Security management system for hosting multiple internal websites of public cloud
By deploying the log collection module and management module on the public cloud, and automatically comparing the client IP list, the problem of low website management efficiency and security in the public cloud environment is solved, and efficient and secure management of internal websites is achieved.
Patent Information
- Application Number
- CN202411176410.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-26
- Publication Date
- 2024-12-20
AI Technical Summary
In a public cloud environment, the network management efficiency and security of hosting multiple websites is low, and existing manual control methods are prone to omissions, reducing management efficiency and security.
A security management system hosting multiple internal websites of the public cloud was designed, including a log collection module, a log transmission storage module and a management module. By deploying a log collection module on a load balancing host, log collection and obtaining a client IP list from it. Compare with the client IP list in the public cloud security group to achieve automated security management of internal websites.
It realizes automatic management of access control of internal websites, reduces the workload and error probability of manual operations, and improves management efficiency and security.
Smart Images
Figure CN119172108A_ABST
Abstract
Description
Background Art
[0002] In a public cloud environment, hosting multiple websites requires effective network management methods to ensure the security and access control of each website. The current solution is to manually control the access of each website, which may lead to omissions and further reduce the efficiency and security of management. Summary of the invention
[0003] In order to overcome the problems of low management efficiency and security of various websites in a public cloud environment, the present invention provides a security management system for hosting multiple internal websites of a public cloud.
[0004] In a first aspect, in order to solve the above technical problems, the present invention provides a security management system for hosting multiple internal websites of a public cloud, comprising: at least one log collection module, a log transmission storage module and a management module; different log collection modules are deployed on different load balancing hosts on the public cloud, and are used to collect logs of the website load balancing hosts; the log transmission storage module is respectively connected to each of the log collection modules and the management module, and is used to transmit and store logs; each of the load balancing hosts corresponds to a public cloud security group, wherein the public cloud security group defines a client IP list that is allowed to access all internal websites on the load balancing host;
[0005] The management module is specifically used for:
[0006] Obtain all the stored logs from the log transmission storage module, and obtain all client IPs that have visited the internal website from the logs to determine a client IP list;
[0007] The client IP list corresponding to the current load balancing host obtained from the public cloud security group is compared with the client IP list corresponding to the current balancing host, and security management is performed on all internal websites corresponding to the current balancing host in the public cloud.
[0008] The beneficial effect of the present invention is that logs are collected by log collection modules deployed on different load balancing hosts on the public cloud, and all client IPs that have visited internal websites are obtained from the collected logs to obtain a client IP list, and the client IP list obtained from the public cloud security group can be compared with the client IP list, thereby performing security management on all internal websites of the load balancing host. The present application realizes the automated management of access control to internal websites, reduces the workload and error probability of manual operations, and improves management efficiency and security. BRIEF DESCRIPTION OF THE DRAWINGS
[0009] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the present invention is further described below in conjunction with the accompanying drawings and embodiments.
[0010] Figure 1 A schematic diagram of the structure of a security management system for hosting multiple internal websites of a public cloud according to an embodiment of the present invention;
[0011] Figure 2 This is a schematic diagram of the structure of a security management system for hosting multiple internal websites in a public cloud according to another embodiment of the present invention. DETAILED DESCRIPTION
[0012] The following examples are provided to further explain and supplement the present invention and do not constitute any limitation to the present invention.
[0013] A security management system for hosting multiple internal websites of a public cloud according to an embodiment of the present invention is described below with reference to the accompanying drawings.
[0014] like Figure 1 As shown, the present invention provides a security management system for hosting multiple internal websites of a public cloud, comprising: at least one log collection module, a log transmission storage module and a management module; different log collection modules are deployed on different load balancing hosts on the public cloud, and are used to collect logs of the website load balancing hosts; the log transmission storage module is respectively connected to each of the log collection modules and the management module, and is used to transmit and store logs; each of the load balancing hosts corresponds to a public cloud security group, wherein the public cloud security group defines a client IP list that is allowed to access all internal websites on the load balancing host;
[0015] The management module is specifically used for:
[0016] Obtain all the stored logs from the log transmission storage module, and obtain all client IPs that have visited the internal website from the logs to determine a client IP list;
[0017] The client IP list corresponding to the current load balancing host obtained from the public cloud security group is compared with the client IP list corresponding to the current balancing host, and security management is performed on all internal websites corresponding to the current balancing host in the public cloud.
[0018] In this embodiment, logs are collected by the log collection module deployed on different load balancing hosts on the public cloud, and all client IPs that have visited the internal website are obtained from the collected logs to obtain a client IP list, which can be compared with the client IP list obtained from the public cloud security group, thereby performing security management on all internal websites of the load balancing host. This application realizes the automated management of access control to internal websites, reduces the workload and error probability of manual operations, and improves management efficiency and security.
[0019] In this embodiment, the log collection module can be a Filebeat lightweight log transmission tool, which is used to monitor and collect data in log files.
