A security detection rule upgrading system

Abstract

The application discloses a kind of security detection rule upgrade systems, comprising: running agent AGENT, agent management end and result display end SERVER and the rule server of receiving SERVER's rule inquiry and rule download, AGENT with each component or system runs in same platform, for receiving SERVER side rule and executing specific baseline detection item, result is fed back to SERVER side, SERVER is responsible for updating rule from rule server, and is issued to specified AGNET side by strategy configuration, receives AGENT execution result and shows, its beneficial effect is: by adopting asymmetric encryption and symmetric encryption dynamic key mode, provide rule confidentiality and integrity protection, by rule business upgrade logic built-in rule package, abstract rule unified upper layer, rule business logic adjustment does not need to modify AGNET side, by encrypting key segmentation storage, improve the difficulty of key leakage.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a security detection rule upgrading system. BACKGROUND

[0002] Security detection rule updating refers to reviewing, modifying and optimizing existing security rules and strategies to cope with new security threats and vulnerabilities. There are currently several schemes for security detection rule updating.

[0003] Scheme 1: Plain rule uncompressed package, SERVER downloads the compressed package from the rule server and obtains the plain baseline rule after decryption without a key; AGENT pulls the plain baseline rule from the SERVER side for execution.

[0004] Scheme 2: Plain baseline rule fixed key compressed package, SERVER downloads the compressed package from the rule server and obtains the plain baseline rule after decryption through the built-in fixed symmetric key K; AGENT pulls the plain baseline rule from the SERVER side for execution.

[0005] Scheme 3: Encrypted baseline rule fixed key compressed package, SERVER downloads the compressed package from the rule server and obtains the encrypted baseline rule after decryption through the built-in fixed symmetric key K1; AGENT pulls the ciphertext baseline rule from the SERVER side and executes it after decryption using the built-in fixed key K2.

[0006] The above schemes have the following defects:

[0007] Scheme 1 is mainly used for open source software, lacking confidentiality and integrity protection, and any third party can easily obtain the plain rule by obtaining the compressed package, and even launch a man-in-the-middle attack on the network side.

[0008] Scheme 2 protects the compressed package with a fixed key, and the security relies on the secrecy of the key K not being leaked, but the fixed key has been listed as a risk item in the development of security, one is that the key can be obtained through binary files and symbols, and the other is that the fixed symmetric key exists in the code, and the authority cannot be finely controlled, and "internal leakage" is only a matter of time.

[0009] Scheme 3 uses two fixed keys, which seems to improve the security level, but does not solve the fixed key risk problem of scheme 2.

[0010] In view of the above defects, a security detection rule upgrading system is proposed. SUMMARY

[0011] This section is intended to summarize some aspects of the embodiments of the present application and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section as well as in the summary of the application and the title of the application in order to avoid obscuring the purpose of this section, the summary of the application and the title of the application, and such simplifications or omissions are not to be construed as limiting the scope of the present application.

[0012] In view of the above problems, the present application is proposed.

[0013] To solve the above technical problems, the present application provides the following technical solutions: a security detection rule upgrading system, comprising:

[0014] AGENT: running agent, running on the same platform as each component or system, receiving rules issued by the SERVER side and executing specific baseline detection items, and feeding back the results to the SERVER side;

[0015] SERVER: proxy management end and result display end, responsible for updating rules from the rule server, and issuing to the designated AGNET side through policy configuration, receiving AGENT execution results and displaying;

[0016] Rule server: receiving rule inquiry and rule download from SERVER;

[0017] Among them, the system running process includes:

[0018] S1, SERVER carries the rule type interaction inquiry rule server latest version, judges whether it needs to download the upgrade compressed package through version comparison, if it needs, then proceed to the next step, wherein the upgrade compressed package includes rule compressed package, upgrade logic compressed package, version file, summary file and signed file;

[0019] S2, SERVER downloads the rule package successfully, and then signs the signed file through the built-in RSA public key, obtains the dynamic AES key K1 and the summary file itself summary, and proceeds to the next step;

[0020] S3, SERVER calculates the SHA256 summary of the rule compressed package, the upgrade logic compressed package and the version file, and compares it with the storage content of the summary file, and proceeds to the next step;

[0021] S4, SERVER uses dynamic AES key to decompress the rule compressed package and the upgrade logic compressed package, and runs the upgrade script in the upgrade logic package;

[0022] S5, AGENT uploads the rule version to SERVER, SERVER judges whether it needs to issue the rule file, if it needs, then proceed to the next step;

[0023] S6, the AGENT receives the rule file, reads the content and loads the rule content decryption key for decryption, and if successful, executes the rule.

