Cloud host security reinforcement method and device, storage medium and electronic equipment

Abstract

The present disclosure provides a cloud host security reinforcement method and device, a storage medium and an electronic device; and relates to the technical field of cloud computing security. The method comprises the following steps: obtaining application information of a cloud host resource, and publishing a to-be-reinforced cloud host according to the application information; scanning the to-be-reinforced cloud host to obtain a security scanning report of the to-be-reinforced cloud host; reinforcing the to-be-reinforced cloud host according to the application information and the security scanning report to obtain a security reinforcement result; verifying the security reinforcement result and outputting corresponding reinforced cloud host resources. In the process of starting the cloud host, the cloud host is scanned, reinforced, verified and delivered, so that the allocation and security reinforcement of the cloud host are integrated, the security of the cloud host is improved, and the security reinforcement efficiency of the cloud host is improved.

Description

Technical Field

[0001] This disclosure relates to the field of cloud computing security technology, and more specifically, to a cloud host security hardening method, a cloud host security hardening device, a computer-readable storage medium, and an electronic device. Background Technology

[0002] With the rapid popularization and application of cloud computing technology, the security issues of cloud servers are becoming increasingly prominent. Cloud servers are a virtualization technology that virtualizes multiple independent-like components on a cluster of hosts, effectively addressing the shortcomings of traditional physical hosts and virtual machine services, such as high management difficulty and weak business scalability. Currently, security protection technologies for cloud servers are still relatively underdeveloped; for example, security standards are not uniform, and security protection levels vary widely. Therefore, improving the security of cloud servers has become an urgent technical problem to be solved.

[0003] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] This disclosure provides a cloud server security hardening method, cloud server security hardening device, computer-readable storage medium, and electronic device, thereby overcoming, to at least a certain extent, the problem of low security of cloud servers due to limitations in related technologies.

[0005] This disclosure provides a method for hardening the security of cloud servers, including:

[0006] Obtain application information for cloud server resources, and publish the cloud servers to be hardened based on the application information;

[0007] Scan the cloud server to be hardened and obtain a security scan report of the cloud server to be hardened;

[0008] The cloud host to be reinforced is reinforced based on the application information and the security scan report to obtain the security reinforcement result.

[0009] Verify the security hardening results and output the corresponding hardened cloud host resources.

[0010] In one exemplary embodiment of this disclosure, obtaining application information for cloud server resources and publishing the cloud server to be hardened based on the application information includes:

[0011] Obtain the resource application form generated from the application information of the cloud host resources;

[0012] The virtualization software interface is invoked according to the resource request form, and the cloud host to be hardened is published through the virtualization software interface.

[0013] In one exemplary embodiment of this disclosure, the application information for the cloud server resources includes cloud server parameter information; the scanning of the cloud server to be hardened to obtain a security scan report of the cloud server to be hardened includes:

[0014] A scan request is generated based on the cloud host parameter information;

[0015] A scan task script is generated in response to the scan request;

[0016] Execute the scanning task script to obtain a security scan report for the cloud host to be hardened. The security scan report includes a list of issues identified during the scan.

[0017] In one exemplary embodiment of this disclosure, generating a scan task script in response to the scan request includes:

[0018] A scan task list is generated based on the cloud host parameter information in the scan request;

[0019] The system queries a preset security rule base based on the scan task list and generates a corresponding scan task script.

[0020] In one exemplary embodiment of this disclosure, the application information for the cloud host resources includes a security hardening level; the step of hardening the cloud host to be hardened based on the application information and the security scan report to obtain a security hardening result includes:

[0021] A reinforcement request is generated based on the cloud host parameter information, the security reinforcement level, and the issue list in the security scan report.

[0022] In response to the reinforcement request, a reinforcement task script is generated;

[0023] The security reinforcement task script is executed to reinforce the cloud host to be reinforced and obtain the security reinforcement result.

[0024] In one exemplary embodiment of this disclosure, verifying the security hardening result and outputting the corresponding hardened cloud host resources includes:

[0025] A verification request is generated based on the security hardening results;

[0026] A verification task script is generated in response to the verification request;

[0027] The verification task script is executed to verify the security hardening results and output the verified hardened cloud host resources.

[0028] In one exemplary embodiment of this disclosure, the method further includes:

[0029] In response to a security rule update request, the security rule base is updated, and a corresponding task script is generated based on the updated security rule base.

