A safety compliance detection method, system and storage medium

Abstract

The present invention discloses a security compliance detection method, system and storage medium. The method applied to the cloud platform includes: when receiving a compliance detection task sent by a control center, using a compliance detection image to create a detection node corresponding to the tested intranet; using the detection node, using the resource connection information of the tested intranet to connect with the tested resource in the tested intranet; obtaining the security compliance detection instruction corresponding to the system version information of the tested resource through the detection node; executing the security compliance detection instruction on the tested resource through the detection node to perform security compliance detection and obtain detection information. Through the above scheme, the security of security compliance detection and the utilization rate of cloud platform resources are improved.

Description

Technical Field

[0001] The present invention relates to security detection technology in the field of communication technology, and in particular to a security compliance detection method, system and storage medium for a cloud platform. Background Art

[0002] With the rapid and multi-dimensional development of Internet business, network security incidents are also frequent in various fields, and security compliance has also become a key consideration for business development. Security compliance is the most basic security measure in security protection and is a condition that all network-connected devices must meet.

[0003] In the existing technology, for security compliance testing, it is necessary to deploy certain front-end machines to open up the network policy of the detection object. At the same time, the front-end machine communicates with the control center through the network, and it is necessary to open up the network between the two and obtain high permissions for the detection equipment. However, in the process of using the front-end machine to perform data collection or analysis, the network topology of the existing equipment will be destroyed, becoming a network weakness of the cloud platform. In addition, once the security compliance equipment has a vulnerability or is invaded, the high-authority account information stored on the device or transmitted during the communication process is at risk of being stolen, which poses certain security risks. The detection frequency of security compliance testing is generally low, and the vacancy rate of front-end machine resources is very high, wasting computing, storage, network and other resources. Summary of the invention

[0004] In order to solve the above technical problems, the present invention hopes to provide a security compliance detection method, system and storage medium, which can improve the security of security compliance detection and the utilization rate of cloud platform resources.

[0005] The technical solution of the present invention is achieved in this way:

[0006] The present invention provides a method for security compliance detection, which is applied to a cloud platform, and the method comprises:

[0007] When receiving the compliance detection task sent by the control center, use the compliance detection image to create a detection node corresponding to the intranet to be tested;

[0008] By means of the detection node, the resource connection information of the intranet to be tested is used to connect with the resource to be tested in the intranet to be tested;

[0009] Obtaining, through the detection node, a security compliance detection instruction corresponding to the system version information of the resource to be tested;

[0010] Through the detection node, the security compliance detection instruction is executed on the resource to be tested to perform security compliance detection and obtain detection information.

[0011] The present invention provides a safety compliance detection method, which is applied to a control center, and the method comprises:

[0012] Send security compliance testing tasks to the cloud platform;

[0013] Receiving encrypted detection information sent by the alarm system of the cloud platform; the encrypted detection information is obtained by the cloud platform executing the security compliance detection task;

[0014] Generate a security compliance test report based on the encrypted test information.

[0015] The present invention provides a security compliance detection method, which is applied to an image publishing device, and the method comprises:

[0016] Receive security compliance detection item information sent by the control center;

[0017] Generate security compliance detection instructions corresponding to different system version information according to the security compliance detection item information to obtain a first detection instruction set;

[0018] A first detection image is generated according to the first detection instruction set, and the first detection image is sent to a cloud platform; the cloud platform is used to determine the first detection image as a compliant detection image.

[0019] The present invention provides a safety compliance detection system, the safety compliance detection system comprising: a control center, a mirror service device and a cloud platform;

[0020] The control center is used to send security compliance detection item information to the mirroring service device;

[0021] The image service device is used to generate a compliance detection image using the security compliance detection item information, and send the compliance detection image to the cloud platform;

[0022] The cloud platform is used to create a detection node corresponding to the intranet to be tested using the compliance detection image when receiving a compliance detection task sent by the control center, and perform security compliance detection on the resources to be tested in the intranet to be tested through the detection node to obtain detection information.

[0023] The present invention provides a cloud platform, the cloud platform comprising:

[0024] A creation module is used to create a detection node corresponding to the intranet to be tested using the compliance detection image when receiving a compliance detection task sent by the control center;

[0025] A connection module, used to connect with the resource to be tested in the intranet to be tested through the detection node and using the resource connection information of the intranet to be tested;

[0026] An acquisition module, used to acquire, through the detection node, a security compliance detection instruction corresponding to the system version information of the resource to be tested;

[0027] The first processing module is used to execute the security compliance detection instruction on the resource to be tested through the detection node to perform security compliance detection and obtain detection information.

[0028] The present invention provides a cloud platform, the cloud platform comprising a first processor, a first storage device and a first communication bus;

[0029] The first communication bus is used to implement a communication connection between the first processor and the first memory;

[0030] The first processor is used to execute the first security compliance detection program stored in the first memory to implement the above-mentioned security compliance detection method applied to the cloud platform.

[0031] The present invention provides a control center, the control center comprising:

[0032] A first sending module, used to send security compliance detection tasks to the cloud platform;

[0033] A first receiving module, configured to receive encrypted detection information sent by the alarm system of the cloud platform; the encrypted detection information is obtained by the cloud platform executing the security compliance detection task;

[0034] The second processing module is used to generate a security compliance detection report based on the encrypted detection information.

