Data inspection device stacking method and data inspection device

Abstract

The present invention discloses a data inspection device stacking method and a data inspection device in the field of data inspection technology, comprising configuring a first data inspection device to enable a stacking mode; configuring the first data inspection device as a stacking system master device, automatically creating a stacking system, and sending a stacking member detection request; configuring a second data inspection device to enable a stacking mode and be a stacking system slave device; configuring the second data inspection device to receive a stacking member detection request sent by the first data inspection device, send a stacking request response, and join the stacking system created by the first data inspection device configuration; the first data inspection device receives a stacking request response from the second data inspection device, verifies the version number of the second data inspection device, and completes a stacking member joining process; the present invention can quickly expand data inspection capabilities, solve the problem of slow inspection speed, automatically calculate balanced inspection boundaries, automatically load balance internal processing modules, and automatically merge inspection results with reports.

Description

Technical Field

[0001] The present invention relates to the technical field of data inspection, and in particular to a data inspection device stacking method and a data inspection device. Background Art

[0002] Data security and data compliance inspections are mainly carried out by connecting the inspection equipment to the inspected system or network and starting to scan and analyze them one by one, such as inspections and analyses of many file systems, database systems, email systems, business systems, etc. These inspected systems often contain massive amounts of data information, including structured and unstructured data.

[0003] Using a single data inspection device to inspect a large amount of data to be inspected often takes a very long time. On-site inspections are usually carried out with portable inspection equipment. Due to the limited processing performance of portable equipment, a single portable inspection device can take several hours to process a large amount of data to be inspected, resulting in low inspection efficiency.

[0004] When using multiple data inspection devices to perform inspection tasks in parallel, the inspection is often complicated and inefficient because the inspection boundary cannot be effectively divided in the inspected system. The inspection results are also scattered and need to be merged.

[0005] Based on this, the present invention designs a data inspection device stacking method and a data inspection device to solve the above problems. Summary of the invention

[0006] The purpose of the present invention is to provide a data inspection device stacking method and a data inspection device, so as to solve the problems proposed in the above background technology that using a single data inspection device to inspect massive amounts of data to be inspected often results in a very long inspection time and low inspection efficiency; using multiple data inspection devices to inspect and perform inspection tasks in parallel cannot effectively divide the inspection boundaries, the operation is complicated and the efficiency is still low, and the inspection results are also scattered and need to be merged.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A data inspection device stacking method comprises the following steps:

[0009] S1: configure the first data inspection device and enable stacking mode;

[0010] S2: configure the first data inspection device as a stack system master device, automatically create a stack system, and send a stack member detection request;

[0011] S3: configure the second data inspection device and enable the stacking mode;

[0012] S4: Configuring the second data inspection device as a stacking system slave device;

[0013] S5: configuring the second data inspection device to receive a stack member detection request sent by the first data inspection device, send a stack joining request response, and join the stack system created by the first data inspection device;

[0014] S6: The first data inspection device receives the stacking request response from the second data inspection device, verifies the version number of the second data inspection device, and allows the second data inspection device to join the stacking system if it is compatible, thus completing a stacking member joining process.

[0015] Preferably, in S1 and S3, after the first data inspection device and the second data inspection device enable the stacking mode, the internal data extraction, inspection, storage and analysis modules of the stacking system open independent external service ports.

[0016] Preferably, the external service port access adopts an authentication method, using the verification code authentication in the stack member request, and while the local system directly accesses, the front-end modules corresponding to all member devices of the stack system can also be allowed to access.

[0017] Preferably, in S2, the stack member detection request is sent within the local network segment or within a specified range. The detection request includes the local system version number, the stack system name, the external service address of the data extraction, inspection, storage, and analysis module, the check code, the current timestamp, and the detection request is sent encrypted.

[0018] Preferably, in S4, after the second data inspection device is configured as a stack system slave device, it starts receiving a stack member detection request service and can dynamically accept stack member detection requests.

[0019] Preferably, in S5, after receiving the stack member detection request sent by the first data check device, i.e., the stack system master device, the second data check device, i.e., the stack system slave device, verifies the version number compatibility, and agrees to join the stack system if it is compatible, and saves the stack system name in the stack member request information, the external service address of the data extraction, inspection, storage, and analysis module of the stack system master device, and the verification code on the local computer. The stack request response includes the external service address of the data extraction, inspection, storage, and analysis module of the current device, the verification code, and the current timestamp.

[0020] Preferably, in S6, after the stack member joining process is completed, each member device of the stack system completes a clock synchronization with the local device according to the stack master device time.

[0021] Preferably, the method further comprises: S7: aggregating the network interfaces of the stacking system into a single logical interface;

[0022] S8: The data extraction modules in the stacking system run in parallel and receive the collected data from the logical interface in a load-balanced manner;

[0023] S9: the inspection modules in the stacking system run in parallel and receive the output data of the data extraction module from the collection interface in a load-balanced manner;

[0024] S10: the storage modules in the stacking system run in parallel and receive output data of the inspection modules from the inspection interface in a load-balanced manner;

[0025] S11: The analysis modules in the stacking system run in parallel to analyze the storage data from the storage module.

