CN114629803A - Zero-trust data monitoring architecture and method based on security key - Google Patents

Abstract

The invention discloses a zero-trust data monitoring architecture and method based on security keys, comprising a system front end, a data acquisition module, a verification application module, a data encapsulation module, a transmission module, a system back end, a service agent end, and a data receiving module , system application, application monitoring module, topology management module, alarm management module, performance management module, running state management module, client and database, the steps include step 1, collecting information; step 2, identity verification; step 3, data transmission step 4, data storage; step 5, data application; step 6, terminal presentation; compared with the existing network management system, the present invention ensures the identity of the access device through digital signatures, and realizes zero transmission through data encapsulation and verification. Trust, and use the national secret algorithm to encrypt and save data, so as to solve the special needs of data security and ensure the confidentiality of data in the face of intranet penetration attacks.

Description

A security key-based zero-trust data monitoring architecture and method

technical field

The invention relates to the technical field of network management, in particular to a zero-trust data monitoring architecture and method based on a security key.

Background technique

With the promotion of 5G technology business scenarios, the Internet of Everything has brought great convenience. The network management applications for the Internet of Things and various Internet devices have entered the stage of market competition. Data security is very important for each system, but the existing large Some network management systems cannot protect the data transmitted by themselves, and the data is stored in plaintext. With the rise of the Internet of Things, the network management system will carry a large number of management information of facilities. In the face of intranet penetration attacks, it cannot be Guarantee the confidentiality of data.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a zero-trust data monitoring architecture and method based on a security key, so as to solve the problems raised in the above background art.

In order to achieve the above purpose, the present invention provides the following technical solutions: a zero-trust data monitoring architecture based on a security key, comprising a system front end, a transmission module, a system back end and a database, and the system front end is connected with a transmission module through a signal line, The front end of the system includes a data acquisition module, a verification application module and a data encapsulation module. The data transmission module is connected to a data acquisition module through a signal line, the transmission module is connected to a verification application module through a signal cable, and the transmission module is connected to a data encapsulation module through a signal cable. .

Preferably, the transmission module is connected with a system back end through a signal line, the system back end includes a service agent end, a system application and a user end, the service agent end includes a data receiving module, a verification module and a data decapsulation module, and the transmission module passes through The signal line is connected with the data receiving module, the transmission module is connected with the verification module through the signal line, and the transmission module is connected with the data decapsulation module through the signal line.

Preferably, the data decapsulation module is connected with a database through a signal line, and the database is connected with a system application through a signal line.

Preferably, the system application includes an application monitoring module, a topology management module, an alarm management module, a performance management module and a running state management module, the database is connected to an application monitoring module through a signal line, the database is connected to a topology management module through a signal line, and the database The alarm management module is connected through the signal line, the performance management module is connected with the database through the signal line, and the running state management module is connected with the database through the signal line.

Preferably, the system application is connected to a user terminal through a signal line, the user terminal includes a chart display module, a monitoring data analysis module, an alarm release module and a data configuration module, the system application is connected to a chart display module through a signal cable, and the system application is connected through a signal line. A monitoring data analysis module is connected to the line, and an alarm issuing module is connected to the system application through a signal line.

A monitoring method for a zero-trust data monitoring architecture based on a security key, comprising: step 1, collecting information; step 2, identity verification; step 3, data transmission; step 4, data storage; step 5, data application; step 6 , the terminal renders;

In the above step 1, a client node is deployed at the front end of the system, and the client node collects the monitoring data of the device through the data acquisition module 11;

In the above step 2, the identity verification application is sent by the verification application module, and is transmitted to the verification module through the transmission module, and the digital signature technology is used to confirm whether the identity of the access terminal is credible;

In the above-mentioned step 3, the monitoring data is added to the header of the TCP message through the data encapsulation module, and then sent to the data decapsulation module through the transmission module for decapsulation, and whether the security field of the matching TCP message conforms to the predefined settings, if If it matches, the data receiving module will receive the data, if not, the data will be discarded;

In the above step 4, after receiving the data, the national secret algorithm is used for encryption processing, and the monitoring data is stored in the database;

In the above step 5, the monitoring data in the database can be decrypted and processed to form a system application to reflect the specific conditions of the equipment;

In the above-mentioned step 6, finally, the user terminal extracts the specific data in the system application to display it to the user in a detailed and intuitive manner.

Preferably, in the first step, the transmission module can support various network connection methods, such as the Internet of Things, the Internet of Things, and wireless networks.

Compared with the prior art, the beneficial effects of the present invention are: compared with the existing network management system, the present invention ensures the identity of the connected device through digital signatures, realizes zero trust in transmission through data encapsulation and verification, and uses national The encryption algorithm encrypts and saves the data, so as to solve the special needs of data security and ensure the confidentiality of the data in the face of intranet penetration attacks.