[0024] As a preferred solution of the security rule detection upgrade system, the rule compression package is compressed using the symmetric dynamic key K1 and AES encryption, and the rule content decryption key and the rule file encrypted using AES are stored using segmented storage.

[0025] As a preferred solution of the security rule detection upgrade system, the rule content decryption key is stored in two segments, SK1 and SK2, and SK1 and SK2 are combined to form the rule content decryption key, which is used to decrypt the rule file using AES.

[0026] As a preferred solution of the security rule detection upgrade system, the SK1 is encoded in the engine program and obtained through program symbols stored as character groups.

[0027] As a preferred solution of the security rule detection upgrade system, the SK2 is stored in a randomly named text file, and SK2 is only readable by the engine program running account.

[0028] As a preferred solution of the security rule detection upgrade system, the upgrade logic compression package is compressed using the symmetric dynamic key K1 and AES encryption, and the rule service upgrade logic is stored.

[0029] As a preferred solution of the security rule detection upgrade system, the version file stores the rule version, urgency and rule type, and the integrity is protected by the digest file.

[0030] As a preferred solution of the security rule detection upgrade system, the digest file stores the digest values of the rule compression package, the upgrade logic compression package and the version file, and the integrity is protected by the signing file.

[0031] As a preferred solution of the security rule detection upgrade system, the signing file stores the symmetric dynamic key K1 and the digest of the digest file itself, which is protected by the OPENSSL asymmetric RSA encryption.

[0032] As a preferred solution of the security rule detection upgrade system, the rule server communicates with the SERVER via HTTPS, and the AGENT communicates with the SERVER via TCP socket, and the content is encrypted using AES.

[0033] The beneficial effects of the present application: by adopting asymmetric encryption and symmetric encryption dynamic key mode, regular confidentiality and integrity protection are provided, by embedding rule service upgrade logic in the rule package, abstracting the rule to the upper layer, the rule service logic adjustment does not need to modify the AGENT side, by segmenting the encrypted key storage, the difficulty of key leakage is improved. BRIEF DESCRIPTION OF DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor. Among them:

[0035] Figure 1 The timing diagram of the security detection rule upgrade system of the present application.

[0036] Figure 2 The upgrade compression package structure diagram of the security detection rule upgrade system of the present application.

[0037] Figure 3 The segmented storage key schematic diagram of the security detection rule upgrade system of the present application.

[0038] Figure 4 The actual deployment diagram of the security detection rule upgrade system of the present application. DETAILED DESCRIPTION

[0039] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings of the specification.

[0040] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the connotation of the present application, therefore the present application is not limited to the specific embodiments disclosed below.

[0041] Secondly, the "one embodiment" or "embodiment" referred to herein means that the specific features, structures or characteristics can be included in at least one implementation of the present application. In this specification, "in one embodiment" appearing in different places does not mean the same embodiment, nor is it an independent or alternative embodiment that excludes other embodiments.

[0042] Thirdly, the present application is described in detail in combination with the schematic diagram, in the detailed description of the embodiments of the present application, for the convenience of description, the sectional view of the device structure will be partially enlarged without the general proportion, and the schematic diagram is only an example, which should not limit the scope of protection of the present application. In addition, the three-dimensional spatial dimensions of length, width and depth should be included in actual production.

[0043] Embodiment 1

[0044] A security detection rule upgrading system comprises:

[0045] AGENT: running agent, running on the same platform as each component or system, receiving rules issued by SERVER side and executing specific baseline detection items, and feeding back the results to SERVER side;

[0046] SERVER: proxy management end and result display end, responsible for updating rules from rule server, and issuing to designated AGNET side through policy configuration, receiving AGENT execution results and displaying;

[0047] Rule server: receiving rule inquiry and rule download of SERVER;

[0048] Among them, the system running process includes:

[0049] S1, SERVER carries the rule type interaction inquiry rule server latest version, judges whether it needs to download the upgrade compressed package through version comparison, if it needs, then the next step is carried out, wherein the upgrade compressed package includes rule compressed package, upgrade logic compressed package, version file, digest file and signed file;

[0050] S2, SERVER downloads rule package successfully, and then signs the signed file through built-in RSA public key, obtains dynamic AES key K1 and digest file itself digest, and then carries out the next step;

[0051] S3, SERVER calculates the SHA256 digest of rule compressed package, upgrade logic compressed package and version file, and compares it with the storage content of digest file, and then carries out the next step;

[0052] S4, SERVER uses dynamic AES key to decompress rule compressed package and upgrade logic compressed package, and runs upgrade script in upgrade logic package;

[0053] S5, AGENT uploads rule version to SERVER, SERVER judges whether it needs to issue rule file, if it needs, then the next step is carried out;

[0054] S6, AGENT receives rule file, reads content and loads rule content decryption key for decryption, if successful, executes the rule.