[0030] This disclosure provides a cloud server security hardening device, including:

[0031] The information acquisition module is used to acquire application information for cloud server resources and publish the cloud servers to be hardened based on the application information;

[0032] The scanning module is used to scan the cloud host to be hardened and obtain a security scan report of the cloud host to be hardened.

[0033] The hardening module is used to harden the cloud host to be hardened based on the application information and the security scan report, and obtain the security hardening result;

[0034] The verification module is used to verify the security hardening results and output the corresponding hardened cloud host resources.

[0035] This disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any one of the above descriptions.

[0036] This disclosure provides an electronic device, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the method described in any of the preceding methods by executing the executable instructions.

[0037] The exemplary embodiments disclosed herein may have some or all of the following beneficial effects:

[0038] In the cloud server security hardening method provided in the exemplary embodiments of this disclosure, application information for cloud server resources is obtained, and a cloud server to be hardened is published according to the application information; the cloud server to be hardened is scanned to obtain a security scan report; the cloud server to be hardened is hardened according to the application information and the security scan report to obtain a security hardening result; the security hardening result is verified, and the corresponding hardened cloud server resources are output. This disclosure integrates cloud server allocation and security hardening during the cloud server activation process by performing security scanning, hardening, verification, and delivery, thereby improving the security of cloud servers and increasing the efficiency of cloud server security hardening.

[0039] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0040] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0041] Figure 1 A schematic diagram of an exemplary system architecture for a cloud host security hardening method and apparatus to which embodiments of the present disclosure can be applied is shown;

[0042] Figure 2 A schematic diagram of the structure of a computer system suitable for implementing embodiments of the present disclosure is shown;

[0043] Figure 3 A flowchart illustrating a cloud host security hardening method according to an embodiment of the present disclosure is shown schematically.

[0044] Figure 4 A schematic diagram of a security hardening module according to an embodiment of the present disclosure is shown.

[0045] Figure 5 A flowchart illustrating a cloud host scanning process according to an embodiment of the present disclosure is shown schematically.

[0046] Figure 6 A flowchart illustrating cloud server hardening according to an embodiment of the present disclosure is shown schematically;

[0047] Figure 7 This illustration schematically shows a flowchart of cloud host verification and delivery according to an embodiment of the present disclosure;

[0048] Figure 8 A flowchart illustrating a cloud host security hardening method according to another embodiment of the present disclosure is shown schematically;

[0049] Figure 9 A block diagram of a cloud host security hardening apparatus according to an embodiment of the present disclosure is shown schematically. Detailed Implementation

[0050] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0051] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0052] Figure 1 A schematic diagram of the system architecture of an exemplary application environment to which a cloud host security hardening method and apparatus according to embodiments of the present disclosure can be applied is shown.

[0053] like Figure 1 As shown, system architecture 100 may include one or more of terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables. Terminal devices 101, 102, and 103 may be various electronic devices, including but not limited to desktop computers, laptops, smartphones, and tablets. It should be understood that... Figure 1The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included. For example, server 105 can be a single server, a server cluster consisting of multiple servers, a virtualization platform, or a cloud computing service center. Optionally, server 105 may include a server for implementing a cloud management platform. The cloud host security hardening method provided in this embodiment is generally executed by server 105. Correspondingly, the cloud host security hardening device is generally installed in server 105. After the server completes the execution, it can deliver the hardened cloud resources to the terminal device, which then displays them to the user.

[0054] Figure 2 A schematic diagram of the structure of a computer system suitable for implementing the embodiments of the present disclosure is shown.

[0055] It should be noted that, Figure 2 The computer system 200 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0056] like Figure 2 As shown, the computer system 200 includes a central processing unit (CPU) 201, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 202 or programs loaded from storage section 208 into random access memory (RAM) 203. The RAM 203 also stores various programs and data required for system operation. The CPU 201, ROM 202, and RAM 203 are interconnected via a bus 204. An input / output (I / O) interface 205 is also connected to the bus 204.

[0057] The following components are connected to I / O interface 205: an input section 206 including a keyboard, mouse, etc.; an output section 207 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 208 including a hard disk, etc.; and a communication section 209 including a network interface card such as a LAN card, modem, etc. The communication section 209 performs communication processing via a network such as the Internet. Drive 210 is also connected to I / O interface 205 as needed. Removable media 211, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 210 as needed so that computer programs read from them can be installed into storage section 208 as needed.

