A method, device and storage medium for repairing vulnerabilities

Abstract

The present disclosure relates to the field of network security, and discloses a method, device and storage medium for repairing vulnerabilities. The method comprises the following steps: in the process of detecting vulnerabilities of internal components through a vulnerability scanning component, if a target internal component in which a vulnerability needs to be repaired is detected, a repair package request is sent to a host machine through a first connection path based on vulnerability information of the detected target internal component through the vulnerability scanning component, the internal component includes a host machine and at least one security component, after a repair package returned by the host machine in response to the repair package request is received through a second connection path, the vulnerability that needs to be repaired in the target internal component is repaired using the repair package, the first connection path is a connection path established between the vulnerability scanning component and the internal component through a management bridge, and the second connection path is a connection path established between the vulnerability scanning component and the internal component through a virtual interface, thereby improving the efficiency and accuracy of internal vulnerability detection of an integrated security device.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network security and provides a vulnerability repair method, device and storage medium. Background Art

[0002] The integrated security device can connect to a variety of security capabilities and provide multi-dimensional protection for the connected security capabilities. The above-mentioned integrated security device itself realizes the containerization of key services and the virtualization management of security capabilities. Therefore, it has the characteristics of unified management and elastic expansion, and can provide one-stop security protection for networks, hosts, applications, and data.

[0003] However, the vulnerability detection, repair and update, and log statistics of the host and security components within the integrated security device are currently mainly handled manually by the operation and maintenance personnel, or by manually updating the upgrade package regularly. This manual detection method has problems such as low efficiency, untimely response, and passive lag. Especially when encountering vulnerabilities such as 0day, the operation and maintenance personnel cannot detect the vulnerability in time, which may have a significant impact on the operation of the integrated security device. Summary of the invention

[0004] The embodiments of the present disclosure provide a vulnerability repair method, device and storage medium to ensure the efficiency and accuracy of vulnerability detection within an integrated security device.

[0005] The specific technical solutions provided by this disclosure are as follows:

[0006] In a first aspect, an embodiment of the present disclosure provides a method for repairing a vulnerability, the method being applied to an integrated security device, the method comprising:

[0007] During the process of performing vulnerability detection on the internal components by the vulnerability scanning component, if the vulnerability scanning component detects that there is a target internal component in the internal components that needs to repair the vulnerability, the vulnerability scanning component sends a repair package request to the host machine through the first connection path based on the vulnerability information of the detected target internal component; wherein the internal components include the host machine and at least one security component;

[0008] After receiving the repair package returned by the host machine in response to the repair package request via the second connection path, the vulnerability scanning component uses the repair package to repair the vulnerability that needs to be repaired in the target internal component;

[0009] The first connection path is a connection path established between the vulnerability scanning component and the internal component through the management bridge, and the second connection path is a connection path established between the vulnerability scanning component and the internal component through the virtual interface.

[0010] Optionally, before performing vulnerability detection on internal components through the vulnerability scanning component, the following steps are also included:

[0011] Determine the management and business ports of each internal component through vulnerability scanning components;

[0012] Establishing a management path between each management port and the management bridge through the vulnerability scanning component, and configuring a first destination address for each management port through the management bridge, and using the management path carrying the first destination address as the first connection path;

[0013] Through the vulnerability scanning component, a virtual interface is configured for each service port, a traffic path is established between the virtual interface and the data packet processing framework, and the proxy bridge built into the data packet processing framework is triggered to configure a second destination address for each service port, and the traffic path carrying the second destination address is used as the second connection path.

[0014] Optionally, vulnerability information is determined by:

[0015] If a target internal component that needs to repair a vulnerability is detected by the vulnerability scanning component, the vulnerability level corresponding to the detected vulnerability that needs to be repaired is determined, and the first destination address and the second destination address corresponding to the internal component are determined;

[0016] The vulnerability level, the first destination address, and the second destination address are all used as vulnerability information through the vulnerability scanning component.

[0017] Optionally, after sending the repair package request to the host machine via the first connection path and before receiving the repair package returned by the host machine in response to the repair package request via the second connection path, the method further includes:

[0018] Searching the vulnerability scanning component on the host machine for a vulnerability scanning component corresponding to the repair package request;

[0019] If yes, parse the repair file carried in the vulnerability scanning component;

[0020] Otherwise, requesting a repair file corresponding to the repair package request from a repair package site through the host machine, wherein the repair package site is connected to the integrated security device through the Internet;

[0021] Generate a configuration file for the repair file through the host machine, and generate a repair package based on the vulnerability information, the repair file and the configuration file through the host machine.

