面向SOAR的云边端安全消息总线

Research on Cloud-Edge-Device Security Message Bus for SOAR

工业企业网络安全运营管理涉及数据中心机房的云环境、车间的边缘层以及生产线上的终端层等,对象分散且网络复杂,实现安全编排自动化与响应(Security Orchestration and Automation Response,SOAR)协同难度大。在分析云、边缘计算与终端设备协同控制传输特性的基础上,设计了一种面向SOAR的云边端(Cloud-Edge-Device,CED)安全消息总线,实现了面向云边端侧子系统的安全消息集成协同机制,解决了云边端侧节点安全接入、在线状态管理、离线安全数据保持及实时性优先SOAR协同。实践表明,云边端安全消息总线很好地满足了云边端复杂网络下SOAR实时性优先的传输要求。

Enterprise network security operation management involves the cloud environment of data center computer room,the edge layer of workshop and the terminal layer of production line,etc.The objects are scattered and the network is complex,so it is difficult to realize the coordination of Security Orchestration and Automation Response(SOAR).On the basis of analyzing the transmission characteristics of cloud,edge computing and terminal equipment,a SOAR-oriented Cloud-Edge-Device(CED)secure message bus is designed,and a secure message integration collaboration mechanism for cloud edge subsystem is realized,which solves the secure access of cloud edge nodes,online status management,offline secure data retention and real-time priority SOAR collaboration.The practice shows that the secure message bus at the cloud edge well meets the requirement of SOAR real-time priority transmission in the complex network at the cloud edge.