[0035] The present invention provides a control center, the control center comprising a second processor, a second storage device and a second communication bus;

[0036] The second communication bus is used to realize the communication connection between the second processor and the second memory;

[0037] The second processor is used to execute the second safety compliance detection program stored in the second memory to implement the above-mentioned safety compliance detection method applied to the control center.

[0038] The present invention provides an image publishing device, the image publishing device comprising:

[0039] A second receiving module is used to receive the safety compliance detection item information sent by the control center;

[0040] A third processing module is used to generate security compliance detection instructions corresponding to different system version information according to the security compliance detection item information to obtain a first detection instruction set;

[0041] The second sending module generates a first detection image according to the first detection instruction set, and sends the first detection image to the cloud platform; the cloud platform is used to determine the first detection image as a compliant detection image.

[0042] The present invention provides a mirror image publishing device, which includes: a third processor, a third storage device and a third communication bus;

[0043] The third communication bus is used to realize the communication connection between the third processor and the third memory;

[0044] The third processor is used to execute the third security compliance detection program stored in the third memory to implement the above-mentioned security compliance detection method applied to the image publishing device.

[0045] The present invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned security compliance detection method.

[0046] The present invention provides a method, system and storage medium for security compliance detection. The security compliance detection method applied to a cloud platform includes: upon receiving a compliance detection task sent by a control center, creating a detection node corresponding to an intranet to be tested using a compliance detection mirror; connecting with the resources to be tested in the intranet to be tested using the resource connection information of the intranet to be tested through the detection node; obtaining a security compliance detection instruction corresponding to the system version information of the resources to be tested through the detection node; executing the security compliance detection instruction on the resources to be tested through the detection node to perform security compliance detection and obtain detection information. The technical solution provided by the present invention, upon receiving a compliance detection task sent by a control center, creates a detection node to implement security compliance detection using the detection node, which not only improves the utilization rate of cloud platform resources, but also the detection node does not establish direct network communication with the external network, thereby improving the security of security compliance detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A schematic diagram of a safety compliance detection method provided by an embodiment of the present invention Figure 1 ;

[0048] Figure 2 A schematic diagram of a safety compliance detection method provided by an embodiment of the present invention Figure 2 ;

[0049] Figure 3 A schematic diagram of a safety compliance detection method provided by an embodiment of the present invention Figure 3 ;

[0050] Figure 4 A schematic diagram of a safety compliance detection method provided by an embodiment of the present invention Figure 4 ;

[0051] Figure 5 A schematic diagram of an exemplary safety compliance detection system provided by an embodiment of the present invention;

[0052] Figure 6 A schematic diagram of a cloud platform structure provided by an embodiment of the present invention Figure 1 ;

[0053] Figure 7 A schematic diagram of a cloud platform structure provided by an embodiment of the present invention Figure 2 ;

[0054] Figure 8 A schematic diagram of a control center structure provided by an embodiment of the present invention Figure 1 ;

[0055] Fig. 9 A schematic diagram of a control center structure provided by an embodiment of the present invention Figure 2 ;

[0056] Fig.10 A schematic diagram of the structure of a mirror service device provided by an embodiment of the present invention Figure 1 ;

[0057] Fig.11 A schematic diagram of the structure of a mirror service device provided by an embodiment of the present invention Figure 2 . DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0059] In the present invention, the security compliance detection method involves three objects, namely: a cloud platform, a control center and an image publishing device.

[0060] The following is a detailed description of the security compliance detection method based on the cloud platform, control center and image publishing device.

[0061] Embodiment 1

[0062] The present invention provides a security compliance detection method, which is applied to a cloud platform. Figure 1 A schematic diagram of a safety compliance detection method provided by an embodiment of the present invention Figure 1 .like Figure 1 As shown, it mainly includes the following steps:

[0063] S101. When receiving a compliance detection task sent by a control center, create a detection node corresponding to the internal network to be tested by using a compliance detection image.

[0064] In an embodiment of the present invention, the cloud platform can directly receive the compliance detection task sent by the control center, and when receiving the compliance detection task sent by the control center, use the compliance detection image to create a detection node corresponding to the intranet to be tested.

[0065] It should be noted that, in an embodiment of the present invention, the compliance detection task is used to trigger the cloud platform to use the compliance detection image to create a detection node corresponding to the intranet to be tested, wherein the cloud platform includes at least one intranet, each of which can be used as an intranet to be tested, and the cloud platform can use the compliance detection image to create a corresponding detection node for each intranet, wherein the intranet refers to an unconnected network.

[0066] Exemplarily, the intranet may be a virtual private network, a container network, etc., which is not connected to the Internet. Multiple resources may be distributed on the network, and communication may be possible within the same network. The specific intranet may be determined based on the actual deployment of the cloud platform, and the embodiments of the present invention do not limit this.

[0067] It can be understood that if the intranet is a virtual private network, then the cloud platform uses the compliance detection image to create a detection node corresponding to the intranet to be tested, which is a virtual node, and the compliance detection image is a system image; if the intranet is a container network, then the cloud platform uses the compliance detection image to create a detection node corresponding to the intranet to be tested, which is a container node, and the compliance detection image is a container image.