[0022] Optionally, the vulnerability scanning component uses the repair package to repair the vulnerabilities that need to be repaired in the target internal components, including:

[0023] Verify through the vulnerability scanning component whether the vulnerability information carried in the received repair package is consistent with the vulnerability level of the detected target internal component;

[0024] If they are consistent, when it is determined that the target internal component is a host machine, the repair file is converted into a Docker image or a Chart package based on the configuration file; or, when it is determined that the target internal component is a security component, the repair file is converted into an RPM package based on the configuration file;

[0025] After receiving the repair instruction of the host machine through the first connection path, the vulnerability on the host machine is repaired by using the Docker image or Chart package through the vulnerability scanning component, or the vulnerability on the security component is repaired by using the RPM package through the vulnerability scanning component.

[0026] Optionally, the method further comprises:

[0027] In the process of repairing the vulnerability through the vulnerability scanning component, the corresponding repair log is recorded and sent to the host machine, wherein the repair log includes the repair time and the repair result;

[0028] If the repair time exceeds the preset repair period and the repair result is a failure, the host machine notifies the user end to re-repair the vulnerability corresponding to the repair result.

[0029] Optionally, the virtual interface includes a Vhost-user interface or a veth interface.

[0030] In a second aspect, the present disclosure also provides a vulnerability repair device, including:

[0031] A detection unit, configured to, during the process of performing vulnerability detection on the internal components through the vulnerability scanning component, if the vulnerability scanning component detects that there is a target internal component in the internal components that needs to repair a vulnerability, send a repair package request to the host machine through the first connection path based on the vulnerability information of the detected target internal component through the vulnerability scanning component; wherein the internal components include the host machine and at least one security component;

[0032] A repair unit, configured to repair the vulnerability that needs to be repaired in the target internal component by using the repair package through the vulnerability scanning component after receiving the repair package returned by the host machine in response to the repair package request through the second connection path;

[0033] The first connection path is a connection path established between the vulnerability scanning component and the internal component through the management bridge, and the second connection path is a connection path established between the vulnerability scanning component and the internal component through the virtual interface.

[0034] Optionally, before performing vulnerability detection on internal components through the vulnerability scanning component, the following steps are also included:

[0035] Determine the management and business ports of each internal component through vulnerability scanning components;

[0036] Establishing a management path between each management port and the management bridge through the vulnerability scanning component, and configuring a first destination address for each management port through the management bridge, and using the management path carrying the first destination address as the first connection path;

[0037] Through the vulnerability scanning component, a virtual interface is configured for each service port, a traffic path is established between the virtual interface and the data packet processing framework, and the proxy bridge built into the data packet processing framework is triggered to configure a second destination address for each service port, and the traffic path carrying the second destination address is used as the second connection path.

[0038] Optionally, vulnerability information is determined by:

[0039] If a target internal component that needs to repair a vulnerability is detected by the vulnerability scanning component, the vulnerability level corresponding to the detected vulnerability that needs to be repaired is determined, and the first destination address and the second destination address corresponding to the internal component are determined;

[0040] The vulnerability level, the first destination address, and the second destination address are all used as vulnerability information through the vulnerability scanning component.

[0041] Optionally, after sending the repair package request to the host machine via the first connection path and before receiving the repair package returned by the host machine in response to the repair package request via the second connection path, the method further includes:

[0042] Searching the vulnerability scanning component on the host machine for a vulnerability scanning component corresponding to the repair package request;

[0043] If yes, parse the repair file carried in the vulnerability scanning component;

[0044] Otherwise, requesting a repair file corresponding to the repair package request from a repair package site through the host machine, wherein the repair package site is connected to the integrated security device through the Internet;

[0045] Generate a configuration file for the repair file through the host machine, and generate a repair package based on the vulnerability information, the repair file and the configuration file through the host machine.

[0046] Optionally, the vulnerability scanning component uses a repair package to repair the vulnerability that needs to be repaired in the target internal component, and the repair unit is used to:

[0047] Verify through the vulnerability scanning component whether the vulnerability information carried in the received repair package is consistent with the vulnerability level of the detected target internal component;

[0048] If they are consistent, when it is determined that the target internal component is a host machine, the repair file is converted into a Docker image or a Chart package based on the configuration file; or, when it is determined that the target internal component is a security component, the repair file is converted into an RPM package based on the configuration file;

[0049] After receiving the repair instruction of the host machine through the first connection path, the vulnerability on the host machine is repaired by using the Docker image or Chart package through the vulnerability scanning component, or the vulnerability on the security component is repaired by using the RPM package through the vulnerability scanning component.

