WO2025036112A1 - Data security protection selection method and apparatus, and storage medium - Google Patents

Abstract

The embodiments of the present disclosure relate to the technical field of mobile communication. Provided are a data security protection selection method and apparatus, and a storage medium. The method comprises: obtaining information of a target application or a target model and information of target data required by the target application or the target model, and determining first security information and/or second security information; determining DTN data security requirements on the basis of the first security information and/or the second security information; determining a candidate data source capable of providing the target data, and on the basis of a data security protection mechanism supported by the candidate data source and a correspondence between each data security protection mechanism and a data security performance, determining a target data source capable of meeting the DTN data security requirements and a target security protection mechanism with which the target data source needs to be configured; and configuring the target security protection mechanism for the target data source and a relevant security entity.

Description

Data security protection selection method, device and storage medium

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to Chinese patent application 202311029613.3 filed in China on August 16, 2023, the entire contents of which are incorporated herein by reference.

Technical Field

The present disclosure relates to the field of mobile communication technology, and in particular to a data security protection selection method, device and storage medium.

Background Art

Digital twins are real-time mirror images of physical entities in the digital world, and are becoming a new focus of global information technology development and industrial digital transformation. In the future network, digital twin technology will be widely used in smart manufacturing, smart cities, scientific research and other fields, making the entire society move towards a "digital twin" world that combines virtuality and reality.

Digital Twin Network (DTN) is a network system with physical network entities and virtual twins, and the two can be interactively mapped in real time. In this system, various network management and applications can use the network virtual twins built by digital twin technology to efficiently analyze, diagnose, simulate and control the physical network based on data and models. The network virtual twin can help the physical network achieve low-cost trial and error, intelligent decision-making, high-efficiency innovation and predictive maintenance. Using the digital twin network as a key enabling platform for future mobile communication networks can help mobile communication networks achieve the goal of distributed autonomy. At the same time, the digital twin network can help users clearly perceive the network status, efficiently mine valuable network information, and explore innovative network applications with a more friendly immersive interactive interface through capability exposure and twin copying.

The deconstruction of the digital twin network is shown in Figure 1. Data is the cornerstone of building digital twins. The functional realization of the digital twin network is closely related to data processing, including data collection-data transmission-data storage-data preprocessing-data use, etc. Among them, data collection realizes the efficient collection of multi-source heterogeneous data of the physical network; data transmission refers to the near real-time transmission of the collected data through the data transmission network; data storage and preprocessing will classify and store heterogeneous data, and use various methods to clean up "dirty" data, compress storage space, and improve data quality. Open use of data refers to the use of data for application models through a unified format and interface.

The data collection methods currently under study partially support the establishment of secure transmission channels, but do not provide security protection for data from the data source to the model level, and do not have the ability to select and dynamically adjust security mechanisms. This cannot meet the precise protection requirements of the diverse models and data sources in the digital twin network, as well as the dynamic changes of the network, and may not meet the real-time requirements of the digital twin network.

Summary of the invention

At least one embodiment of the present disclosure provides a data security protection selection method, device and storage medium, which provide a data security protection mechanism for the data of the digital twin network that is adapted to the upper-layer applications and the underlying network to meet the security and real-time requirements of the digital twin network.

In order to solve the above technical problems, the present disclosure is implemented as follows:

In a first aspect, an embodiment of the present disclosure provides a data security protection selection method in a digital twin network, which is applied to a security policy management function, and the method includes:

Obtain information of a target application or a target model and information of target data required by the target application or the target model, and determine first security information and/or second security information, wherein the first security information is security information of the target application or the target model, and the second security information is security information of the target data required by the target application or the target model;

Determine, according to the first security information and/or the second security information, a digital twin network DTN data security requirement, wherein the DTN data security requirement includes at least one of a confidentiality requirement, a privacy requirement, a trust requirement, and a real-time requirement;

Determine a candidate data source that can provide the target data based on the data that can be provided by each pre-maintained data source, and determine a target data source that can meet the DTN data security requirements and a target security protection mechanism that needs to be configured for the target data source based on the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance;

The target security protection mechanism is configured for the target data source and related security entities.

Optionally, determining the first security information and/or the second security information includes:

Analyze information of a target application or a target model, determine security information of the target application or the target model, and obtain the first security information; and/or analyze information of target data required by the target application or the target model, determine security information of the target data, and obtain the second security information;

or,

Receive security information of target data required by the target application or target model and/or security information of the target application or target model sent by the target application or target model; obtain the first security information based on the security information of the target application or target model, and/or obtain the second security information based on the security information of the target data.

Optionally, the above method further includes:

Establish and maintain in advance the data that each data source can provide and the data security protection mechanism supported by each data source;

Establish and maintain the correspondence between various data security protection mechanisms and data security performance in advance.

Optionally, the above method further includes:

Obtaining the network status and determining whether it is necessary to update the target data source and/or update the target security protection mechanism;

In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements;

In the case where the target security protection mechanism needs to be updated, re-determine and configure the DTN data to meet the requirements. Target security protection mechanism based on security requirements.

Optionally, the acquiring of the network status includes at least one of the following:

Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators;

Monitor the network and obtain the network indicators.

