Security baseline detection method, device and storage medium

Abstract

The present disclosure relates to a security baseline detection method, device and storage medium. The present disclosure discloses a security baseline detection method, the method comprising: generating a security baseline detection task for each node of the user based on node registration information received from the user, wherein the node registration information includes address information of each node of the user; using the address information of the node, attempting to establish a remote communication channel with the node by adopting the remote communication mechanism provided by each operating system in turn; determining the operating system used by the node according to the remote communication mechanism used to successfully establish the remote communication channel with the node; and for the security baseline detection task of each node, calling the remote detection process corresponding to the determined operating system via the successfully established remote communication channel to obtain detection data from the node.

Description

Technical Field

[0001] The present disclosure generally relates to the field of network security technology, and more specifically to a security baseline detection method, device and storage medium. Background Art

[0002] Security baselines are widely used in computing to describe how to configure and manage computers. At the same time, they also describe all relevant configuration settings to achieve secure operation. Generally, the elements of a security baseline include: (1) service and application settings. For example, only specified users have the right to start services or run applications; (2) configuration of operating system components. For example, all sample files that come with Internet Information Services (IIS) must be deleted from the computer; (3) permissions and rights allocation. For example, only administrators have the right to change operating system files; and (4) management rules. For example, the administrator password on the computer should be changed every 30 days.

[0003] The existing security baseline detection technology adopts the server-client architecture mode. The client (detection engine) is deployed on the user's node host and runs on the user's node host for a long time to collect data for the security baseline, and then regularly sends the baseline detection data to the server. The server is responsible for data collation, analysis and display; deploying the client on the user's node host will make the user worry about the security and resource occupation of their own node, and the deployment operation will also make maintenance and upgrades difficult. For example, if the user is the People's Bank of China, then deploying the client on various computers owned by the People's Bank of China will obviously bring security and resource occupation concerns to the People's Bank of China.

[0004] The existing security baseline detection technology is relatively simple in detecting operating systems. One technical solution is only for one operating system, and it is impossible to perform security baseline detection on multiple types of operating systems at the same time. In addition, many of them are only for Windows, and the analysis is also for single node output, so it is impossible to perform unified security baseline detection on multiple server nodes belonging to a user. Before deployment and detection, users need to register on the server and fill in the operating system type and other information of their server nodes before security baseline detection can be performed by operating system type. When the operating system of the user node changes, it is necessary to modify the operating system information of the relevant nodes on the management platform of the server.

[0005] Therefore, there is a need in the prior art for a technology that can automatically perform security baseline detection on various operating systems without deploying a client on a user node. Summary of the invention

[0006] A brief overview of the disclosure is given below in order to provide a basic understanding of some aspects of the disclosure. However, it should be understood that this overview is not an exhaustive overview of the disclosure. It is not intended to identify the key or important parts of the disclosure, nor is it intended to limit the scope of the disclosure. Its purpose is simply to give some concepts of the disclosure in a simplified form as a prelude to a more detailed description given later.

[0007] According to one aspect of the present disclosure, a security baseline detection method is provided, the method comprising: generating a security baseline detection task for each node of the user based on node registration information received from the user, wherein the node registration information comprises address information of each node of the user; using the address information of the node, attempting to establish a remote communication channel with the node by adopting in turn the remote communication mechanisms provided by each operating system; determining the operating system used by the node based on the remote communication mechanism used to successfully establish the remote communication channel with the node; and for the security baseline detection task of each node, calling the remote detection process corresponding to the determined operating system via the successfully established remote communication channel to obtain detection data from the node.

[0008] According to another aspect of the present disclosure, a security baseline detection device is provided, including: a memory on which instructions are stored; and a processor configured to execute the instructions stored on the memory to perform the method according to the above aspects of the present disclosure.

[0009] According to another aspect of the present disclosure, a computer-readable storage medium is provided, which includes computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the one or more processors execute the method according to the above aspects of the present disclosure.

[0010] The security baseline detection program according to the present invention runs on the server platform side and collects data from the user node in remote call mode. It does not need to stay on the user node for a long time and does not occupy the user node resources. The user does not need to worry about the security risks caused by placing the detection engine on his own node; and there is no need for personnel to deploy the detection engine client, reducing the risk of operational errors caused by deployment and upgrade operations.

[0011] The present invention uses the user as the management unit of the task set. The multiple nodes of the user are collected using the same process channel, so that the data of each node of the user are in the same process, and there will be no crosstalk with the data of other users, thereby ensuring the accuracy of the data and facilitating the unified management and deployment of the security baseline of the user's own nodes.