[0020] In this embodiment, the log transmission storage module can be a Logstash data processing pipeline, a Redis high-performance key-value pair storage database, and an Elasticsearch distributed search and analysis engine; wherein:
[0021] The role of Logstash is to collect log and event data from various sources, filter and parse them, and then transmit them to storage engines such as Elasticsearch.
[0022] The function of Redis is to provide fast data read and write operations, and it is often used in scenarios such as caching, session management, and real-time data processing.
[0023] Elasticsearch is used to store, search, and analyze massive amounts of data.
[0024] Based on the above, Filebeat outputs the collected logs to the Redis queue, and Logstash stores the logs in the Redis queue in Elasticsearch.
[0025] Optionally, the management module is specifically used to:
[0026] Compare the client IP list corresponding to the current load balancing host obtained from the public cloud security group with the client IP list corresponding to the current load balancing host, update the client IP list corresponding to the current load balancing host, and determine a new client IP list corresponding to the current load balancing host;
[0027] According to the new client IP list corresponding to the current load balancing host, security management is performed on all internal websites corresponding to the current load balancing host.
[0028] In this embodiment, the public cloud security group is a firewall-like virtual service provided by the public cloud, which provides relevant API calls for security group content management.
[0029] In this embodiment, the client IP list stores the client IPs that are allowed to access all internal websites corresponding to the load balancing host. Therefore, by obtaining the client IP list from the log, it is possible to accurately know the access status of each client IP in the client IP list to the internal website, and then update and manage the client list to improve the security of the internal website.
[0030] Optionally, the management module is specifically used to:
[0031] The client IP list corresponding to the current load balancing host obtained from the public cloud security group is compared with the client IP list corresponding to the current balancing host, and the client IPs in the client IP list corresponding to the current load balancing host that have no access records for more than a first preset time are cleared to determine a new client IP list corresponding to the current load balancing host.
[0032] In this embodiment, the first preset time period can be set according to actual conditions. Preferably, in this embodiment, the first preset time period is 7 days or 30 days. That is, if the client IP has not visited the internal website for more than 7 days or 30 days, the client IP will be deleted from the client IP list to improve the security of the internal website.
[0033] In this embodiment, by obtaining the client IP list from the log, the access status of each client IP in the client IP list to the internal website is clearly and accurately obtained, thereby eliminating some client IPs that have not visited the internal website for a long time to improve the security of the internal website.
[0034] Optionally, the management module is further used to:
[0035] Determine the access rights of all internal websites corresponding to the current load balancing host by calling the public cloud security group corresponding to the current load balancing host;
[0036] Based on the access permissions of all internal websites corresponding to the current load balancing host, security management is performed on all internal websites corresponding to the current load balancing host in the public cloud.
[0037] In this embodiment, if the public cloud security group opens the port of the internal website corresponding to the load balancing host, the internal website allows each client IP in its client IP list to access it. Therefore, the management module calls the public cloud security group to directly obtain whether the internal website corresponding to the load balancing host has opened access rights.
[0038] Optionally, the management module is specifically used to:
[0039] By calling the policy of the public cloud security group corresponding to the current load balancing host, it is determined whether the current internal URL corresponding to the current load balancing host is temporarily open to the Internet;
[0040] If the current internal URL corresponding to the current load balancing host is judged to be temporarily open to the Internet, an alarm message is sent to the administrator.
[0041] In this embodiment, by calling the public cloud security group, the access rights of the internal website can be viewed, so that the internal website address can be securely managed according to its access rights, thereby achieving effective management of the temporary opening requirements of the internal website and avoiding the risk of forgetting to close the temporary access rights.
[0042] Optionally, the management module is specifically used to:
[0043] If the current internal website corresponding to the current load balancing host is determined to be temporarily open to the Internet, an alarm email is sent to the administrator every second preset time period until the current internal website corresponding to the current load balancing returns to the restricted IP access state.
[0044] In this embodiment, the second preset time period can be set according to actual conditions. Preferably, in this embodiment, the second preset time period is 24 hours, that is, an alarm is issued every 24 hours to remind relevant personnel that the access rights corresponding to the current load balancing host are open Internet access, and to adjust the internal website permissions back to the restricted IP access state as soon as possible to avoid security issues caused by long-term open Internet access.
[0045] Optionally, the log transmission storage module includes a log cleaning module, a queue module and a storage module, wherein:
[0046] The queue module is used to store logs;
[0047] The log cleaning module is used to clean the logs and store them in the storage module.
[0048] In this embodiment, the logs are cleaned to ensure that all logs meet the requirements, thereby improving the efficiency and accuracy of subsequent website management.
[0049] Optionally, the log cleaning module is specifically used to:
[0050] The log is cleaned and stored in the storage module; wherein the cleaning process includes:
[0051] Filter the access logs of discard monitoring and CDN origin survival detection from the collected logs;
[0052] Format logs uniformly;
[0053] Add the location attribute to the access client IP.
[0054] In this embodiment, the cleaning mainly does three things: 1. Filter and discard monitoring, CDN (Content Distribution Network) source station survival detection and other access logs; 2. Format the unified log format. For example, if a website is connected to the CDN, it is necessary to obtain the client IP from the HTTP header so that the client IP is correct regardless of whether the website is connected to the CDN or not; 3. Query the location through the IP and add the location to the log.