Optionally, the determining whether it is necessary to update the target data source and/or update the target security protection mechanism includes at least one of the following:

Analyze whether the network indicator affects the data security performance that can be achieved by the target security protection mechanism of the target data source, and if so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism;

Analyze whether it is necessary to update the digital twin network DTN data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism.

In a second aspect, an embodiment of the present disclosure provides a data security protection selection method in a digital twin network, which is applied to a data source node and a corresponding security entity, and the method includes:

Receiving configuration information sent by the security policy management function, the configuration information including a target security protection mechanism;

According to the target security protection mechanism, the data source node and related security entities are configured.

In a third aspect, an embodiment of the present disclosure provides a data security protection selection device in a digital twin network, which is applied to a security policy management function and includes a transceiver and a processor, wherein:

The transceiver is used to obtain information of a target application or a target model and information of target data required by the target application or the target model, and determine first security information and/or second security information, wherein the first security information is security information of the target application or the target model, and the second security information is security information of the target data required by the target application or the target model;

The processor is used to determine the digital twin network DTN data security requirements based on the first security information and/or the second security information, and the DTN data security requirements include at least one of confidentiality requirements, privacy requirements, trust requirements and real-time requirements; determine the candidate data source that can provide the target data based on the data that can be provided by each pre-maintained data source, and determine the target data source that can meet the DTN data security requirements and the target security protection mechanism that needs to be configured for the target data source based on the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance; configure the target security protection mechanism for the target data source and related security entities.

Optionally, the transceiver is further used for:

Analyze information of a target application or a target model, determine security information of the target application or the target model, and obtain the first security information; and/or analyze information of target data required by the target application or the target model, determine security information of the target data, and obtain the second security information;

or,

Receive security information of target data required by the target application or target model and/or security information of the target application or target model sent by the target application or target model; obtain the first security information based on the security information of the target application or target model, and/or obtain the second security information based on the security information of the target data.

Optionally, the processor is further configured to:

Establish and maintain in advance the data that each data source can provide and the data security protection mechanism supported by each data source;

Establish and maintain the correspondence between various data security protection mechanisms and data security performance in advance.

Optionally, the transceiver is further used to: obtain a network status, determine whether it is necessary to update a target data source and/or update a target security protection mechanism;

The processor is further configured to:

In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements;

In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured.

Optionally, the transceiver is further configured to obtain the network status in at least one of the following ways:

Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators;

Monitor the network and obtain the network indicators.

Optionally, the processor is further configured to determine whether it is necessary to update the target data source and/or update the target security protection mechanism in at least one of the following ways:

Analyze whether the network indicator affects the data security performance that can be achieved by the target security protection mechanism of the target data source, and if so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism;

Analyze whether it is necessary to update the digital twin network DTN data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism.

In a fourth aspect, an embodiment of the present disclosure provides a data security protection selection device in a digital twin network, which is applied to security policy management functions, including: a processor, a memory, and a program stored on the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method described in the first aspect.

In a fifth aspect, an embodiment of the present disclosure provides a data security protection selection device in a digital twin network, which is applied to a data source node and a corresponding security entity, including a transceiver and a processor, wherein:

The transceiver is used to receive configuration information sent by the security policy management function, wherein the configuration information includes a target security protection mechanism;

The processor is used to configure the data source node and related security entities according to the target security protection mechanism

In the sixth aspect, an embodiment of the present disclosure provides a data security protection selection device in a digital twin network, which is applied to data source nodes and corresponding security entities, including: a processor, a memory, and a program stored on the memory and executable on the processor, and when the program is executed by the processor, the steps of the method described in the second aspect are implemented.

In a seventh aspect, an embodiment of the present disclosure provides a computer-readable storage medium, on which a program is stored. When the program is executed by a processor, the steps of the method described above are implemented.

Compared with the prior art, the data security protection selection method, device and storage medium provided in the embodiments of the present disclosure provide a data security protection mechanism for the data of the digital twin network that is adapted to the upper-layer applications and the underlying network, and can meet the precise protection requirements of the diverse models and data sources in the digital twin network and the dynamic changes of the network. It can meet the real-time and security requirements of digital twin networks and reduce human intervention.

BRIEF DESCRIPTION OF THE DRAWINGS

Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present disclosure. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

FIG1 is an example diagram of a digital twin network deconstruction in the related art;

FIG2 is a flow chart of a data security protection selection method according to an embodiment of the present disclosure;

FIG3 is another flow chart of a data security protection selection method according to an embodiment of the present disclosure;

FIG4 is an exemplary flow chart of a data security protection selection method according to an embodiment of the present disclosure;

FIG5 is a schematic diagram of a structure of a data security protection selection device according to an embodiment of the present disclosure;

FIG6 is another schematic diagram of the structure of the data security protection selection device according to an embodiment of the present disclosure;

FIG7 is another schematic diagram of the structure of the data security protection selection device according to an embodiment of the present disclosure;

FIG8 is another schematic diagram of the structure of the data security protection selection device according to an embodiment of the present disclosure;

FIG9 is another schematic diagram of the structure of the data security protection selection device according to an embodiment of the present disclosure;

FIG. 10 is another schematic diagram of the structure of the data security protection selection device according to an embodiment of the present disclosure.

DETAILED DESCRIPTION

The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

The terms "first", "second", etc. in the specification and claims of the present disclosure are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. "And/or" in the specification and claims represents at least one of the connected objects.