[0058] In particular, according to embodiments of this disclosure, the processes described below with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 209, and / or installed from removable medium 211. When the computer program is executed by central processing unit (CPU) 201, it performs the various functions defined in the methods and apparatus of this application.

[0059] On the other hand, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to perform the methods described in the following embodiments. For example, the electronic device may perform... Figure 3 , Figures 5 to 8 The various steps shown are as follows.

[0060] It should be noted that the computer-readable medium disclosed herein may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0061] The technical solutions of the embodiments of this disclosure are described in detail below:

[0062] With the rapid popularization and application of cloud computing technology, the security issues of cloud servers are becoming increasingly prominent. Currently, security protection technologies for cloud servers are still relatively underdeveloped. For example, security hardening systems are not embedded in the cloud server resource application and activation process. Performing security hardening after applications are deployed on the cloud server can easily have adverse effects on business operations. Furthermore, verifying security hardening by building a business test environment requires significant manpower and material resources, resulting in low efficiency for cloud server hardening. Another example is that some security hardening systems only perform scanning, providing scan results and solutions, without actually performing security hardening, or they fail to perform security scanning and hardening according to industry standards, thus reducing the security of cloud server hardening.

[0063] To address one or more of the aforementioned issues, this example implementation provides a method for hardening the security of cloud servers. (Reference) Figure 3 As shown, the cloud host security hardening method may include the following steps S310 to S340:

[0064] Step S310. Obtain the application information for cloud server resources, and publish the cloud server to be hardened according to the application information;

[0065] Step S320. Scan the cloud host to be hardened to obtain a security scan report of the cloud host to be hardened;

[0066] Step S330. Based on the application information and the security scan report, the cloud host to be reinforced is reinforced to obtain the security reinforcement result;

[0067] Step S340. Verify the security hardening results and output the corresponding hardened cloud host resources.

[0068] In the cloud server security hardening method provided in the exemplary embodiments of this disclosure, application information for cloud server resources is obtained, and a cloud server to be hardened is published according to the application information; the cloud server to be hardened is scanned to obtain a security scan report; the cloud server to be hardened is hardened according to the application information and the security scan report to obtain a security hardening result; the security hardening result is verified, and the corresponding hardened cloud server resources are output. This disclosure integrates cloud server allocation and security hardening during the cloud server activation process by performing security scanning, hardening, verification, and delivery, thereby improving the security of cloud servers and increasing the efficiency of cloud server security hardening.

[0069] The steps described above in this example implementation will now be explained in more detail.

[0070] In step S310, the application information for cloud host resources is obtained, and the cloud host to be hardened is published according to the application information.

[0071] In one example implementation, when activating a cloud server, the user can perform security hardening on the cloud server to be deployed during the activation process. For instance, a security hardening module can be added to the cloud management platform to perform security hardening on the cloud server to be deployed during the activation process. The cloud management platform can efficiently organize and allocate various resources and provide users with services ranging from order to delivery, from fine-grained resource allocation and control to monitoring and troubleshooting.

[0072] Before hardening the security of a cloud server, a resource application form generated from the cloud server resource application information is required. Based on this form, an unhardened cloud server can be created. For example, users can log in to the resource application portal, access the resource application interface, and select the cloud server specifications, operating system type, operating system version, and security hardening level according to their actual business needs. Cloud server specifications can include the number of CPU (Central Processing Unit) cores and memory, such as a general-purpose 2-core 4GB configuration, an advanced 4-core 8GB configuration, or a high-performance 8-core 16GB configuration. The cloud server operating system type can be Windows or Linux. For example, for Windows, there are multiple versions such as Server 2003 SP2 (a server operating system) and Server 2008 R2 (a server operating system that only provides a 64-bit version). Security hardening levels are divided into low, medium, and high based on their impact on business operations, allowing users to select the appropriate level based on their specific business needs.

[0073] After selecting cloud server resources, users can send a resource request to the resource application portal. This request can include the cloud server resources selected by the user, such as a cloud server with 4 CPU cores and 8GB of memory, a Windows operating system, and a medium security hardening level. In one example, users can send resource request to the resource application portal through a message interaction interface. This interface can be either HTTP (Hypertext Transfer Protocol) or HTTPS (Hypertext Transfer Protocol over Secure Socket Layer). Correspondingly, the request can be sent via HTTP or HTTPS. HTTPS is a security-oriented version of HTTP, ensuring security through transmission encryption and authentication. It also incorporates SSL (Secure Socket Layer), adding an encryption / authentication layer to the default HTTP port. HTTPS provides authentication and encrypted communication methods and is widely used for security-sensitive communications, such as transaction payments.

