running service container when the security problem includes the exception of the service container. In the case that a service container with abnormal operation is detected, it is determined that there is an abnormal service container in the 5G access network system. Through the application-level security review of each micro-service application running in the system, it can accurately identify business containers with abnormal operation in the system, avoid duplication of security detection, and improve the coverage of security detection.

Further, the operation detection of each service container by the baseband processing unit through the security container includes one of the following or any combination thereof: file permission detection, running user identity detection, access control detection, patch update detection, and daemon process detection. Specifically, when performing operation detection, it is possible to detect whether there are files with 777 permissions in each business container, to detect whether there is a host identity or user identity running the business container, and to detect whether there is a file with inconsistent rights and responsibilities in the business container. Check the access control instructions, check whether the service components in the business container implement patch updates for leaked vulnerabilities, and check whether the container daemon process and its configuration items of the business container meet the specification requirements. In the case that one or more detection results are abnormal, it is determined that the service container has an abnormal operation problem, and then it is determined that the system has an abnormal service container. Through the multi-dimensional operation detection of business containers, it can comprehensively and accurately determine the business containers with abnormal operation and improve the effectiveness of security detection.

In another example, the baseband operation unit performs security detection on the system through the security container, including: analyzing the security log of the system according to the security log data in the running state data; in the case of detecting abnormal data in the security log data , it is determined that there is a security problem in the system. Specifically, the key events of the 5G access network system will be automatically recorded in the system, which is convenient for auditing and backtracking. The recorded form is a security log. Therefore, when the security detection of the system is carried out through the security container, the security log data in the running state data can be directly analyzed through the security container, and the abnormal data reported in the security log data can be detected. If there is abnormal data in the security data, it is determined that the system has a security problem. Wherein, the security log data may be obtained through interaction between the baseband processing unit and the log storage container in the system. There can be one or more specific types of security issues, and the types of issues can be obtained by analyzing abnormal data or extracting keywords. By regularly auditing and analyzing security log data, the auditing efficiency of security events and the reporting efficiency of recorded security events are improved, and the security detection capability of the system is further deepened.

Step 103, reporting an alarm when a security problem is detected in the system.

Specifically, when the baseband processing unit detects that there is a security problem in the system through the security container, according to the detected specific security problem, it reports the alarm of the security problem in the system to the management personnel or operation and maintenance personnel, or reports the alarm of the security problem in the detection result The page displays the detected security issues and prompts that there are security issues in the system. For example, if an abnormal external intrusion is detected in the 5G access network system through the security container, the operation and maintenance personnel will be prompted that the system is currently in an external intrusion state, and the port affected by the external intrusion will be reported for the operation and maintenance personnel to intercept the external intrusion, and then The system is safe to restore. The security detection of the system based on the customized security container is carried out through automatic means, which greatly enhances the coverage and speed of security detection, thereby enhancing the robustness of the business.

In one example, before the baseband processing unit obtains the operating status data of the system, it also includes: obtaining the latest vulnerability information, synchronizing the latest vulnerability information to the security container, and performing vulnerability detection on the system according to the latest vulnerability information through the security container; When there is a vulnerability in the system, report the vulnerability. Specifically, the 5G access network system and other types of access network systems will contain a specific standard component, and the standard component will disclose leaked or newly detected vulnerability information on the industry website for all The system performs corresponding security problem avoidance and defense according to the leaked vulnerability information. Therefore, the baseband processing unit can also monitor leaked vulnerability information on industry websites, obtain the latest leaked vulnerability information, and synchronize the latest vulnerability information to the security container. Then, based on the latest vulnerability information obtained, the security container automatically generates detection scripts for each vulnerability or directly obtains external detection scripts, and uses the detection scripts to detect whether there are flawed vulnerabilities in the 5G access network system. In the event that a leaked vulnerability is detected in the system, report the detected vulnerability to the detection result interface or report a vulnerability alarm to the management operation and maintenance personnel. By performing vulnerability detection on the system according to the latest vulnerability information of leaks, and reporting the detected system vulnerabilities in time, the system's response and processing speed to vulnerabilities can be improved, and the security of the system can be enhanced.

It is worth mentioning that after the security container detects that there are leaked vulnerabilities in the system, the security container can also instruct the relevant components in the system to automatically generate corresponding patches for the detected vulnerabilities based on the detected vulnerabilities, and generate The patch is used to defend and repair the vulnerability; or obtain the corresponding patch corresponding to the detected vulnerability from the outside, and defend and repair the vulnerability according to the obtained patch, thereby further deepening the security problem defense capability of the system.

In addition, after detecting the security issues of the system through the security components, the detection rules in the security components and the detection content involved in the security detection can be continuously iteratively updated according to the detected security issues or the latest vulnerability information, so as to further improve The system requires the security management of business containers to achieve the purpose of system endogenous security.

In addition, it should be understood that the division of steps in the above methods is only for clarity of description, and may be combined into one step or split into multiple steps during implementation. As long as the same logical relationship is included, all Within the scope of protection of this patent; adding insignificant modifications or introducing insignificant designs to the algorithm or process, but not changing the core design of the algorithm and process are all within the scope of protection of the patent.

Another aspect of the embodiment of the present application also provides a safety detection device, referring to Figure 2, including:

The obtaining module 201 is used to obtain the running status data of the system.