The following description provides examples and does not limit the scope, applicability, or configuration set forth in the claims. Changes may be made to the functions and arrangements of the elements discussed without departing from the spirit and scope of the present disclosure. Various examples may appropriately omit, replace, or add various procedures or components. For example, the described methods may be performed in an order different from that described, and various steps may be added, omitted, or combined. In addition, features described with reference to certain examples may be combined in other examples.

In related technologies, common data collection methods include:

1. Collect network device data (Simple Network Management Protocol (SNMP), Network Configuration Protocol (NETCONF)), the network device data includes:

(1) Geometric data, such as the physical form data of the device, including device size, number of ports, device image, device deployment location, etc.

(2) Status data, such as the device’s operating status data, including port up/down status, central processing unit (CPU) utilization, memory utilization, etc.

(3) Event data: data triggered by events such as device configuration changes, abnormal conditions, and failures, such as alarms and logs;

(4) Topological data; such as data indicating the connection relationship between network elements, including device identification, number of links, port name, etc.

2. Collect network performance data (Telemetry). The network performance data refers to performance data such as network delay, jitter, packet loss, bandwidth, etc., including performance data of different network types such as wireless networks, transmission networks, and data center networks. Telemetry is a network monitoring technology.

3. Collect network traffic data (Sflow, Netflow, IPFIX, Netstream, eBPF, plug-in probes). Network traffic data refers to the traffic data running in the network, including traffic quintuples, packet length, priority, payload, etc. Sflow is a network monitoring technology, Netflow is a network monitoring function, IPFIX refers to IP data flow information output (IP Flow Information Export), Netstream is a statistical technology based on network flow information, and eBPF refers to Extended Berkeley Packet Filter.

4. Obtain data from the network management system or network data analysis function (NWDAF) (such as Restful service interface);

5. Get data from the unified database and external database (Restful service interface or File Transfer Protocol (FTP) or Kafka).

DTN will generate and store a large amount of device information, user information, interaction information, and management information. The leakage of these data or unauthorized access by applications may cause privacy leakage of users or networks. If data is tampered with or destroyed during transmission or storage, or the collected data is unreliable, it will be difficult to meet the application and analysis requirements of data in DTN. The multi-level collaboration of heterogeneous networks and the need for cross-domain twin generation of DTN data sharing have increased the complexity of ensuring the above data security requirements. Therefore, the digital twin network system needs to provide corresponding security mechanisms to ensure the confidentiality, integrity, reliability, and traceability of data.

The real-time, replication, and scalability characteristics of digital twins put forward more requirements for data security mechanisms.

First, since digital twins need to track the state changes of real networks, for application scenarios with strong dynamics, there are higher requirements for the real-time and accuracy of data collection and synchronization. However, some scenarios do not require high real-time performance, so the acceptance of the time overhead and information loss of the data security mechanism used varies.

Secondly, network twins pursue a comprehensive and accurate representation of the network, which involves the collection of various types of data from various network devices and external libraries such as threat intelligence. Each data source may have different security requirements for its own data. For example, The User Data Management (UDM) in the security domain and the Network Slice Management Function (NSMF) in the management security domain have different restrictions on the access scope of their respective traffic data. At the same time, each type of data has its own privacy requirements. For example, the privacy requirements of user data and device status data are different. In addition, the resource capabilities of computing and storage bandwidth of various devices are different, and the data volume is different. Therefore, there may be different choices for the device and transmission resource consumption of the security mechanism as well as the software and hardware support.

Third, the digital twin network supports multi-scale, multi-physical quantity, and multi-level application models. There are many types of application models and they may have different security restrictions and security requirements. For example, a network element may have a requirement that data is available but invisible for cross-operator or cross-domain application models, while it is visible for models in the local domain. Another example is that application models with high interaction with the network (such as autonomous operation and maintenance) have high requirements for data credibility, while those with low interaction (such as artificial intelligence (AI) model training and optimization) have low requirements for data credibility.

Finally, security mechanisms have different security and non-security effects, such as security level, efficiency, cost, information loss, software and hardware support, availability and visibility, etc. That is, the above different security and non-security requirements require the selection of appropriate security mechanisms. See Table 1.

Table 1

Another thing to consider is that the network is dynamically changing. The twin network supports model updates, expansions, and autonomous construction. The content of twin data collection may also change dynamically based on network bandwidth conditions, failures, security attacks, etc. to strike a balance between real-time accuracy and overhead. For example, in order to reduce resource overhead, only high-value data needs to be identified in some scenarios and network states. For example, a small amount of data may be uploaded in normal states and more data may be uploaded in problem states for analysis. Accordingly, the security mechanism may need to be adjusted dynamically. Therefore, a framework that supports the selection of security protection mechanisms and can be adjusted dynamically is needed.

Although the data collection method of the relevant technology supports the establishment of a secure transmission channel, it does not provide security protection for data from the data source to the model level, and does not have the ability to select and dynamically adjust security mechanisms. It cannot meet the precise protection requirements of the diverse models and data sources in the digital twin network and the dynamic changes of the network, and may not meet the real-time requirements of the digital twin network.

