A security protection method, equipment and media for a small data center

Abstract

This application discloses a security protection method, device, and medium for small data centers. The method includes: a template server registering a running server to the template server; the template server classifying servers according to version type; controlling the running server to upload running information conforming to the configuration information to a collection server according to preset configuration information related to the running server; so that the collection server can monitor the running server according to the running information; and mounting the monitoring information of the collection server to monitor the running server according to the monitoring information. This method saves manpower and resources and reduces costs when implementing security protection for small data centers.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a security protection method, device and medium for a small data center. Background Technology

[0002] A data center is a building that provides an operating environment for centrally located electronic information equipment, including main server rooms and auxiliary areas. Based on size, data centers can be categorized as ultra-large, large, and small-to-medium-sized. As can be seen, small data centers are relatively small in scale and can be flexibly deployed according to market demand.

[0003] Currently, the security protection of small data centers follows the same approach as large data centers, typically involving the addition of a honeypot or other security system. However, this is too expensive for small data centers and consumes more resources. Furthermore, using complex tools for monitoring and early warning requires significant investment and substantial human and material resources. Summary of the Invention

[0004] This application provides a security protection method, device, and medium for small data centers, which addresses the problem of high manpower and material resources being required for security protection of small data centers.

[0005] The embodiments of this application adopt the following technical solutions:

[0006] On one hand, this application provides a security protection method for a small data center. The method includes: a template server registering a running server to the template server; the template server being divided according to version type; the running server being controlled to upload running information that meets the requirements of the configuration information to a collection server according to preset configuration information related to the running server; so that the collection server can monitor the running server according to the running information; and the monitoring information of the collection server being mounted, and the running server being monitored according to the monitoring information.

[0007] In one example, monitoring the running server based on the monitoring information specifically includes: adding an automatic startup task for simulated antivirus software; determining the main process name of the preset antivirus software, and starting the corresponding main process according to the main process name at startup; determining whether the main process exists within a preset period; if not, recording the relevant information of the main process and using the relevant information as early warning information.

[0008] In one example, monitoring the running server based on the monitoring information specifically includes: obtaining the login information of the running machine; analyzing the login information to identify abnormal login information; and uploading the IP address of the abnormal login information to the aggregation server.

[0009] In one example, monitoring the running server based on the monitoring information specifically includes: obtaining the CPU resources of the running machine; analyzing the CPU resources of the running machine to determine whether the CPU resources exceed a preset threshold; if so, determining the process list corresponding to the CPU resources and uploading the process list to the aggregation server.

[0010] In one example, the aggregation server monitors the running server based on the running information, specifically including: when creating a data center, the first aggregation server adds a preset shared folder so that the second aggregation server in the local area network can obtain the running information uploaded to the first aggregation server through the preset shared folder; the first aggregation server and the second aggregation server monitor the running server.

[0011] In one example, after the aggregation server monitors the running server based on the running information, the method further includes: the aggregation server determining a preset notification method for the administrator; the preset notification method includes email; analyzing the log information in the running information to determine whether the running machine updates information within a preset time period; if not, generating a first alarm message and sending the first alarm message to the administrator through the preset notification method.

[0012] In one example, after the aggregation server monitors the running server based on the running information, the method further includes: determining a list of sensitive information based on the HTTP publishing service; entering the sensitive information list into process checks and file checks to periodically check whether there is abnormal process information on the running machine; if so, issuing an alarm for the abnormal process information through a preset notification method.

[0013] In one example, the configuration information includes at least one of the following: process information of the running server, file log information, login information, and system log.

[0014] On the other hand, this application embodiment provides a security protection device for a small data center, applied to a template server, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: register a running server to the template server; classify the template server according to version type; control the running server to upload running information conforming to the configuration information to a collection server according to preset configuration information related to the running server; so that the collection server monitors the running server according to the running information; mount the monitoring information of the collection server, and monitor the running server according to the monitoring information.

[0015] On the other hand, embodiments of this application provide a security protection non-volatile computer storage medium for small data centers, storing computer-executable instructions applied to a template server. The computer-executable instructions are configured to: register a running server with the template server; classify the template server according to version type; control the running server to upload running information conforming to the configuration information to a collection server according to preset configuration information related to the running server; so that the collection server monitors the running server according to the running information; and mount the collection server to monitor the running server according to the monitoring information.

