Cloud intranet asset network security management method, device and storage medium

Abstract

The present application discloses a network security management method, device and storage medium. A network security management method includes: generating a detection data packet for performing a detection task in an intranet; establishing a communication tunnel with a tunnel client of a host deployed in the intranet; and sending the detection data packet to the tunnel client through the communication tunnel.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security management method, device and storage medium. Background Art

[0002] With the popularization of the concept of Internet+, various network devices and tools are constantly updated, the most typical of which are smart home of Internet+home, smart factory of Internet+factory, online education of Internet+education and remote office of Internet+office. In essence, they are all composed of several intranets, and each device or tool constitutes a network node in the intranet, making people's life, study and work more and more closely integrated with the network, while also bringing new challenges to network security. Therefore, how to detect the intranet lightly, quickly and accurately is a prerequisite for security management work such as discovering network vulnerabilities and conducting threat analysis, which is of great significance to protecting people's property safety, building network security and national security.

[0003] Existing network detection methods can be summarized into at least the following categories:

[0004] 1) Client / server-based detection method: Deploy the client on a host in the internal network and deploy the server in the external network. Establish network communication between the client and the server. The server sends the detection task to the client. After the client completes the task, it returns the result to the server, and the result is stored in the server's database.

[0005] 2) Proxy-based detection method: deploy a proxy server in the intranet, deploy the scanning client on the proxy server, connect the proxy server to the remote server, send the detection task to the proxy server, the proxy server forwards the task to the client, and the client returns the result to the proxy server after completing the detection task. The proxy server then forwards it to the server, and the server stores the result in the database or further presents it on the Web front end.

[0006] However, in the above-mentioned network detection method, when detecting the intranet, the client needs to detect the intranet according to the detection task, so the client is deployed with multiple execution modules for executing the detection task, which causes the problem of excessive load on the client.

[0007] With respect to the technical problem in the prior art that the client is overloaded when detecting an intranet, no effective solution has been proposed yet. Summary of the invention

[0008] The embodiments of the present application provide a network security management method, device and storage medium to at least solve the technical problem existing in the prior art that the client is overloaded when detecting an intranet.

[0009] According to one aspect of an embodiment of the present application, a network security management method is provided, including: generating a detection data packet for performing a detection task in an intranet; establishing a communication tunnel with a tunnel client of a host deployed in the intranet; and sending the detection data packet to the tunnel client through the communication tunnel.

[0010] According to another aspect of an embodiment of the present application, a network security management method is also provided, including: establishing a communication tunnel with the cloud through a pre-deployed tunnel client; receiving a detection data packet sent by the cloud through the communication tunnel, wherein the detection data packet is used to perform a detection task in the intranet; and performing a detection task in the intranet according to the detection data packet.

[0011] According to another aspect of an embodiment of the present application, a storage medium is further provided, the storage medium including a stored program, wherein when the program is running, a processor executes any one of the methods described above.

[0012] According to another aspect of an embodiment of the present application, a network security management device is also provided, including: a data packet generation module, used to generate a detection data packet for performing a detection task in an intranet; a first establishment module, used to establish a communication tunnel with a tunnel client of a host deployed in the intranet; and a data packet sending module, used to send the detection data packet to the tunnel client through the communication tunnel.

[0013] According to another aspect of an embodiment of the present application, a network security management device is also provided, including: a second establishment module, used to establish a communication tunnel with the cloud through a pre-deployed tunnel client; a data packet receiving module, used to receive a detection data packet sent by the cloud through the communication tunnel, wherein the detection data packet is used to perform a detection task in the intranet; and a task execution module, used to perform a detection task in the intranet according to the detection data packet.

[0014] According to another aspect of an embodiment of the present application, a network security management device is also provided, including: a first processor; and a first memory, connected to the first processor, for providing the first processor with instructions for processing the following processing steps: generating a detection data packet for performing a detection task in an intranet; establishing a communication tunnel with a tunnel client of a host deployed in the intranet; and sending a detection data packet to the tunnel client through the communication tunnel.

[0015] According to another aspect of an embodiment of the present application, a network security management device is also provided, including: a second processor; and a second memory, connected to the second processor, for providing the second processor with instructions for processing the following processing steps: establishing a communication tunnel with the cloud through a pre-deployed tunnel client; receiving a detection data packet sent by the cloud through the communication tunnel, wherein the detection data packet is used to perform a detection task in the intranet; and performing a detection task in the intranet according to the detection data packet.