[0068] In an embodiment of the present invention, the cloud platform uses the compliance detection image to create a detection node corresponding to the intranet to be tested only when it receives a compliance detection task sent by the control center. In other words, the detection node will only be created during the actual execution of the security compliance detection, thereby improving the resource utilization of the cloud platform.

[0069] It should be noted that in step S101, that is, when receiving the compliance detection task sent by the control center, before using the compliance detection image to create the detection node corresponding to the intranet to be tested, the cloud platform can also perform the following steps: receiving the first detection image sent by the image publishing device; determining the first detection image as a compliance detection image, and storing it in the image library of the cloud platform.

[0070] It should be noted that after receiving the first detection image, the cloud platform will determine the first detection image as a compliance detection image and store it in the image library of the cloud platform. That is to say, when the cloud platform receives a compliance detection task sent by the control center, it can use the compliance detection image stored in the image library to create a detection node. Different types of cloud platforms have corresponding compliance detection image types.

[0071] Exemplarily, if the cloud platform is a virtual cloud platform, then the detection node created by the cloud platform is a virtual machine node, so as to detect the resources to be tested in the cloud platform; if the cloud platform is a containerized cloud platform, then the detection node created by the cloud platform is a container node, so as to detect the resources to be tested in the cloud platform.

[0072] It should be noted that after the first detection image is determined as a compliant detection image and stored in the image library of the cloud platform, the cloud platform can also perform the following steps: upon receiving a second detection image sent by the image publishing device, update the compliant detection image to the second detection image.

[0073] It should be noted that the security and compliance detection system maintenance personnel will regularly update the security and compliance detection item information stored in the control center. Whenever the security and compliance detection item information changes, the control center will send the updated security and compliance detection item information to the image publishing device to generate and publish a new image. Then, when the cloud platform receives the second detection image sent by the image publishing device, it will update the compliance detection image to the second detection image.

[0074] It can be understood that in an embodiment of the present invention, when the cloud platform has not received a new image released by the image service device, the compliance detection image may be a first detection image. Once the cloud platform receives a second detection image released by the image service device, the cloud platform will update the compliance detection image to the second detection image. At this time, the compliance detection image is the second detection image.

[0075] It should be noted that in the embodiment of the present invention, when the cloud platform receives the second detection image sent by the image publishing device, it will update the compliance detection image to the second detection image. This step can be before receiving the compliance detection task sent by the control center, or after executing the security compliance detection instruction on the resource to be tested through the detection node to perform security compliance detection and obtain the detection information. The present invention does not limit the specific situation.

[0076] S102 . Connecting to the resources to be tested in the intranet to be tested by using the detection node and the resource connection information of the intranet to be tested.

[0077] In an embodiment of the present invention, after creating a detection node corresponding to the intranet to be tested, the cloud platform can further communicate with the resources to be tested in the intranet to be tested by using the resource connection information of the intranet to be tested through the detection node.

[0078] It should be noted that the resource connection information can be the resource user account information in the network. After the cloud platform creates the detection node, the detection node can use the resource user account information in the network to connect with the resource to be tested in the intranet to be tested. Specifically, when the cloud platform creates the detection node, it injects the resource user account information in the network into the detection node. That is, after the detection node is created, the detection node will connect with the resource to be tested in the intranet to be tested according to the injected resource user account information, and access the corresponding resource through the intranet to be tested.

[0079] S103: Obtain, through the detection node, a security compliance detection instruction corresponding to the system version information of the resource to be tested.

[0080] In an embodiment of the present invention, the detection node may directly obtain the security compliance detection instruction corresponding to the system version information of the resource to be detected.

[0081] It should be noted that in an embodiment of the present invention, after the detection node is connected with the resource to be tested in the intranet to be tested based on the injected resource user account information, it can obtain the system version information of the resource to be tested, and then obtain the security compliance detection instructions corresponding to the system version information of the resource to be tested.

[0082] It should be noted that in an embodiment of the present invention, the compliance detection image contains security compliance detection instructions corresponding to different system version information. The detection node created by the cloud platform using the compliance detection image contains security compliance detection instructions corresponding to different system version information. Therefore, the detection node can directly obtain security compliance detection instructions that match the system version information of the resource to be tested.

[0083] S104: Through the detection node, execute the security compliance detection instruction on the resource to be tested to perform security compliance detection and obtain detection information.

[0084] In an embodiment of the present invention, the detection node executes a security compliance detection instruction on the resource to be detected to perform security compliance detection and obtain detection information.

[0085] It should be noted that the detection node performs security compliance detection on the resources to be tested according to the security compliance detection instructions corresponding to the system version information to obtain the detection results. Specifically, when multiple security compliance detection instructions are included, the security compliance detection instructions will be executed in sequence to obtain the detection information.

[0086] It should be noted that, in the embodiment of the present invention, when the detection node performs security compliance detection on the resource to be detected according to the security compliance detection instruction, it calls the control program corresponding to the security compliance detection instruction and the execution result processing program to obtain feedback detection information.

[0087] Figure 2 A schematic diagram of a safety compliance detection method provided by an embodiment of the present invention Figure 2 .like Figure 2 As shown, in step S104, the cloud platform executes the security compliance detection instruction to perform security compliance detection on the resources to be detected through the detection node. After obtaining the detection information, the cloud platform can also perform the following steps:

[0088] S105 . Preprocess the detection information through the detection node to obtain processed detection information.