[0055] Specifically, the rule compression package is compressed by using symmetric dynamic key K1 and AES encryption, stores rule content decryption key and AES encrypted rule file using segmented storage, the rule content decryption key is stored in two segments SK1 and SK2, SK1 and SK2 are combined to form a rule content decryption key, which is used for AES decryption of the rule file, SK1 is encoded in the engine program and is obtained through program symbols in the form of character attribute groups, and SK2 is stored in a randomly named text file, and SK2 is readable only by the engine program running account.

[0056] In addition, the upgrade logic compression package is compressed by using symmetric dynamic key K1 and AES encryption, stores rule service upgrade logic, version file stores rule version, urgency and rule type, the integrity of which is protected by the digest file, the digest file stores the digest values of the rule compression package, the upgrade logic compression package and the version file, the integrity of which is protected by the signing file, the signing file stores symmetric dynamic key K1 and the digest of the digest file itself, which is protected by OPENSSL asymmetric RSA encryption.

[0057] It should be noted that the communication between the rule server and the SERVER is HTTPS, the communication between the AGENT and the SERVER is a TCP socket, and the content is encrypted by AES.

[0058] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and are not limiting, although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present application, which should be covered in the scope of the claims of the present application.

Claims

1. A security detection rule upgrade system, characterized by, Comprise: AGENT: running agent, running with each component or system on the same platform, receiving SERVER side rules and executing specific baseline detection items, and feeding back the results to the SERVER side; SERVER: proxy management end and result display end, responsible for updating rules from rule server, and issuing to designated AGNET side through policy configuration, receiving AGENT execution results and displaying; Rule server: receive SERVER rule inquiry and rule download; Wherein, the system running process comprises: S1, SERVER carries rule version interaction inquiry rule server latest version, judges whether it needs to download upgrade compressed package through version comparison, needs to proceed to next step, wherein, the upgrade compressed package comprises rule compressed package, upgrade logic compressed package, version file, digest file and signed file; S2, SERVER downloads upgrade compressed package successfully, and signs the signed file through built-in RSA public key, obtains dynamic AES key K1 and digest file itself digest, and proceeds to next step through; S3, SERVER calculates SHA256 digest of rule compressed package, upgrade logic compressed package and version file, and compares with the storage content of digest file, and proceeds to next step through; S4, SERVER uses dynamic AES key to decompress rule compressed package and upgrade logic compressed package, and runs upgrade script in upgrade logic package; S5, AGENT uploads rule version to SERVER, SERVER judges whether it needs to issue rule file, needs to proceed to next step; S6, AGENT receives rule file, reads content and loads rule content decryption key for decryption, succeeds to execute rule; The rule compressed package is a package compressed by symmetric dynamic key K1 and AES, which stores rule content decryption key and AES encrypted rule file using segmented storage; the rule content decryption key is stored in two segments SK1 and SK2, SK1 and SK2 are combined to form rule content decryption key, which is used for AES decryption of rule file; SK1 is encoded in engine program and obtained through program symbol by storing as character group; SK2 is stored in a randomly named text file, and SK2 is only readable by engine program running account; The upgrade logic compressed package is a package compressed by symmetric dynamic key K1 and AES, which stores rule business upgrade logic.

2. The system of claim 1, wherein: The version file stores rule version, urgency and rule type, and its integrity is protected by the digest file.

3. The system of claim 2, wherein: The digest file stores the digest values of rule compressed package, upgrade logic compressed package and version file, and its integrity is protected by the signed file.

4. The system of claim 3, wherein: The signed file stores symmetric dynamic key K1 and digest file itself digest, which is protected by OPENSSL asymmetric RSA encryption.

5. The system of claim 1, wherein: The communication between the rule server and SERVER is HTTPS, the communication between the AGENT and SERVER is TCP socket, and the content is encrypted by AES.

Images