Network security server system based on block chain

Abstract

The invention discloses a network security server system based on a block chain. The network security server system comprises a central processing unit, an operation monitoring module, a data analysis module and a security protection module, the operation detection module is used for monitoring an operation and maintenance environment of the server and obtaining operation data information of the server; the data analysis module is used for analyzing and processing the operation data information of the server to obtain a current server operation safety coefficient; and the security protection module completes synchronous detection of a hardware system and a software system of the network security server on the basis of the current server operation security coefficient, and performs abnormal reason analysis on the network security server system under the abnormal condition through the security protection module. Abnormal reason analysis is processed through two dimensions of the hardware module and the software module, so that abnormal reasons of the network security server system are fed back to the user side, and the user side realizes accurate targeted processing based on an analysis result of the security protection module.

Description

Technical Field

[0001] The present invention relates to the field of server technology, and in particular to a network security server system based on blockchain. Background Art

[0002] Blockchain is essentially a shared database, which makes it inconvenient to maintain the large number of servers based on blockchain. For example, when installing multiple servers in a cabinet, the distance between the multiple servers will be small when installing multiple servers in a vertical multi-layer installation.

[0003] For example, patent application No. 202010280510.4 discloses a network security server system based on blockchain, including a mounting seat, a heat dissipation port, a chassis, a trusteeship, a ring, a force rod, a top ring, a compression spring I and a wheel, which can keep the position of the server to be adjusted unchanged and increase the distance between the adjacent mounting seat above and itself. Thereby reducing the surplus space of other servers and expanding the surplus space of the server with maintenance. No secondary damage will be caused when the server is moved alone or the mounting seat where it is located is moved alone due to maintenance; the chassis that is easy to move out of a part of the shell, after the wheels on it touch the ground, the chassis and the mounting seat above begin to tilt, which is convenient for the server interface area to rise, which is conducive to the maintenance of the interface; two clamping plates are used to clamp the server relative to the mounting seat to keep it unchanged, to avoid the wiring falling off or the server falling off when tilting.

[0004] However, the prior art only processes the hardware modules of the blockchain's network security server system, and lacks protection processing for the software modules in the blockchain's network security server system, resulting in low security of the blockchain's network security server system during data transmission. Summary of the invention

[0005] The purpose of the present invention is to provide a blockchain-based network security server system, which uses an operation detection module to monitor the server operation and maintenance environment and obtain the server's operation data information; the data analysis module is used to analyze and process the server's operation data information to obtain the current server operation safety factor; the security protection module completes the synchronous detection of the network security server hardware system and software system based on the current server operation safety factor, thereby realizing the synchronous detection and processing of the network security server system hardware and software, and improving the safety of the network security server system.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A blockchain-based network security server system includes a central processing unit, wherein the central processing unit is connected to an operation monitoring module, a data analysis module, and a security protection module;

[0008] The operation detection module is used to monitor the server operation and maintenance environment and obtain the server operation data information;

[0009] The data analysis module is used to analyze and process the operation data information of the server to obtain the current server operation safety factor;

[0010] The security protection module completes the synchronous detection of the hardware system and software system of the network security server based on the current server operation safety factor.

[0011] As a further solution of the present invention: the operation detection module includes a file transceiver unit, a file transmission unit and a program loading unit;

[0012] The file sending and receiving unit is used to obtain the file sending and receiving speed of the server;

[0013] The file transfer unit is used to obtain the server file opening speed;

[0014] The program loading unit is used to obtain the server program loading speed.

[0015] As a further solution of the present invention: the data analysis module processes the operation data information as follows:

[0016] Step 1: The data analysis module marks the received file sending and receiving speed as V1, the file opening speed as V2, and the program loading speed as V3;

[0017] Step 2: Use the formula Get the running speed Vi of the server, where α, β, and γ are the preset fixed values ​​of the proportional coefficients, and θ is the correction coefficient, which is 0.341256.

[0018] As a further solution of the present invention: the storage space in the system is counted by the storage measurement unit in the central processing unit, and the server storage space occupancy rate is marked as Ci;

[0019] Get the number of home links and external links opened by the server, and get the server DNS resolution time based on the home links and external links, marked as Ji;

[0020] Weights are assigned to the server's operating speed, server storage space occupancy, and server DNS resolution time. The weight of the server's operating speed is marked as q1, the weight of the server storage space occupancy is marked as q2, and the weight of the server DNS resolution time is marked as q3, where q1+q2+q3=1;

[0021] The server operation safety factor Qi is calculated by the formula Qi=Vi×q1+Vi×q2+Vi×q3;

[0022] When the operating safety factor Qi is less than or equal to the preset safety factor threshold, it means that there are safety risks in the network security server system, and a risk signal is generated. The data analysis module transmits the risk signal to the central processor, and the central processor sends the risk signal to the security protection module. The security protection module performs security detection and processing on the current network security server system;

[0023] When the operation safety factor Qi is greater than the preset safety factor threshold, it means that the current network security server system is running safely, and a safety signal is generated. The data analysis module transmits the risk signal to the central processor.