[0016] In an embodiment of the present application, a tunnel server deployed at the tunnel layer of the cloud and a tunnel client deployed by a host in the intranet establish a communication tunnel. The cloud generates a corresponding detection data packet according to the detection task of detecting the intranet, and the detection data packet can be sent to the host through the communication tunnel, thereby detecting the security status of the intranet. Thus, the technical solution transmits the detection data packet through the communication tunnel, and the communication tunnel only performs the operation of forwarding the detection data packet, which can avoid the problem of IP exposure when the client and the server communicate in the network in the prior art, thereby improving the security of the transmission. In addition, the tunnel client in the technical solution is responsible for managing the communication tunnel, and forwarding the detection data packet to other devices can realize the operation of detecting the intranet, avoiding the situation in the prior art that multiple execution modules are set in the client to detect the intranet, realizing a lightweight tunnel client, reducing deployment costs, and reducing load. Thus, the technical problem of excessive load on the client when detecting the intranet in the prior art is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a hardware structure block diagram of a computing device for implementing the method according to Embodiment 1 of the present application;

[0019] Figure 2 is a schematic diagram of a network security management system according to Embodiment 1 of the present application;

[0020] Figure 3 is a flowchart of a network security management method according to the first aspect of Embodiment 1 of the present application;

[0021] Figure 4 This is a schematic diagram of the overall process of the network security management method according to Example 1 of the present application;

[0022] Figure 5 is a flowchart of a network security management method according to the second aspect of Embodiment 1 of the present application;

[0023] Figure 6 is a schematic diagram of a network security management device according to the first aspect of Embodiment 2 of the present application;

[0024] Figure 7 is a schematic diagram of a network security management device according to the second aspect of Embodiment 2 of the present application;

[0025] Figure 8 is a schematic diagram of a network security management device according to the first aspect of Embodiment 3 of the present application; and

[0026] Fig. 9 It is a schematic diagram of the network security management device described in the second aspect of Example 3 of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only embodiments of a part of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] First, some nouns or terms that appear in the process of describing the embodiments of the present disclosure are subject to the following explanations:

[0030] VPN: Virtual Private Network, a private network built on the public Internet for encrypted communications. VPN is a remote access technology that solves the problem of external network access to the internal network. VPN gateways achieve remote access by encrypting data packets and converting the destination address of data packets. VPN can be implemented in a variety of ways, such as servers, hardware, and software.

[0031] Example 1

[0032] According to this embodiment, a method embodiment of a network security management method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] The method embodiment provided in this embodiment can be executed in a mobile terminal, a computer terminal, a server or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computing device for implementing a network security management method. Figure 1 As shown, the computing device may include one or more processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory for storing data, and a transmission device for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0034] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computing device. As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0035] The memory can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the network security management method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, the network security management method of the above-mentioned application is realized. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computing device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0036] The transmission device is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computing device. In one example, the transmission device includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly.

[0037] The display may be, for example, a touch screen liquid crystal display (LCD) that may enable a user to interact with a user interface of the computing device.

[0038] It should be noted that, in some optional embodiments, the above Figure 1 The computing device shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of both hardware elements and software elements. Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computing devices described above.

[0039] Figure 2 Schematic diagram of a network security management system according to this embodiment. Figure 2 As shown, the system includes: a host 110 deployed in an intranet 100 and a cloud 200. The host 110 includes a tunnel client 111 and a web client 112. The cloud 200 includes a cloud layer, a scheduling layer, a task layer and a tunnel layer. The cloud layer is deployed with a cloud server 210, the scheduling layer is deployed with a scheduling server 220, the task layer is deployed with a task execution server 230, and the tunnel layer is deployed with a tunnel server 240.

[0040] The web client 112 communicates with the cloud server 210 , sends a task request for detecting the intranet 100 to the cloud server 210 , and receives and displays the detection result related to the task request returned by the cloud server 210 .

[0041] The cloud server 210 generates a detection task for detecting the intranet 100 according to the task request, and sends the detection task to the scheduling server 220. The cloud server 210 stores the detection result returned by the scheduling server 220.

[0042] The scheduling server 220 splits the received detection tasks and schedules the split detection tasks to the task execution server 230 , and summarizes the detection results returned by the task execution server 230 , and sends the summarized detection results to the cloud server 210 .

[0043] The task execution server 230 generates a detection data packet according to the detection task, and sends the detection data packet to the tunnel server 240 , and receives the detection result returned by the tunnel server 240 , and sends the detection result to the scheduling server 220 .

[0044] The tunnel server 240 communicates with the tunnel client 111 through the communication tunnel, and is used to send a detection data packet to the tunnel client 111. The tunnel client 111 uses the detection data packet to obtain a detection result about the intranet 100, and returns the detection result to the tunnel server 240. The tunnel server 240 returns the detection result to the execution server 240.

[0045] It should be noted that when the web client 112 on the host 110 sends a task request for detecting the intranet 100 to the cloud server 210, it will detect whether the host 110 has installed the tunnel client 111. When the web client detects that the tunnel client 111 is not installed on the host 110, it will automatically install the tunnel client 111 on the host 110. The task request is generated by the user's operation on the subscription function of the web client 112, for example, the user checks the functions he needs, such as asset detection, vulnerability detection and threat analysis, etc.