[0012] The present invention has multiple operating system detection functions and can automatically identify and detect multiple systems such as Windows and Linux. It can automatically identify the operating system type when the detection process is running, thereby calling the relevant security baseline detection strategy. Users do not need to modify the node operation type of the management platform due to subsequent changes in the node operating system, thereby reducing the difficulty of subsequent maintenance for users. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0014] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0015] Figure 1 is a schematic diagram showing an exemplary security baseline detection system according to an embodiment of the present disclosure.

[0016] Figure 2 is a flow chart showing an exemplary security baseline detection method according to one embodiment of the present disclosure.

[0017] Figure 3 is a flowchart illustrating an example process of performing remote security baseline detection according to one embodiment of the present disclosure.

[0018] Figure 4 is a flow chart illustrating a process performed by an exemplary security baseline detection system according to one embodiment of the present disclosure.

[0019] Figure 5 An exemplary configuration of a computing device that can implement an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0020] The following detailed description is made with reference to the accompanying drawings, and the following detailed description is provided to assist in a comprehensive understanding of the various exemplary embodiments of the present disclosure. The following description includes various details to assist in understanding, but these details are considered to be examples only and not to limit the present disclosure, which is defined by the appended claims and their equivalents. The words and phrases used in the following description are only used to enable a clear and consistent understanding of the present disclosure. In addition, for the sake of clarity and brevity, descriptions of well-known structures, functions, and configurations may be omitted. Those of ordinary skill in the art will recognize that various changes and modifications may be made to the examples described herein without departing from the spirit and scope of the present disclosure.

[0021] Figure 1 is a schematic diagram showing an exemplary security baseline detection system according to an embodiment of the present disclosure. Figure 1It is worth noting that the following description includes a large number of unnecessary details, and those skilled in the art may choose to discard these details as needed.

[0022] like Figure 1 As shown, the security baseline detection system includes a management platform and multiple users. Each user can include one or more user nodes. These user nodes can be, for example, personal digital assistants, tablet computers, handheld computers, servers, etc. These user nodes can use various operating systems, such as Windows, Linux, DOS, OS / 2, UNIX, etc.

[0023] like Figure 1 As shown, the management platform itself can be a server, a computing device, etc., or a management module on the network side. The management platform includes at least a processor and a memory. The memory stores instructions. The processor is configured to execute the instructions stored on the memory to perform the processing of the present invention.

[0024] The user registers the node with the management platform through the registration portal provided by the management platform. The management platform generates detection tasks for the registered users and puts them into the task queue. The task queue can be a data structure in any known format, which can be stored in the memory. The management platform can generate a task queue for each user, or a task queue for multiple users or all users, depending on the specific implementation requirements.

[0025] The management platform distributes tasks, connects nodes in the form of task processes, automatically identifies the system through polling in combination with the characteristics of the operating system, establishes communication channels with user nodes, and calls the node kernel process to perform baseline detection. The entire process does not require the installation of a client (baseline detection engine).

[0026] The platform can provide analysis and visualization based on the security baseline of users (with one or more nodes), making it easier for users to manage and analyze the security of multiple nodes and simplify the process with one-click operation.

[0027] An exemplary embodiment according to the present invention is given below.

[0028] The user first registers and logs in on the detection service platform, enters the multi-node address for baseline detection, and applies for the security baseline detection service.

[0029] The management platform generates a task set for each user based on the detection service declared by the user and puts it into the task queue.

[0030] The task scheduling module of the management platform distributes tasks and assigns independent processes to user tasks. Each user is assigned a process independent of other users to perform all security baseline detection tasks for that user.

[0031] Figure 3 FIG. 1 is a flowchart showing an example process of performing remote security baseline detection according to an embodiment of the present disclosure. Figure 3 As shown in the figure, the management platform automatically identifies the operating system. Due to the difference in the remote communication mechanisms of Windows and Linux, the remote communication of Windows system uses the winrm module, and Linux uses the ssh module. In order to achieve the function of automatic identification, it attempts to communicate with the nodes in turn in the task process, executes the communication instructions in turn, and achieves the purpose of automatic identification of the system according to the execution instruction process.

[0032] When a detection task needs to be performed on a node, it is no longer necessary to install an engine on the node to collect relevant data. Instead, the corresponding commands and parameters are called from the corresponding database on the platform to remotely perform the detection and obtain the baseline data.