[0050] Optionally, it also includes:

[0051] In the process of repairing the vulnerability through the vulnerability scanning component, the corresponding repair log is recorded and sent to the host machine, wherein the repair log includes the repair time and the repair result;

[0052] If the repair time exceeds the preset repair period and the repair result is a failure, the host machine notifies the user end to re-repair the vulnerability corresponding to the repair result.

[0053] Optionally, the virtual interface includes a Vhost-user interface or a veth interface.

[0054] In a third aspect, an integrated safety device includes:

[0055] A memory for storing executable instructions;

[0056] A processor is used to read and execute executable instructions stored in a memory to implement any method as described in the first aspect.

[0057] In a fourth aspect, a computer-readable storage medium is provided. When instructions in the storage medium are executed by a processor, the processor is enabled to execute any method described in the first aspect.

[0058] The beneficial effects of the present disclosure are as follows:

[0059] In summary, in an embodiment of the present disclosure, a method, device and storage medium for vulnerability repair are provided, the method comprising: in the process of performing vulnerability detection on internal components through a vulnerability scanning component, if a target internal component in which a vulnerability needs to be repaired is detected in the internal components, then a repair package request is sent to a host machine through a first connection path based on vulnerability information of the detected target internal component through the vulnerability scanning component, the internal component includes a host machine and at least one security component, after receiving a repair package returned by the host machine in response to the repair package request through a second connection path, the vulnerability scanning component uses the repair package to repair the vulnerability that needs to be repaired in the target internal component, the above-mentioned first connection path is a connection path established between the vulnerability scanning component and the internal component through a management bridge, and the second connection path is a connection path established between the vulnerability scanning component and the internal component through a virtual interface, thereby improving the efficiency and accuracy of detecting internal vulnerabilities of the integrated security device and ensuring the safe operation of the integrated security device.

[0060] Other features and advantages of the present disclosure will be described in the following description, and partly become apparent from the description, or be understood by practicing the present disclosure. The purpose and other advantages of the present disclosure can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

[0062] Figure 1 A schematic diagram of a system architecture for repairing vulnerabilities in an embodiment of the present disclosure;

[0063] Figure 2 A schematic diagram of a process for repairing a vulnerability in an embodiment of the present disclosure;

[0064] Figure 3 A schematic diagram of a process for determining a first connection path and a second connection path in an embodiment of the present disclosure;

[0065] Figure 4 A schematic diagram of a process for repairing detected vulnerabilities in an embodiment of the present disclosure;

[0066] Figure 5 A schematic diagram of a process for re-repairing a vulnerability in an embodiment of the present disclosure;

[0067] Figure 6 A schematic diagram of the logical architecture of a vulnerability repair device in an embodiment of the present disclosure;

[0068] Figure 7Schematic diagram of the physical architecture of the integrated security device in the embodiment of the present disclosure. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the technical solution of the present disclosure, rather than all the embodiments. Based on the embodiments recorded in the present disclosure document, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present disclosure.

[0070] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented using sequences other than those illustrated or described herein.

[0071] The preferred embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0072] See also Figure 1 As shown, in the embodiment of the present disclosure, the system includes at least one integrated security device, and the integrated security device is internally provided with a vulnerability scanning component and internal components, wherein the internal components include a host machine and at least one security component. It should be noted that, relative to the vulnerability scanning component and security component inside the integrated security device, the host machine is a host that controls and manages the vulnerability scanning component, security component, etc.; the vulnerability scanning component and other security components are equivalent to virtual machines controlled by the host. The vulnerability scanning component here can be understood as multiple vulnerability scanning components of different types, or can be understood as different types of scanning parts under one vulnerability scanning component.

[0073] In the disclosed embodiment, the vulnerability repair method is implemented mainly within the integrated security device, that is, the vulnerability scanning component disposed within the integrated security device performs vulnerability detection and repair on the host machine or security component, which is described in detail below.

[0074] See also Figure 2 As shown, in the embodiment of the present disclosure, the specific process of the integrated security device performing vulnerability repair is as follows:

[0075] Step 201: During the process of performing vulnerability detection on internal components through a vulnerability scanning component, if the vulnerability scanning component detects that there is a target internal component in the internal components that needs to repair a vulnerability, the vulnerability scanning component sends a repair package request to the host machine through a first connection path based on the vulnerability information of the detected target internal component; wherein the internal components include a host machine and at least one security component.