[0089] In an embodiment of the present invention, the detection node pre-processes the detection information to obtain processed detection information.

[0090] Exemplarily, preprocessing the detection information may include performing configuration files, intercepting log files, performing weak password detection and comparison on the detection information, and so on, thereby obtaining the detection information after preliminary processing.

[0091] S106. Encrypt the processed detection information through the detection node to obtain encrypted detection information, and transmit the encrypted detection information to the alarm system of the cloud platform.

[0092] In an embodiment of the present invention, in the detection node, the processed detection information is encrypted to obtain the encrypted detection information, and the encrypted detection information is transmitted to the alarm system of the cloud platform in the form of an alarm.

[0093] It is understandable that after the detection node pre-processes the obtained detection information and before transmitting it to the alarm system, the pre-processed detection information is encrypted to obtain encrypted detection information. The specific encryption method is not limited in the present invention.

[0094] It should be noted that the alarm system is used to collect system logs, equipment alarms, etc. of cloud resources. The system will collect alarm information from all cloud platforms, and the alarm system is the cloud platform’s own business system, which ensures that the security and compliance detection system has no direct contact with the resources within the cloud platform and does not destroy the network topology within the cloud platform, thereby improving the security of security and compliance detection.

[0095] S107. Send encrypted detection information to the control center through the alarm system.

[0096] In the embodiment of the present invention, after obtaining the encrypted detection information, the detection node sends the encrypted detection information to the control center through the alarm system.

[0097] It should be noted that, in the embodiment of the present invention, the detection node encrypts the obtained detection information after preprocessing it, and the encrypted detection information is sent to the control center via the alarm system.

[0098] In an embodiment of the present invention, after step S106, i.e. encrypting the processed detection information through the detection node to obtain the encrypted detection information and transmitting it to the alarm system of the cloud platform, the following steps are also included:

[0099] S108. When the preset node recycling time is reached, the detection node is recycled.

[0100] In the embodiment of the present invention, after the detection node completes the detection of the resource to be detected and all the encrypted detection information is transmitted to the control node via the alarm system, the detection node is recovered.

[0101] It should be noted that the preset node recovery time may be a preset period of time, or may be the moment when the detection node completes transmitting the encrypted detection information. The specific preset node recovery time is not limited in the embodiment of the present invention.

[0102] The present invention provides a method for security compliance detection, which is applied to a cloud platform. When the cloud platform receives a compliance detection task sent by a control center, a detection node corresponding to an intranet to be tested is created using a compliance detection image; the detection node is connected to the resource to be tested in the intranet to be tested by using the resource connection information of the intranet to be tested; the security compliance detection instruction corresponding to the system version information of the resource to be tested is obtained through the detection node; the security compliance detection instruction is executed on the resource to be tested to perform security compliance detection through the detection node to obtain detection information. The technical solution provided by the present invention, when receiving a compliance detection task sent by a control center, creates a detection node again to implement security compliance detection using the detection node, which not only improves the utilization rate of cloud platform resources, but also the detection node does not establish direct network communication with the external network, thereby improving the security of security compliance detection.

[0103] Embodiment 2

[0104] The present invention provides a safety compliance detection method, which is applied to a control center. Figure 3 A schematic diagram of a safety compliance detection method provided by an embodiment of the present invention Figure 3 .like Figure 3 As shown, it mainly includes the following steps:

[0105] S201. Send security compliance detection tasks to the cloud platform.

[0106] In an embodiment of the present invention, the control center may send a security compliance detection task to the cloud platform.

[0107] It should be noted that operators can publish compliance detection tasks in the control center, and then the control center sends the compliance detection tasks to the cloud platform.

[0108] It should also be noted that, in step S201, that is, before the control center sends the security compliance detection task to the cloud platform, the control center may also perform the following steps: receiving security compliance detection item information, and sending the security compliance detection item information to the image publishing device.

[0109] It should be noted that the control center stores security compliance detection item information, which is used by the image service device to generate a compliance detection image corresponding to the security compliance detection task. The specific security compliance detection item information has been described in detail in the first embodiment and will not be repeated here.

[0110] It should be noted that after receiving the security compliance detection item information and sending the security compliance detection item information to the image publishing device, the control center can also perform the following steps: when receiving update information of the security compliance detection item information, send update information to the image publishing device.

[0111] It should be noted that in an embodiment of the present invention, the security compliance detection system maintenance personnel will regularly update the security compliance detection item information stored in the control center. When the security compliance detection item information is updated, it is necessary to send the update information to the image publishing device, and then the image publishing device generates a new compliance detection image to replace the original compliance detection image in the cloud platform.

[0112] S202, receiving the encrypted detection information sent by the alarm system of the cloud platform; the encrypted detection information is obtained by the cloud platform executing the security and compliance detection task.

[0113] In an embodiment of the present invention, the control center receives encrypted detection information sent by the alarm system of the cloud platform; the encrypted detection information is obtained by the cloud platform executing a security compliance detection task.

[0114] It should be noted that in an embodiment of the present invention, after receiving a compliance detection task, the cloud platform uses a compliance detection image to create a detection node to implement security compliance detection through the detection node, and encrypts the detection result to obtain encrypted detection information, which is sent to the control center through the cloud platform's own alarm system. The control center can then receive the encrypted detection information.

