A shared leak scanning method in a multi-network environment

Abstract

The present invention provides a shared leak scanning method in a multi-network environment, belonging to the field of network security. The shared leak scanning method first sets up the same leak scanning system for multiple networks; when adding a user in the leak scanning system, the network to which the user belongs is specified, and the network identifier is bound to the user; the leak scanning system adds data permission control, and the scanning tasks created by each user are independent of each other. When the user logs into the leak scanning system, he can only see the scanning tasks he created; when starting the scanning task, the user checks whether there are other users in the leak scanning system in the scanning task; if there are, the current user adds his own scanning task to the scanning queue, and automatically starts the task startup process after the scanning of other users in the queue is completed; if not, directly enter the current scanning task startup process; before the task is started, the leak scanning system is automatically switched to the corresponding network according to the network identifier to start the scanning task. The present invention saves costs and improves the efficiency of leak scanning.

Description

Technical Field

[0001] The invention belongs to the field of network security, and in particular relates to a shared vulnerability scanning method in a multi-network environment. Background Art

[0002] With the development of cloud computing, virtualization technology and network security, it is necessary to use vulnerability scanning software to perform vulnerability scanning on hosts (virtual hosts or physical hosts) in multiple networks (virtual networks or physical networks).

[0003] In the prior art, since each network is independent and multiple networks are not interconnected, a vulnerability scanning system is deployed in each network when performing vulnerability scanning. Users in different networks log in to their own vulnerability scanning systems to scan the hosts in their own networks for vulnerabilities. Figure 1 As shown in the figure, three networks are isolated from each other (LAN-1, LAN-2, LAN-n). Each network has three hosts (Host 1, Host 2, Host n) and a vulnerability scanning system. Users in different networks log in to their own vulnerability scanning systems to scan the vulnerabilities of the hosts in their own networks. With the development of business, the number of LANs may increase to hundreds or even thousands, and the number of hosts in each LAN may also increase to hundreds or even thousands. At this time, if a vulnerability scanning system is deployed in each network, a large number of vulnerability scanning systems will need to be deployed, which will bring the following problems: First, it wastes hardware resources and increases hardware costs. Each set of vulnerability scanning systems needs to be deployed on a host; second, it increases management costs. Users need to manage and maintain a large number of vulnerability scanning systems at the same time. In particular, when the vulnerability scanning system needs to be upgraded, each machine needs to be upgraded one by one, which is very time-consuming and labor-intensive; third, the scalability is poor. Each additional network requires the deployment of a vulnerability scanning system. At the same time, if the vulnerability scanning system itself has vulnerabilities, each machine needs to be repaired one by one. Summary of the invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, an embodiment of the present invention aims to provide a shared leak scanning method in a multi-network environment, thereby saving costs and improving leak scanning efficiency.

[0005] In order to achieve the above purpose, the embodiment of the present invention adopts the following technical solution:

[0006] A shared leak scanning method in a multi-network environment comprises the following steps:

[0007] Step S1, setting the same leak scanning system for multiple networks;

[0008] Step S2, when adding a user in the missed scanning system, specify the network to which the user belongs, and bind the network identifier of the network to which the user belongs;

[0009] Step S3, the missed scanning system adds data permission control, and the scanning tasks created by each user are independent of each other. When a user logs into the missed scanning system, he can only see the scanning tasks he created;

[0010] Step S4, when starting a scanning task, the user checks whether there are other users in the missed scanning system who are already in the scanning task; if there are other users who are scanning, the current user adds his scanning task to the scanning queue, and the task status is in the waiting scanning status, and the task startup process automatically starts after the scanning of other users in the queue is completed; if there are no other users in the missed scanning system who are already in the scanning task, the current scanning task startup process is directly entered;

[0011] Step S5, before the task is started, the missed scanning system is automatically switched to the corresponding network according to the network identifier of the network to which the user belongs, and then the scanning task is started in the corresponding network.

[0012] In the above solution, the missed scanning system is implemented by a host computer installed with a missed scanning program.

[0013] In the above scheme, in a multi-network environment, each network corresponds to a unique network identifier.

[0014] The technical solution provided by the embodiment of the present invention has the following beneficial effects:

[0015] The vulnerability scanning method is shared in a multi-network environment. Only one vulnerability scanning system needs to be deployed in a multi-network environment, and only one vulnerability scanning system needs to be managed and maintained. If an upgrade is required, only one vulnerability scanning system needs to be upgraded. When a vulnerability occurs in the vulnerability scanning system itself, only one vulnerability scanning system needs to be patched. At the same time, only one hardware resource needs to be allocated to deploy and install vulnerability scanning, thereby saving costs and improving vulnerability scanning efficiency.

[0016] Of course, it is not necessary to achieve all of the advantages described above at the same time to implement any product or method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 It is a structural diagram of the deployment mode of the leakage scanning system in the prior art;

[0019] Figure 2 It is a structural diagram of a deployment mode of a shared leak scanning system in a multi-network environment according to an embodiment of the present invention;

[0020] Figure 3 is a flow chart of a shared leak scanning method in a multi-network environment according to an embodiment of the present invention;

[0021] Figure 4 It is a flow chart of the missed scan service in a specific embodiment of the present invention. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations. It should be noted that the embodiments of the present invention and the features in the embodiments can also be combined with each other without conflict.