[0076] Since, during the operation of the integrated security device, the vulnerabilities of its internal components are generated in real time, a detection cycle is usually defined to detect the vulnerabilities of the internal components, and the length of the detection cycle is not specifically defined. In addition, the above-mentioned internal components include a host machine and at least one security component, and the number of security components is set according to the type of the integrated security device.

[0077] Before using the vulnerability scanning component to detect vulnerabilities in internal components, refer to Figure 3 As shown, it also includes:

[0078] Step 101: Determine the management port and business port of each internal component through the vulnerability scanning component.

[0079] First of all, it should be explained that each internal component and vulnerability scanning component is respectively provided with a management port and a business port. Control instructions such as control and management commands are transmitted through the management port, and traffic data such as repair packages are transmitted through the business port. Therefore, in the implementation process, the management port and business port of each internal component are first determined through the vulnerability scanning component, and on this basis, the connection between each management port and the connection between each business port can be established.

[0080] Step 102: Establish a management path between each management port and the management bridge through the vulnerability scanning component, configure a first destination address for each management port through the management bridge, and use the management path carrying the first destination address as the first connection path.

[0081] In order to connect the vulnerability scanning component, the host machine and the security component in a unified manner, each management port determined by the vulnerability scanning component is connected to the management bridge, thereby forming a management path between the management port and the management bridge.

[0082] In order to clearly identify each component, the management bridge configures the first destination address, that is, the Internet Protocol address (IP) of the intranet, for each management port. In this way, the host machine or security component corresponding to the management port can be quickly found through the IP address, and then the relevant repair package can be sent to the host machine or security component to complete the vulnerability repair.

[0083] During the implementation process, the above-mentioned first connection path is a connection path established between the vulnerability scanning component and the internal component through the management bridge. Specifically, the management path carrying the first destination address is used as the first connection path, that is, the first connection path is used to collectively refer to the management link formed by the host machine, security components, etc. The above-mentioned first connection path is only used to transmit control instructions such as control and management commands.

[0084] Step 103: Configure a virtual interface for each service port through the vulnerability scanning component, establish a traffic path between the virtual interface and the vector packet processing framework (VPP), and trigger the proxy bridge built into the vector packet processing framework to configure a second destination address for each service port, and use the traffic path carrying the second destination address as the second connection path.

[0085] The above-mentioned VPP is an open source high-performance network forwarding framework, which runs in the Linux system user space and can run on multiple central processing unit (CPU) platforms, and can provide switch or router functions to the outside world.

[0086] In order to transmit the repair package between the vulnerability scanning component, the host and the security component, the vulnerability scanning component configures a virtual interface for each service port. Specifically, the virtual interface includes a Vhost-user interface or a veth interface, which is mainly used for the transmission of traffic data. In addition, each virtual interface is connected to the VPP to form a traffic path between the service port and the VPP.

[0087] In order to clearly identify the traffic addresses of each component, the vulnerability scanning component will also trigger the VPP proxy bridge to configure a second destination address for each service port. The configuration method of the second destination address is the same as that of the first destination address, which will not be repeated here.

[0088] During the implementation, the second connection path is a connection path established between the vulnerability scanning component and the internal component through a virtual interface. Specifically, the traffic path carrying the second destination address is used as the second connection path, that is, the second connection path is used to collectively refer to the traffic link formed by the host machine, security components, etc. The second connection path is only used to transmit traffic data such as repair packages.

[0089] After the first connection path and the second connection path are established, the vulnerability can be detected. In the specific implementation process, that is, in the process of detecting the vulnerability of the internal component through the vulnerability scanning component, if a vulnerability that needs to be repaired is detected in the host machine and / or any security component, the host machine and / or any security component are collectively referred to as the target internal component.

[0090] After the target internal component is determined, vulnerability information of the target internal component is further determined through the vulnerability scanning component, a repair package request is generated according to the vulnerability information, and the repair package request is sent to the host machine through the established first connection path.

[0091] The following is an introduction to the process of determining vulnerability information. Vulnerability information is determined in the following ways:

[0092] (1) If a target internal component that needs to repair a vulnerability is detected by the vulnerability scanning component, the vulnerability level corresponding to the detected vulnerability that needs to be repaired is determined, and the first destination address and the second destination address corresponding to the internal component are determined.

[0093] Since the objects of vulnerability detection are the host machine and at least one security component, and the host machine further includes system components and cluster components (for example, K8S cluster, etc.), the levels of the detected vulnerabilities are different. Therefore, during the implementation process, based on the detection of target internal components that need to be repaired through the vulnerability scanning component, it is necessary to further determine the vulnerability level corresponding to the detected vulnerability that needs to be repaired, so as to obtain an accurate repair package.