[0115] S203. Generate a security compliance test report based on the encrypted test information.

[0116] In an embodiment of the present invention, the control center generates a security compliance detection report based on the encrypted detection information.

[0117] It should be noted that, in the embodiment of the present invention, the encrypted detection information is information that is encrypted after the detection node pre-processes the detection information.

[0118] Specifically, in an embodiment of the present invention, the control center generates a security compliance detection report based on the encrypted detection information, including: decrypting the encrypted detection information to obtain processed detection information; summarizing and collating the processed detection information to generate a security compliance detection report.

[0119] It should be noted that, in the embodiment of the present invention, the control center needs to decrypt the encrypted detection information. The specific decryption method depends on the encryption method, and the present invention does not limit this.

[0120] It is understandable that the processed test information is summarized and organized to generate a safety and compliance test report.

[0121] The present invention provides a security compliance detection method, which is applied to a control center. The control center sends a security compliance detection task to a cloud platform; receives encrypted detection information sent by an alarm system of the cloud platform; the encrypted detection information is obtained by the cloud platform executing the security compliance detection task; and generates a security compliance detection report based on the encrypted detection information. In other words, the control center receives the detection information sent by the alarm system of the cloud platform, and has no direct contact with the resources in the cloud platform. All information exchanges are completed through the alarm system of the cloud platform, and the network topology of the resources in the cloud platform is not damaged, thereby improving the security of security compliance detection.

[0122] Embodiment 3

[0123] The present invention provides a security compliance detection method, which is applied to an image publishing device. Figure 4 A schematic diagram of a safety compliance detection method provided by an embodiment of the present invention Figure 4 .like Figure 4 As shown, it mainly includes the following steps:

[0124] S301. Receive security compliance detection item information sent by a control center.

[0125] In an embodiment of the present invention, the image publishing device can directly receive the security compliance detection item information sent by the control center.

[0126] It should be noted that the security compliance detection item information at least includes the security compliance detection items and the detection methods, judgment conditions, compliance modification suggestions and other information for different systems and versions of the security compliance detection items.

[0127] S302: Generate security compliance detection instructions corresponding to different system version information according to the security compliance detection item information to obtain a first detection instruction set.

[0128] In an embodiment of the present invention, the image publishing device generates security compliance detection instructions corresponding to different system version information according to the security compliance detection item information to obtain a first detection instruction set.

[0129] It should be noted that the image publishing device generates security compliance detection instructions for detecting different system versions based on the security compliance detection item information sent by the control center, thereby obtaining a first detection instruction set. Specifically, the first detection instruction set includes at least different operating systems, versions, devices, and corresponding security compliance detection instructions, wherein the first detection instruction set includes at least one security compliance detection instruction.

[0130] S303: Generate a first detection image according to the first detection instruction set, and send the first detection image to the cloud platform; the cloud platform is used to determine the first detection image as a compliant detection image.

[0131] In an embodiment of the invention, the image publishing device generates a first detection image according to a first detection instruction set, and sends the first detection image to a cloud platform, and the cloud platform is used to determine the first detection image as a compliant detection image.

[0132] It should be noted that the first detection image generated by the image publishing device according to the first instruction set includes at least a control program for executing compliance detection instructions, a first detection instruction set, and a result processing program. Specifically, the first detection image can be a system image or a container image. The specific corresponding relationship has been described in detail in Example 1 and will not be repeated here.

[0133] It should also be noted that the detection image generated by the image publishing device will be sent to the image library of the cloud platform. Specifically, the image is based on a tailored operating system and only retains the components necessary to complete the compliance detection function. In this way, resource usage can be reduced and the speed of cloud platform creation and deployment can be accelerated.

[0134] In an embodiment of the present invention, in step S303, that is, after generating a first detection image according to a first detection instruction set and sending the first detection image to a cloud platform, the following steps may also be performed: upon receiving update information of the security compliance detection item information sent by a control center, updating the security compliance detection item information using the update information to obtain updated detection item information; generating security compliance detection instructions corresponding to different system version information according to the updated detection item information to obtain a second detection instruction set; generating a second detection image according to the second detection instruction set, and sending the second detection image to the cloud platform; the cloud platform is used to update the compliance detection image to the second detection image.

[0135] It should be noted that in an embodiment of the present invention, the security and compliance detection system maintenance personnel will regularly update the security and compliance detection item information stored in the control center. When the security and compliance detection item information is updated, the control center will send the updated security and compliance detection item information to the image publishing device to generate and publish a new image. Then, when the cloud platform receives the second detection image sent by the image publishing device, the compliance detection image will be updated to the second detection image, wherein the compliance detection image includes at least a control program for executing the security and compliance detection instructions, the security and compliance detection instructions generated in the previous step, and a result processing program.

[0136] The present invention provides a security compliance detection method, which is applied to an image publishing device, wherein the image publishing device receives security compliance detection item information sent by a control center; generates security compliance detection instructions corresponding to different system version information according to the security compliance detection item information, and obtains a first detection instruction set; generates a first detection image according to the first detection instruction set, and sends the first detection image to a cloud platform; the cloud platform is used to determine the first detection image as a compliance detection image. In other words, the technical solution provided by the present invention pushes the instructions required for security compliance detection to the cloud platform in the form of an image, and since the image is based on a tailored operating system, only the necessary components for completing security compliance detection are retained, thereby increasing the speed at which the cloud platform creates detection nodes.

