Security protection method and apparatus

Patent metadata

Field	Value
Publication number	US-11934530-B2
Application number	US-201916960587-A
Country	US
Kind code	B2
Filing date	Jan 30, 2019
Priority date	Feb 9, 2018
Publication date	Mar 19, 2024
Grant date	Mar 19, 2024

Abstract

Provided are a security protection method and apparatus. The security protection method includes: generating software versions based on diversity compilation, and constructing a software version pool using the software versions as heterogeneous functional equivalents; and dynamically deploying a software version on a network element according to the software version pool.

First claim

What is claimed is:

1. A security protection method, comprising:
generating software versions based on diversity compilation, and constructing a software version pool using the software versions as heterogeneous functional equivalents; and
dynamically deploying a software version on a network element according to the software version pool,
wherein dynamically deploying the software version on the network element according to the software version pool further comprises:
during system operation, migrating services from a first network element to a second network element according to a security policy, deploying a first software version in the software version pool on the first network element, and deploying a second software version in the software version pool on the second network element, wherein the first software version and the second software version correspond to a same software function but different compiled versions.

2. The method as claimed in claim 1 , wherein
the software versions in the software version pool comprise the following version attributes: a software function version attribute and a diversity compilation version attribute, wherein the software function version attribute is used to mark a logical function difference between software versions, and the diversity compilation version attribute is used to mark a difference in results of the diversity compilation.

3. The method as claimed in claim 2 , further comprising:
establishing a software version mapping table, wherein the software version mapping table records a correspondence between version attributes of each software version used as a heterogeneous functional equivalent and a network element on which the software version is deployed.

4. The method as claimed in claim 1 , wherein dynamically deploying the software version on the network element according to the software version pool further comprises:
when the network element is initially generated, selecting one software version from the software version pool randomly or based on a security policy, and deploying the selected software version onto a physical resource of the network element.

5. The method according to claim 1 , wherein dynamically deploying the software version on the network element according to the software version pool further comprises:
when the network element is subjected to elastic capacity expansion, selecting one software version from the software version pool randomly or based on a security policy, and deploying the selected software version onto the capacity-expended physical resource of the network element.

6. A security protection apparatus, a hardware processor, configured to execute program modules stored on a memory, wherein the program modules comprising:
a software version pool establishment module, configured to generate software versions based on diversity compilation, and construct a software version pool using the software versions as heterogeneous functional equivalents; and
a software version deployment module, configured to dynamically deploy a software version on a network element according to the software version pool, wherein the software version deployment module is further configured to, during system operation, migrate services from a first network element to a second network element according to a security policy, deploy a first software version in the software version pool on the first network element, and deploy a second software version in the software version pool on the second network element, wherein the first software version and the second software version correspond to a same software function but different compiled versions.

7. The apparatus as claimed in claim 6 , wherein
the software versions in the software version pool comprise the following version attributes: a software function version attribute and a diversity compilation version attribute, wherein the software function version attribute is used to mark a logical function difference between software versions, and the diversity compilation version attribute is used to mark a difference in results of the diversity compilation.

8. The apparatus as claimed in claim 7 , wherein
the software version pool establishment module is further configured to establish a software version mapping table, wherein the software version mapping table records a correspondence between version attributes of each software version used as a heterogeneous functional equivalent and a network element on which the software version is deployed.

9. The apparatus as claimed in claim 6 , wherein
the software version deployment module is configured to dynamically deploy the software version on the network element according to the software version pool in a following manner: when the network element is initially generated, selecting one software version from the software version pool randomly or based on a security policy, and deploying the selected software version onto a physical resource of the network element.

10. The apparatus as claimed in claim 6 , wherein
the software version deployment module is further configured to dynamically deploy the software version on the network element according to the software version pool in a following manner: when the network element is subjected to elastic capacity expansion, selecting one software version from the software version pool randomly or based on a security policy, and deploying the selected software version onto the capacity-expended physical resource of the network element.

11. A security protection apparatus, a hardware processor, configured to execute program modules stored on a memory, wherein the program modules comprising:
a memory, a processor and a security protection program which is stored on the memory and is able to be executed by the processor, and the security protection program, when being executed by the processor, implements operations of the security protection method as claimed in claim 1 .

12. A non-transitory computer readable storage medium, wherein a security protection program is stored on the computer readable storage medium, and the security protection program, when being executed by a processor, implements operations of the security protection method as claimed in claim 1 .

13. The method as claimed in claim 2 , wherein dynamically deploying the software version on the network element according to the software version pool comprises:
when the network element is initially generated, selecting one software version from the software version pool randomly or based on a security policy, and deploying the selected software version onto a physical resource of the network element.

14. The method as claimed in claim 3 , wherein dynamically deploying the software version on the network element according to the software version pool comprises:
when the network element is initially generated, selecting one software version from the software version pool randomly or based on a security policy, and deploying the selected software version onto a physical resource of the network element.

15. The method according to claim 4 , wherein dynamically deploying the software version on the network element according to the software version pool further comprises:
during system operation, changing the software version on the network element periodically or according to the security policy, wherein the software version after the change is selected from the software version pool randomly or selected from the software version pool based on the security policy, and the software version before the change and the software version after the change co

Assignees

• Zte Corp

Inventors

• Wu Qiang
• Wu Chunming
• Ma Suan
• Zhao Hongxun
• Qin Yifei

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F8/60 Primary

  Software deployment · CPC title

• G06F8/71 Primary

  Version control (security arrangements therefor G06F21/57); Configuration management · CPC title

• G06F21/572

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• G06F2221/033

  Test or assess software · CPC title