[0046] It should be noted that the host 110 and the cloud 200 in the system can both be applicable to the hardware structure described above.

[0047] Under the above operating environment, according to the first aspect of this embodiment, a network security management method is provided. Figure 2 The cloud 200 shown in is implemented. Figure 3 A schematic diagram showing the process of the method is shown in FIG. Figure 3 As shown, the method includes:

[0048] S302: Generate a detection data packet for performing a detection task in the intranet;

[0049] S304: Establishing a communication tunnel with a tunnel client of a host deployed in the intranet; and

[0050] S306: Send a detection data packet to the tunnel client through the communication tunnel.

[0051] Specifically, the host 110 is deployed in the intranet 100, and a web client 112 is provided on the host 110, and the web client 112 is provided with a "subscription" function. The user selects functions such as asset detection, vulnerability detection and threat analysis in the "subscription" page through the web client 112, thereby detecting the security status of the intranet 100. After that, the web client sends the task request for detecting the intranet 100 related to the subscription function to the cloud 200. Among them, each function in the "subscription" page can generate a task request for a detection task respectively. For example, the "asset detection" function can generate a task request, the "vulnerability detection" function can generate a task request, and the "threat analysis" function can generate another task request.

[0052] Furthermore, after receiving the task request of the detection task, the cloud 200 generates a detection data packet according to the detection task, wherein the detection data packet includes data such as a target address, a source address, and a detection command.

[0053] Further, when the user detects the intranet 100 through the "subscribe" function of the web client 112, the web client 112 will install the tunnel client 111 on the host 110, and then the tunnel client 111 sends a request to establish a communication tunnel to the tunnel server 240 deployed in the tunnel layer of the cloud 200, and the tunnel server 240 responds to the request and establishes a communication tunnel with the tunnel client 111. The communication tunnel is used for the tunnel client 111 and the tunnel server 240 to transmit data packets to each other. And the communication tunnel is an encrypted communication tunnel.

[0054] Furthermore, the tunnel server 240 sends the generated detection data packet to the tunnel client 111 through the communication tunnel. After receiving the detection data packet, the tunnel client 111 forwards the detection data packet to the router, and the router forwards the detection data packet to other modules of the host 110, and then the host 110 detects the intranet according to the detection command of the detection data packet.

[0055] As described in the background technology, in the existing network detection method, when detecting the intranet, the client needs to detect the intranet according to the detection task, so the client is deployed with multiple execution modules for executing the detection task, which causes the problem of excessive load on the client.

[0056] In view of the technical problems described above, through the technical solution of the embodiment of the present application, a tunnel server deployed at the tunnel layer of the cloud and a tunnel client deployed by a host in the intranet establish a communication tunnel, and the cloud generates a corresponding detection data packet according to the detection task of detecting the intranet, and the detection data packet can be sent to the host through the communication tunnel, thereby detecting the security status of the intranet. Thus, the technical solution transmits the detection data packet through the communication tunnel, and the communication tunnel only performs the operation of forwarding the detection data packet, which can avoid the problem of IP exposure when the client and the server communicate in the network in the prior art, thereby improving the security of the transmission. In addition, the tunnel client in the technical solution is responsible for managing the communication tunnel, and forwarding the detection data packet to other devices can realize the operation of detecting the intranet, avoiding the situation in the prior art that multiple execution modules are set in the client to detect the intranet, realizing a lightweight tunnel client, reducing the deployment cost, and reducing the load. Thus, the technical problem of excessive load on the client when detecting the intranet in the prior art is solved.

[0057] Optionally, the method also includes: receiving a task request related to the detection task from the host through a cloud server deployed in the cloud layer; and splitting the detection task through a scheduling server belonging to the scheduling layer, and scheduling the split detection task to the task execution server of the task layer.

[0058] Specifically, refer to Figure 2 As shown, the cloud layer of the cloud 200 is deployed with a cloud server 210, and the web client 112 of the host 110 sends a task request related to the detection task to the cloud server 210. After receiving the task request, the cloud server 210 records the detection task and generates a task list. The task list may include multiple detection tasks. After that, the cloud server 210 sends the task list to the scheduling server 220 deployed in the scheduling layer.

[0059] Furthermore, the cloud 200 can divide the detection tasks for detecting the intranet 100 into two types according to the correlation of the detection tasks, including independent tasks and associated tasks. Among them, independent tasks have no correlation with other detection tasks, and will not be affected by other detection tasks during execution, nor will they affect the execution of other detection tasks, and independent tasks can be executed in parallel with other detection tasks. And the associated tasks will more or less affect other detection tasks or be affected by other detection tasks, and they can only be executed in series.