[0033] The platform can classify baseline detection into four categories according to accounts, passwords, permissions, and log audits. According to Linux and Windows systems, the detection commands, related parameters, defined types, thresholds and other parameters corresponding to each detection item under the four categories are classified separately, and together with the execution strategy, they form a corresponding command database. Specific examples are as follows:

[0034] 1. When the determination node uses the Linux system, a basic example of the process of executing the baseline detection is as follows: first, the command (command) and parameters (params) of the detection item set of the Linux system type are taken out from the account (account) command library (such as: remote login timeout limit (login_timeout) indicator item...), and the corresponding data set is formed. The process takes out the data, remotely executes the command and obtains the detection result value; then the baseline detection items of the password (password) command library are executed (such as: password maximum life cycle (pwd_max_cycle)...) The data set composed of related commands and parameters, remotely executes the detection and obtains the result value; after completing the password detection, the baseline detection of the permission (permission) command library is executed (such as: root remote login permission (permit_root_login), calling the data set composed of parameters such as PermitRootLogin no), remotely executes the detection and obtains the result value; finally, the baseline detection of the log is executed, the cat command is selected, and the detection is performed remotely in combination with the related component data sets. For all the test data obtained, the data is cleaned in turn according to the security baseline category, the obtained results are compared with the corresponding thresholds, and compliance processing is performed, and then the data results are stored.

[0035] 2. When the determination node uses the Windows system, the called commands and parameters are different, but the process processing is similar. For example, the detection of account is started (such as the command (command) and parameters (params) of the indicator item of account lockout time (lockout_duration), and the threshold (threshold) and data type (type) of the item are obtained from the threshold library, and a data set is synthesized. The process takes out the command and parameters to synthesize the final command statement, and the command is remotely executed to obtain the detection result value); then the baseline detection item of the password command library is executed, taking the password complexity requirement (pwd_complexity) as an example, the relevant commands, parameters and thresholds are also taken out to form a data set, the process calls the command containing the data set, and the command is remotely executed to obtain the detection result value; for the baseline detection item of the permission command library, taking the remote user to modify the registry settings of the current computer (remote_registry) as an example, the relevant data is also taken out, and the command is remotely executed to obtain the detection result value; for the detection of windows log (record) type, taking the login record detection as an example, Get-EventLog–List, Security and other related commands and parameters are used to combine into a data set, and the detection result value is obtained by remotely executing the command. For all the test data obtained, the data is cleaned in turn according to the security baseline category, the obtained results are compared with the corresponding thresholds, and compliance processing is performed, and then the data results are stored.

[0036] Then, the management platform determines whether the task process has completed the detection of all nodes to which the user belongs. If so, it proceeds to the next step of the process; if not, it continues the detection.

[0037] Finally, the backend of the management platform uniformly classifies, analyzes and processes the user's multi-node baseline detection data according to the established rules, and the front end of the platform displays it based on user granularity.

[0038] Figure 2 is a flow chart showing an exemplary security baseline detection method 200 according to one embodiment of the present disclosure.

[0039] The process starts at step 201. At this step, a security baseline detection task is generated for each node of the user based on node registration information received from the user, wherein the node registration information includes address information of each node of the user.

[0040] Optionally, the process may also establish a task queue for each user to store all security baseline detection tasks of the user.

[0041] At step 202, using the address information of the node, an attempt is made to establish a remote communication channel with the node by adopting the remote communication mechanisms provided by various operating systems in turn.

[0042] Optionally, the present process may also allocate a security baseline detection process independent of other users to each user for executing all security baseline detection tasks of the user.

[0043] At step 203, the operating system used by the node is determined according to the remote communication mechanism used to successfully establish the remote communication channel with the node.

[0044] The determination can be achieved by: when a remote communication channel is successfully established with a node using the winrm module provided by the windows operating system, it is determined that the node uses the windows operating system; and when a remote communication channel is successfully established with a node using the ssh module provided by the linux operating system, it is determined that the node uses the linux operating system.

[0045] At step 204, for the security baseline detection task of each node, via the successfully established remote communication channel, a remote detection process corresponding to the determined operating system is called to obtain detection data from the node.

[0046] For example, the remote detection process may perform account indicator detection, password indicator detection, permission indicator detection, and log indicator detection, as well as other required detections.

[0047] Optionally, the process may also include: classifying, analyzing and processing the acquired detection data; and displaying the processed data to the user on a user interface.

[0048] In order to explain the present invention in more detail, the following reference Figure 4 An exemplary security baseline detection method according to the present invention is described in detail. It is worth noting that the following description includes a large number of unnecessary details, and those skilled in the art may choose to discard these details as needed.