The detection module 202 is configured to input the running status data into a pre-created security container, and perform security detection on the system through the security container; wherein, the security container is built on a lightweight platform deployed on the operating system kernel.

The alarm module 203 is configured to report an alarm when a security problem is detected in the system.

It is not difficult to find that this embodiment is an apparatus embodiment corresponding to the method embodiment, and this embodiment can be implemented in cooperation with the method embodiment. The relevant technical details mentioned in the method embodiments are still valid in this embodiment, and will not be repeated here in order to reduce repetition. Correspondingly, the related technical details mentioned in this embodiment can also be applied in the method embodiment.

It is worth mentioning that all the modules involved in this embodiment are logical modules. In practical applications, a logical unit can be a physical unit, or a part of a physical unit, or multiple physical units. Combination of units. In addition, in order to highlight the innovative part of the present invention, units that are not closely related to solving the technical problem proposed by the present invention are not introduced in this embodiment, but this does not mean that there are no other units in this embodiment.

Another aspect of the embodiment of the present application also provides an electronic device, referring to FIG. 3 , including: including at least one processor 301; Instructions executed by at least one processor 301, the instructions are executed by at least one processor 301, so that at least one processor 301 can execute the security detection method described in any one of the foregoing method embodiments.

Wherein, the memory 302 and the processor 301 are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors 301 and various circuits of the memory 302 together. The bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein. The bus interface provides an interface between the bus and the transceivers. A transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium. The data processed by the processor 301 is transmitted on the wireless medium through the antenna, and further, the antenna receives the data and transmits the data to the processor 301 .

The processor 301 is responsible for managing the bus and general processing, and may also provide various functions including timing, peripheral interface, voltage regulation, power management and other control functions. And the memory 302 can be used to store data used by the processor 301 when performing operations.

Embodiments of the present invention also provide a computer-readable storage medium storing a computer program. The above method embodiments are implemented when the computer program is executed by the processor.

That is, those skilled in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, the program is stored in a storage medium, and includes several instructions to make a device ( It may be a single-chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

Those of ordinary skill in the art can understand that the above-mentioned embodiments are specific embodiments for realizing the present application, and in practical applications, various changes can be made to it in form and details without departing from the spirit and spirit of the present application. scope.

Claims

A safety detection method, comprising:

Obtain the operating status data of the system;

Inputting the running state data into a pre-created security container, and performing security detection on the system through the security container; wherein, the security container is built on a lightweight platform deployed on the operating system kernel;

When it is detected that there is a security problem in the system, an alarm is reported.
The security detection method according to claim 1, wherein the security issues include one of the following or any combination thereof:

Operating system kernel exceptions, external intrusion exceptions, and business container exceptions.
The security detection method according to claim 2, wherein, in the case that the security problem includes an abnormality of the operating system kernel, performing security detection on the system through the security container includes:

Acquiring the configuration items in the configuration files of the public components in the system according to the configuration data in the running status data;

If it is detected that the configuration item does not meet the preset security criteria of the public component, it is determined that the operating system kernel exception exists in the system.
The security detection method according to claim 2, wherein, in the case that the security problem includes an abnormal external intrusion, the security detection of the system through the security container includes:

Acquiring resource occupancy information of each hardware resource according to the resource invocation information in the running state data;

If it is detected that there is the hardware resource whose resource occupation exceeds a preset threshold, it is determined that the external intrusion exception exists in the system.
The security detection method according to claim 2, wherein, in the case that the security problem includes an abnormality of a business container, performing security detection on the system through the security container includes:

According to the operation data of each service container in the operation status data, perform operation detection on each of the service containers;

If it is detected that there is the service container running abnormally, it is determined that the system has the service container abnormality.
The safety detection method according to claim 5, wherein the operation detection comprises one of the following or any combination thereof:

File permission detection, running user identity detection, access control detection, patch update detection, daemon process detection.
The security testing method according to claim 1, wherein the security testing of the system through the security container comprises:

Perform security log analysis on the system according to the security log data in the running state data;

If it is detected that there is abnormal data in the security log data, it is determined that the security problem exists in the system.
The safety detection method according to any one of claims 1 to 7, wherein, before acquiring the operating state data of the system, further comprising:

Obtaining the latest vulnerability information, synchronizing the latest vulnerability information to the security container, and performing vulnerability detection on the system according to the latest vulnerability information through the security container;

When a vulnerability is detected in the system, the vulnerability is reported.
The safety detection method according to any one of claims 1 to 7, wherein said acquiring the operating state data of the system comprises:

The current operating state data of the system is periodically acquired according to a preset time interval.
A safety detection device, comprising:

The acquisition module is used to acquire the operating status data of the system;

A detection module, configured to input the running state data into a pre-created security container, and perform security detection on the system through the security container; wherein, the security container is built on a lightweight platform deployed on the operating system kernel middle;

The alarm module is configured to report an alarm when a security problem is detected in the system.
An electronic device comprising:

at least one processor; and,

a memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can perform the security operation according to any one of claims 1 to 8. Detection method.
A computer-readable storage medium storing a computer program, wherein the computer program implements the security detection method according to any one of claims 1 to 8 when executed by a processor.