Security operation and maintenance auditing method and system based on network element management and micro-isolation technology

Abstract

The invention provides a security operation and maintenance auditing method and system based on a network element management and micro-isolation technology, and relates to the technical field of information security and operation and maintenance management, and the method comprises the steps: guaranteeing the legality of an operation and maintenance user through identity authentication, and then carrying out the authority review and behavior recording of a remote operation and maintenance request. And creating an isolated network group environment by using the network element management module, dynamically adjusting resources and executing network micro-isolation according to a strategy. Application access of the operation and maintenance terminal needs to be authorized through the service micro-isolation agent, it is ensured that only an authorization request can reach a network target, unauthorized access is effectively prevented, and operation and maintenance safety is enhanced. Through comprehensive application of identity authentication, network element management and micro-isolation technologies, strict verification of the identity of the operation and maintenance user and fine isolation of the operation and maintenance terminal and the network target are realized, the security and protection capability of the operation and maintenance environment are remarkably improved, and the blank of security protection of the operation and maintenance terminal is filled.

Description

Technical Field

[0001] The present invention relates to the field of information security and operation and maintenance management technology, and in particular to a security operation and maintenance audit method and system based on network element management and micro-isolation technology. Background Art

[0002] With the rapid development of information technology, the degree of enterprise informatization is deepening. As a key link to ensure the stable operation and efficient maintenance of the system, the security and compliance of operation and maintenance activities have become the focus of enterprise attention. As an important means to ensure the security of operation and maintenance, the traditional security operation and maintenance audit system effectively improves the controllability, traceability and compliance of operation and maintenance operations through core functions such as centralized account management, centralized authentication management, centralized authorization management and centralized operation audit. The system implements single sign-on through a globally unique identity to ensure that operation and maintenance activities cannot bypass the audit system; at the same time, the introduction of multiple authentication methods further enhances the security of the system and effectively resists the intrusion of illegal users. In addition, the fine-grained authorization strategy and the full-process operation audit mechanism enable the refined management of the authority of operation and maintenance personnel, and provide a strong basis for post-audit and accountability.

[0003] However, although the traditional security operation and maintenance audit system has achieved remarkable results in improving operation and maintenance security, it still has certain limitations. Specifically, the system mainly focuses on the safe use of existing, logged-in, and authorized operation and maintenance users, but it is unable to verify the legitimacy of the operation and maintenance user identity and isolate and protect the operation and maintenance terminal from the external network. When the operation and maintenance user is hijacked or the VPN information is leaked, the attacker may use the operation and maintenance link channel to upload illegal attack scripts to the operation and maintenance terminal device, thereby achieving device privilege escalation and network accessibility, posing a serious threat to the operation and maintenance system and even the entire network environment.

[0004] The root cause of this security risk is that traditional systems fail to adopt a permission minimization strategy. Once a user passes the authorization verification, he or she will gain unlimited access to the operation and maintenance terminal and its accessible network, leaving a protection gap in the accessible network and terminal targets outside the operation and maintenance terminal.

[0005] In view of this, a more advanced and comprehensive security operation and maintenance audit method and system is urgently needed to make up for the shortcomings of traditional systems. Summary of the invention

[0006] To this end, an embodiment of the present invention provides a secure operation and maintenance audit method and system based on network element management and micro-isolation technology, which is used to solve the problem in the prior art that the secure operation and maintenance audit system is difficult to verify the authenticity of the operation and maintenance user identity and fails to effectively isolate the operation and maintenance terminal from other network targets, thereby preventing security risks caused by the hijacking of the operation and maintenance user identity or bypassing of the access management system.

[0007] In order to solve the above problems, an embodiment of the present invention provides a security operation and maintenance audit method based on network element management and micro-isolation technology, the method comprising:

[0008] The operation and maintenance user logs in through the identity authentication privileged access management system. After verifying the operation and maintenance user information, the identity authentication privileged access management system displays the operation and maintenance terminal resources authorized to access to the operation and maintenance user;

[0009] Review the permissions of remote desktop operation and maintenance request links initiated by operation and maintenance users, and record operation and maintenance behaviors and goals;

[0010] The operation and maintenance request link enters the network element management module, which converts the user group mode into a network group mode based on network elements, creating an isolated resource usage environment for operation and maintenance users;

[0011] The network element management module dynamically adjusts network resources and obtains the network element control policy of the preset network group. It executes network micro-segmentation authorization according to the network element control policy and performs network micro-segmentation on the network access behavior of operation and maintenance users.

[0012] The operation and maintenance user uses the host application to initiate a request to a network target other than the operation and maintenance terminal. The request is forwarded through the network element management module for network micro-isolation authorization. If the requested target is not within the authorized network element, the access is not responded to, and network micro-isolation is completed.

[0013] The service micro-isolation agent deployed on the operation and maintenance terminal performs service micro-isolation on the application access behavior of the operation and maintenance user according to the network element management policy of the preset business group;

[0014] Operation and maintenance users can only send requests to network targets other than operation and maintenance terminals through host applications authorized by business micro-isolation. The request is forwarded through the network element management module after network micro-isolation authorization. If the requested target is not within the authorized network element, or the executed stand-alone business program is not authorized by business micro-isolation, the request will be rejected, the access will not be responded to, and business micro-isolation will be completed.

[0015] Preferably, the operation and maintenance user information includes user name, password, source address, source device, user fingerprint, login time period, availability, and client certificate.

[0016] Preferably, the network element management module is an independent packet device, including a switch or a firewall with network boundary computing capability.