To solve at least one of the above problems, the present disclosure provides a data security protection selection method. The data of the digital twin network provides a data security protection mechanism that adapts to the upper-layer applications and the underlying network to meet the security and real-time requirements of the digital twin network. Figure 2 is a flow chart of the data security protection selection method provided by the embodiment of the present disclosure applied to the security policy management function. The security policy management function can specifically be the security management function in the network twin management of the twin network layer shown in Figure 1, or it can be the security management function in the existing network. As shown in Figure 2, the method includes:

The information of the target application or target model and the target data information required by the target application or target model are obtained. Here, the information of the target application or target model may generally include: description, type, user, etc. of the target application or target model, such as "model optimization application", "security deduction application", "slice security operation and maintenance", "core network slice resource configuration", "wireless network optimization", etc. The information of the target data indicates the type, collection time, collection period, etc. of the target data, such as "the five-tuple of the data packets flowing through the user plane function (User Plane Function, UPF) of the network element at all times (source IP, source port, destination IP, destination port, 5 fields such as layer 4 protocol)", periodic collection of network element logs, information of network element processes at all times, etc.

Step 201, obtain information about the target application or target model and information about the target data it needs, and determine first security information and/or second security information, where the first security information is the security information of the target application or target model, and the second security information is the security information of the target data required by the target application or target model.

Here, the security information of the target application or target model indicates the security limitations of the target application or target model (for example, the model can only use the data of network elements in the same security domain, the model cannot use user privacy data, etc.) or security requirements. The security requirements may be one or more of the requirements such as confidentiality requirements, privacy requirements, trust requirements, and real-time requirements. For example, application models with high interaction with the network (such as autonomous operation and maintenance) have high trust and high real-time requirements, and application models with low interaction (such as AI model training and optimization) do not have high requirements for data trustworthiness. The security information of the target data indicates the security limitations of the target data (for example, the data can only be read by models or applications in the same security domain/core security domain/management security domain, etc.) or security requirements. The security requirements may be one or more of the requirements such as confidentiality requirements, privacy requirements, trust requirements, and real-time requirements. For example, the privacy requirements for user data and device status data are different.

The target application or target model information refers to the description information of the target application or target model, which may specifically include but is not limited to at least one of the following: (1) the purpose of the target application or target model, such as "AI model training and optimization"; (2) the characteristics of the target application or target model, such as "high interactivity with the network"; (3) the field of the target application or target model, such as "core network" or "wireless network"; (4) the requirements of the target application or target model, such as "high reliability and high real-time" and so on.

The target data information refers to the descriptive information of the target data, including but not limited to at least one of the following: (1) information indicating the data content of the target data, such as "user credentials", "login and logout time", "Internet Protocol (IP) address", "port number", "domain name requested by the user", "host version number", "number of processes", "vulnerability", "network risk/real-time/bandwidth occupancy index", etc.; (2) the name of the object containing the data, so that the data can be parsed and obtained from the object, for example, "Virtual Private Network (VPN)/proxy/Network Address Translation (NAT)/system/service log", "intrusion detection system (IDS) alarm information", "netflow log and captured data packets", "nmap information", "threat intelligence", etc.

After the security policy management function receives the target data and the information of the model or application, it analyzes and determines the security information of the target application or target model or target data accordingly. For example, based on a pre-trained AI model or preset conditions, the information of the model or application and the target data is analyzed to determine the security information of the model or application, thereby obtaining the first security information, and/or the security information of the target data is analyzed to obtain the second security information.

As another implementation method, the security policy management function can also directly receive the security information of the target data required by the target application or target model and/or the security information of the target application or target model; obtain the first security information based on the security information of the target application or target model, and/or obtain the second security information based on the security information of the target data.

Step 202: Determine the digital twin network DTN data security requirements based on the first security information and/or the second security information, where the DTN data security requirements include at least one of confidentiality requirements, privacy requirements, trust requirements, and real-time requirements.

Here, confidentiality requirements refer to information not being disclosed to unauthorized users, entities, or processes; privacy protection refers to the protection of information obtained by observing network behavior; credibility refers to the trustworthy characteristics of evidence or the degree to which it can be trusted; and real-time requirements refer to the time length requirement from data generation to acquisition. These characteristics can have different levels, as shown in Table 2.

Table 2

The security policy management function determines the DTN data security requirements based on the first security information and/or the second security information, thereby converting the security requirements from the model (or application) side and the data side, which are also unstructured, into structured security requirements for DTN data protection. The DTN data security requirements may include at least one of confidentiality requirements, privacy protection requirements, trust requirements, and real-time requirements. For example, based on the requirements from the model - high-trust data, and the requirements from the data - user data cannot be directly read, the security requirements for DTN data protection are: high trust of user data, privacy protection, and repository invisibility.

Step 203, based on the data that can be provided by each pre-maintained data source, determine the candidate data source that can provide the target data, and based on the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance, determine the target data source that can meet the DTN data security requirements and the target security protection mechanism that needs to be configured for the target data source.

Here, in the embodiments of the present disclosure, the data that can be provided by each data source and the data security protection mechanisms supported by each data source can be pre-established and maintained. In addition, the correspondence between various data security protection mechanisms and data security performance can also be pre-established and maintained. For example, a plurality of different levels of data security performance are pre-defined, and for each level of data security performance, a corresponding data security protection mechanism is determined, which can specifically include one or more of a confidentiality security protection mechanism, a privacy security protection mechanism, a trusted security protection mechanism, and a real-time security protection mechanism.