[0023] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. In the description of the present invention, the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as just or implying relative importance.

[0024] In order to solve the problem that multiple leak scanning systems need to be deployed in multiple network environments, the embodiments of the present invention provide a shared leak scanning method in multiple network environments, readjust the network deployment structure, realize hidden switching between multiple networks, and switch to the required network without the user's perception, so that no matter how many independent networks there are, only one leak scanning system needs to be deployed, thereby reducing the amount of hardware, saving hardware costs, reducing management costs, and increasing scalability.

[0025] See also Figure 2 and Figure 3 The shared leak scanning method in a multi-network environment provided by an embodiment of the present invention comprises the following steps:

[0026] Step S1, setting the same leak scanning system for multiple networks.

[0027] In this step, the leak scanning system is implemented by a host computer installed with a leak scanning program.

[0028] Step S2, when adding a user in the missed scanning system, specify the network to which the user belongs, and bind the network identifier of the network to which the user belongs.

[0029] In this step, in a multi-network environment, each network corresponds to a unique network identifier to distinguish other networks.

[0030] Step S3, the missed scanning system adds data authority control, and the scanning tasks created by each user are independent of each other. When a user logs into the missed scanning system, he can only see the scanning tasks he created.

[0031] Step S4, when starting a scanning task, the user checks whether there are other users in the missed scanning system who are already in the scanning task; if there are other users who are scanning, the current user adds his scanning task to the scanning queue, and the task status is in the waiting scanning status. After the scanning of other users in the queue is completed, the scanning task startup process will be automatically entered; if there are no other users in the missed scanning system who are in the scanning task, the current scanning task startup process will be directly entered.

[0032] Step S5, before the task is started, the missed scanning system is automatically switched to the corresponding network according to the network identifier of the network to which the user belongs, and then the scanning task is started in the corresponding network.

[0033] It can be seen from the above technical solutions that the shared vulnerability scanning method in a multi-network environment provided by the embodiment of the present invention can reduce the need to deploy multiple vulnerability scanning systems in multiple independent networks in the past to only deploying one vulnerability scanning system, and only one vulnerability scanning system needs to be managed and maintained. If an upgrade is required, only one vulnerability scanning system needs to be upgraded; when a vulnerability occurs in the vulnerability scanning system itself, only one vulnerability scanning system needs to be patched; at the same time, only one hardware resource needs to be allocated to deploy and install vulnerability scanning, thereby saving costs and improving vulnerability scanning efficiency.

[0034] The present invention is further described in detail below through a specific embodiment.

[0035] like Figure 4 As shown, the user uses the shared vulnerability scanning method in a multi-network environment provided by the present invention to scan multiple networks for vulnerabilities, and the objects involved include the current user (user1), a vulnerability scanning system (scan1), and two independent network environments (lan1, lan2). When performing vulnerability scanning, perform the following operations:

[0036] User (user1) logs in to the missed scanning system (scan1). Scan1 queries and displays the task data to which user1 belongs based on the current user permissions.

[0037] Scan1 determines that the network environment to which user1 belongs is lan1 or lan2 based on the network characteristics of user1. As long as the current environment is lan1, the scan task is directly started to execute the scan initiated by user1 normally. If scan1 does not currently belong to lan1, it is necessary to check whether there are scan tasks initiated by other users (user-n) currently being scanned. If there are other users scanning, the new task will be added to the scan queue. At this time, the task status is in the waiting scan status. After the scan of other users is completed, the scan task startup process will be automatically started; if the system has no other users scanning, the task startup process will be directly entered.

[0038] The process of starting the scan task is as follows:

[0039] Switch the scan1 network environment to the corresponding lan, which is lan1 in this embodiment;

[0040] Execute the scan task.

[0041] The above description is only a preferred embodiment of the present invention and an explanation of the technical principles used. It is not intended to limit the scope of the invention claimed for protection, but only represents the preferred embodiment of the present invention. Those skilled in the art should understand that the scope of the invention involved in the present invention is not limited to the technical solution formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the inventive concept. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present invention.

Claims

1. A shared leak scanning method in a multi-network environment, characterized in that: The steps include: Step S1, setting up a same leak scanning system for multiple networks; the leak scanning system is implemented by a host computer with a leak scanning program installed; Step S2, when adding a user in the leak scanning system, specify the network to which the user belongs, and bind the network identifier of the network to which the user belongs; in a multi-network environment, each network corresponds to a unique network identifier; the leak scanning system scan1 determines that the network environment to which user1 belongs is lan1 or lan2 based on the network characteristics of user user1; Step S3, the missed scanning system adds data authority control. The scanning tasks created by each user are independent of each other. When a user logs into the missed scanning system, he can only see the scanning tasks he created. When user user1 logs into the missed scanning system scan1, scan1 queries and displays the task data belonging to user1 according to the current user authority. Step S4, when starting a scanning task, the user checks whether there are other users in the missed scanning system who are already in the scanning task; if there are other users who are scanning, the current user adds his scanning task to the scanning queue, and the task status is in the waiting scanning status, and the task startup process automatically starts after the scanning of other users in the queue is completed; if there are no other users in the missed scanning system who are already in the scanning task, the current scanning task startup process is directly entered; Step S5, before the task is started, the missed scanning system is automatically switched to the corresponding network according to the network identifier of the network to which the user belongs, and then the scanning task is started in the corresponding network.

Images