[0060] After receiving the task list, the scheduling server 220 generates a correlation matrix corresponding to the multiple detection tasks according to the priority order and correlation of the multiple detection tasks in the task list, wherein the priority of each detection task and the correlation between each detection task are preset by the administrator.

[0061] For example, there are n detection tasks in the task list, namely T1, T2, ..., T n . Set T1, T2, ..., T n Arrange in descending order of priority, so as to schedule the server 220 to perform the detection tasks T1 to T2. n The correlation matrix generated by the correlation between the two is:

[0062]

[0063] Among them, t ij (i, j = 1, 2, ..., n) represents the detection task T i With the detection task T j The correlation between them. The generation of the correlation matrix includes the following rules:

[0064] 1) The detection tasks for generating the association matrix are arranged in descending order of priority;

[0065] 2) The elements in the incidence matrix are -1, 0 or 1, and the elements on the diagonal are all 1;

[0066] 3) If the detection task T a With T b The correlation degree is 1, then the detection task T b With T a The correlation degree is -1; if the detection task T a With T b The correlation degree is -1, then the detection task T b With T a The correlation degree is 1; if the detection task T a With T b The correlation degree is 0, then the detection task T b With T a The correlation degree is also 0;

[0067] 4) If the detection task T a With T b The correlation degree is 1, which means that the detection task T a Prior to the detection task T b Execute; if the detection task T a With T b The correlation degree is 0, indicating that the detection task T a With T b Do not affect each other; if the detection task T a With T b The correlation degree is -1, which means that the detection task T b Prior to the detection task T a implement.

[0068] For example, there are four detection tasks T1 to T4 in the task list. The scheduling server 220 generates a correlation matrix T based on the correlation between the detection tasks T1 to T4:

[0069]

[0070] For example, the correlation between the preset detection tasks T1 to T4 includes: the correlation between T1 and T2 is 0, the correlation between T1 and T3 is 1, the correlation between T1 and T4 is -1, the correlation between T2 and T3 is 1, the correlation between T2 and T4 is 1, the correlation between T3 and T4 is -1, and so on, so that the generated correlation matrix T is:

[0071]

[0072] And the detection tasks T1 to T4 are arranged in descending order of priority: T2, T4, T1 and T3. That is, T2 has the highest priority and T3 has the lowest priority. The priority vector of detection tasks T1 to T4 for:

[0073]

[0074] The priority vectors of T1 to T4 correspond to p1 to p4 respectively. Thus, the scheduling server 220 obtains the preset priorities of T2, T4, T1 and T3, which are 1, 2, 3 and 4 respectively. That is, T2 has the highest priority and T3 has the lowest priority. Therefore, the priority vectors of detection tasks T1 to T4 are for:

[0075]

[0076] The scheduling server 220 then calculates the correlation matrix T and the priority vector The dot product between them gives the scheduling vector

[0077]

[0078] Among them, the scheduling vector 0, 9, -4, and 6 in the table correspond to T2, T4, T1, and T3, respectively. Afterwards, the scheduling server 220 will first schedule the vector Select the detection task with the same value as its priority, and then check the correlation matrix T to see if the detection task is really unrelated to other detection tasks. If so, remove the detection task from the scheduling vector Removed.

[0079] Then the scheduling server 220 will schedule the vector As the execution order of detection tasks T1 to T4, scheduling is performed. That is, the scheduling vector Sorting in descending order, we get 9>6>0>-4, which is consistent with the scheduling vector The execution order of the corresponding detection tasks T1-T4 is T4, T3, T2, T1. Therefore, the scheduling server 220 schedules the detection tasks T1-T4 to the task execution server 230 of the task layer according to the execution order of the detection tasks.

[0080] Therefore, the technical solution sends the detection task to the scheduling server through the cloud server, and then the scheduling server generates a reasonable execution order between multiple detection tasks based on the correlation and priority of the detection tasks. Therefore, according to the execution order, the execution efficiency of multiple detection tasks can be improved and the load can be reduced during execution.

[0081] Optionally, the operation of generating a detection data packet for executing a detection task in an intranet includes: generating the detection data packet according to the detection task through a task execution server; and sending the detection data packet to a tunnel server of a tunnel layer through the task execution server.

[0082] Specifically, after receiving the detection tasks T1-T4 sent by the scheduling server 220 of the scheduling layer, the task execution server 230 of the task layer generates detection data packets for the detection tasks T1-T4 respectively, thereby obtaining detection data packets P1-P4. The detection data packets generated by different detection tasks are also different. Afterwards, the task execution server 230 sends the corresponding detection data packets P1-P4 to the tunnel server 240 of the tunnel layer in sequence according to the execution order of the detection tasks T1-T4.

