Secure on-demand supply method and system and traffic type acquisition method

1. A secure on-demand supply method, comprising:

determining a configuration parameter of a security function module according to a security level set for requested traffic by a user, an application scenario of a user terminal, and a traffic type; wherein the traffic type is defined by a traffic identifier, the traffic type identifier is set for traffic at the time of carrying out Quality of Service (QoS) priority protection on the traffic; and the traffic type identifier is implemented by a Diffserv traffic framework, by using the Diffserv traffic framework, each QoS characteristic has a corresponding mapped field value in a Differentiated Services Code Point (DSCP) field of an IP data header; wherein different field values represent different traffic granularity distinguishing identifiers, which have different traffic data transmisson priorties;

configuring the security function module according to the configuration parameter; and protecting security of traffic data of the user by the security function module.

2. The method according to claim 1 , wherein the step of determining a configuration parameter of a security function module comprises:

matching a security strategy by using the security level, the application scenario of the user terminal and the traffic type, to acquire the configuration parameter of the security function module; or

calculating the configuration parameter of the security function module by using a preset algorithm according to the security level, the application scenario of the user terminal and the traffic type; or

matching a security strategy by using the security level, the application scenario of the user terminal and the traffic type, to acquire the configuration parameter of the security function module, calculating the configuration parameter of the security function module by using a preset algorithm, combining the configuration parameters of the security function module acquired in the above two ways, and determining a final configuration parameter of the security function module.

3. The method according to claim 1 , wherein the step of protecting security of traffic data of the user by the security function module comprises:

acquiring a traffic data package matching with a user identifier and/or a traffic identifier, and carrying out security protection on the acquired traffic data package according to the configuration parameter.

4. The method according to claim 3 , wherein the way of acquiring a traffic type identifier comprises:

acquiring a set traffic type identifier through a data package including the traffic type identifier; or

acquiring, by a QoS function module, a set type identifier.

5. The method according to claim 1 , wherein the security level is set by a security requirement of the user for traffic information or by the user according to an asset value of the traffic information;

parameters of the application scenario comprise a location of the user terminal and a type of an access network, wherein the type of the access network comprises: a local area network, a wireless local area network, and a wireless mobile network of a Global System for Mobile Communications (GSM), a Code Division Multiple Access (CDMA) system and a Long Term Evolution (LTE) system;

the traffic type comprises real-time traffic and non-real-time traffic; and

the security function module comprises one or more of following functions: confidentiality, integrity, authentication and flow cleaning.

6. A traffic type acquisition method, comprising:

acquiring, by a security function module according to a security level set for requested traffic by a user, an application scenario of a user terminal, a traffic type identifier set for traffic at the time of carrying out Quality of Service (QoS) priority protection on the traffic, and protecting security of the traffic and/or a user;

wherein the step of protecting security of the traffic and/or a user comprises:

acquiring a traffic data package matching with a user identifier and/or a traffic identifier, and carrying out security protection on the acquired traffic data package according to a configuration parameter; and

wherein the traffic type identifier is implemented by a Diffserv traffic framework;

by using the Diffserv traffic framework, each QoS characteristic has a corresponding mapped field value in a Differentiated Services Code Point (DSCP) field of an IP data header;

wherein different field values represent different traffic granularity distinguishing identifiers, which have different traffic data transmission priorities.

7. The method according to claim 6 , wherein the way of acquiring the traffic type identifier comprises:

acquiring the set traffic type identifier through a data package including the traffic type identifier; or

receiving the traffic type identifier, which is notified by a QoS function module.

8. The method according to claim 6 , wherein the step of protecting security of the traffic and/or a user comprises:

acquiring a traffic data package matching with a user identifier and/or a traffic identifier, and carrying out security protection on the acquired traffic data package according to a configuration parameter.