[0137] Embodiment 4

[0138] Based on the security compliance detection methods provided in the above-mentioned embodiments 1, 2 and 3, a complete security compliance detection system is provided below, including:

[0139] The control center is used to send security compliance detection item information to the image service device.

[0140] The image service device is used to generate a compliance detection image using the security compliance detection item information and send the compliance detection image to the cloud platform.

[0141] The cloud platform is used to create a detection node corresponding to the tested intranet using the compliance detection image when receiving the compliance detection task sent by the control center, and perform security compliance detection on the tested resources of the tested intranet through the detection node to obtain detection information.

[0142] It should be noted that, in an embodiment of the present invention, the control center is used for overall control scheduling. The security and compliance detection system maintenance personnel can issue compliance detection tasks in the control center, send the compliance detection tasks to the cloud platform, and regularly update the security and compliance detection item information, and send the security and compliance detection item information to the mirror publishing device; the control center is also used to receive encrypted detection information from the cloud platform alarm system, decrypt it, summarize it, organize it, generate security and compliance detection reports, and store test history data.

[0143] It should be noted that in an embodiment of the present invention, the image service device generates security compliance detection instructions for detecting different system versions based on the security compliance detection item information sent by the control center, and combines it with an automated detection program to package it into a system image or container image, publish it, and send the latest image to the image library of the cloud platform to replace the original image.

[0144] It should be noted that in an embodiment of the present invention, when the cloud platform receives a compliance detection task sent by the control center, it uses the compliance detection image sent by the image publishing device to create a detection node corresponding to the intranet to be tested, and performs security compliance detection on the resources to be tested in the intranet to be tested through the detection node to obtain detection information, pre-processes the obtained detection information, encrypts it, and sends it to the alarm system of the cloud platform in the form of an alarm, which is then sent to the control center by the alarm system. After the detection information is sent, the detection node will be recovered.

[0145] Figure 5 Schematic diagram of an exemplary safety compliance detection system provided by an embodiment of the present invention. Figure 5 As shown, the security compliance detection system includes two cloud platforms, a control center and an image service device. The two cloud platforms are containerized and virtualized cloud platforms respectively. When the control center issues compliance detection tasks to the two cloud platforms, the two cloud platforms can respectively create corresponding detection nodes for their respective intranets to be tested, namely virtual machine nodes and container nodes, to achieve security compliance detection, and then send them to the control center through the alarm system of the cloud platform. In addition, the image service device receives the security compliance detection item information of the control center, generates a new image and sends it to the cloud platform. The above-mentioned security compliance detection system realizes information interaction between the image publishing device, the cloud platform and the control center.

[0146] The present invention provides a security compliance detection system, comprising: a control center, which is used to send security compliance detection item information to a mirror service device; the mirror service device, which is used to generate a compliance detection image using the security compliance detection item information. And the compliance detection image is sent to a cloud platform; the cloud platform is used to create a detection node corresponding to the internal network to be tested using the compliance detection image when receiving a compliance detection task sent by the control center, and perform security compliance detection on the resources to be tested in the internal network to be tested through the detection node to obtain detection information. Through the above system, not only the utilization rate of cloud platform resources is improved, but also the detection node does not establish direct network communication with the external network, thereby improving the security of security compliance detection.

[0147] Embodiment 5

[0148] The present invention provides a cloud platform. Figure 6 A schematic diagram of a cloud platform structure provided by an embodiment of the present invention Figure 1 .like Figure 6 As shown, the cloud platform includes:

[0149] A creation module 601 is used to create a detection node corresponding to the internal network to be tested by using the compliance detection image when receiving a compliance detection task sent by the control center;

[0150] A connection module 602 is used to connect with the resource to be tested in the intranet to be tested by using the resource connection information of the intranet to be tested through the detection node;

[0151] The acquisition module 603 is used to acquire, through the detection node, a security compliance detection instruction corresponding to the system version information of the resource to be tested;

[0152] The first processing module 604 is used to execute the security compliance detection instruction on the resource to be tested through the detection node to perform security compliance detection and obtain detection information.

[0153] Optionally, the first processing module 604 is also used to pre-process the detection information through the detection node to obtain processed detection information; encrypt the processed detection information through the detection node to obtain encrypted detection information; transmit the encrypted detection information to the alarm system of the cloud platform; and send the encrypted detection information to the control center through the alarm system.

[0154] Optionally, the cloud platform further includes:

[0155] The recycling module (not shown in the figure) is used to recycle the detection node when a preset node recycling time is reached.

[0156] Optionally, the first processing module 604 is further configured to receive a first detection image sent by an image publishing device; determine the first detection image as the compliance detection image, and store it in the image library of the cloud platform.

[0157] Optionally, the first processing module 604 is further configured to update the compliance detection image to the second detection image when receiving a second detection image sent by the image publishing device.

[0158] Figure 7 A schematic diagram of a cloud platform structure provided by an embodiment of the present invention Figure 2 .like Figure 7 As shown, the cloud platform includes a first processor 701, a first memory 702 and a first communication bus 703;

[0159] The first communication bus 703 is used to implement a communication connection between the first processor 701 and the first memory 702;

[0160] The first processor 701 is used to execute the first interactive program stored in the first memory 702 to implement the above-mentioned security compliance detection method applied to the cloud platform.