[0049] Figure 4 is a flow chart illustrating a process performed by an exemplary security baseline detection system according to one embodiment of the present disclosure.

[0050] At step 401, the user registers and logs in on the detection service management platform, enters the address of the multi-node server for baseline detection, and applies for the security baseline detection service.

[0051] At step 402, the management platform generates a task set for the user based on the detection service declared by the user and puts it into the task queue.

[0052] In step 403, the task scheduling module of the management platform distributes tasks and assigns independent processes to user tasks.

[0053] At step 404, a communication channel is established, and the operating system is automatically identified. Due to the difference in remote communication mechanisms between Windows and Linux, the remote communication of Windows system uses the winrm module, and Linux uses the ssh module. In order to achieve the function of automatic identification, communication with the nodes is attempted in turn in the task process, and communication instructions are executed in turn, and the purpose of automatic identification of the system is achieved according to the execution instruction flow.

[0054] At step 405, when a detection task needs to be performed on a node, the engine is no longer installed on the node to collect relevant data, but the corresponding commands and parameters are called from the corresponding database on the platform to remotely perform the detection and obtain the baseline data. The platform can classify the baseline detection into four categories according to account, password, authority, and log audit. According to the Linux system and Windows system, the detection commands, related parameters, defined types, thresholds and other parameters corresponding to each detection item under the four categories are classified separately, and together with the execution strategy, they form a corresponding command database.

[0055] At step 406, it is determined whether the task process has completed the detection of all nodes to which the user belongs. If so, the process proceeds to step 407; if not, the process proceeds to step 408.

[0056] At step 408 , the management platform continues detection.

[0057] At step 409, the management platform backend uniformly categorizes, analyzes and processes the user's multi-node baseline detection data according to the established rules, and the platform frontend displays it based on user granularity.

[0058] Compared with the prior art, the present invention has one or more of the following advantages:

[0059] 1. The integration of multiple operating system security baseline solutions can automatically determine the target node system and execute the corresponding detection solution for the target system.

[0060] 2. The remote call mode is used for baseline data collection, which changes the common server-client mode of baseline collection. The platform uses the task process to communicate remotely with the node host, and the remote connection service of the node system itself executes the detection command of the security baseline detection, thereby achieving the purpose of detection without the need to install the client engine in each node in advance.

[0061] 3. The definition of all execution operations is completed on the server side. The channel is only opened during the collection time and closed after the detection is completed. The process only takes a dozen seconds and will not occupy user resources for a long time. It will not cause excessive interference to user nodes. In addition, the remote service module of the system itself is called, and there is no need to install specific communication software on the node system. It takes up less time and fewer resources, eliminating the user's concerns about resource occupation and security.

[0062] Figure 5 An exemplary configuration of a computing device 1200 capable of implementing embodiments according to the present disclosure is shown.

[0063] The computing device 1200 is an example of a hardware device to which the above aspects of the present disclosure can be applied. The computing device 1200 can be any machine configured to perform processing and / or computing. The computing device 1200 can be, but is not limited to, a workstation, a server, a desktop computer, a laptop computer, a tablet computer, a personal data assistant (PDA), a smart phone, a vehicle-mounted computer, or a combination thereof.

[0064] like Figure 5 As shown, the computing device 1200 may include one or more components that may be connected or communicated with the bus 1202 via one or more interfaces. The bus 2102 may include, but is not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus. The computing device 1200 may include, for example, one or more processors 1204, one or more input devices 1206, and one or more output devices 1208. The one or more processors 1204 may be any type of processor and may include, but is not limited to, one or more general-purpose processors or special-purpose processors (such as special-purpose processing chips). The processor 1202 may correspond to, for example, Figure 1 The processor in the management platform in is configured to implement the security baseline detection method according to the present invention. The input device 1206 can be any type of input device capable of inputting information to the computing device, and can include but is not limited to a mouse, a keyboard, a touch screen, a microphone and / or a remote controller. The output device 1208 can be any type of device capable of presenting information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator and / or a printer.