[0094] In addition, in order to transmit the repair package request and receive the corresponding repair package, the first destination address and the second destination address corresponding to each internal component must be determined, that is, the destination address to which the repair package request needs to be sent and the destination address to which the repair package should reach for specific repair must be clearly determined.

[0095] (2) The vulnerability level, the first destination address, and the second destination address are all used as vulnerability information through the vulnerability scanning component.

[0096] During the implementation process, the detected vulnerability level, and the first destination address and the second destination address associated with the detected vulnerability are used as vulnerability information.

[0097] After the vulnerability information is determined in the above manner and a repair package request is generated based on the vulnerability information, the repair package request is sent to the host machine through the first connection path to obtain the corresponding repair package.

[0098] After sending a repair package request to the host machine via the first connection path and before receiving a repair package returned by the host machine in response to the repair package request via the second connection path, the method further includes:

[0099] 1) The host machine searches the vulnerability scanning component to find out whether there is a vulnerability scanning component corresponding to the repair package request.

[0100] Usually, the vulnerability scanning components inside the integrated security device correspond to the vulnerability information in the historical detection process, or to the more common vulnerability information. This will lead to two situations: 1. The vulnerability scanning component inside the integrated security device corresponds to the detected vulnerability information; 2. The vulnerability scanning component inside the integrated security device does not correspond to the detected vulnerability information. During the implementation process, the host machine must first search in the vulnerability scanning component to see if there is a vulnerability scanning component corresponding to the repair package request, that is, to determine whether the vulnerability scanning component inside the integrated security device can repair the detected vulnerability.

[0101] 2) If yes, that is, a vulnerability scanning component corresponding to the repair package request is found inside the integrated security device, so that it can be determined that the vulnerability scanning component inside the integrated security device can repair the detected vulnerability. In this case, the repair file carried by the vulnerability scanning component is directly parsed.

[0102] 3) Otherwise, it is found that there is no vulnerability scanning component corresponding to the repair package request in the integrated security device, so it can be determined that the vulnerability scanning component in the integrated security device cannot repair the detected vulnerability. In this case, it is necessary to introduce a new repair file through the host machine to generate a repair package and repair the detected vulnerability.

[0103] Specifically, the host machine requests the repair file corresponding to the repair package request from the repair package site, wherein the repair package site is connected to the integrated security device through the Internet.

[0104] It should be noted that the repair package site integrates multiple repair files. Compared with the repair files in the vulnerability scanning component, the repair files in the repair package site are newer, that is, these repair files are updated in real time with the network, and can update and optimize the repair files in the vulnerability scanning component. The host can obtain the repair file corresponding to the repair package request from the repair package site.

[0105] 4) Generate a configuration file for the repair file through the host machine, and generate a repair package based on the vulnerability information, the repair file and the configuration file through the host machine.

[0106] After obtaining the repair file through the above steps 2) and 3), the host needs to generate a corresponding configuration file for the repair file. The role of the configuration file here is to assist the repair file in repairing the vulnerability. In addition, in order to repair the vulnerability more accurately, the host generates a repair package based on the vulnerability information, repair file and configuration file. In this way, after receiving the repair package, the vulnerability scanning component can also verify the correctness of the repair package based on the matching of the received vulnerability information with the previously generated vulnerability information.

[0107] Step 202: After receiving the repair package returned by the host machine in response to the repair package request via the second connection path, the vulnerability scanning component uses the repair package to repair the vulnerability that needs to be repaired in the target internal component.

[0108] During the implementation process, the vulnerability scanning component receives the repair package returned by the host machine. The repair package here is transmitted through the second connection path between the host machine and the vulnerability scanning component. After that, the vulnerability scanning component can use the repair package to repair the vulnerabilities that need to be repaired in the target internal components. Figure 4 As shown in the figure, the repair process specifically includes:

[0109] Step 221: Verify through the vulnerability scanning component whether the vulnerability information carried in the received repair package is consistent with the vulnerability level of the detected target internal component.

[0110] Usually, there are multiple vulnerabilities scanned in the host machine and security components. In order to obtain a repair package that is consistent with the vulnerability to be repaired, after receiving the repair package, the vulnerability scanning component verifies whether the vulnerability information carried in the repair package is consistent with the vulnerability level corresponding to the detected target internal component, so as to determine the availability of the received repair package.

[0111] Step 2022: If they are consistent, when it is determined that the target internal component is a host machine, the repair file is converted into a Docker image or Chart package based on the configuration file, or, when it is determined that the target internal component is a security component, the repair file is converted into an RPM package based on the configuration file.