[0161] The present invention provides a security compliance detection method, which is applied to a cloud platform. When the cloud platform receives a compliance detection task sent by a control center, a detection node corresponding to an intranet to be tested is created using a compliance detection image; the detection node is connected to the resource to be tested in the intranet to be tested by using the resource connection information of the intranet to be tested; the security compliance detection instruction corresponding to the system version information of the resource to be tested is obtained through the detection node; the security compliance detection instruction is executed on the resource to be tested through the detection node to perform security compliance detection and obtain detection information. The technical solution provided by the present invention, when receiving a compliance detection task sent by a control center, creates a detection node again to implement security compliance detection using the detection node, which not only improves the utilization rate of cloud platform resources, but also the detection node does not establish direct network communication with the external network, thereby improving the security of security compliance detection.

[0162] The present invention provides a control center. Figure 8 A schematic diagram of a control center structure provided by an embodiment of the present invention Figure 1 .like Figure 8 As shown, the control center includes:

[0163] The first sending module 801 is used to send a security compliance detection task to the cloud platform;

[0164] A first receiving module 802 is used to receive encrypted detection information sent by the alarm system of the cloud platform; the encrypted detection information is obtained by the cloud platform executing the security compliance detection task;

[0165] The second processing module 803 is used to generate a security compliance detection report according to the encrypted detection information.

[0166] Optionally, the second processing module 803 is specifically used to decrypt the encrypted detection information to obtain processed detection information; summarize and organize the processed detection information to generate the security compliance detection report.

[0167] Optionally, the first receiving module 802 is further configured to receive security compliance detection item information;

[0168] The first sending module 801 is further configured to send the security compliance detection item information to the image publishing device.

[0169] Optionally, the first sending module 801 is further configured to send the update information of the security compliance detection item information to the image publishing device when the update information of the security compliance detection item information is received.

[0170] Fig. 9 A schematic diagram of a control center structure provided by an embodiment of the present invention Figure 2 .like Fig. 9 As shown, the control center includes a second processor 901, a second memory 902 and a second communication bus 903;

[0171] The second communication bus 903 is used to implement a communication connection between the second processor 901 and the second memory 902;

[0172] The second processor 901 is used to execute the second safety compliance detection program stored in the second memory 902 to implement the above-mentioned safety compliance detection method applied to the control center.

[0173] The present invention provides a security compliance detection method, which is applied to a control center. The control center sends a security compliance detection task to a cloud platform; receives encrypted detection information sent by an alarm system of the cloud platform; the encrypted detection information is obtained by the cloud platform executing the security compliance detection task; and generates a security compliance detection report based on the encrypted detection information. In the technical solution provided by the present invention, the control center receives the detection information sent by the alarm system of the cloud platform, and has no direct contact with the resources in the cloud platform. All information exchanges are completed through the alarm system of the cloud platform itself, and the network topology of the resources in the cloud platform is not damaged, thereby improving the security of security compliance detection.

[0174] The embodiment of the present invention provides a mirroring service device. Fig.10 A schematic diagram of the structure of a mirror service device provided by an embodiment of the present invention Figure 1 .like Fig.10 As shown, the image publishing device includes:

[0175] The second receiving module 1001 is used to receive the safety compliance detection item information sent by the control center;

[0176] The third processing module 1002 is used to generate security compliance detection instructions corresponding to different system version information according to the security compliance detection item information to obtain a first detection instruction set;

[0177] The second sending module 1003 generates a first detection image according to the first detection instruction set, and sends the first detection image to the cloud platform; the cloud platform is used to determine the first detection image as a compliant detection image.

[0178] Optionally, the second sending module 1003 is further used to send the second detection image to the cloud platform; and the cloud platform is used to update the compliance detection image to the second detection image.

[0179] Optionally, the third processing module 1002 is also used to, upon receiving update information of the security compliance detection item information sent by the control center, update the security compliance detection item information using the update information to obtain updated detection item information; generate security compliance detection instructions corresponding to different system version information according to the updated detection item information to obtain a second detection instruction set; and generate a second detection image according to the second detection instruction set.

[0180] Fig.11 A schematic diagram of the structure of a mirror service device provided by an embodiment of the present invention Figure 2 .like Fig.11 As shown, the mirror service device includes a third processor 1101, a third memory 1102 and a third communication bus 1103;

[0181] The third communication bus 1103 is used to realize the communication connection between the third processor 1101 and the third memory 1102;

[0182] The third processor 1101 is used to execute the third security compliance detection program stored in the third memory 1102 to implement the above-mentioned security compliance detection method applied to the image publishing device.

[0183] The present invention provides a security compliance detection method, which is applied to an image publishing device, wherein the image publishing device receives security compliance detection item information sent by a control center; generates security compliance detection instructions corresponding to different system version information according to the security compliance detection item information, and obtains a first detection instruction set; generates a first detection image according to the first detection instruction set, and sends the first detection image to a cloud platform; the cloud platform is used to determine the first detection image as a compliance detection image. In the technical solution provided by the present invention, the image publishing device pushes the instructions required for security compliance detection to the cloud platform in the form of an image, and since the image is based on a tailored operating system, only the necessary components for completing security compliance detection are retained, thereby improving the speed of cloud platform creation and deployment.