[0026] Preferably, in S7, the interface aggregation is specifically the first data inspection device and the second data inspection device automatically configure a routing redundancy protocol, and a virtual address receives the inspected data traffic; in S8, after the inspection task scope is determined, the data extraction module automatically calculates the inspection segmentation boundary according to the overall inspection task scope, so as to achieve that the inspection data volume of a single physical data inspection device is roughly equal; in S9, S10, and S11, the inspection module, storage module, and analysis module are in a stateless processing mode, and can dynamically adjust the devices to be inspected sent by the data extraction modules of other physical devices according to the operating load of the current physical device.

[0027] A data inspection device, wherein a plurality of data inspection devices are stacked to form a logical data inspection device.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. The present invention can quickly expand data inspection capabilities, solve the problems of slow inspection speed, limited storage capacity, slow analysis speed, etc. of a single physical data inspection device, and can determine the number of stack members to be configured according to actual business scenarios.

[0030] 2. Easy to use. Compared with multiple manual inspection devices, the logical inspection system formed by stacking multiple data inspection devices has the same business usage as a single physical device. The stacking system automatically calculates balanced inspection boundaries, the internal processing module automatically load balances, and the inspection results and reports are automatically merged. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0032] Figure 1This is a schematic diagram of the stacking method of the present invention;

[0033] Figure 2 A schematic diagram of a stacking system is formed by enabling the stacking mode for the inspection device of the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] See also Figure 1-2 , the present invention provides a technical solution:

[0036] A data inspection device stacking method includes the following steps:

[0037] S1. Configure the first data inspection device to enable stacking mode.

[0038] S2. Configure the first data inspection device as a stack system master device, automatically create a stack system, and send a stack member detection request.

[0039] S3. Configure the second data inspection device to enable stacking mode.

[0040] S4. Configure the second data inspection device as a stacking system slave device

[0041] S5. Configure the second data inspection device to receive the stack member detection request sent by the first data inspection device, send a stack joining request response, and join the stack system created by the first data inspection device.

[0042] S6. The first data inspection device receives the stacking request response from the second data inspection device, verifies the version number of the second data inspection device, and allows it to join the stacking system if it is compatible. The first and second data inspection devices form a logical data inspection device and storage medium.

[0043] S7. The network interface of the stacking system is aggregated to form a single logical interface.

[0044] S8. The data extraction modules inside the stacking system run in parallel and receive the collected data from the logical interface in a load-balanced manner.

[0045] S9. The inspection modules inside the stacking system run in parallel and receive the output data of the data extraction module from the collection interface in a load-balanced manner.

[0046] S10. The storage modules inside the stacking system run in parallel and receive the output data of the inspection modules from the inspection interface in a load-balanced manner.

[0047] S11. The analysis modules within the stacking system run in parallel to analyze the storage data from the storage module.

[0048] Steps 1-6 are about creating a stack system and adding members. Steps 7-11 are about adjusting the internal member devices after the stack system is created, completing the extraction, inspection, storage, and analysis of dynamic balancing to improve the system's parallel processing capabilities.

[0049] Among them, in S1 and S3, after the first and second data inspection devices start the stacking mode, the system's internal data extraction, inspection, storage, and analysis modules open independent external service ports.

[0050] In S2, the first data inspection device is configured as the stack system master device, the stack system is automatically created, and the stack member detection request service is enabled. The detection request is sent within the local network segment or within a specified range. The detection request includes the local system version number, the stack system name, the external service address of the data extraction, inspection, storage, and analysis module, the check code, and the current timestamp. The detection request is sent encrypted.

[0051] In S4, the second data inspection device is configured as a stack system slave device, and a stack member detection request receiving service is started, so that the stack member detection request can be dynamically accepted.

[0052] In S5, after receiving the stack member detection request sent by the first data inspection device, i.e., the stack system slave device, the second data inspection device, i.e., the stack system master device, verifies the compatibility of the version number, and agrees to join the stack system if it is compatible, and saves the stack system name, the external service address of the data extraction, inspection, storage, and analysis module of the stack system master device, and the check code in the stack member request information on the local device. A stack request response is sent, and the request response includes the external service address of the data extraction, inspection, storage, and analysis module of the current device, the check code, and the current timestamp.

[0053] In S6, the first data inspection device saves the external service address and verification code information of the data extraction, inspection, storage, and analysis module in the stack member request response sent by the second data inspection device. After completing a stack member joining process, each member device of the stack system completes a clock synchronization with the local device according to the stack master device time. The data extraction, inspection, storage, and analysis module service interface access of the first and second data inspection devices adopts an authentication method, using the verification code authentication in the stack member request. While the local system is directly accessed, the front-end modules corresponding to all member devices of the stack system can also be allowed to access.