[0016] The above-described technical solutions adopted in the embodiments of this application can achieve the following beneficial effects:

[0017] It can pre-configure relevant information on the template server, and perform autonomous checks and troubleshooting of the security protection of the running server based on the aggregation server, achieving low resource consumption, reduced capital investment, and highly customizable scripts that can be improved and modified based on the data in cvnd. Attached Figure Description

[0018] To more clearly illustrate the technical solution of this application, some embodiments of this application will be described in detail below with reference to the accompanying drawings, in which:

[0019] Figure 1 A flowchart illustrating a security protection method for a small data center provided in this application embodiment;

[0020] Figure 2 This is a schematic diagram of the structure of a security protection device for a small data center provided in an embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] Some embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0023] Figure 1 This is a flowchart illustrating a security protection method for a small data center provided in this application embodiment. This method can be applied to various business sectors, such as internet finance, e-commerce, instant messaging, gaming, and government services. Certain input parameters or intermediate results in this process can be manually adjusted to help improve accuracy.

[0024] The analysis method involved in the embodiments of this application can be implemented by a terminal device or a server, and this application does not impose any special limitations on it. For ease of understanding and description, the following embodiments are all described in detail using a server as an example.

[0025] It should be noted that the server can be a single device or a system composed of multiple devices, i.e., a distributed server. This application does not make any specific limitations on this.

[0026] Figure 1 The process may include the following steps:

[0027] S102: Register the running server to the template server; the template server is divided according to version type.

[0028] For example, the template server version types include Windows, iOS, Linux, etc. In other words, there are multiple types of template servers, each with a preset number; for example, there is one server for the Windows version.

[0029] By registering a running server with the template server, the template server can be managed by the running server.

[0030] S104: Based on the preset configuration information related to the running server, control the running server to upload running information that meets the requirements of the configuration information to the aggregation server; so that the aggregation server can monitor the running server based on the running information.

[0031] In other words, administrators will modify the original template server and configure its settings. These default configuration settings include information about the running server's processes, file logs, login information, and system logs.

[0032] In some embodiments of this application, the aggregation server monitors the running server based on the running information, specifically including: when creating a data center, the first aggregation server adds a preset shared folder so that the second aggregation server in the local area network can obtain the running information uploaded to the first aggregation server through the preset shared folder; the first aggregation server and the second aggregation server monitor the running server.

[0033] For example, when creating a data center, administrators can add a shared folder on the first aggregation server, making it easier for other aggregation servers on the local area network to aggregate the operational information of different running servers.

[0034] In some embodiments of this application, after the aggregation server monitors the running server based on the running information, the method further includes: the aggregation server determining a preset notification method for the administrator; the preset notification method includes email; analyzing the log information in the running information to determine whether the running machine updates information within a preset time period; if not, generating a first alarm message and sending the first alarm message to the administrator through the preset notification method. It should be noted that if email is not sent, access is required for viewing.

[0035] In other words, add configuration for early warning and email notification information to the aggregation server.

[0036] In some embodiments of this application, after the aggregation server monitors the running server based on the running information, the method further includes: determining a list of sensitive information based on the HTTP publishing service; entering the sensitive information list into process checks and file checks to periodically check whether there is abnormal process information on the running machine; if so, issuing an alarm for the abnormal process information through a preset notification method; otherwise, no action is taken.

[0037] In other words, the aggregation server needs to have an HTTP publishing service to periodically update sensitive information, and then use the sensitive information to check the processes running the server.

[0038] It should be noted that periodically updating sensitive information refers to obtaining sensitive information from the network within a preset period. S106: Mount the aggregation server and monitor the running server according to the monitoring information.

[0039] It should be noted that when the aggregation server receives a mounting notification, it will automatically maintain a list of running servers for statistical analysis.

[0040] In some embodiments of this application, the template server will simulate processes such as antivirus software. Specifically, it will add a task to automatically start the simulated antivirus software; determine the main process name of the preset antivirus software, and start the corresponding main process according to the main process name at boot time; within a preset period, it will determine whether the main process exists; if not, it will record the relevant information of the main process and use the relevant information as early warning information. It should be noted that after receiving the early warning information, the simulation service also needs to be started.

[0041] One of the features is a scheduled task that checks whether the main storyline process exists within a preset period.

[0042] In some embodiments of this application, the template server includes resources and anomaly checks. Specifically, it acquires the login information of the running machine; analyzes the login information to determine abnormal login information; and uploads the IP address of the abnormal login information to the aggregation server.

[0043] Obtain the CPU resources of the running machine; analyze the CPU resources of the running machine to determine whether the CPU resources exceed a preset threshold; if so, determine the process list corresponding to the CPU resources and upload the process list to the aggregation server.

[0044] In addition, regularly check scheduled task information, examine all machine scheduled tasks, and report any tasks that use curl or wget to retrieve external scripts. Furthermore, monitor TCP connection counts and categorize TCP connections.

