Disclosure of Invention
Aiming at the requirements of cross-network cross-domain security inspection and security control, the invention provides a security service chain construction method based on a data tag for meeting the requirements of suitability, high efficiency, strong control, security and the like of cross-network exchange security processing, so as to solve the following problems:
1) Aiming at the security protection requirements of different diversified data and the security attack threat problem which is continuously developed, the security protection capability has the capability of dynamic expansion;
2) The security enhancement is needed to be carried out on the security service provided by the network system, so that the problems of counterfeit service call, falsification of the calling process, counterfeit execution result and the like can be prevented;
3) The cross-network information network relates to different services of different networks, not only ensures the compliance of data content, but also needs to accurately control various attributes such as data sources, known ranges, time control and the like, and realizes accurate circulation and exchange in the data exchange process.
Aiming at the problems, the method for constructing the safety service chain based on the data tag establishes an integrated binding data tag by taking the data as a center, takes the tag data attribute as a matching element, defines a safety detection flow by using an expandable service chain, adds a credibility measurement and signature protection mechanism in the process of registering, calling and judging the safety detection service, improves the credibility and safety of the safety service, realizes dynamic expansion of safety protection capability, and realizes accurate data exchange and safety problem execution of the whole service flow.
The technical scheme of the invention is as follows:
A security service chain construction method based on a data tag comprises the following steps:
Generating an integral binding data tag corresponding to original data content to be transmitted according to an integral binding data tag format, wherein the integral binding data tag format comprises user data, tag attributes and a security service chain, wherein the user data is the original data content to be transmitted, the tag attributes comprise a data version number, an application type, a security level, a sending/receiving unit, a time stamp, an extensible field and a tag abstract, and the security service chain comprises a security service sequence, security service execution time, security service signature information, security service key information metric value and an execution sequence rule based on security policy configuration;
Invoking a security service chain, executing each security service according to a security service sequence, and comparing key information metric values of the security service in the execution process to ensure the security service to be credible;
And performing two-stage exchange control verification based on the tag attribute, if the two-stage verification is passed and the execution result of the security service chain is compliant, allowing data flow, otherwise blocking and alarming.
Further, the extensible field supports custom extensions to business requirements for storing additional control attributes.
Further, the security services include virus scanning, content filtering, signature verification.
Further, the security service key information metric value is a key information hash value of the security service, including a service version number, a configuration parameter and a signature public key.
Further, the construction of the security service chain includes:
Establishing a secure service resource pool and a three-party service resource pool, and registering secure service through a service bus;
and arranging a security service chain according to the data type and the security policy.
Further, the invoking the secure service chain includes:
Verifying the integrity and signature authenticity of the security service chain based on the registered security service and the arranged security service chain;
calling registered security service according to the security service sequence, and comparing key information metric values of the security service in the security service execution process to ensure the service credibility;
Writing the execution result of each security service into a security service chain, and performing signature protection.
Further, the two-stage exchange control verification includes:
The first-stage verification, namely verifying the integrity of the data load and the label content through a hash algorithm;
And the second stage of verification, namely verifying the legality of data sources, data attributes and data forwarding according to the exchange control strategy and the data exchange authority.
Further, the construction of the secure service resource pool and the three-party service resource pool comprises the following steps:
based on a security function expansion mechanism of a security service chain, a service idea is adopted to service the security functions of multiple types of heterogeneous types, and a security service resource pool is established;
and integrating the three-party security service through function expansion to establish a three-party service resource pool, wherein the three-party service resource pool can be dynamically expanded.
Further, the final judgment is carried out by integrating the execution result of the security service, the signature verification and the integrity verification result, the discarding or blocking operation is carried out on the non-compliance data, and the judgment log is recorded.
Furthermore, the construction of the security service chain supports multi-network domain cooperation, and the data source and the destination are identified through the tag attribute, so that the accurate management and control of the cross-network cross-domain data exchange are realized.