In the embodiments of the present disclosure, data security performance refers to the security effect that can be produced by the data security protection mechanism or the security performance that can be achieved, and its specific indicators can also be referred to Table 2. DTN data security requirements refer to the security requirements of the data involved.

In this way, in step 203, the security policy management function can determine the candidate data sources that can provide the target data based on the data that can be provided by each pre-maintained data source, and then screen out the target data source that meets the DTN data security requirements from the candidate data sources based on the data security protection mechanisms supported by the candidate data sources and the correspondence between each pre-maintained data security protection mechanism and data security performance, and determine the target security protection mechanism that needs to be configured for the target data source, for example, determine a security protection mechanism that meets at least one of confidentiality requirements, privacy requirements, trust requirements and real-time requirements.

Step 204: configure the target security protection mechanism for the target data source and related security entities.

Here, the security policy management function can configure the target security protection mechanism for the target data source and related security entities, for example, by sending a configuration message to configure the target data source and related security entities to use the target security protection mechanism to perform security protection on data. The related security entity is a security entity related to the target data source and used to implement security protection of the data source.

Through the above steps, the embodiment of the present disclosure provides a data security protection mechanism for the data of the digital twin network that is adapted to the upper-layer applications and the underlying network, thereby meeting the security and real-time requirements of the digital twin network.

Taking into account changes in network status and changes in model requirements, the embodiments of the present disclosure can timely update the data source and its security protection mechanism according to the above changes to ensure that the security and real-time requirements of the digital twin network are met.

Specifically, in the embodiments of the present disclosure, the security policy management function can obtain the network status. For example, the security policy management function can obtain the network status by subscribing to network indicators that indicate the network status and changes in the network status; and, receiving the network indicators, thereby obtaining the network status. For another example, the security policy management function can obtain the network indicators by monitoring the network.

After obtaining the network status, the security policy management function can determine whether it is necessary to update the target data source and/or update the target security protection mechanism. For example, the security policy management function can analyze whether the network indicators affect the data security performance that can be achieved by the target security protection mechanism of the target data source. If so, it is determined that the target data source needs to be updated and/or the target security protection mechanism needs to be updated; for another example, the security policy management function can analyze whether it is necessary to update the digital twin network DTN data security requirements based on the network indicators. If so, it is determined that the target data source needs to be updated and/or the target security protection mechanism needs to be updated.

Thus, when it is determined that the target data source needs to be updated, the security policy management function can re-determine and configure the target data source and target security protection mechanism that can meet the DTN data security requirements. Determine a new target data source and a new target security protection mechanism that can meet the DTN data security requirements, and configure the new target security protection mechanism for the new target data source and related security entities;

When the target security protection mechanism needs to be updated, the security policy management function can redefine and configure a new target security protection mechanism that can meet the DTN data security requirements, for example, redefine a new target security protection mechanism that can meet the DTN data security requirements, and configure the new target security protection mechanism for the target data source and related security entities.

Referring to FIG. 3 , the data security protection selection method in the digital twin network provided in the embodiment of the present disclosure, when applied to the data source node and the corresponding security entity, includes:

Step 301: Receive configuration information sent by the security policy management function, where the configuration information includes a target security protection mechanism.

Step 302: configure the data source node and related security entities according to the target security protection mechanism.

Through the above steps, the security policy management function configures the target security protection mechanism for the data source nodes and corresponding security entities to meet the security and real-time requirements of the digital twin network.

The embodiment of the present disclosure also provides a data security protection selection method in a digital twin network, which is applied to a network indicator monitoring function. The method includes:

Step a, receiving a subscription request sent by a network indicator monitoring function, wherein the subscription request is used to subscribe to network indicators indicating network status and changes in network status;

Step b: sending the network indicator to the network indicator monitoring function according to the subscription request.

FIG4 further provides an example flow of the data security protection selection method of the embodiment of the present disclosure interacting between multiple entities. In this example, the relevant functional entity functions are logical entities, which can be co-located with other network element functions or deployed independently. Among them:

(1) Security policy management entity: responsible for receiving data security requirements or performing data security requirements analysis based on models and data; responsible for obtaining data sources; responsible for generating the initial list or changes of DTN data security mechanisms based on security requirements, network indicators, differences in security protection mechanisms, and support of data sources for security mechanisms.

(2) Network indicator monitoring function: responsible for collecting and analyzing network indicators; responsible for notifying network indicators and changes based on subscriptions.

(3) Data source and related security entities: Data source refers to the entity that provides or collects data, which can be a network element or NWDAF in the network, or a network/network element management entity, or a unified data warehouse or external database of the digital twin network (such as a threat intelligence library or other digital twin networks). Related security entities refer to the supporting entities required by the security mechanism supported by the data source, such as a key distribution entity or a certificate issuing entity.

The process of this example mainly includes:

1) Model registration data - the online application or model reports the data it needs to the security policy management function; registers the data of each data source, including network elements and external data sources (such as threat intelligence libraries, etc.) reporting the data that can be collected by themselves or other network elements and the supported security mechanisms; the security policy management function establishes and maintains the correspondence between data security protection mechanisms and data security performance.