[0055] Alternatively, if Figure 2 As shown, another embodiment is used to describe a security management system for hosting multiple internal websites of a public cloud, as follows:
[0056] Install Filebeat on all load balancing hosts on the public cloud for log collection.
[0057] Filebeat outputs the collected logs to the Redis queue.
[0058] Logstash cleans all logs in the Redis queue and stores them in Elasticsearch.
[0059] The management module obtains all logs from Elasticsearch and obtains the access client IP from the logs.
[0060] The management module is linked to the public cloud security group, and compares the client IP list corresponding to the current load balancing host obtained from the public cloud security group with the client IP list corresponding to the current load balancing host, thereby deleting the client IP in the client IP list that has no access record for more than 7 days from the client IP list.
[0061] In addition, the management module also links with the public cloud security group to obtain the access rights of each internal website corresponding to the current load balancing host. If any internal website is temporarily opened to the Internet, an alarm email will be sent to the administrator every 24 hours until the internal website changes back to the restricted IP access status.
[0062] Those skilled in the art know that the present invention can be implemented as a system, method or computer program product. Therefore, the present disclosure can be specifically implemented in the following forms, namely: it can be complete hardware, it can be complete software (including firmware, resident software, microcode, etc.), or it can be a combination of hardware and software, generally referred to as "circuit", "module" or "system" herein. In addition, in some embodiments, the present invention can also be implemented in the form of a computer program product in one or more computer-readable media, and the computer-readable medium contains computer-readable program code. Computer-readable storage media can be, for example, but not limited to - electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above.
[0063] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.
[0064] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.
Claims
1. A security management system for hosting multiple internal websites on a public cloud. It is characterized in that include: At least one log collection module, log transmission storage module and management module; different log collection modules are deployed on different load balancing hosts on the public cloud, and are used to collect logs of the website load balancing hosts; the log transmission storage module is respectively connected to each log collection module and the management module, and is used to transmit and store logs; each load balancing host corresponds to a public cloud security group, wherein the public cloud security group defines a client IP list that is allowed to access all internal websites on the load balancing host; The management module is specifically used for: Obtain all the stored logs from the log transmission storage module, and obtain all client IPs that have visited the internal website from the logs to determine a client IP list; The client IP list corresponding to the current load balancing host obtained from the public cloud security group is compared with the client IP list corresponding to the current balancing host, and security management is performed on all internal websites corresponding to the current balancing host in the public cloud.
2. The system according to claim 1, It is characterized in that The management module is specifically used for: Compare the client IP list corresponding to the current load balancing host obtained from the public cloud security group with the client IP list corresponding to the current load balancing host, update the client IP list corresponding to the current load balancing host, and determine a new client IP list corresponding to the current load balancing host; According to the new client IP list corresponding to the current load balancing host, security management is performed on all internal websites corresponding to the current load balancing host.
3. The system according to claim 2, It is characterized in that The management module is specifically used for: The client IP list corresponding to the current load balancing host obtained from the public cloud security group is compared with the client IP list corresponding to the current balancing host, and the client IPs in the client IP list corresponding to the current load balancing host that have no access records for more than a first preset time are cleared to determine a new client IP list corresponding to the current load balancing host.
4. The system according to claim 1, It is characterized in that The management module is further used for: Determine the access rights of all internal websites corresponding to the current load balancing host by calling the public cloud security group corresponding to the current load balancing host; Based on the access permissions of all internal websites corresponding to the current load balancing host, security management is performed on all internal websites corresponding to the current load balancing host in the public cloud.
5. The system according to claim 4, It is characterized in that The management module is specifically used for: By calling the policy of the public cloud security group corresponding to the current load balancing host, it is determined whether the current internal URL corresponding to the current load balancing host is temporarily open to the Internet; If the current internal URL corresponding to the current load balancing host is judged to be temporarily open to the Internet, an alarm message is sent to the administrator.
6. The system according to claim 5, It is characterized in that The management module is specifically used for: If the current internal website corresponding to the current load balancing host is determined to be temporarily open to the Internet, an alarm email is sent to the administrator every second preset time period until the current internal website corresponding to the current load balancing returns to the restricted IP access state.
7. The system according to claim 1, It is characterized in that The log transmission storage module includes a log cleaning module, a queue module and a storage module, wherein: The queue module is used to store logs; The log cleaning module is used to clean the logs and store them in the storage module.
8. The system according to claim 7, It is characterized in that The log cleaning module is specifically used for: The log is cleaned and stored in the storage module; wherein the cleaning process includes: Filter the access logs of discard monitoring and CDN origin survival detection from the collected logs; Format logs uniformly; Add the location attribute to the access client IP.
9. The system according to claim 7, It is characterized in that The log collection module is Filebeat.
10. The system according to claim 7, It is characterized in that The queue module is Redis, the log cleaning module is Logstash, and the storage module is Elasticsearch.