Compared with the prior art, the invention has the beneficial effects that:
The prior art can realize safety dynamic expansion based on a service chain or classification and related safety processing based on a data tag, but is a solution which is not unified and fused in different scenes or different products. The invention creatively provides an integrated binding data tag, which binds three parts of user data, tag attributes and a security service chain, and effectively combines security inspection and exchange control elements, wherein the data fine granularity exchange control can be performed based on the tag attributes, and the security capability dynamic expansion can be realized based on the security service chain. The integrated binding data tag can enable the concurrent execution of security inspection and security control, and the processing efficiency is greatly improved. Meanwhile, signature and integrity protection are carried out on labels, service registration, call and results by combining a cryptographic technology, so that important judgment information is prevented from being tampered, the safety of the security service is greatly improved, and the requirements of suitability, high efficiency, strong control, safety and the like of cross-network exchange security processing are met.
Detailed Description
It is noted that relational terms such as "first" and "second", and the like, are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises an element.
The features and capabilities of the present invention are described in further detail below in connection with examples.
Example 1
Firstly, it should be noted that the cross-network and cross-domain data security processing mainly comprises two aspects of security check and security control, the invention organically fuses the two functions based on the integrated binding data label creatively, wherein the security check is based on the security service chain in the label for dynamic expansion and security detection, and the security control is based on the attribute in the label for accurate matching control.
Specifically, referring to fig. 1, a method for constructing a security service chain based on a data tag specifically includes the following steps:
Generating an integral binding data tag corresponding to original data content to be transmitted according to an integral binding data tag format, wherein the integral binding data tag format comprises user data, tag attributes and a safety service chain, wherein the user data is the original data content to be transmitted, the tag attributes comprise a data version number, an application type, a safety grade, a sending/receiving unit, a time stamp, an extensible field and a tag abstract, and the safety service chain comprises a safety service sequence (safety service is detection service), safety service execution time, safety service signature information, a safety service key information metric value and an execution sequence rule based on safety strategy configuration;
Invoking a security service chain, executing each security service according to a security service sequence, and comparing key information metric values of the security service in the execution process to ensure the security service to be credible;
And performing two-stage exchange control verification based on the tag attribute, if the two-stage verification is passed and the execution result of the security service chain is compliant, allowing data flow, otherwise blocking and alarming.
Referring to fig. 2, it should be noted that, in this embodiment, in order to organically combine two functions of dynamic expansion and fine switching control of security services, an integrated binding data tag is innovatively designed, which includes 3 parts, namely user data, tag attribute and security service chain;
the user data is the original data content to be transmitted, and is subjected to security check according to a security service sequence in a security service chain;
The tag attribute mainly comprises a data version number, an application type, a security level, a sending/receiving unit, a timestamp, an extensible field and a tag abstract, wherein the security level is the data level in the graph (totally called as the data security level), the sending/receiving unit comprises a sender, a sending unit, a receiver and a receiving unit in the graph, the timestamp comprises the sending time and the receiving time in the graph, the extensible field is reserved and supports custom extension according to service requirements and is used for storing additional control attributes, and the tag abstract is used for preventing the tag from being tampered in the transmission process and improving the security and the credibility of the tag;
And the security service chain writes related information such as security service, security service execution time, service signature and the like which are needed to be done by the data into the integrated binding data security tag according to security policy configuration.
In this embodiment, the security services include virus scanning, content filtering, signature verification, and the like.
In this embodiment, specifically, the security service key information metric value is a key information hash value of the security service, including a service version number, a configuration parameter, and a signature public key.
In this embodiment, specifically, the construction of the security service chain includes:
Establishing a secure service resource pool and a three-party service resource pool, and registering secure service through a service bus;
and arranging a security service chain according to the data type and the security policy.
In this embodiment, specifically, the invoking the security service chain includes:
Verifying the integrity and signature authenticity of the security service chain based on the registered security service and the arranged security service chain;
calling registered security service according to the security service sequence, and comparing key information metric values of the security service in the security service execution process to ensure the service credibility;
Writing the execution result of each security service into a security service chain, and performing signature protection.
In this embodiment, specifically, the two-stage exchange control verification includes:
the first-stage verification comprises verifying the integrity of the data load and the label content by a hash algorithm, namely generating an integrity check value by adopting the hash algorithm aiming at the data load and the label content, and verifying the integrity check value by each control point in the data exchange process to realize integrity protection;
And the second-stage verification is to verify the legality of data sources, data attributes and data forwarding according to the exchange control strategy and the data exchange authority, namely, in the cross-network cross-domain data exchange process, the tag attribute (namely, the control attribute) can be used as a core element for formulating the exchange control strategy and the data exchange authority strategy, and the data flow management and control based on the data security tag can be realized by identifying and extracting the tag attribute such as a network domain, a sender, a receiver, a sending unit, a receiving unit, a grade and an knowing range and comparing and matching the tag attribute with the exchange control strategy and the exchange authority strategy.