2) The security policy management function obtains the security information of data and applications or models, and based on this, makes static judgments on DTN data requirements, including confidentiality, privacy, trustworthiness, real-time, etc., to obtain security information on the data;

3) Based on the data that can be collected by the registered network elements, determine the candidate data sources, and based on the support of the candidate data sources for the security mechanism and the correspondence between the data security protection mechanism and the data security performance, determine to generate a DTN data security mechanism list, which includes the screened target data sources and their corresponding target security protection mechanisms. If the candidate data source security mechanism does not meet the security requirements, select other data sources or notify the model to replace the data.

4) Configure the DTN data security mechanism for the target data source and related security entities. It may be necessary to add protocol bits to indicate confidentiality, privacy, trust, and real-time mechanisms or configure through existing service interfaces. The security entity refers to the functions necessary to implement the security mechanism, such as the Certificate Authority (CA) entity of the certificate mechanism (issuing certificates), or the key management entity (distributing keys).

5) The security policy management function collects network status, analyzes changes in network indicators or obtains changes in network indicators through network indicator monitoring, determines whether it is necessary to update the target data source and/or update the target security protection mechanism, determines the data source to be updated, determines the security mechanism to be updated, and configures the DTN data security mechanism for the data source and related security entities. Because the original data source may be unavailable due to changes in network status (bandwidth conditions, failures, security attacks, etc.), or due to changes in bandwidth, the security mechanism of the data source does not meet the real-time requirements or other reasons, it may be necessary to replace the data source or update the security mechanism.

From the above, it can be seen that the embodiments of the present disclosure provide a method and framework that supports the selection of a security protection mechanism and can be dynamically adjusted, providing a data security protection mechanism for the data of the digital twin network that is adapted to the upper-layer applications and the underlying network, which can meet the precise protection requirements of the diverse models and data sources in the digital twin network and the dynamic changes of the network. With data as the granularity, it can meet the real-time and security requirements of the digital twin network and reduce human intervention.

The above describes various methods of the embodiments of the present disclosure. The following further provides devices for implementing the above methods.

Referring to FIG. 5 , an embodiment of the present disclosure further provides a data security protection selection device in a digital twin network, which is applied to a security policy management function, and the device includes:

A first obtaining module 501 is used to obtain information of a target application or a target model and information of target data required by the target application or the target model, and determine first security information and/or second security information, wherein the first security information is security information of the target application or the target model, and the second security information is security information of the target data required by the target application or the target model;

A first determination module 502 is used to determine a digital twin network DTN data security requirement according to the first security information and/or the second security information, wherein the DTN data security requirement includes at least one of a confidentiality requirement, a privacy requirement, a trust requirement, and a real-time requirement;

The second determination module 503 is used to determine, based on the data that can be provided by each pre-maintained data source, a candidate data source that can provide the target data, and determine, based on the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance, a target data source that can meet the DTN data security requirements and a target security protection mechanism that needs to be configured for the target data source;

The first configuration module 504 is used to configure the target security protection mechanism for the target data source and related security entities.

Through the above modules, the embodiments of the present disclosure provide a data security protection mechanism for the data of the digital twin network that is adapted to the upper-layer applications and the underlying network, thereby meeting the security and real-time requirements of the digital twin network.

Optionally, the first obtaining module is further used to:

Analyze information of a target application or a target model, determine security information of the target application or the target model, and obtain the first security information; and/or analyze information of target data required by the target application or the target model, determine security information of the target data, and obtain the second security information;

or,

Receive security information of target data required by the target application or target model and/or security information of the target application or target model sent by the target application or target model; obtain the first security information based on the security information of the target application or target model, and/or obtain the second security information based on the security information of the target data.

Optionally, the above device further includes:

The maintenance module is used to pre-establish and maintain the data that each data source can provide and the data security protection mechanism supported by each data source; pre-establish and maintain the correspondence between various data security protection mechanisms and data security performance.

Optionally, the above device further includes:

A third determination module is used to obtain the network status and determine whether it is necessary to update the target data source and/or update the target security protection mechanism;

In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements;

In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured.

Optionally, the third determining module includes:

The second acquisition module is used to obtain the network status by at least one of the following methods:

Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators;

Monitor the network and obtain the network indicators.

Optionally, the third determining module includes:

The fourth determining unit is used to determine whether it is necessary to update the target data source and/or update the target security protection mechanism by at least one of the following methods:

Analyze whether the network indicator affects the data security performance that can be achieved by the target security protection mechanism of the target data source, and if so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism;

Analyze whether it is necessary to update the digital twin network DTN data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism.

It should be noted that the device in this embodiment is a device corresponding to the method applied to the security policy management function, and the implementation methods in the above embodiments are applicable to the embodiments of the device and can achieve the same technical effect. The above device provided in the embodiment of the present disclosure can implement all the method steps implemented in the above method embodiment, and can To achieve the same technical effect, the parts and beneficial effects of this embodiment that are the same as those of the method embodiment will not be described in detail here.