[0024] As a further solution of the present invention: DNS resolution includes the number of reciprocating analyses and the time spent on each analysis, and the sum of the two is the DNS resolution time.

[0025] As a further solution of the present invention: after the security protection module receives the risk signal transmitted by the central processor, the virus detection unit of the security protection module performs virus detection on the server software system, and the external detection unit of the security protection module detects the server hardware system.

[0026] As a further solution of the present invention: the virus detection unit transmits the suspicious files, network information and black and white lists received by the server to the central processor, and the central processor compares the received suspicious file information, network information and black and white list information with the standard file information, network information and black and white list information;

[0027] If one or more of the received suspicious file information, network information and black and white list information are abnormal, the central processing unit generates a virus detection abnormality signal, and the central processing unit sends the virus detection abnormality signal to the user end.

[0028] As a further solution of the present invention: the external detection unit detects the server hardware system by processing the maximum voltage, maximum temperature and abnormal sound decibel value when the server chassis is running, thereby obtaining the working condition of the server chassis and sending the working condition to the user end.

[0029] As a further solution of the present invention: the network security server system also includes a data encryption module, and the data encryption module is used for encryption during data transmission.

[0030] As a further solution of the present invention: the network security server system also includes a traffic statistics module for collecting statistics on the traffic data in the server.

[0031] Beneficial effects of the present invention:

[0032] (1) The present invention detects data during the operation of the network security server system through an operation detection module, analyzes and processes the operation status of the current network security server system according to the operation data information through a data analysis module, and analyzes the abnormal cause of the network security server system under abnormal conditions through a security protection module. The abnormal cause analysis is processed in two dimensions, namely, a hardware module and a software module, so that the abnormal cause of the network security server system is fed back to the user end, and the user end implements accurate targeted processing based on the analysis result of the security protection module;

[0033] (2) The present invention sets a data encryption module in the network security server system, and implements encryption during data transmission through the data encryption module, thereby making data transmission in the network security server system more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The present invention will be further described below in conjunction with the accompanying drawings.

[0035] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] See also Figure 1 As shown, the present invention is a network security server system based on blockchain, including a central processing unit, an operation monitoring module, a data analysis module and a security protection module;

[0038] The operation detection module is used to monitor the server operation and maintenance environment and obtain the server operation data information;

[0039] The data analysis module is used to analyze and process the server's operating data information to obtain the current server operation safety factor;

[0040] The security protection module completes the synchronous detection of the network security server hardware system and software system based on the current server operation safety factor.

[0041] The operation detection module includes a file receiving and sending unit, a file transmission unit and a program loading unit; the operation data information obtained through the operation detection module includes file receiving and sending speed, file opening speed and program loading speed.

[0042] The central processing unit receives the operation data information transmitted by the operation detection module and sends the operation data information to the data analysis module. The data analysis module processes the operation data information as follows:

[0043] Step 1: The data analysis module marks the received file sending and receiving speed as V1, the file opening speed as V2, and the program loading speed as V3;

[0044] Step 2: Use the formula Get the running speed Vi of the server, where α, β, and γ are the preset fixed values ​​of the proportional coefficients, and θ is the correction coefficient, which is 0.341256;

[0045] Step 3: The storage space in the system is counted by the storage measurement unit in the central processing unit, and the server storage space occupancy rate is marked as Ci;

[0046] Step 4: Obtain the number of local links and external links opened by the server, and obtain the server DNS resolution time based on the local links and external links, marked as Ji;

[0047] DNS resolution includes the number of round-trip analyses and the time spent on each analysis. The sum of the two is the DNS resolution time.

[0048] Step 5: Weight the server's operating speed, server storage space occupancy rate, and server DNS resolution time. The weight of the server's operating speed is marked as q1, the weight of the server's storage space occupancy rate is marked as q2, and the weight of the server's DNS resolution time is marked as q3, where q1+q2+q3=1;

[0049] The server operation safety factor Qi is calculated by the formula Qi=Vi×q1+Vi×q2+Vi×q3;

[0050] Step 6: When the operating safety factor Qi is less than or equal to the preset safety factor threshold, it means that there is a security risk in the network security server system, and a risk signal is generated. The data analysis module transmits the risk signal to the central processing unit, and the central processing unit sends the risk signal to the security protection module. The security protection module performs security detection and processing on the current network security server system;

[0051] When the operation safety factor Qi is greater than the preset safety factor threshold, it means that the current network security server system is running safely, and a safety signal is generated. The data analysis module transmits the risk signal to the central processor.