Description of drawings

Fig. 1 is the system module frame diagram of the present invention;

Fig. 2 is the system flow chart of the present invention;

Fig. 3 is the method flow chart of the present invention;

Fig. 4 is the device connection diagram of the present invention;

In the figure: 1. System front-end; 11. Data acquisition module; 12. Verification application module; 13. Data encapsulation module; 2. Transmission module; 3. System back-end; 4. Service agent; 41. Data receiving module; 42. Verification module; 43. Data decapsulation module; 5. System application; 51. Application monitoring module; 52. Topology management module; 53. Alarm management module; 54. Performance management module; 55. Running status management module; 6 61. Chart display module; 62. Monitoring data analysis module; 63. Alarm issuing module; 64. Data configuration module; 7. Database.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Please refer to FIG. 1, an embodiment provided by the present invention: a zero-trust data monitoring architecture based on security keys, including a system front end 1, a transmission module 2, a system back end 3 and a database 7, and the system front end 1 passes through a signal line. A transmission module 2 is connected, and the system front end 1 includes a data acquisition module 11, a verification application module 12 and a data encapsulation module 13. The data transmission module 2 is connected to a data acquisition module 11 through a signal line, and the transmission module 2 is connected to a verification module through a signal cable. The application module 12, the transmission module 2 is connected with a data encapsulation module 13 through a signal line; the transmission module 2 is connected with a system backend 3 through a signal line, and the system backend 3 includes a service agent end 4, a system application 5 and a user end 6, and the service agent The terminal 4 includes a data receiving module 41, a verification module 42 and a data decapsulation module 43. The transmission module 2 is connected with a data receiving module 41 through a signal line, the transmission module 2 is connected with a verification module 42 through a signal line, and the transmission module 2 is connected with a signal cable. The line is connected with a data decapsulation module 43, the data receiving module 41 is used to receive monitoring data, the verification module 42 is used to verify the identity, and the data decapsulation module 43 is used to decapsulate and verify the data message; the data decapsulation module 43 passes the signal The line is connected with a database 7, the database 7 is connected with a system application 5 through a signal line, the database 7 is used for storing data, and the system application 5 is used for the specific application of the data; the system application 5 includes an application monitoring module 51, a topology management module 52, and an alarm management module. Module 53, performance management module 54 and operating state management module 55, database 7 is connected with application monitoring module 51 through signal lines, database 7 is connected with topology management module 52 through signal lines, database 7 is connected with alarm management module 53 through signal lines, The database 7 is connected with a performance management module 54 through a signal line, the database 7 is connected with a running state management module 55 through a signal line, an application monitoring module 51 is used for real-time monitoring of applications, a topology management module 52 is used for adjusting node functions, and an alarm management module 53 It is used to issue abnormal warnings, the performance management module 54 is used to adjust the overall performance, and the operation status management module 55 is used to manage the operation of the system; the system application 5 is connected to a user terminal 6 through a signal line, and the user terminal 6 includes a chart display module 61, monitoring data The analysis module 62 , the alarm issuing module 63 and the data configuration module 64 , the system application 5 is connected with the chart display module 61 through the signal line, the system application 5 is connected with the monitoring data analysis module 62 through the signal line, and the system application 5 is connected with the alarm through the signal line The publishing module 63, the chart display module 61 is used for visual display of monitoring data, the monitoring data analysis module 62 can perform specific analysis on the data, the alarm publishing module 63 is used for publishing abnormal warnings, and the data configuration module 64 is used for allocating data.

Please refer to FIG. 2-4, an embodiment provided by the present invention: a monitoring method of a zero-trust data monitoring architecture based on a security key, including step 1, collecting information; step 2, identity verification; step 3, data transmission; step 4, data storage; step 5, data application; step 6, terminal presentation;

In the above step 1, the client node is deployed in the front end 1 of the system, and the client node collects the monitoring data of the device through the data acquisition module 11, wherein the transmission module 2 can support various network connection methods, such as the Internet of Things, the Internet of Things and wireless network, etc.;

In the above step 2, the identity verification application is sent by the verification application module 12, and is transmitted to the verification module 42 through the transmission module 2, and the digital signature technology is used to confirm whether the identity of the access terminal is credible;

In the above-mentioned step 3, the monitoring data is added with a security field in the header of the TCP message through the data encapsulation module 13, and is transmitted to the data decapsulation module 43 through the transmission module 2 for decapsulation, and matches whether the security field of the TCP message conforms to the predefined Set, if it matches, the data receiving module 41 will receive the data, and if it does not match, the data will be discarded;

Wherein in the above-mentioned step 4, after accepting the data, adopt the national secret algorithm to carry out encryption processing, and store the monitoring data in the database 7;

Wherein, in the above-mentioned step 5, the monitoring data in the database 7 can be formed into a system application 5 after being decrypted to reflect the specific situation of the equipment;

In the above-mentioned step 6, finally, the user terminal 6 extracts the specific data in the system application 5 to display it to the user in a detailed and intuitive manner.