[0112] During the implementation process, the repair process will only continue when it is determined that the above-mentioned vulnerability information is consistent with the vulnerability level corresponding to the detected target internal component; if the above-mentioned vulnerability information is inconsistent with the vulnerability level corresponding to the detected target internal component, the repair process will be stopped.

[0113] On the basis of continuing the repair process, it is further determined whether the target internal component to be repaired is the host machine or the security component. Since the host machine itself includes system components and K8S clusters, when the target internal component is the host machine, the repair file is converted into a Docker image or Chart package according to the configuration file, so as to carry out targeted repairs on the system components and K8S clusters, etc.; when the target internal component is a security component, the repair file is converted into an RPM package according to the configuration file, so as to carry out targeted repairs on the security component.

[0114] Step 2023: After receiving the repair instruction of the host machine through the first connection path, the vulnerability on the host machine is repaired by using the Docker image or Chart package through the vulnerability scanning component, or the vulnerability on the security component is repaired by using the RPM package through the vulnerability scanning component.

[0115] After determining the target internal component to be repaired and obtaining the specific repair package (Docker image or Chart package and RPM package, etc.), it is also necessary to receive the repair instruction of the host machine through the first connection path, that is, the actual repair process is truly started after receiving the command of the host machine. In the actual repair process, when repairing the vulnerability on the host machine through the vulnerability scanning component, the vulnerability on the host machine is repaired using the Docker image or Chart package, or the vulnerability on the security component is repaired using the RPM package.

[0116] In addition, it should be noted that after the vulnerability is fixed, the repair results need to be tracked. Figure 5 As shown, the above method also includes:

[0117] Step 3011: During the process of repairing the vulnerability through the vulnerability scanning component, a corresponding repair log is recorded and sent to the host machine, wherein the repair log includes the repair time and the repair result.

[0118] Considering that multiple vulnerabilities may be detected at the same time within a preset repair cycle, it is necessary to repair multiple vulnerabilities at the same time through the vulnerability scanning component. Therefore, during the implementation process, it is necessary to record the repair status of each vulnerability, such as the repair time, repair result, repair type, corresponding repair package, etc., and summarize the above repair status into a repair log and send it to the host machine so that the vulnerability repair status can be uniformly summarized, which is convenient for the user to view.

[0119] Step 3012: If the repair time exceeds the preset repair period and the repair result is a failure, the host machine notifies the user end to repair the vulnerability corresponding to the repair result again.

[0120] During the implementation process, if the repair time exceeds the preset repair cycle, that is, the repair time for a vulnerability exceeds the preset repair time, and the repair result is failure, it means that the vulnerability still exists and has not been successfully repaired within the preset repair cycle. In this case, the host machine notifies the user end, and further, the repair log corresponding to the vulnerability can be sent to the user end, so that the user end can re-repair the vulnerability corresponding to the repair result. The re-repair method is not specifically limited here.

[0121] Based on the same inventive concept, see Figure 6As shown, an embodiment of the present disclosure provides a device for repairing a vulnerability, including:

[0122] The detection unit 601 is used for sending a repair package request to the host machine through the first connection path based on the vulnerability information of the detected target internal component during the process of performing vulnerability detection on the internal component through the vulnerability scanning component, if the vulnerability scanning component detects that there is a target internal component in the internal component that needs to repair the vulnerability, wherein the internal component includes the host machine and at least one security component;

[0123] The repair unit 602 is used to repair the vulnerability that needs to be repaired in the target internal component by using the repair package through the vulnerability scanning component after receiving the repair package returned by the host machine in response to the repair package request through the second connection path;

[0124] The first connection path is a connection path established between the vulnerability scanning component and the internal component through the management bridge, and the second connection path is a connection path established between the vulnerability scanning component and the internal component through the virtual interface.

[0125] Optionally, before performing vulnerability detection on internal components through the vulnerability scanning component, the following steps are also included:

[0126] Determine the management and business ports of each internal component through vulnerability scanning components;

[0127] Establishing a management path between each management port and the management bridge through the vulnerability scanning component, and configuring a first destination address for each management port through the management bridge, and using the management path carrying the first destination address as the first connection path;

[0128] Through the vulnerability scanning component, a virtual interface is configured for each service port, a traffic path is established between the virtual interface and the data packet processing framework, and the proxy bridge built into the data packet processing framework is triggered to configure a second destination address for each service port, and the traffic path carrying the second destination address is used as the second connection path.