[0052] After receiving the risk signal transmitted by the central processor, the security protection module performs virus detection on the server software system through the virus detection unit of the security protection module, and at the same time, detects the server hardware system (server chassis) through the external detection unit of the security protection module;

[0053] The virus detection unit transmits the suspicious files, network information, and black and white lists received by the server to the central processor, and the central processor compares the received suspicious file information, network information, and black and white list information with the standard file information, network information, and black and white list information:

[0054] If one or more of the received suspicious file information, network information and black and white list information are abnormal, the central processing unit generates a virus detection abnormality signal, and the central processing unit sends the virus detection abnormality signal to the user end.

[0055] The CPU determines the type of virus attack based on the abnormal virus detection signal, specifically:

[0056] The types of virus attacks on the server are divided into access-end attack types and attacker-end attack types. The access-end attack types include IP address attacks and IP port attacks, and the attacker-end attack types include service request sender attacks and third-party attacks.

[0057] A third-party attack is a type of third-party attack launched by a server or client. The attack source of a third-party attack is generated by an external third party and forwarded to the server through the server or client.

[0058] The attack on the service request sender is that the server or client is invaded due to poisoning, and the server or client generates an attack event and sends it to the server;

[0059] The central processing unit sends the detected virus attack type to the user end, so that the user end can perform anti-virus processing on different virus attack types.

[0060] The external detection unit is used to monitor the operation data of the server chassis, and the operation data of the server chassis includes the maximum voltage when the server chassis is running, the maximum temperature of the server chassis, and the decibel value of abnormal sound when the server chassis is working;

[0061] The specific external detection unit detects and processes the server chassis as follows:

[0062] SS1: obtain the maximum voltage of the server chassis when it is running, and mark the maximum voltage of the server chassis when it is running as VD i;

[0063] SS2: Get the maximum temperature of the server chassis and mark it as WD i;

[0064] SS3: Obtain the abnormal sound decibel value when the server chassis is working, and mark the abnormal sound decibel value when the server chassis is working as ED i;

[0065] SS4: By formula Obtain the operating coefficient PD i of the server chassis, where b1, b2 and b3 are all preset proportional coefficients, and b1>b2>b3>0;

[0066] SS5: Compare the operating factor PD i of the server chassis with the operating factor threshold:

[0067] If the operation coefficient PD i of the server chassis ≥ the operation coefficient threshold, it is determined that the server chassis is operating normally, a normal operation signal is generated, and the normal operation signal is sent to the user end;

[0068] If the operation coefficient PD i of the server chassis is less than the operation coefficient threshold, the server chassis is determined to be operating abnormally, an operation abnormality signal is generated, and the operation abnormality signal is sent to the user end, and the user end matches and selects maintenance personnel for the server chassis.

[0069] In another specific embodiment, the network security server system further includes a data encryption module, which is used for encryption during data transmission, specifically:

[0070] S1: The data encryption module generates a key pair, where the character standard consists of characters and values, and each character corresponds to a unique value;

[0071] S2: Use the public key of the key pair to encrypt the file data transmitted by the server. When the file data is text, identify the characters in the text, match the identified characters with the character standard to obtain the numerical values ​​corresponding to the characters, and convert the characters in the text into numerical values ​​in sequence to obtain a conversion number book; when the file data is a video, extract each frame in the video to obtain a number of pictures, magnify the obtained pictures several times to form a pixel grid picture, establish a plane rectangular coordinate system for the pixel grid picture, obtain the coordinates of each pixel grid in the pixel grid picture, the coordinates include a horizontal coordinate and a numerical coordinate, perform color identification on the pixel grid, set all colors to correspond to a unique color number value, wherein the color number value and the numerical value corresponding to the character are not repeated, match the identified color with all colors to obtain the corresponding pixel grid color number value; form a pixel grid triple with the pixel grid coordinate and the pixel grid color number; form a conversion number book with the pixel grid triple in the order of the pixel grid picture;

[0072] S3: Convert the conversion number book, select a white blank image, select the center point of the blank image, set several rays with equal angles with the center point as the center of the circle, select one of the rays as the baseline, take the center of the circle as the starting point, intercept a baseline segment on the baseline, so that the length value of the baseline segment is equal to the first value in the conversion number book, intercept the rays adjacent to the baseline in a clockwise direction, so that the length value of the intercepted segment is equal to the second value in the conversion number book, and so on; connect the endpoints of the intercepted segment together to obtain the encrypted image, and obtain all encrypted images through the conversion number book.