[0074] After receiving a resource application request, the resource application portal can approve the cloud server resources in the request. Upon approval, a corresponding resource application form can be generated based on the requested cloud server resources. This form can include details such as cloud server specifications, operating system type, operating system version, and security hardening level. The resource application portal can then send the resource application form to the cloud management platform via an API. The cloud management platform can then invoke the virtualization software interface based on the information in the application form, operate the virtualization software through the interface to generate an unhardened cloud server, and distribute the unhardened cloud server to the user's terminal device.

[0075] In this example implementation, a security hardening module can be used to harden the security of the cloud server to be deployed during the cloud server activation process. (See reference...) Figure 4 As shown, the security hardening module can include sub-modules such as a unified security interface module, a scanning module, a hardening module, a verification module, and a rule update module, as well as a security rule base. Furthermore, the security hardening module can interface with the cloud management platform through the unified security interface module. Specifically, it can receive security requests from the cloud management platform, such as scanning requests, hardening requests, verification requests, and security rule update requests, and then call the corresponding sub-modules based on different security requests. Each sub-module can generate corresponding scanning task scripts, hardening task scripts, and verification task scripts from the security rule base and return security response messages to the cloud management platform through the unified interface. In addition, the cloud management platform can respond to security rule updates from the SOC (Security Operations Center) management platform by calling the rule update module within the security hardening module to update the security rule base through the unified security interface module. Therefore, the security response message can include the scanning task script, hardening task script, verification task script, and rule update results.

[0076] After generating an unhardened cloud server, the security hardening module can be used to scan, harden, and verify the cloud server sequentially. In other examples, rule updates can also be performed during the cloud server activation process. For instance, when the security hardening module receives security requests from the cloud management platform through a unified interface, the main parameters of the interface can include the cloud server IP address, cloud server name, cloud server operating system type, cloud server operating system version, and request type. The request type can further include scan requests, hardening requests, and security rule update requests.

[0077] In step S320, the cloud host to be hardened is scanned to obtain a security scan report of the cloud host to be hardened.

[0078] After publishing the cloud server to be hardened, it can be scanned first, and hardening can be performed based on the scan results. In one example implementation, refer to... Figure 5 As shown, the cloud host to be hardened can be scanned according to steps S510 to S530.

[0079] In step S510, a scan request is generated based on the cloud host parameter information.

[0080] Cloud server parameter information may include the cloud server IP address, cloud server name, cloud server operating system type, and cloud server operating system version. In one example, the cloud server parameter information can be assembled to generate a scan request, such as generating a corresponding scan request message. This request message can be an HTTP message, containing information for HTTP protocol interaction. HTTP messages can carry various data types of digital data, such as images, videos, HTML documents, and software applications. The HTTP message format can be a fixed-length message format, a delimited message format, or an XML (Extensible Markup Language) message format. The storage method can be persistent, such as saving to a database or saving to disk.

[0081] In step S520, a scan task script is generated in response to the scan request.

[0082] After the cloud management platform generates a scan request, it can call the scanning interface of the security hardening module. The scanning interface can be an HTTP interface, an HTTPS interface, a WebSocket interface, etc. In one example, the HTTP interface of the scanning module can be called. The HTTP interface is a development interface based on the HTTP protocol, which in turn is built on top of TCP (Transmission Control Protocol). For example, when a browser needs to retrieve webpage data from a server, it sends an HTTP request, establishing a connection with the server via TCP. Once the requested data is returned, the TCP connection is closed.

[0083] After receiving a scan request from the cloud management platform, the scanning module generates a scan task list based on the cloud host parameter information in the scan request. It then queries a pre-defined security rule base to generate the corresponding scan task script. The security rule base is the core of the security hardening module, storing all security specifications, such as scanning rules, hardening rules, and verification rules. This security rule base periodically retrieves the latest specification requirements from the SOC management platform, and after review and testing by security experts, it is finally stored in the database.

[0084] Referring to Table 1, Table 1 schematically illustrates one structure of the security rule base.