9. A secure on-demand supply system, comprising

a memory storing instructions; and

a processor executing the instructions to implement a security strategy parameter collection unit, a security strategy unit and a security execution unit, wherein

the security strategy parameter collection unit is configured to: collect a security level parameter set by a user; acquire a traffic type parameter of traffic requested by the user; and acquire a parameter of an application scenario of the user at the time of using the traffic, and send the collected parameter to the security strategy unit; wherein the traffic type is defined by a traffic identifier, the traffic type identifier is set for traffic at the time of carrying out Quality of Service (QoS) priority protection on the traffic; wherein the traffic type identifier is implemented by a Diffserv traffic framework; by using the Diffserv traffic framework, each QoS characteristic has a corresponding mapped field value in a Differentiated Services Code Point (DSCP) field of an IP data header; wherein different field values represent different traffic granularity distinguishing identifiers, which have different traffic data transmission priorities;

the security strategy unit is configured to determine a configuration parameter of a security function module according to a security level, an application scenario of a user terminal and a traffic type, and to send the determined configuration parameter of the security function module to the security execution unit; and

the security execution unit is configured to configure the security function module according to the received configuration parameter of the security function module to protect security of traffic data of the user.

10. The system according to claim 9 , wherein the security strategy unit is further configured to:

map the received parameter to an optimally-matched security strategy rule by a preset security strategy rule, and acquire the configuration parameter of the security function module: or calculate the configuration parameter of the security function module by a preset algorithm model according to an input parameter; or combine the configuration parameter of the security function module acquired in the above two ways, and determine a final configuration parameter of the security function module.

11. The system according to claim 9 , further comprising: the processor executing the instructions to implement a Quality of Service (QoS) unit configured to set a traffic type identifier for traffic, and to carry out personalized QoS priority protection on the traffic data according to a user identifier and/or a traffic type; and

the security execution unit is further configured to acquire the traffic type identifier from the QoS unit, or the QoS unit is further configured to send the traffic type identifier to the security execution unit.

12. The system according to claim 11 , wherein the security execution unit is further configured to:

acquire a traffic data package matching with a user identifier and/or a traffic identifier, and carry out security protection on the acquired traffic data package according to the security configuration parameter, wherein the traffic data package includes the user identifier and/or the traffic identifier.

13. The system according to claim 9 , wherein the security level is set by a security requirement of the user for traffic information or by the user according to an asset value of the traffic information;

parameters of the application scenario comprise a location of the user terminal and a type of an access network, wherein the type of the access network comprises:

a local area network, a wireless local area network, and a wireless mobile network of a Global System for Mobile Communications (GSM), a Code Division Multiple Access (CDMA) system and a Long Term Evolution (LTE) system;

the traffic type comprises real-time traffic and non-real-time traffic; and

the security function module comprises one or more of following functions: confidentiality, integrity, authentication and flow cleaning.

14. The method according to claim 2 , wherein the step of protecting security of traffic data of the user by the security function module comprises:

acquiring a traffic data package matching with a user identifier and/or a traffic identifier, and carrying out security protection on the acquired traffic data package according to the configuration parameter.

15. The method according to claim 14 , wherein the way of acquiring a traffic type identifier comprises:

acquiring a set traffic type identifier through a data package including the traffic type identifier; or acquiring, by a QoS function module, a set type identifier.

16. The method according to claim 7 , wherein the step of protecting security of the traffic and/or a user comprises:

acquiring a traffic data package matching with a user identifier and/or a traffic identifier, and carrying out security protection on the acquired traffic data package according to a configuration parameter.

17. The system according to claim 10 , further comprising: the processor executing the instructions to implement a Quality of Service (QoS) unit configured to set a traffic type identifier for traffic, and to carry out personalized QoS priority protection on the traffic data according to a user identifier and/or a traffic type; and

the security execution unit is further configured to acquire the traffic type identifier from the QoS unit, or the QoS unit is further configured to send the traffic type identifier to the security execution unit.

18. The system according to claim 17 , wherein the security execution unit is further configured to:

acquire a traffic data package matching with a user identifier and/or a traffic identifier, and carry out security protection on the acquired traffic data package according to the security configuration parameter, wherein the traffic data package includes the user identifier and/or the traffic identifier.