[0129] Optionally, vulnerability information is determined by:

[0130] If a target internal component that needs to repair a vulnerability is detected by the vulnerability scanning component, the vulnerability level corresponding to the detected vulnerability that needs to be repaired is determined, and the first destination address and the second destination address corresponding to the internal component are determined;

[0131] The vulnerability level, the first destination address, and the second destination address are all used as vulnerability information through the vulnerability scanning component.

[0132] Optionally, after sending the repair package request to the host machine via the first connection path and before receiving the repair package returned by the host machine in response to the repair package request via the second connection path, the method further includes:

[0133] Searching, through the host machine, in the vulnerability scanning component, whether there is a vulnerability scanning component corresponding to the repair package request;

[0134] If yes, parse the repair file carried in the vulnerability scanning component;

[0135] Otherwise, requesting a repair file corresponding to the repair package request from a repair package site through the host machine, wherein the repair package site is connected to the integrated security device through the Internet;

[0136] Generate a configuration file for the repair file through the host machine, and generate a repair package based on the vulnerability information, the repair file and the configuration file through the host machine.

[0137] Optionally, the vulnerability scanning component uses a repair package to repair the vulnerability that needs to be repaired in the target internal component, and the repair unit 602 is used to:

[0138] Verify through the vulnerability scanning component whether the vulnerability information carried in the received repair package is consistent with the vulnerability level of the detected target internal component;

[0139] If they are consistent, when it is determined that the target internal component is a host machine, the repair file is converted into a Docker image or a Chart package based on the configuration file; or, when it is determined that the target internal component is a security component, the repair file is converted into an RPM package based on the configuration file;

[0140] After receiving the repair instruction of the host machine through the first connection path, the vulnerability on the host machine is repaired by using the Docker image or Chart package through the vulnerability scanning component, or the vulnerability on the security component is repaired by using the RPM package through the vulnerability scanning component.

[0141] Optionally, it also includes:

[0142] In the process of repairing the vulnerability through the vulnerability scanning component, the corresponding repair log is recorded and sent to the host machine, wherein the repair log includes the repair time and the repair result;

[0143] If the repair time exceeds the preset repair period and the repair result is a failure, the host machine notifies the user end to re-repair the vulnerability corresponding to the repair result.

[0144] Optionally, the virtual interface includes a Vhost-user interface or a veth interface.

[0145] Based on the same inventive concept, see Figure 7 As shown, an embodiment of the present disclosure provides an integrated security device, including: a memory 701, used to store executable instructions; a processor 702, used to read and execute the executable instructions stored in the memory, and execute any one of the methods of the first aspect above.

[0146] Based on the same inventive concept, an embodiment of the present disclosure provides a computer-readable storage medium. When instructions in the storage medium are executed by a processor, the processor is enabled to execute any method described in the first aspect above.

[0147] In summary, in an embodiment of the present disclosure, a method, device and storage medium for vulnerability repair are provided, the method comprising: in the process of performing vulnerability detection on internal components through a vulnerability scanning component, if a target internal component in which a vulnerability needs to be repaired is detected in the internal components, then a repair package request is sent to a host machine through a first connection path based on vulnerability information of the detected target internal component through the vulnerability scanning component, the internal component includes a host machine and at least one security component, after receiving a repair package returned by the host machine in response to the repair package request through a second connection path, the vulnerability scanning component uses the repair package to repair the vulnerability that needs to be repaired in the target internal component, the above-mentioned first connection path is a connection path established between the vulnerability scanning component and the internal component through a management bridge, and the second connection path is a connection path established between the vulnerability scanning component and the internal component through a virtual interface, thereby improving the efficiency and accuracy of detecting internal vulnerabilities of the integrated security device and ensuring the safe operation of the integrated security device.

[0148] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program product systems. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product system implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0149] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program product systems according to the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0150] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0151] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0152] Obviously, those skilled in the art can make various changes and modifications to the present disclosure without departing from the spirit and scope of the present disclosure. Thus, if these modifications and variations of the present disclosure fall within the scope of the claims of the present disclosure and their equivalents, the present disclosure is also intended to include these modifications and variations.