Please refer to FIG6 , the embodiment of the present disclosure further provides a data security protection selection device 600 in a digital twin network, including: a transceiver 601 and a processor 602;

The transceiver 601 is used to obtain information of a target application or a target model and information of target data required by the target application or the target model, and determine first security information and/or second security information, wherein the first security information is security information of the target application or the target model, and the second security information is security information of the target data required by the target application or the target model;

The processor 602 is used to: determine the digital twin network DTN data security requirements based on the first security information and/or the second security information, and the DTN data security requirements include at least one of confidentiality requirements, privacy requirements, trust requirements and real-time requirements; determine the candidate data source that can provide the target data based on the data that can be provided by each pre-maintained data source, and determine the target data source that can meet the DTN data security requirements and the target security protection mechanism that needs to be configured for the target data source based on the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance; configure the target security protection mechanism for the target data source and related security entities

Optionally, the transceiver is further used to: analyze information of a target application or a target model, determine security information of the target application or the target model, and obtain the first security information; and/or analyze information of target data required by the target application or the target model, determine security information of the target data, and obtain the second security information;

or,

Receive security information of target data required by the target application or target model and/or security information of the target application or target model sent by the target application or target model; obtain the first security information based on the security information of the target application or target model, and/or obtain the second security information based on the security information of the target data.

Optionally, the processor is further configured to:

Establish and maintain in advance the data that each data source can provide and the data security protection mechanism supported by each data source;

Establish and maintain the correspondence between various data security protection mechanisms and data security performance in advance.

Optionally, the processor is further configured to:

Obtaining the network status and determining whether it is necessary to update the target data source and/or update the target security protection mechanism;

In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements;

In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured.

Optionally, the processor is further configured to:

Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators;

Monitor the network and obtain the network indicators.

Optionally, the processor is further configured to determine whether the target data source needs to be updated by at least one of the following methods: And/or update the target security protection mechanism:

Analyze whether the network indicator affects the data security performance that can be achieved by the target security protection mechanism of the target data source, and if so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism;

Analyze whether it is necessary to update the digital twin network DTN data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism.

It should be noted that the device in this embodiment is a device corresponding to the method applied to the security policy management function side, and the implementation methods in the above embodiments are all applicable to the embodiments of the device, and can achieve the same technical effect. The above device provided by the embodiment of the present disclosure can implement all the method steps implemented by the above method embodiment, and can achieve the same technical effect, and the parts and beneficial effects that are the same as those in the method embodiment in this embodiment will not be specifically described here.

Referring to FIG. 7 , the embodiment of the present disclosure further provides a data security protection selection device in a digital twin network, which is applied to a data source node and a corresponding security entity, including:

A first receiving module 701 is used to receive configuration information sent by the security policy management function, wherein the configuration information includes a target security protection mechanism;

The first configuration module 702 is used to configure the data source node and related security entities according to the target security protection mechanism.

It should be noted that the device in this embodiment is a device corresponding to the method applied to the data source node and the corresponding security entity side, and the implementation methods in the above embodiments are all applicable to the embodiments of the device, and can also achieve the same technical effects. The above device provided by the embodiment of the present disclosure can implement all the method steps implemented by the above method embodiment, and can achieve the same technical effects. The parts and beneficial effects that are the same as those in the method embodiment in this embodiment will not be specifically described here.

Please refer to FIG8 , the embodiment of the present disclosure further provides a data security protection selection device 800 in a digital twin network, which is applied to a data source node and a corresponding security entity, including: a transceiver 801 and a processor 802;

The transceiver 801 is used to receive configuration information sent by the security policy management function, wherein the configuration information includes a target security protection mechanism;

The processor 802 is used to configure the data source node and related security entities according to the target security protection mechanism.

It should be noted that the device in this embodiment is a device corresponding to the method applied to the data source node and the corresponding security entity side, and the implementation methods in the above embodiments are all applicable to the embodiments of the device, and can also achieve the same technical effects. The above device provided by the embodiment of the present disclosure can implement all the method steps implemented by the above method embodiment, and can achieve the same technical effects. The parts and beneficial effects that are the same as those in the method embodiment in this embodiment will not be specifically described here.

Referring to FIG9 , the embodiment of the present disclosure further provides a data security protection selection device 900 in a digital twin network, which is applied to a security policy management function, and includes a processor 901, a memory 902, and a computer program stored in the memory 902 and executable on the processor 901. When the computer program is executed by the processor 901, the terminal executes the above-mentioned The various processes of the data security protection selection method implementation example are similar to those of the embodiment of the present invention, and can achieve the same technical effect. To avoid repetition, they will not be described here.

Please refer to Figure 10. The embodiment of the present disclosure also provides a data security protection selection device 1000 in a digital twin network, which is applied to data source nodes and corresponding security entities, including a processor 1001, a memory 1002, and a computer program stored in the memory 1002 and executable on the processor 1001. When the computer program is executed by the processor 1001, the various processes of the data security protection selection method embodiment performed by the network device are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

The disclosed embodiment also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process of the above-mentioned data security protection selection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

It should be noted that, in this article, the terms "include", "include" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present disclosure, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present disclosure.

The embodiments of the present disclosure are described above in conjunction with the accompanying drawings, but the present disclosure is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present disclosure, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present disclosure and the claims, all of which are within the protection of the present disclosure.