[0085] Table 1

[0086]

[0087] The security rule base shown in Table 1 can include rule type, security hardening level, operating system type, operating system version, target issue, detailed issue description, script, and update time. The rule type can include scanning rules, hardening rules, and verification rules. The security hardening level is medium, the operating system is Linux, and the operating system version is Red Hat 6.5. The target issue is account password complexity, indicating that the account password configured on the cloud host to be hardened will be scanned, hardened, and verified. The detailed description of this target issue includes password length, uppercase and lowercase letters, and special characters. The corresponding scanning task script for this target issue could be: account_scan.sh, the corresponding hardening task script could be: account_safty.sh, and the corresponding verification task script could be: account_verify.sh. It can also be seen that the last update time for this security rule base was February 26, 2021. In other examples, in other structures of the security rule base, the security hardening level can be low, medium, or high, and the operating system can be a Windows operating system, and the operating system version can be Server 2003 SP2. This disclosure does not make any specific restrictions on this.

[0088] For example, when the security hardening level in the scan task list is medium, the operating system is Linux, the operating system version is Red Hat 6.5, and the target issue is account password complexity, with a detailed description of the target issue including password length, uppercase and lowercase letters, and special characters, a corresponding scan task script, account_scan.sh, can be generated by querying the preset security rule base based on this scan task list.

[0089] In step S530, the scanning task script is executed to obtain a security scan report of the cloud host to be hardened. The security scan report includes a list of issues obtained from the scan.

[0090] The scanning module can return the generated scanning task script to the cloud management platform via the scanning interface. After the cloud management platform executes the scanning task script, it can obtain a security scan report of the cloud host, which may include a list of identified issues.

[0091] In step S330, the cloud host to be hardened is hardened according to the application information and the security scan report to obtain the security hardening result.

[0092] After scanning the cloud server, the appropriate level of security hardening can be applied based on the security scan report. In one example implementation, refer to... Figure 6 As shown, the cloud host to be hardened can be hardened according to steps S610 to S630.

[0093] Step S610. Generate a hardening request based on the cloud host parameter information, the security hardening level, and the problem list in the security scan report.

[0094] The system can assemble user-selected cloud server parameters, such as the cloud server IP address, name, operating system type, and version, along with the security hardening level (e.g., medium) and a list of issues obtained during a scan of the cloud server, to generate a hardening request and a hardening list. It should be noted that different security hardening levels will generate different hardening lists.

[0095] Step S620. Generate a hardening task script in response to the hardening request.

[0096] After the cloud management platform generates a hardening request, it can call the hardening interface of the security hardening module. The hardening interface can be an HTTP interface, an HTTPS interface, etc., through which the hardening list can be sent to the hardening module. The hardening module responds to the scanning request from the cloud management platform, generates a corresponding hardening task list based on the hardening list, and queries the preset security rule base based on the hardening task list to generate the corresponding hardening task script.

[0097] For example, when the security hardening level in the hardening task list is medium, the operating system is Linux, the operating system version is Red Hat 6.5, and the target issue is account password complexity, with a detailed description of the target issue including password length, uppercase and lowercase letters, and special characters, a corresponding hardening task script, account_safty.sh, can be generated by querying the preset security rule base based on this hardening task list.

[0098] Step S630. Execute the reinforcement task script to reinforce the cloud host to be reinforced and obtain the security reinforcement result.

[0099] The scanning module can return the generated scanning task script to the cloud management platform through the scanning interface. The cloud management platform executes the scanning task script to harden the security of the cloud host, and outputs the security hardening results after the hardening is completed.

[0100] In step S340, the security hardening result is verified and the corresponding hardened cloud host resources are output.

[0101] After scanning and hardening the cloud servers sequentially, the cloud management platform can verify the security hardening results returned by the security hardening module to output the final security hardening result. In one example implementation, refer to... Figure 7 As shown, the reinforced cloud host resources can be verified according to steps S710 to S730.

[0102] Step S710. Generate a verification request based on the security hardening results.

[0103] The cloud management platform can assemble the cloud host parameters selected by the user, such as cloud host IP, cloud host name, cloud host operating system type, cloud host operating system version, security hardening level such as medium, and the security hardening results returned by the security hardening module, to generate a verification request, and then call the security hardening module based on the verification request.

[0104] Step S720. Generate a verification task script in response to the verification request.