[0073] In another specific embodiment, the network security server system also includes a traffic statistics module, which uses the original data packet header information to perform traffic statistics, and performs traffic statistics on each external connection of the server. It extracts the IP and port number feature information of the communicating parties to participate in the hash function operation, uses a step-size doubling algorithm to resolve hash conflicts, and uses the message length field value in the packet header to update the cumulative traffic of the connection.

[0074] In another specific embodiment, the network security server system also includes a timed inspection module for regularly auditing and monitoring traffic entering the server, proposing suggestions for handling abnormal traffic, and redirecting it to the security protection module.

[0075] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A network security server system based on blockchain, characterized in that: It includes a central processing unit, and the central processing unit is connected to an operation monitoring module, a data analysis module and a safety protection module; The operation detection module is used to monitor the server operation and maintenance environment and obtain the server operation data information; The data analysis module is used to analyze and process the operation data information of the server to obtain the current server operation safety factor; The security protection module completes the synchronous detection of the hardware system and software system of the network security server based on the current server operation safety factor.

2. According to claim 1, a network security server system based on blockchain is characterized in that: The operation detection module includes a file transceiver unit, a file transmission unit and a program loading unit; The file sending and receiving unit is used to obtain the file sending and receiving speed of the server; The file transfer unit is used to obtain the server file opening speed; The program loading unit is used to obtain the server program loading speed.

3. A blockchain-based network security server system according to claim 2, characterized in that: The data analysis module processes the operation data information as follows: Step 1: The data analysis module marks the received file sending and receiving speed as V1, the file opening speed as V2, and the program loading speed as V3; Step 2: Use the formula Get the running speed Vi of the server, where α, β, and γ are the preset fixed values ​​of the proportional coefficients, and θ is the correction coefficient, which is 0.341256.

4. A blockchain-based network security server system according to claim 3, characterized in that: The storage space in the system is counted by the storage measurement unit in the central processor, and the server storage space occupancy rate is marked as Ci; Get the number of home links and external links opened by the server, and get the server DNS resolution time based on the home links and external links, marked as Ji; Weights are assigned to the server's operating speed, server storage space occupancy, and server DNS resolution time. The weight of the server's operating speed is marked as q1, the weight of the server storage space occupancy is marked as q2, and the weight of the server DNS resolution time is marked as q3, where q1+q2+q3=1; The server operation safety factor Qi is calculated by the formula Qi=Vi×q1+Vi×q2+Vi×q3; When the operating safety factor Qi is less than or equal to the preset safety factor threshold, it means that there are safety risks in the network security server system, and a risk signal is generated. The data analysis module transmits the risk signal to the central processor, and the central processor sends the risk signal to the security protection module. The security protection module performs security detection and processing on the current network security server system; When the operating safety factor Qi is greater than the preset safety factor threshold, it means that the current network security server system is operating safely, and a safety signal is generated. The data analysis module transmits the risk signal to the central processor.

5. A blockchain-based network security server system according to claim 4, characterized in that: DNS resolution includes the number of round-trip analyses and the time spent on each analysis. The sum of the two is the DNS resolution time.

6. A blockchain-based network security server system according to claim 4, characterized in that: After the security protection module receives the risk signal transmitted by the central processing unit, the virus detection unit of the security protection module performs virus detection on the server software system, and the external detection unit of the security protection module detects the server hardware system.

7. A blockchain-based network security server system according to claim 6, characterized in that: The virus detection unit transmits the suspicious files, network information and black and white lists received by the server to the central processor, and the central processor compares the received suspicious file information, network information and black and white list information with the standard file information, network information and black and white list information; If one or more of the received suspicious file information, network information and black and white list information are abnormal, the central processing unit generates a virus detection abnormality signal, and the central processing unit sends the virus detection abnormality signal to the user end.

8. A blockchain-based network security server system according to claim 6, characterized in that: The external detection unit detects the server hardware system by processing the maximum voltage, maximum temperature and abnormal noise decibel value when the server chassis is running, thereby obtaining the working condition of the server chassis and sending the working condition to the user end.

9. A blockchain-based network security server system according to claim 1, characterized in that: The network security server system also includes a data encryption module, which is used for encryption during data transmission.

10. A blockchain-based network security server system according to claim 1, characterized in that: The network security server system also includes a traffic statistics module for collecting statistics on traffic data in the server.

Images