[0184] The present invention provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the above-mentioned security compliance detection method.

[0185] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0186] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0187] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0188] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0189] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention.

Claims

1. A safety compliance detection method, characterized in that: Applied to a cloud platform, the method includes: In the case of receiving a compliance detection task sent by the control center, using the compliance detection image to create a detection node corresponding to the intranet to be tested; the compliance detection image is an image publishing device that generates security compliance detection instructions corresponding to different system version information based on the security compliance detection item information received from the control center, obtains a first detection instruction set, and generates according to the first detection instruction set; By means of the detection node, the resource connection information of the intranet to be tested is used to communicate with the resources to be tested in the intranet to be tested; Obtaining, through the detection node, a security compliance detection instruction corresponding to the system version information of the resource to be tested; Through the detection node, the security compliance detection instruction is executed on the resource to be tested to perform security compliance detection and obtain detection information.

2. The method according to claim 1, characterized in that After executing the security compliance detection instruction to perform security compliance detection on the resource to be detected through the detection node and obtaining detection information, the method further includes: Preprocessing the detection information through the detection node to obtain processed detection information; By means of the detection node, the processed detection information is encrypted to obtain encrypted detection information, and the encrypted detection information is transmitted to the alarm system of the cloud platform; The encrypted detection information is sent to the control center through the alarm system.

3. The method according to claim 2, characterized in that After encrypting the processed detection information through the detection node to obtain the encrypted information and transmitting it to the alarm system of the cloud platform, the method further includes: When the preset node recycling time is reached, the detection node is recycled.

4. The method according to claim 1, characterized in that In the case of receiving the compliance detection task sent by the control center, before using the compliance detection image to create a detection node corresponding to the internal network to be tested, the method also includes: Receive a first detection image sent by an image publishing device; The first detection image is determined as the compliance detection image, and is stored in the image library of the cloud platform.

5. A safety compliance detection method, characterized in that: Applied to a control center, the method comprises: Sending a security compliance detection task to the cloud platform, so that the cloud platform can use the compliance detection image to create a detection node corresponding to the intranet to be tested based on the compliance detection task received, and perform security compliance detection on the resources to be tested of the intranet to be tested through the detection node to obtain detection information; the compliance detection image is an image publishing device that generates security compliance detection instructions corresponding to different system version information according to the security compliance detection item information received from the control center, obtains a first detection instruction set, and generates according to the first detection instruction set; Receiving encrypted detection information sent by the alarm system of the cloud platform; the encrypted detection information is obtained by the cloud platform executing the security compliance detection task; Generate a security compliance test report based on the encrypted test information.

6. The method according to claim 5, characterized in that Generating a security compliance test report according to the encrypted test information includes: Decrypting the encrypted detection information to obtain processed detection information; The processed detection information is summarized and collated to generate the safety compliance detection report.

7. The method according to claim 5, characterized in that Before sending the security compliance detection task to the cloud platform, the method further includes: Receive security compliance detection item information, and send the security compliance detection item information to the image publishing device.

8. The method according to claim 7, characterized in that After receiving the security compliance detection item information and sending the security compliance detection item information to the image publishing device, the method further includes: When the update information of the security compliance detection item information is received, the update information is sent to the image publishing device.

9. A safety compliance detection method, characterized in that: Applied to an image publishing device, the method comprises: Receive security compliance detection item information sent by the control center; Generate security compliance detection instructions corresponding to different system version information according to the security compliance detection item information to obtain a first detection instruction set; A first detection image is generated according to the first detection instruction set, and the first detection image is sent to the cloud platform; the cloud platform is used to determine the first detection image as a compliance detection image, and use the compliance detection image to create a detection node corresponding to the intranet to be tested, and perform security compliance detection on the resources to be tested of the intranet to be tested through the detection node to obtain detection information.

10. The method according to claim 9, characterized in that After generating the first detection image according to the first detection instruction set and sending the first detection image to the cloud platform, the method further includes: Upon receiving update information of the security compliance detection item information sent by the control center, updating the security compliance detection item information by using the update information to obtain updated detection item information; Generate security compliance detection instructions corresponding to different system version information according to the updated detection item information to obtain a second detection instruction set; A second detection image is generated according to the second detection instruction set, and the second detection image is sent to the cloud platform; the cloud platform is used to update the compliance detection image to the second detection image.

11. A safety compliance detection system, characterized in that: include: Control center, image publishing device and cloud platform; The control center is used to send security compliance detection item information to the image publishing device; The image publishing device is used to generate a compliance detection image using the security compliance detection item information, and send the compliance detection image to the cloud platform; the compliance detection image is generated by the image publishing device according to the security compliance detection item information sent by the control center, generating security compliance detection instructions corresponding to different system version information, obtaining a first detection instruction set, and generating according to the first detection instruction set; The cloud platform is used to create a detection node corresponding to the intranet to be tested using the compliance detection image when receiving a compliance detection task sent by the control center, and perform security compliance detection on the resources to be tested in the intranet to be tested through the detection node to obtain detection information.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the security compliance detection method described in any one of claims 1-10.

Images