[0083] Therefore, the technical solution sends the detection data packets of different detection tasks to the tunnel server respectively through the task execution server, so that after the execution order of the detection tasks is generated, the detection tasks can be executed in sequence, thereby effectively executing the detection tasks and improving the practicality of the detection tasks executed in sequence.

[0084] Optionally, the operation of establishing a communication tunnel with a tunnel client of a host deployed in an intranet includes: establishing a communication tunnel with the tunnel client through a tunnel server, and sending a detection data packet to the tunnel client through the communication tunnel, including using the tunnel server to send a detection data packet to the tunnel client through the communication tunnel.

[0085] Specifically, the tunnel client 111 sends a request to establish a communication tunnel to the tunnel server 240, and the tunnel server 240 responds to the request to establish a communication tunnel with the tunnel client 111. The communication tunnel is an encrypted communication tunnel.

[0086] Further, the tunnel server 240 receives the detection data packet sent by the task execution server 230. The target address of the detection data packet sent by the task execution server 230 is the intranet address of the detected intranet 100. The tunnel server 240 then checks the detection data packet, and when it is found that the target address of the detection data packet is the intranet address, the detection data packet is encapsulated. Specifically, the tunnel server 240 encapsulates the detection data packet into a data packet whose target address is the external network address of the tunnel client 111, thereby constructing a new ordinary data packet. The target address of the ordinary data packet is the external network address of the tunnel client 111.

[0087] Afterwards, the tunnel server 240 sends the ordinary data packet to the public network, and the public network uses a router to send the ordinary data packet to the tunnel client 111 according to the target address of the ordinary data packet. Afterwards, after receiving the ordinary data packet, the tunnel client 111 detects the ordinary data packet, thereby detecting that the source address of the ordinary data packet is the address of the tunnel server 240. Afterwards, the tunnel client 111 strips off the encapsulation of the ordinary data packet to obtain the original detection data packet. Then the tunnel client 111 checks the target address of the detection data packet, and if it is found that the target address of the detection data packet is the intranet address, the detection data packet is sent to other modules of the host 110 according to the target address (i.e., the intranet address). Afterwards, the host 110 turns on the monitoring mode according to the detection data packet, thereby detecting the intranet, and obtaining detection results such as the security status of the intranet, data flow, and transmitted information.

[0088] Further, refer to Figure 4 As shown, the tunnel client 111 deployed on the host 110 returns the detection result to the tunnel server 240 through the communication tunnel, and then the tunnel server 240 sends the detection result to the task execution server 230. The returned detection result is a detection result data packet. The task execution server 230 sends the detection result to the scheduling server 220. After receiving the detection results corresponding to different detection tasks, the scheduling server 220 summarizes the detection results and then sends the summarized detection results to the cloud server 210. The cloud server 210 stores the detection results in a cloud database. The tunnel client can be, for example, a VPN client, and the corresponding tunnel server can be a VPN server.

[0089] Furthermore, the web client 111 presents the detection results in a page according to the detection results stored in the cloud server 210. The web page can export the detection results in formats such as xml, json, excel and pdf.

[0090] Therefore, the technical solution transmits the detection data packet through the encrypted communication tunnel, thereby ensuring the security of the data packet. In addition, the technical solution transmits the detection data packet for detecting the intranet through the communication tunnel, so that the intranet can be detected through the detection data packet, without creating multiple execution modules for detecting the intranet in the tunnel client, thereby realizing a lightweight tunnel client and improving the convenience of detection.

[0091] In addition, when multiple cloud servers are deployed in the cloud, the multiple cloud servers generate different types of detection tasks respectively, wherein the multiple detection tasks are used to detect the same intranet, and the task types of each detection task are different. And the cloud servers that generate different detection tasks can form a cluster.

[0092] Specifically, the detailed process of the parallel execution mechanism of detection tasks based on cloud multi-servers is as follows:

[0093] 1) After the cloud server receives the task instruction, the tunnel server will establish a communication tunnel with the intranet to be detected;

[0094] 2) When multiple cloud servers are used to detect the same intranet, a communication tunnel will be established between each cloud server and the intranet, and multiple communication tunnels will be established between the cluster and the intranet;

[0095] 3) The detection results obtained by each cloud server when detecting the intranet will be collected to the cloud in real time.

[0096] In addition, the modular function configuration of the web client encapsulates functions into tasks, and the required functions can be selected according to the needs and the cloud can execute the relevant detection tasks, and the functions can be updated iteratively. Thus, the scalability of functions is improved through modular design.

[0097] The detailed process of modular functional configuration is as follows:

[0098] 1) System administrators in the cloud perform iterative updates on functions;

[0099] 2) The web client subscribes to the cloud for required functions based on the user.