Claims

1. A vulnerability repair method, characterized in that: The method is applied to an integrated safety device, and the method comprises: During the process of performing vulnerability detection on the internal components by the vulnerability scanning component, if the vulnerability scanning component detects that there is a target internal component in the internal components that needs to repair a vulnerability, the vulnerability scanning component sends a repair package request to the host machine through the first connection path based on the detected vulnerability information of the target internal component; wherein the internal components include the host machine and at least one security component; After receiving the repair package returned by the host machine in response to the repair package request via the second connection path, the vulnerability scanning component verifies whether the vulnerability information carried in the received repair package is consistent with the vulnerability level corresponding to the detected target internal component; if they are consistent, when it is determined that the target internal component is the host machine, the repair file is converted into a Docker image or a Chart package based on the configuration file, or, when it is determined that the target internal component is the security component, the repair file is converted into an RPM package based on the configuration file; after receiving the repair instruction of the host machine via the first connection path, the vulnerability scanning component uses the Docker image or the Chart package to repair the vulnerability on the host machine, or, uses the RPM package to repair the vulnerability on the security component through the vulnerability scanning component; The first connection path is a connection path established between the vulnerability scanning component and the internal component through a management bridge, and the second connection path is a connection path established between the vulnerability scanning component and the internal component through a virtual interface.

2. The method according to claim 1, characterized in that Before the vulnerability scanning component is used to detect the vulnerability of the internal component, the following steps are also included: Determine the management port and business port of each of the internal components through a vulnerability scanning component; Establishing a management path between each of the management ports and the management bridge through a vulnerability scanning component, and configuring a first destination address for each of the management ports through the management bridge, and using the management path carrying the first destination address as the first connection path; The virtual interface is configured for each of the service ports through the vulnerability scanning component, a traffic path is established between the virtual interface and the data packet processing framework, and the proxy bridge built into the data packet processing framework is triggered to configure a second destination address for each of the service ports, and the traffic path carrying the second destination address is used as the second connection path.

3. The method according to claim 2, characterized in that The vulnerability information is determined in the following way: If a target internal component that needs to repair a vulnerability is detected by the vulnerability scanning component, the vulnerability level corresponding to the detected vulnerability that needs to be repaired is determined, and the first destination address and the second destination address corresponding to the internal component are determined; The vulnerability level, the first destination address, and the second destination address are all used as the vulnerability information through a vulnerability scanning component.

4. The method according to claim 1, characterized in that After sending the repair package request to the host machine via the first connection path and before receiving the repair package returned by the host machine in response to the repair package request via the second connection path, the method further includes: Searching, by the host machine, in the vulnerability scanning component whether there is a vulnerability scanning component corresponding to the repair package request; If yes, parsing the repair file carried in the vulnerability scanning component; Otherwise, requesting a repair file corresponding to the repair package request from a repair package site through the host machine, wherein the repair package site is connected to the integrated security device through the Internet; A configuration file is generated for the repair file by the host machine, and the repair package is generated by the host machine based on the vulnerability information, the repair file and the configuration file.

5. The method according to claim 1, characterized in that The method further comprises: In the process of repairing the vulnerability through the vulnerability scanning component, a corresponding repair log is recorded and sent to the host machine, wherein the repair log includes the repair time and the repair result; If the repair time exceeds the preset repair period, and the repair result is a failure, the host machine notifies the user end to re-repair the vulnerability corresponding to the repair result.

6. The method according to any one of claims 1 to 5, characterized in that: The virtual interface includes a Vhost-user interface or a veth interface.

7. A device for repairing a vulnerability, characterized in that: include: A detection unit, configured to, during the process of performing vulnerability detection on the internal components through the vulnerability scanning component, if the vulnerability scanning component detects that there is a target internal component in the internal components that needs to repair a vulnerability, send a repair package request to the host machine through the first connection path through the vulnerability scanning component based on the detected vulnerability information of the target internal component; wherein the internal components include the host machine and at least one security component; a repair unit, configured to, after receiving the repair package returned by the host machine in response to the repair package request via the second connection path, verify through the vulnerability scanning component whether the vulnerability information carried in the received repair package is consistent with the vulnerability level corresponding to the detected target internal component; if consistent, converting the repair file into a Docker image or a Chart package based on the configuration file when determining that the target internal component is the host machine, or converting the repair file into an RPM package based on the configuration file when determining that the target internal component is the security component; after receiving the repair instruction of the host machine via the first connection path, using the Docker image or the Chart package to repair the vulnerability on the host machine through the vulnerability scanning component, or using the RPM package to repair the vulnerability on the security component through the vulnerability scanning component; The first connection path is a connection path established between the vulnerability scanning component and the internal component through a management bridge, and the second connection path is a connection path established between the vulnerability scanning component and the internal component through a virtual interface.

8. An integrated safety device, characterized in that: include: A memory for storing executable instructions; A processor, configured to read and execute the executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor, the processor is enabled to execute the method according to any one of claims 1 to 6.

Images