Claims (17)

A data security protection selection method in a digital twin network, applied to a security policy management function, the method comprising: Obtain information of a target application or a target model and information of target data required by the target application or the target model, and determine first security information and/or second security information, wherein the first security information is security information of the target application or the target model, and the second security information is security information of the target data required by the target application or the target model; Determine, according to the first security information and/or the second security information, a digital twin network DTN data security requirement, wherein the DTN data security requirement includes at least one of a confidentiality requirement, a privacy requirement, a trust requirement, and a real-time requirement; Determine a candidate data source that can provide the target data based on the data that can be provided by each pre-maintained data source, and determine a target data source that can meet the DTN data security requirements and a target security protection mechanism that needs to be configured for the target data source based on the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance; The target security protection mechanism is configured for the target data source and related security entities. The method of claim 1, wherein determining the first security information and/or the second security information comprises: Analyze information of a target application or a target model, determine security information of the target application or the target model, and obtain the first security information; and/or analyze information of target data required by the target application or the target model, determine security information of the target data, and obtain the second security information; or, Receive security information of target data required by the target application or target model and/or security information of the target application or target model; obtain the first security information based on the security information of the target application or target model, and/or obtain the second security information based on the security information of the target data. The method according to claim 1, wherein the method further comprises: Establish and maintain in advance the data that each data source can provide and the data security protection mechanism supported by each data source; Establish and maintain the correspondence between various data security protection mechanisms and data security performance in advance. The method according to claim 1, wherein the method further comprises: Obtaining the network status and determining whether it is necessary to update the target data source and/or update the target security protection mechanism; In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements; In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured. The method according to claim 4, wherein the obtaining of the network status comprises at least one of the following: Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators; Monitor the network and obtain the network indicators. The method of claim 4, wherein the determining whether the target data source needs to be updated and/or the target security protection mechanism needs to be updated comprises at least one of the following: Analyze whether the network indicator affects the data security performance that can be achieved by the target security protection mechanism of the target data source, and if so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism; Analyze whether it is necessary to update the digital twin network DTN data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism. A data security protection selection method in a digital twin network is applied to a data source node and a corresponding security entity, and the method comprises: Receiving configuration information sent by the security policy management function, the configuration information including a target security protection mechanism; According to the target security protection mechanism, the data source node and related security entities are configured. A data security protection selection device in a digital twin network, applied to security policy management functions, includes a transceiver and a processor, wherein: The transceiver is used to obtain information of a target application or a target model and information of target data required by the target application or the target model, and determine first security information and/or second security information, wherein the first security information is security information of the target application or the target model, and the second security information is security information of the target data required by the target application or the target model; The processor is used to determine the digital twin network DTN data security requirements based on the first security information and/or the second security information, and the DTN data security requirements include at least one of confidentiality requirements, privacy requirements, trust requirements and real-time requirements; determine the candidate data source that can provide the target data based on the data that can be provided by each pre-maintained data source, and determine the target data source that can meet the DTN data security requirements and the target security protection mechanism that needs to be configured for the target data source based on the data security protection mechanism supported by the candidate data source and the correspondence between each pre-maintained data security protection mechanism and data security performance; configure the target security protection mechanism for the target data source and related security entities. The apparatus according to claim 8, wherein the transceiver is further configured to: Analyze information of a target application or a target model, determine security information of the target application or the target model, and obtain the first security information; and/or analyze information of target data required by the target application or the target model, determine security information of the target data, and obtain the second security information; or, Receive security information of target data required by the target application or target model and/or security information of the target application or target model; obtain the first security information based on the security information of the target application or target model, and/or obtain the second security information based on the security information of the target data. The apparatus of claim 8, wherein the processor is further configured to: Establish and maintain in advance the data that each data source can provide and the data security protection mechanism supported by each data source; Establish and maintain the correspondence between various data security protection mechanisms and data security performance in advance. The device as claimed in claim 8, wherein The transceiver is also used to: obtain the network status, determine whether it is necessary to update the target data source and/or update the target Safety protection mechanism; The processor is further configured to: In the case where the target data source needs to be updated, re-determine and re-configure the target data source and target security protection mechanism that can meet the DTN data security requirements; In the case where the target security protection mechanism needs to be updated, the target security protection mechanism that can meet the DTN data security requirements is re-determined and reconfigured. The apparatus according to claim 11, wherein the transceiver is further configured to obtain the network status by at least one of the following methods: Subscribing to network indicators indicating network status and changes in network status; and receiving the network indicators; Monitor the network and obtain the network indicators. The apparatus of claim 11, wherein the processor is further configured to determine whether it is necessary to update the target data source and/or update the target security protection mechanism by at least one of the following methods: Analyze whether the network indicator affects the data security performance that can be achieved by the target security protection mechanism of the target data source, and if so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism; Analyze whether it is necessary to update the digital twin network DTN data security requirements based on network indicators. If so, determine whether it is necessary to update the target data source and/or update the target security protection mechanism. A data security protection selection device in a digital twin network, applied to security policy management functions, comprising: a processor, a memory, and a program stored on the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method described in any one of claims 1 to 6. A data security protection selection device in a digital twin network is applied to a data source node and a corresponding security entity, including a transceiver and a processor, wherein: The transceiver is used to receive configuration information sent by the security policy management function, wherein the configuration information includes a target security protection mechanism; The processor is used to configure the data source node and related security entities according to the target security protection mechanism. A data security protection selection device in a digital twin network, applied to a data source node and a corresponding security entity, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program implements the steps of the method as claimed in claim 7 when executed by the processor. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.