[0100] Thus, according to the first aspect of this embodiment, a tunnel server deployed at the tunnel layer of the cloud establishes a communication tunnel with a tunnel client deployed on a host in the intranet. The cloud generates a corresponding detection data packet according to the detection task of detecting the intranet, and the detection data packet can be sent to the host through the communication tunnel, thereby detecting the security status of the intranet. Thus, the technical solution transmits the detection data packet through the communication tunnel, and the communication tunnel only performs the operation of forwarding the detection data packet, which can avoid the problem of IP exposure when the client and the server communicate in the network in the prior art, thereby improving the security of transmission. In addition, the tunnel client in the technical solution is responsible for managing the communication tunnel, and forwarding the detection data packet to other devices can realize the operation of detecting the intranet, avoiding the situation in the prior art that multiple execution modules are set in the client to detect the intranet, realizing a lightweight tunnel client, reducing deployment costs, and reducing load. Thus, the technical problem of excessive load on the client when detecting the intranet in the prior art is solved.

[0101] In addition, according to a second aspect of this embodiment, a network security management method is provided, the method comprising: Figure 2 The intranet 100 shown in FIG. Figure 5 A schematic diagram showing the process of the method is shown in FIG. Figure 5 As shown, the method includes:

[0102] S502: Establishing a communication tunnel with the cloud through a pre-deployed tunnel client;

[0103] S504: receiving a detection data packet sent by the cloud through the communication tunnel, wherein the detection data packet is used to perform a detection task in the intranet; and

[0104] S506: Execute a detection task in the intranet according to the detection data packet.

[0105] Specifically, the intranet 100 is pre-deployed with a tunnel client 111, and then the tunnel client 111 sends a request to establish a communication tunnel to the tunnel server 240 deployed at the tunnel layer of the cloud 200. The tunnel server 240 responds to the request and establishes a communication tunnel with the tunnel client 111, wherein the communication tunnel is used to transmit data packets between the tunnel client 111 and the tunnel server 240.

[0106] Furthermore, the cloud 200 generates a detection data packet for detecting the intranet according to the detection task, and then the tunnel server 240 sends the generated detection data packet to the tunnel client 111 through the communication tunnel. After receiving the detection data packet, the tunnel client 111 forwards the detection data packet to the router, and the router forwards the detection data packet to other modules of the host 110, and then detects the intranet according to the detection command of the detection data packet, thereby executing the detection task.

[0107] As described in the background technology, in the existing network detection method, when detecting the intranet, the client needs to detect the intranet according to the detection task, so the client is deployed with multiple execution modules for executing the detection task, which causes the problem of excessive load on the client.

[0108] In view of the technical problems described above, through the technical solution of the embodiment of the present application, a tunnel server deployed at the tunnel layer of the cloud and a tunnel client deployed by a host in the intranet establish a communication tunnel, and the cloud generates a corresponding detection data packet according to the detection task of detecting the intranet, and the detection data packet can be sent to the host through the communication tunnel, thereby detecting the security status of the intranet. Thus, the technical solution transmits the detection data packet through the communication tunnel, and the communication tunnel only performs the operation of forwarding the detection data packet, which can avoid the problem of IP exposure when the client and the server communicate in the network in the prior art, thereby improving the security of the transmission. In addition, the tunnel client in the technical solution is responsible for managing the communication tunnel, and forwarding the detection data packet to other devices can realize the operation of detecting the intranet, avoiding the situation in the prior art that multiple execution modules are set in the client to detect the intranet, realizing a lightweight tunnel client, reducing the deployment cost, and reducing the load. Thus, the technical problem of excessive load on the client when detecting the intranet in the prior art is solved.

[0109] Optionally, the method further includes: releasing all occupied loads when the detection task is completed.

[0110] Specifically, the host 110 detects the intranet 100 according to the detection data packet and obtains the detection result, and generates a detection result data packet from the detection result. Then the tunnel client 111 returns the detection result data packet to the cloud 200 through the communication tunnel, and the cloud 200 stores the detection result, so that the detection task is completed. Then the tunnel client 111 releases all the loads it occupies, including: closing the communication tunnel to release the network resources it occupies, and releasing the memory, files, processes and other resources it occupies.

[0111] Therefore, since the detection tasks are diverse and complex, if the execution module is placed on the host, the performance of the host will be affected to a certain extent when executing the task, and even cause serious security issues such as freezing, crashing or even freezing of the host. Therefore, the lightweight deployment client in this technical solution supports the release of all the loads occupied by it after the task is completed, thereby saving operation time and reducing deployment costs.