[0105] After the cloud management platform generates a verification request, it can call the verification interface of the security hardening module. The verification interface can be an HTTP interface, an HTTPS interface, etc. The verification module can respond to the verification request from the cloud management platform through this interface. For example, after receiving a verification request from the cloud management platform, the scanning module can generate a verification task list based on the cloud host security hardening results in the verification request, and query the preset security rule base based on the verification task list to generate the corresponding verification task script.

[0106] For example, when the security hardening level in the verification task list is medium, the operating system is Linux, the operating system version is Red Hat 6.5, and the target issue is account password complexity, with a detailed description of the target issue including password length, uppercase and lowercase letters, and special characters, a corresponding verification task script, account_verify.sh, can be generated by querying the preset security rule base based on this verification task list.

[0107] Step S730. Execute the verification task script to verify the security hardening result and output the verified hardened cloud host resources.

[0108] The verification module can return the generated verification task script to the cloud management platform through the verification interface. The cloud management platform executes the verification task script to verify the security hardening results. For example, it can verify the security of the hardened cloud host. After verification, it can output the final security hardening result and the hardened cloud host resources. In this example, the cloud management platform can obtain a cloud host delivery report based on the results of the three stages: security scanning, security hardening, and security verification, realizing the fully automated distribution of secure cloud hosts.

[0109] In one example implementation, the security hardening module can update the security rule base in response to a security rule update request from the cloud management platform, and generate corresponding task scripts based on the updated security rule base. For example, the cloud management platform can periodically obtain the latest security specifications from the SOC management platform and distribute the updated security rules to the rule update module through the unified interface of the security hardening module. Finally, security experts can review and test the updated rules, and the reviewed and tested security rules can be distributed to the security rule base. The security hardening module can use the updated security rules to respond to different security requests to generate different task scripts to harden the distributed cloud hosts.

[0110] This method integrates cloud server allocation and security hardening into a seamless, user-invisible security cloud server hardening module within the cloud management system's activation process. This streamlined process does not affect the existing cloud server activation workflow. The security hardening module provides a standardized interface for easy integration into the cloud management platform's cloud server activation and distribution process. This addresses the issue of secure cloud servers from the source, resolving security management challenges. It's important to note that the standardized interface provided by this method is compatible with various cloud management platforms; the security hardening module can be adapted to any cloud management platform, enabling security hardening and other security feature extensions before cloud server delivery, with simple and rapid integration.

[0111] Furthermore, the security hardening module in this method can interface with the SOC management platform and perform security scanning, hardening, verification, and delivery of cloud servers according to unified security standards, forming an integrated workflow. It can also update the security rule base used for hardening cloud servers based on the SOC management platform, achieving centralized management and updates for security hardening.

[0112] In one example implementation, reference Figure 8 As shown, the cloud host can be security hardened according to steps S801 to S813.

[0113] Step S801. Initiate a resource request. Users can log in to the cloud server resource request interface and select cloud server resources according to their actual business needs.

[0114] Step S802. Approval status. The resource application portal can approve the cloud server resources selected by the user. If the approval is successful, proceed to step S803. If the approval fails, it means that cloud server resources cannot be allocated to the user, and the cloud server security hardening process can be terminated.

[0115] Step S803. Generate resource application form: When the approval is granted, the resource application portal can generate the corresponding resource application form based on the cloud host resources selected by the user;

[0116] Step S804. Generate an unhardened cloud host by calling the virtualization software interface. The resource application portal can send resource application forms to the cloud management platform through the interface. The cloud management platform can call the virtualization software interface according to the content of the resource application form to generate an unhardened cloud host and complete the automatic distribution of the unhardened cloud host.

[0117] Step S805. Whether the resource request form selects security hardening: The cloud management platform can confirm whether the user has selected to harden the cloud server based on the resource request form. When the user needs to harden the cloud server, proceed to step S806; when the user does not need to harden the cloud server, proceed to step S812.

[0118] Step S806. Call the security hardening interface. The cloud management platform can call different security hardening interfaces according to different security requests. For example, when sending a scan request, it can call the scan interface of the security hardening module;

[0119] Step S807. Call the corresponding submodule. For example, if a scan request from the cloud management platform can be received, the scanning module of the security hardening module can be called to scan the unhardened cloud host;

[0120] Step S808. Generate task script. After receiving a scan request from the cloud management platform, the scanning module can generate a scan task list based on the cloud host parameter information in the scan request, and then query the preset security rule base based on the scan task list to generate the corresponding scan task script.