[0054] In S7, the interfaces are aggregated to form a virtual address mode, the first data inspection device and the second data inspection device automatically configure a routing redundancy protocol, and the virtual address receives the inspected data traffic.

[0055] In S8, after the inspection task scope is determined, the data extraction modules of the first data inspection device and the second data inspection device automatically calculate the inspection segmentation boundaries according to the overall inspection task scope, such as segmentation by database, segmentation by data table, or segmentation by data row range in a large data table, in order to achieve that the amount of inspection data of a single physical data inspection device is roughly equal.

[0056] In S9, S10, and S11, the inspection, storage, and analysis modules of the first data inspection device and the second data inspection device are in a stateless processing mode, and can dynamically adjust the devices to be inspected sent by the data extraction modules of other physical devices according to the operating load of the current physical device.

[0057] Through the above stacking method, multiple inspection devices are logically formed into one data inspection device. The data inspection stacking system realizes unified management of multiple devices, automatic allocation and processing of internal resources, and realizes rapid parallel inspection of massive inspected data. In particular, according to actual scenario requirements, more data inspection devices can be added to the stacking system.

[0058] The present invention can quickly expand data inspection capabilities and solve the problems of slow inspection speed, limited storage capacity, slow analysis speed, etc. of a single physical data inspection device. The number of stack members can be configured according to the actual business scenario.

[0059] It is easy to use. Compared with multiple manual inspection devices, the logical inspection system formed by stacking multiple data inspection devices has the same business usage as a single physical device. The stacking system automatically calculates balanced inspection boundaries, the internal processing module automatically load balances, and the inspection results and reports are automatically merged.

[0060] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0061] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A data inspection device stacking method, characterized in that: The following steps are involved: S1: configure the first data inspection device and enable stacking mode; S2: configure the first data inspection device as a stack system master device, automatically create a stack system, and send a stack member detection request; S3: configure the second data inspection device and enable the stacking mode; S4: Configuring the second data inspection device as a stacking system slave device; S5: configuring the second data inspection device to receive a stack member detection request sent by the first data inspection device, send a stack joining request response, and join the stack system created by the first data inspection device; S6: The first data inspection device receives the stacking request response from the second data inspection device, verifies the version number of the second data inspection device, and allows the second data inspection device to join the stacking system if it is compatible, thus completing a stacking member joining process; S7: Aggregate the network interfaces of the stack system into a single logical interface; S8: The data extraction modules in the stacking system run in parallel and receive the collected data from the logical interface in a load-balanced manner; S9: the inspection modules in the stacking system run in parallel and receive the output data of the data extraction module from the collection interface in a load-balanced manner; S10: the storage modules in the stacking system run in parallel and receive output data of the inspection modules from the inspection interface in a load-balanced manner; S11: the analysis modules in the stacking system run in parallel to analyze the storage data from the storage module; In S7, the interface aggregation is specifically for the first data inspection device and the second data inspection device to automatically configure the routing redundancy protocol, and the virtual address receives the inspected data traffic. In S8, after the inspection task scope is determined, the data extraction module automatically calculates the inspection segmentation boundary according to the overall inspection task scope to achieve that the inspection data volume of a single physical data inspection device is roughly equal. In S9, S10, and S11, the inspection module, storage module, and analysis module are stateless processing modes, and can dynamically adjust the reception of the data to be inspected sent by the data extraction modules of other physical devices according to the operating load of the current physical device; In S1 and S3, after the first data inspection device and the second data inspection device enable the stacking mode, the internal data of the stacking system is extracted, inspected, and stored, and the analysis module opens an independent external service port; In S2, the stack member detection request is sent within the local network segment or within a specified range. The detection request contains the local system version number, the stack system name, the external service address of the data extraction, inspection, storage, and analysis module, the check code, the current timestamp, and the detection request is sent encrypted; In S4, after the second data inspection device is configured as a stack system slave device, a stack member detection request receiving service is started, and the stack member detection request can be dynamically accepted; In S5, after receiving the stack member detection request sent by the first data check device, i.e., the stack system master device, the second data check device, i.e., the stack system slave device, verifies the compatibility of the version number, and agrees to join the stack system if it is compatible, and saves the stack system name in the stack member request information, the external service address of the data extraction, inspection, storage, and analysis module of the stack system master device, and the verification code on the local computer. The stack request response includes the external service address of the data extraction, inspection, storage, and analysis module of the current device, the verification code, and the current timestamp.

2. A data inspection device stacking method according to claim 1, characterized in that: The external service port access adopts an authentication method, using the verification code in the stack member request for authentication. While the local system directly accesses, the front-end modules corresponding to all member devices of the stack system can also be allowed to access.

3. A data inspection device stacking method according to claim 1, characterized in that: In S6, after the stack member joining process is completed, each member device of the stack system completes clock synchronization with the local device according to the stack master device time.

4. A data inspection device, applicable to the data inspection device stacking method according to any one of claims 1 to 3, characterized in that: A plurality of data inspection devices are stacked together to form a logical data inspection device.

Images