[0112] Thus, according to the second aspect of this embodiment, a tunnel server deployed at the tunnel layer of the cloud and a tunnel client deployed by a host in the intranet establish a communication tunnel. The cloud generates a corresponding detection data packet according to the detection task of detecting the intranet, and the detection data packet can be sent to the host through the communication tunnel, thereby detecting the security status of the intranet. Thus, the technical solution transmits the detection data packet through the communication tunnel, and the communication tunnel only performs the operation of forwarding the detection data packet, which can avoid the problem of IP exposure when the client and the server communicate in the network in the prior art, thereby improving the security of the transmission. In addition, the tunnel client in the technical solution is responsible for managing the communication tunnel, and forwarding the detection data packet to other devices can realize the operation of detecting the intranet, avoiding the situation in the prior art that multiple execution modules are set in the client to detect the intranet, realizing a lightweight tunnel client, reducing the deployment cost, and reducing the load. Thus, the technical problem of excessive load on the client when detecting the intranet in the prior art is solved.

[0113] In addition, reference Figure 1 As shown, according to the third aspect of this embodiment, a storage medium is provided, wherein the storage medium includes a stored program, wherein when the program is run, a processor executes any one of the above methods.

[0114] Thus, according to this embodiment, a tunnel server deployed at the tunnel layer of the cloud and a tunnel client deployed by a host in the intranet establish a communication tunnel. The cloud generates a corresponding detection data packet according to the detection task of detecting the intranet, and the detection data packet can be sent to the host through the communication tunnel, thereby detecting the security status of the intranet. Thus, the technical solution transmits the detection data packet through the communication tunnel, and the communication tunnel only performs the operation of forwarding the detection data packet, which can avoid the problem of IP exposure when the client and the server communicate in the network in the prior art, thereby improving the security of the transmission. In addition, the tunnel client in the technical solution is responsible for managing the communication tunnel, and forwarding the detection data packet to other devices can realize the operation of detecting the intranet, avoiding the situation in the prior art that multiple execution modules are set in the client to detect the intranet, realizing a lightweight tunnel client, reducing the deployment cost, and reducing the load. Thus, the technical problem of excessive load on the client when detecting the intranet in the prior art is solved.

[0115] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0116] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0117] Example 2

[0118] Figure 6 The network security management device 600 according to the first aspect of this embodiment is shown, and the device 600 corresponds to the method according to the first aspect of embodiment 1. Figure 6 As shown, the device 600 includes: a data packet generation module 610, used to generate a detection data packet for performing a detection task in the intranet; a first establishment module 620, used to establish a communication tunnel with a tunnel client of a host deployed in the intranet; and a data packet sending module 630, used to send a detection data packet to the tunnel client through the communication tunnel.

[0119] Optionally, the device 600 also includes: a first receiving submodule, used to receive a task request related to the detection task from the host through a cloud server deployed in the cloud layer; and a task splitting submodule, used to split the detection task through a scheduling server belonging to the scheduling layer, and schedule the split detection task to the task execution server of the task layer.

[0120] Optionally, the data packet generation module 610 includes: a first generation submodule, used to generate a detection data packet according to the detection task through the task execution server; and a first sending submodule, used to send the detection data packet to the tunnel server of the tunnel layer through the task execution server.

[0121] Optionally, the first establishing module 620 includes: a first establishing submodule, used to establish a communication tunnel with the tunnel client through the tunnel server, and the data packet sending module 630 includes a second sending submodule, used to use the tunnel server to send a detection data packet to the tunnel client through the communication tunnel.

[0122] also, Figure 7 FIG. 7 shows a network security management device 700 according to the second aspect of this embodiment, and the device 700 corresponds to the method according to the second aspect of embodiment 1. Figure 7 As shown, the device 700 includes: a second establishing module 710, used to establish a communication tunnel with the cloud through a pre-deployed tunnel client; a data packet receiving module 720, used to receive a detection data packet sent by the cloud through the communication tunnel, wherein the detection data packet is used to perform a detection task in the intranet; and a task execution module 730, used to perform a detection task in the intranet according to the detection data packet.

[0123] Optionally, the device 700 further includes: a release submodule, configured to release all occupied loads when the detection task is completed.

[0124] Thus, according to this embodiment, a tunnel server deployed at the tunnel layer of the cloud and a tunnel client deployed by a host in the intranet establish a communication tunnel. The cloud generates a corresponding detection data packet according to the detection task of detecting the intranet, and the detection data packet can be sent to the host through the communication tunnel, thereby detecting the security status of the intranet. Thus, the technical solution transmits the detection data packet through the communication tunnel, and the communication tunnel only performs the operation of forwarding the detection data packet, which can avoid the problem of IP exposure when the client and the server communicate in the network in the prior art, thereby improving the security of the transmission. In addition, the tunnel client in the technical solution is responsible for managing the communication tunnel, and forwarding the detection data packet to other devices can realize the operation of detecting the intranet, avoiding the situation in the prior art that multiple execution modules are set in the client to detect the intranet, realizing a lightweight tunnel client, reducing the deployment cost, and reducing the load. Thus, the technical problem of excessive load on the client when detecting the intranet in the prior art is solved.