In this embodiment, specifically, the construction of the secure service resource pool and the three-party service resource pool includes:
based on a security function expansion mechanism of a security service chain, a service idea is adopted to service the security functions of multiple types of heterogeneous types, and a security service resource pool is established;
the method comprises the steps of integrating three-party security services through function expansion, establishing a three-party service resource pool, enabling the three-party service resource pool to be dynamically expanded, registering each security service through a service bus before dispatching, and dispatching only the security service which is successfully registered.
In this embodiment, specifically, the final decision is performed by integrating the security service execution result, signature verification and integrity verification result, and the discard or blocking operation is performed on the non-compliant data, and the decision log is recorded.
In this embodiment, specifically, the construction of the security service chain supports multi-domain collaboration, and identifies the source and destination of data through the tag attribute, so as to realize the accurate management and control of the cross-network and cross-domain data exchange.
In this embodiment, it should be noted that, the security function extension mechanism based on the security service chain adopts a service design concept to package various security functions in a service manner, flexibly and efficiently arrange and schedule corresponding security services according to different data types for processing, and make exchange validity judgment according to service execution results.
The core of service arrangement, service scheduling and service execution is a safety service chain, which is a 'flow sheet' output by service arrangement, is a 'baton' of a service calling process, is a 'physical examination sheet' of a service execution result, and the safety of the safety service chain is critical, and mainly comprises the following aspects:
(1) The risk of falsification and tampering of the secure service chain of the service orchestration output needs to be addressed.
(2) There is a need to address the issue of whether security services performed during service invocation are trusted.
(3) The problem of falsification resistance of service execution results is required to be solved.
Therefore, as shown in fig. 3, the security enhancement design based on the security service chain utilizes the cryptographic technology to carry out security enhancement on the whole process of service arrangement, service scheduling and service execution, and constructs the security service chain, so that the problems of service call impersonation, call process falsification, execution result impersonation and the like can be effectively prevented, and the execution of various security functions of parallel processing can be safer and more reliable.
Example two
The second embodiment is based on the further implementation of the security service chain construction method based on the data tag, and provides a data tag-based cross-network and cross-domain exchange data security processing system which comprises a service arrangement module, a service scheduling module and a security judgment module.
The service arrangement module establishes a plurality of service chains according to various data security processing strategies, each service chain comprises one or more different types of data security processing services and serial or parallel execution sequences, the service arrangement module outputs a security service chain after the service arrangement is finished, and the security service key information measurement values in the service registration process are recorded together and used for comparison of the execution process and integrity and authenticity protection of the generated security service chain.
In the execution process of the data exchange task, the service scheduling module identifies the data type to execute the corresponding safety service chain, firstly verifies the integrity and the authenticity of the safety service chain, performs safety service calling, compares the measurement value of the safety service in the calling process, and verifies the credibility of the safety service. After the service call is completed, the security service writes the checking or processing result back into the security service chain, and performs integrity protection, and confirms the service execution result of this time. The service scheduling module monitors the execution condition of the security service chain, and after all security services are executed, the execution result is uniformly checked and verified, so that the execution process is prevented from being bypassed and the execution result is prevented from being forged.
The security judgment module performs final comparison, analysis and judgment according to the execution result of the security check, signature verification, integrity verification and the like, decides whether the data content passes the security check, is legal and compliant, discards the data which is not legal and blocks traffic.
The above examples merely illustrate specific embodiments of the application, which are described in more detail and are not to be construed as limiting the scope of the application. It should be noted that it is possible for a person skilled in the art to make several variants and modifications without departing from the technical idea of the application, which fall within the scope of protection of the application.
This background section is provided to generally present the context of the present invention and the work of the presently named inventors, to the extent it is described in this background section, as well as the description of the present section as not otherwise qualify as prior art at the time of filing, are neither expressly nor impliedly admitted as prior art against the present invention.