Based on the above, the advantage of the present invention is that when data transmission and storage is performed, a client node is first deployed in the system front end 1, and the client node collects the monitoring data of the device through the data acquisition module 11, and the verification application module 12 uses the digital signature technology at the same time. Authentication is performed by the verification module 42, and then the data encapsulation module 13 adds a security field to the header of the TCP message, which is transmitted to the data decapsulation module 43 through the transmission module 2 for decapsulation, and matches whether the security field of the TCP message conforms to the predefined settings , if the data is received by the data receiving module 41 in the service agent 4, if not, the data is discarded, after receiving the data, the national secret algorithm is used for encryption processing, and the monitoring data is stored in the database 7, the data in the database 7 After the monitoring data is decrypted, it is applied to each module in the system application 5, such as the application monitoring module 51, the topology management module 52, the alarm management module 53, the performance management module 54, and the running state management module 55. Finally, the client 6 may have The chart display module 61 , the monitoring data analysis module 62 , and the data configuration module 64 display the specific information of the device data, wherein the system backend 3 is used for information processing and application, and the alarm issuing module 63 is used for issuing abnormal warnings.

It will be apparent to those skilled in the art that the present invention is not limited to the details of the above-described exemplary embodiments, but that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments are to be regarded in all respects as illustrative and not restrictive, and the scope of the invention is to be defined by the appended claims rather than the foregoing description, which are therefore intended to fall within the scope of the claims. All changes within the meaning and range of the equivalents of , are included in the present invention. Any reference signs in the claims shall not be construed as limiting the involved claim.

Claims (7)

1. A zero-trust data monitoring architecture based on security keys, comprising a system front end (1), characterized in that: the system front end (1) is connected with a transmission module (2) through a signal line, and the system front end (1) includes A data acquisition module (11), a verification application module (12) and a data encapsulation module (13), the data transmission module (2) is connected with a data acquisition module (11) through a signal line, and the transmission module (2) is connected with a signal line with The verification application module (12), the transmission module (2) is connected with a data encapsulation module (13) through a signal line. 2. A zero-trust data monitoring architecture based on security keys according to claim 1, characterized in that: the transmission module (2) is connected with a system back-end (3) through a signal line, and the system back-end (3) ) includes a service agent (4), a system application (5) and a client (6), and the service agent (4) includes a data receiving module (41), a verification module (42) and a data decapsulation module (43), The transmission module (2) is connected with a data receiving module (41) through a signal line, the transmission module (2) is connected with a verification module (42) through a signal line, and the transmission module (2) is connected with a data decapsulation module (43) through a signal line ). 3. A security key-based zero-trust data monitoring architecture according to claim 2, characterized in that: the data decapsulation module (43) is connected to a database (7) through a signal line, and the database (7) passes through The signal line is connected with the system application (5). 4. A zero-trust data monitoring architecture based on security keys according to claim 3, characterized in that: the system application (5) comprises an application monitoring module (51), a topology management module (52), an alarm management module The module (53), the performance management module (54) and the running state management module (55), the database (7) is connected with the application monitoring module (51) through the signal line, and the database (7) is connected with the topology management module (52) through the signal line ), the database (7) is connected to an alarm management module (53) through a signal line, the database (7) is connected to a performance management module (54) through a signal line, and the database (7) is connected to an operating state management module (55) through a signal line . 5. A zero-trust data monitoring architecture based on a security key according to claim 4, characterized in that: the system application (5) is connected with a user terminal (6) through a signal line, and the user terminal (6) includes The chart display module (61), the monitoring data analysis module (62), the alarm release module (63) and the data configuration module (64), the system application (5) is connected with the chart display module (61) through the signal line, and the system application (5) ) is connected with the monitoring data analysis module (62) through the signal line, and the system application (5) is connected with the alarm issuing module (63) through the signal line. 6. A monitoring method for a zero-trust data monitoring architecture based on a security key, comprising: step 1, collecting information; step 2, identity verification; step 3, data transmission; step 4, data storage; step 5, data application; Step 6, terminal presentation; it is characterized in that: In the above step 1, the client node is deployed at the front end of the system (1), and the client node collects the monitoring data of the device through the data acquisition module 11; In the above-mentioned step 2, the identity verification application is sent by the verification application module (12), and is transmitted to the verification module (42) through the transmission module (2), and the digital signature technology is used to confirm whether the identity of the access terminal is credible; In the above-mentioned step 3, the monitoring data is added with a security field in the header of the TCP message through the data encapsulation module (13), and is transmitted to the data decapsulation module (43) through the transmission module (2) for decapsulation, and matches the TCP message. Whether the security field conforms to the predefined settings, if so, the data receiving module (41) receives the data, and if not, discards the data; In the above step 4, after receiving the data, the national secret algorithm is used for encryption processing, and the monitoring data is stored in the database (7); In the above step 5, the monitoring data in the database (7) can be formed into a system application (5) after being decrypted to reflect the specific conditions of the equipment; In the above-mentioned step 6, finally, the user terminal (6) extracts the specific data in the system application (5) to display it to the user in a detailed and intuitive manner. 7 . The monitoring method for a zero-trust data monitoring architecture based on a security key according to claim 8 , wherein in the step 1, the transmission module (2) can support various network connection methods, such as physical Internet of Things, Internet of Things, and Wi-Fi, etc.

Images