[0121] Step S809. Execute the task script and output the security hardening results. For example, if the scanning task script can be executed, a security scan report of the cloud host to be hardened will be obtained. Similarly, hardening task scripts and verification task scripts can be generated sequentially, and the final security hardening results can be output by executing the task scripts.

[0122] Step S810. Return to generate the host hardening report and security score. Simultaneously, the cloud management platform can distribute the hardened cloud host resources to the resource application portal for user use;

[0123] Step S811. Obtain the hardened cloud host resources, security report, and security score. The process ends.

[0124] Step S812. Return the unhardened cloud server. When the user does not need to harden the cloud server, the cloud management platform can directly distribute the unhardened cloud server to the resource application portal for the user's use;

[0125] Step S813. Obtain the unhardened cloud server resources, and the process ends.

[0126] In the cloud server security hardening method provided in the exemplary embodiments of this disclosure, application information for cloud server resources is obtained, and a cloud server to be hardened is published according to the application information; the cloud server to be hardened is scanned to obtain a security scan report; the cloud server to be hardened is hardened according to the application information and the security scan report to obtain a security hardening result; the security hardening result is verified, and the corresponding hardened cloud server resources are output. This disclosure integrates cloud server allocation and security hardening during the cloud server activation process by performing security scanning, hardening, verification, and delivery, thereby improving the security of cloud servers and increasing the efficiency of cloud server security hardening.

[0127] It should be noted that although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0128] Furthermore, this example embodiment also provides a cloud host security hardening device. This device can be applied to a server or terminal device. (See reference...) Figure 9 As shown, the cloud host security hardening device 900 may include an information acquisition module 910, a scanning module 920, a hardening module 930, and a verification module 940, wherein:

[0129] The information acquisition module 910 is used to acquire application information for cloud server resources and publish the cloud servers to be hardened based on the application information;

[0130] The scanning module 920 is used to scan the cloud host to be hardened and obtain a security scan report of the cloud host to be hardened.

[0131] The hardening module 930 is used to harden the cloud host to be hardened according to the application information and the security scan report, and obtain the security hardening result;

[0132] The verification module 940 is used to verify the security hardening results and output the corresponding hardened cloud host resources.

[0133] In one optional implementation, the information acquisition module 910 includes:

[0134] The application form generation module is used to obtain a resource application form generated from the application information of the cloud host resources;

[0135] The module for publishing the host to be hardened is used to call the virtualization software interface according to the resource request form, and publish the cloud host to be hardened through the virtualization software interface.

[0136] In one optional implementation, the cloud host resource application information includes cloud host parameter information; the scanning module 920 includes:

[0137] The scan request generation module is used to generate a scan request based on the cloud host parameter information.

[0138] A scan script generation module is used to generate a scan task script in response to the scan request;

[0139] The scan report generation module is used to execute the scan task script to obtain a security scan report of the cloud host to be hardened. The security scan report includes a list of issues obtained from the scan.

[0140] In one optional implementation, the scan script generation module includes:

[0141] The scan list generation submodule is used to generate a scan task list based on the cloud host parameter information in the scan request.

[0142] The scan script generation submodule is used to query a preset security rule base based on the scan task list and generate the corresponding scan task script.

[0143] In one optional implementation, the application information for the cloud host resources includes a security hardening level; the hardening module 930 includes:

[0144] The reinforcement request generation module is used to generate a reinforcement request based on the cloud host parameter information, the security reinforcement level, and the issue list in the security scan report;

[0145] The reinforcement script generation module is used to generate a reinforcement task script in response to the reinforcement request;

[0146] The reinforcement result acquisition module is used to execute the reinforcement task script to reinforce the cloud host to be reinforced and obtain the security reinforcement result.

[0147] In one alternative implementation, the verification module 940 includes:

[0148] The verification request generation module is used to generate a verification request based on the security hardening result.

[0149] The verification script generation module is used to generate a verification task script in response to the verification request;

[0150] The resource hardening delivery module is used to execute the verification task script to verify the security hardening results and output the verified hardened cloud host resources.

[0151] In one optional implementation, the cloud host security hardening device 900 further includes:

[0152] The rule base update module is used to update the security rule base in response to a security rule update request, and generate a corresponding task script based on the updated security rule base.

[0153] The specific details of each module in the aforementioned cloud server security hardening device have been described in detail in the corresponding cloud server security hardening methods, so they will not be repeated here.