[0045] It should be noted that, although the embodiments in this application are based on... Figure 1 Steps S102 to S106 will be described sequentially, but this does not mean that steps S102 to S106 must be performed in a strict order. The reason this embodiment follows this order is... Figure 1 The order in which steps S102 to S106 are described is provided to facilitate understanding of the technical solutions of the embodiments of this application by those skilled in the art. In other words, in the embodiments of this application, the order of steps S102 to S106 can be appropriately adjusted according to actual needs.

[0046] pass Figure 1This method allows for the pre-configuration of relevant information on the template server, enabling autonomous checks and error identification of the security protection components of the running server based on the aggregation server. This approach minimizes resource consumption, reduces capital investment, and allows for highly customizable scripts that can be improved and modified based on data within cvnd.

[0047] Based on the same idea, some embodiments of this application also provide devices and non-volatile computer storage media corresponding to the above methods.

[0048] Figure 2 A schematic diagram of a security protection device for a small data center, provided in this application embodiment, is applied to a template server and includes:

[0049] At least one processor; and,

[0050] A memory communicatively connected to the at least one processor; wherein,

[0051] The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to:

[0052] The runtime server is registered with the template server; the template server is divided according to version type;

[0053] Based on preset configuration information related to the running server, the running server is controlled to upload running information that meets the requirements of the configuration information to the aggregation server; so that the aggregation server can monitor the running server based on the running information.

[0054] The monitoring information of the aggregation server is mounted, and the running server is monitored based on the monitoring information.

[0055] Some embodiments of this application provide a security protection non-volatile computer storage medium for a small data center, storing computer-executable instructions, applied to a template server, wherein the computer-executable instructions are configured as follows:

[0056] The runtime server is registered with the template server; the template server is divided according to version type;

[0057] Based on preset configuration information related to the running server, the running server is controlled to upload running information that meets the requirements of the configuration information to the aggregation server; so that the aggregation server can monitor the running server based on the running information.

[0058] The monitoring information of the aggregation server is mounted, and the running server is monitored based on the monitoring information.

[0059] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device and medium embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the description of the method embodiments.

[0060] The devices and media provided in this application are one-to-one with the methods. Therefore, the devices and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0061] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0066] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0067] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0068] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0069] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the technical principles of this application should fall within the protection scope of this application.

Claims

1. A security protection method for a small data center, characterized in that, The method includes: The template server registers the running server with the template server; the template server is divided according to version type; Based on preset configuration information related to the running server, the running server is controlled to upload running information that meets the requirements of the configuration information to the aggregation server; so that the aggregation server can monitor the running server based on the running information. The monitoring information of the aggregation server is mounted, and the running server is monitored based on the monitoring information; The monitoring of the running server based on the monitoring information specifically includes: Added a task to automatically launch simulated antivirus software; The main process name of the preset antivirus software is determined, and the corresponding main process is started according to the main process name at boot time; Within a preset period, determine whether the main process exists; If not, the relevant information of the main process will be recorded and used as early warning information; The monitoring of the running server based on the monitoring information specifically includes: Obtain the login information of the running machine; The login information is analyzed to identify abnormal login information; Upload the IP address of the abnormal login information to the aggregation server; The monitoring of the running server based on the monitoring information specifically includes: Obtain the CPU resources of the running machine; The CPU resources of the running machine are analyzed to determine whether the CPU resources exceed a preset threshold. If so, then determine the process list corresponding to the CPU resource and upload the process list to the aggregation server; After the aggregation server monitors the running server based on the running information, the method further includes: Determine the list of sensitive information based on the HTTP publishing service; Based on the list of sensitive information, enter it into process checks and file checks to periodically check whether there is any abnormal process information on the running machine; If so, an alert will be issued for the abnormal process information through a preset notification method; The aggregation server monitors the running server based on the running information, specifically including: When creating a data center, the first aggregation server adds a preset shared folder so that the second aggregation server in the local area network can obtain the running information uploaded to the first aggregation server through the preset shared folder; The first collection server and the second collection server monitor the running server; After the aggregation server monitors the running server based on the running information, the method further includes: The aggregation server determines a preset notification method for the administrators; the preset notification method includes email. Analyze the log information in the operation information to determine whether the running machine updates the information within a preset time period; If not, a first alarm message is generated and sent to the administrator via the preset notification method. The configuration information includes at least one of the following: The process information, file log information, login information, and system log of the running server.

2. A security protection device for a small data center, characterized in that, Applied to template servers, including: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to: perform the security protection method for a small data center as described in claim 1.

3. A security-protected non-volatile computer storage medium for small data centers, storing computer-executable instructions, characterized in that, Applied to a template server, the computer-executable instructions are configured to execute the security protection method for a small data center as described in claim 1.

Images