[0125] Example 3

[0126] Figure 8 The network security management device 800 according to the first aspect of this embodiment is shown, and the device 800 corresponds to the method according to the first aspect of embodiment 1. Figure 8 As shown, the device 800 includes: a first processor 810; and a first memory 820, which is connected to the first processor 810 and is used to provide the first processor 810 with instructions for processing the following processing steps: generating a detection data packet for performing a detection task in the intranet; establishing a communication tunnel with a tunnel client of a host deployed in the intranet; and sending a detection data packet to the tunnel client through the communication tunnel.

[0127] Optionally, the device 800 also includes: receiving a task request related to the detection task from the host through a cloud server deployed in the cloud layer; and splitting the detection task through a scheduling server belonging to the scheduling layer, and scheduling the split detection task to the task execution server of the task layer.

[0128] Optionally, the operation of generating a detection data packet for executing a detection task in an intranet includes: generating the detection data packet according to the detection task through a task execution server; and sending the detection data packet to a tunnel server of a tunnel layer through the task execution server.

[0129] Optionally, the operation of establishing a communication tunnel with a tunnel client of a host deployed in an intranet includes: establishing a communication tunnel with the tunnel client through a tunnel server, and sending a detection data packet to the tunnel client through the communication tunnel, including using the tunnel server to send a detection data packet to the tunnel client through the communication tunnel.

[0130] also, Fig. 9 The network security management device 900 according to the second aspect of this embodiment is shown, and the device 900 corresponds to the method according to the second aspect of embodiment 1. Fig. 9 As shown, the device 900 includes: a second processor 910; and a second memory 920, which is connected to the second processor 910 and is used to provide the second processor 910 with instructions for processing the following processing steps: establishing a communication tunnel with the cloud through a pre-deployed tunnel client; receiving a detection data packet sent by the cloud through the communication tunnel, wherein the detection data packet is used to perform a detection task in the intranet; and performing a detection task in the intranet according to the detection data packet.

[0131] Optionally, the device 900 further includes: releasing all occupied loads when the detection task is completed.

[0132] Thus, according to this embodiment, a tunnel server deployed at the tunnel layer of the cloud and a tunnel client deployed by a host in the intranet establish a communication tunnel. The cloud generates a corresponding detection data packet according to the detection task of detecting the intranet, and the detection data packet can be sent to the host through the communication tunnel, thereby detecting the security status of the intranet. Thus, the technical solution transmits the detection data packet through the communication tunnel, and the communication tunnel only performs the operation of forwarding the detection data packet, which can avoid the problem of IP exposure when the client and the server communicate in the network in the prior art, thereby improving the security of the transmission. In addition, the tunnel client in the technical solution is responsible for managing the communication tunnel, and forwarding the detection data packet to other devices can realize the operation of detecting the intranet, avoiding the situation in the prior art that multiple execution modules are set in the client to detect the intranet, realizing a lightweight tunnel client, reducing the deployment cost, and reducing the load. Thus, the technical problem of excessive load on the client when detecting the intranet in the prior art is solved.

[0133] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0134] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0135] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0136] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0138] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0139] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network security management method, characterized in that: include: Generate a detection data packet for performing detection tasks in the intranet; Establish a communication tunnel with the tunnel client of the host deployed on the intranet; as well as Sending the detection data packet to the tunnel client through the communication tunnel; The method further comprises: receiving a task request related to the detection task from the host through a cloud server deployed in the cloud layer; and The detection task is split by a scheduling server deployed in the scheduling layer, and the split detection task is scheduled to a task execution server in the task layer, including: The cloud server divides the detection task of detecting the intranet into independent tasks and associated tasks according to the relevance of the detection tasks, wherein the independent task has no relevance to other detection tasks, and will neither be affected by other detection tasks nor affect the execution of other detection tasks during execution, and the independent task can be executed in parallel with other detection tasks, while the associated task will affect other detection tasks or be affected by other detection tasks, and the associated tasks are executed serially; After receiving the task list, the scheduling server generates an association matrix corresponding to the multiple detection tasks according to the priority order and correlation of the multiple detection tasks in the task list, and the scheduling server schedules the detection tasks to the task execution server according to the association matrix.

2. The method according to claim 1, characterized in that The operation of generating a detection data packet for performing a detection task on the intranet includes: Generate the detection data packet according to the detection task by the task execution server; and The detection data packet is sent to the tunnel server of the tunnel layer through the task execution server.

3. The method according to claim 2, characterized in that The operation of establishing a communication tunnel with a tunnel client of a host deployed in an intranet includes: establishing the communication tunnel with the tunnel client through the tunnel server, and The operation of sending the detection data packet to the tunnel client through the communication tunnel includes using the tunnel server to send the detection data packet to the tunnel client through the communication tunnel.

Images