[0154] The modules in the above-described device can be general-purpose processors, including central processing units (CPUs), network processors, etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Each module can also be implemented using software, firmware, etc. The processors in the above-described device can be independent processors or integrated together.

[0155] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0156] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method for security hardening of cloud servers, characterized in that, include: Obtain application information for cloud server resources, and publish the cloud servers to be hardened based on the application information; Scan the cloud server to be hardened and obtain a security scan report of the cloud server to be hardened; The cloud host to be reinforced is reinforced based on the application information and the security scan report to obtain the security reinforcement result. Verify the security hardening results and output the corresponding hardened cloud host resources; The security hardening module is called by the cloud management platform through a standardized interface to add it to the cloud host activation and distribution process, thereby enabling the scanning, hardening, and verification of the cloud host. The cloud management platform also responds to security rule updates by calling the security hardening module to update the security rule base. The security rule base is used to store all security scopes, including scanning rules, hardening rules, and verification rules. The application information for the cloud server resources includes cloud server parameter information; the scanning of the cloud server to be hardened, and the resulting security scan report of the cloud server to be hardened, includes: A scan request is generated based on the cloud host parameter information, and a scan task script is generated in response to the scan request; Execute the scanning task script to obtain a security scan report of the cloud host to be hardened, the security scan report including a list of issues obtained during the scan; The application information for the cloud server resources includes the security hardening level; the process of hardening the cloud server to be hardened based on the application information and the security scan report to obtain the security hardening result includes: A reinforcement request is generated based on the cloud host parameter information, the security reinforcement level, and the issue list in the security scan report. In response to the reinforcement request, a reinforcement task script is generated and executed to reinforce the cloud host to be reinforced and obtain a security reinforcement result.

2. The cloud server security hardening method according to claim 1, characterized in that, The process of obtaining application information for cloud server resources and publishing the cloud servers to be hardened based on the application information includes: Obtain the resource application form generated from the application information of the cloud host resources; The virtualization software interface is invoked according to the resource request form, and the cloud host to be hardened is published through the virtualization software interface.

3. The cloud server security hardening method according to claim 1, characterized in that, The step of generating a scan task script in response to the scan request includes: A scan task list is generated based on the cloud host parameter information in the scan request; The system queries a preset security rule base based on the scan task list and generates a corresponding scan task script.

4. The cloud server security hardening method according to claim 1, characterized in that, The process of verifying the security hardening results and outputting the corresponding hardened cloud host resources includes: A verification request is generated based on the security hardening results; A verification task script is generated in response to the verification request; The verification task script is executed to verify the security hardening results and output the verified hardened cloud host resources.

5. The cloud server security hardening method according to claim 1, characterized in that, The method further includes: In response to a security rule update request, the security rule base is updated, and a corresponding task script is generated based on the updated security rule base.

6. A cloud server security hardening device, characterized in that, include: The information acquisition module is used to acquire application information for cloud server resources and publish the cloud servers to be hardened based on the application information; The scanning module is used to scan the cloud host to be hardened and obtain a security scan report of the cloud host to be hardened. The hardening module is used to harden the cloud host to be hardened based on the application information and the security scan report, and obtain the security hardening result; The verification module is used to verify the security hardening results and output the corresponding hardened cloud host resources; The security hardening module is called by the cloud management platform through a standardized interface to add it to the cloud host activation and distribution process, thereby enabling the scanning, hardening, and verification of the cloud host. The cloud management platform also responds to security rule updates by calling the security hardening module to update the security rule base. The security rule base is used to store all security scopes, including scanning rules, hardening rules, and verification rules. The application information for the cloud server resources includes cloud server parameter information; the scanning of the cloud server to be hardened, and the resulting security scan report of the cloud server to be hardened, includes: A scan request is generated based on the cloud host parameter information, and a scan task script is generated in response to the scan request; Execute the scanning task script to obtain a security scan report of the cloud host to be hardened, the security scan report including a list of issues obtained during the scan; The application information for the cloud server resources includes the security hardening level; the process of hardening the cloud server to be hardened based on the application information and the security scan report to obtain the security hardening result includes: A reinforcement request is generated based on the cloud host parameter information, the security reinforcement level, and the issue list in the security scan report. In response to the reinforcement request, a reinforcement task script is generated and executed to reinforce the cloud host to be reinforced and obtain a security reinforcement result.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method according to any one of claims 1-5.

8. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the method of any one of claims 1-5 by executing the executable instructions.

Images