[0065] The computing device 1200 may also include or be connected to a non-transitory storage device 1214, which may be any non-transitory storage device that can implement data storage, and may include, but is not limited to, a disk drive, an optical storage device, a solid-state memory, a floppy disk, a flexible disk, a hard disk, a tape, or any other magnetic medium, a compressed disk or any other optical medium, a cache memory, and / or any other storage chip or module, and / or any other medium from which a computer can read data, instructions, and / or code. The computing device 1200 may also include a random access memory (RAM) 1210 and a read-only memory (ROM) 1212. The ROM 1212 may store programs, utilities, or processes to be executed in a non-volatile manner. The RAM 1210 may provide volatile data storage and store instructions related to the operation of the computing device 1200. The computing device 1200 may also include a network / bus interface 1216 coupled to a data link 1218. The network / bus interface 1216 may be any type of device or system capable of enabling communication with an external device and / or a network, and may include but is not limited to a modem, a network card, an infrared communication device, a wireless communication device, and / or a chipset (such as a Bluetooth TM equipment, 802.11 equipment, WiFi equipment, WiMax equipment, cellular communication facilities, etc.).

[0066] The present disclosure includes the use of software, applications, computer programs, or algorithms. The software, applications, computer programs, or algorithms may be stored on a non-transitory computer-readable medium to enable a computer such as one or more processors to perform the above steps and the steps described in the accompanying drawings. For example, one or more memories store the software or algorithm in executable instructions, and one or more processors may associate a set of instructions to execute the software or algorithm to provide various functions according to the embodiments described in the present disclosure.

[0067] Software and computer programs (which may also be referred to as programs, software applications, applications, components or code) include machine instructions for a programmable processor and may be implemented in a high-level procedural language, an object-oriented programming language, a functional programming language, a logic programming language, or an assembly language or a machine language. The term "computer-readable medium" refers to any computer program product, apparatus or device for providing machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories and programmable logic devices (PLDs), including computer-readable media that receive machine instructions as computer-readable signals.

[0068] For example, computer readable media may include dynamic random access memory (DRAM), random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to carry or store the desired computer readable program code in the form of instructions or data structures and can be accessed by a general or special purpose computer or a general or special purpose processor. As used herein, disk or disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically by laser. Combinations of the above are also included in the scope of computer readable media.

[0069] The subject matter of the present disclosure is provided as an example of devices, systems, methods and programs for performing the features described in the present disclosure. However, in addition to the above-mentioned features, other features or variations may also be expected. It is expected that the implementation of the components and functions of the present disclosure may be completed with any emerging technology that may replace any of the above-mentioned implementation technologies.

[0070] In addition, the above description provides examples without limiting the scope, applicability or configuration set forth in the claims. Without departing from the spirit and scope of the present disclosure, the functions and arrangements of the elements discussed may be changed. Various embodiments may appropriately omit, replace or add various processes or components. For example, features described with respect to certain embodiments may be combined in other embodiments.

[0071] In addition, in the description of the present disclosure, the terms “first”, “second”, “third”, etc. are used for descriptive purposes only and cannot be understood as indicating or implying relative importance and order.

[0072] Similarly, while operations are depicted in a particular order in the drawings, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed to achieve desired results. In certain circumstances, multitasking and parallel processing can be advantageous.

Claims

1. A security baseline detection method, include: Based on the node registration information received from the user, generating a security baseline detection task for each node of the user, wherein the node registration information includes address information of each node of the user; Using the address information of the node, try to establish a remote communication channel with the node by adopting the remote communication mechanisms provided by each operating system in turn; Determine the operating system used by the node based on the remote communication mechanism used to successfully establish a remote communication channel with the node; as well as For the security baseline detection task of each node, a remote detection process corresponding to the determined operating system is called via the successfully established remote communication channel to obtain detection data from the node.

2. The method according to claim 1, in, Determine the operating system used by the node: When a remote communication channel is successfully established with a node using a winrm module provided by the windows operating system, it is determined that the node uses the windows operating system; and When a remote communication channel is successfully established with a node using the ssh module provided by the Linux operating system, it is determined that the node uses the Linux operating system.

3. The method according to claim 1, further comprising: include: A security baseline detection process independent of other users is allocated to each user to execute all security baseline detection tasks of the user.

4. The method according to claim 1, in, The remote detection process performs account indicator detection, password indicator detection, permission indicator detection and log indicator detection.

5. The method according to claim 1, further comprising: include: Classify, analyze and process the acquired test data; as well as The processed data is displayed to the user on the user interface.

6. The method according to claim 1, further comprising: include: A task queue is established for each user to store all security baseline detection tasks of the user.

7. A safety baseline detection device, include: a memory having instructions stored therein; as well as A processor configured to execute instructions stored on the memory to perform the method according to any one of claims 1 to 6.

8. A computer-readable storage medium comprising computer-executable instructions, which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 6.

Images