[0017] Preferably, the specific forms of the network element include an operation and maintenance terminal, a terminal stand-alone service, a terminal browser service, and an integrated unit composed of a plurality of independent terminal stand-alone services.

[0018] Preferably, all services are communicated or self-executed within the network element.

[0019] Preferably, the network element control strategy of the preset network group includes: the operation of removing the operation and maintenance terminal from the network element will end the current operation and maintenance session and interrupt the ongoing terminal operation and maintenance behavior.

[0020] Preferably, the network element management strategy of the preset business group includes: any operation of the operation and maintenance terminal will be reviewed by the business micro-isolation agent program.

[0021] The embodiment of the present invention further provides a security operation and maintenance audit system based on network element management and micro-isolation technology, which is used to implement the security operation and maintenance audit method based on network element management and micro-isolation technology described above, specifically including:

[0022] The operation and maintenance user login and authentication unit is used for the operation and maintenance user to log in through the identity authentication privileged access management system. After the identity authentication privileged access management system verifies the operation and maintenance user information, it displays the operation and maintenance terminal resources authorized for access to the operation and maintenance user;

[0023] The remote desktop operation and maintenance request and permission review unit is used to review the permission of the remote desktop operation and maintenance request link initiated by the operation and maintenance user, and record the operation and maintenance behavior and operation and maintenance goals;

[0024] The network element management module is involved in the network element grouping unit, and is used for the operation and maintenance request link to enter the network element management module. The network element management module converts the user group mode into a network group mode based on network elements, and creates a mutually isolated resource use environment for operation and maintenance users;

[0025] Dynamic resource adjustment and network micro-isolation unit, which is used by the network element management module to dynamically adjust network resources, obtain the network element control policy of the preset network group, execute network micro-isolation authorization according to the network element control policy, and perform network micro-isolation on the network access behavior of the operation and maintenance user;

[0026] The business micro-isolation and access control unit is used for operation and maintenance users to use host applications to initiate requests to network targets other than operation and maintenance terminals. The request is forwarded through network micro-isolation authorization through the network element management module. If the requested target is not in the authorized network element, the access is not responded to, and the network micro-isolation is completed. The business micro-isolation agent deployed on the operation and maintenance terminal performs business micro-isolation on the application access behavior of the operation and maintenance user according to the network element management policy of the preset business group. The operation and maintenance user can only send requests to network targets other than the operation and maintenance terminal through host applications authorized by business micro-isolation. The request is forwarded through network micro-isolation authorization through the network element management module. If the requested target is not in the authorized network element, or the executed stand-alone business program is not authorized by business micro-isolation, the request will be rejected, the access will not be responded to, and the business micro-isolation is completed.

[0027] An embodiment of the present invention also provides an electronic device, which includes a processor, a memory and a bus system, wherein the processor and the memory are connected through the bus system, the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the above-mentioned security operation and maintenance audit method based on network element management and micro-isolation technology.

[0028] An embodiment of the present invention also provides a computer storage medium, which stores a computer software product. The computer software product includes a number of instructions for enabling a computer device to execute the above-mentioned security operation and maintenance audit method based on network element management and micro-isolation technology.

[0029] It can be seen from the above technical solutions that the present invention has the following beneficial effects:

[0030] (1) Enhanced identity authentication and resource isolation: Strict user identity verification is implemented through the identity authentication privileged access management system to ensure the authenticity of the operation and maintenance user identity. At the same time, the network element management module converts the user group mode into a network group mode based on network elements, creating an isolated resource usage environment for operation and maintenance users, effectively preventing the risk of bypassing the identity authentication privileged access management system and enhancing the security of the system.

[0031] (2) Refined network micro-isolation and business micro-isolation: The network element management module performs network micro-isolation according to the preset network group control policy, limiting the network access scope of the operation and maintenance users, ensuring that only authorized requests can access the target network element. In addition, the business micro-isolation agent further performs business micro-isolation on application access behavior, ensuring that only authorized applications can be executed, greatly reducing security risks. This dual isolation mechanism provides more refined and comprehensive security protection.

[0032] (3) Expanded operation and maintenance security management scope and enhanced protection capabilities: The present invention not only expands the security management scope from traditional operation and maintenance terminals to port applications or terminal application levels through the combination of network element management and micro-isolation technology, but also reduces the potential attack surface by shielding the network reachable range of the operation and maintenance terminal. This technological innovation fills the gap in the security protection of operation and maintenance terminals and significantly improves the security and protection capabilities of the operation and maintenance environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the implementation cases of the present invention or the technical solutions in the prior art, the following is a brief description of the drawings required for use in the embodiments. By referring to the drawings, the features and advantages of the present invention will be more clearly understood. The drawings are schematic and should not be understood as limiting the present invention in any way. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0034] Figure 1 A flowchart of a security operation and maintenance audit method based on network element management and micro-isolation technology provided in an embodiment;

[0035] Figure 2 A block diagram of a security operation and maintenance audit system based on network element management and micro-isolation technology provided in an embodiment. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] Embodiment 1

[0038] In order to solve the problem that the security operation and maintenance audit system in the existing technology is difficult to verify the authenticity of the operation and maintenance user identity and fails to effectively isolate the operation and maintenance terminal from other network targets, so as to prevent the security risks caused by bypassing the identity authentication privileged access management system. Figure 1 As shown, an embodiment of the present invention proposes a security operation and maintenance audit method based on network element management and micro-isolation technology, the method comprising:

[0039] Step S1: The operation and maintenance user logs in through the identity authentication privileged access management system. After the identity authentication privileged access management system verifies the operation and maintenance user information, it displays the operation and maintenance terminal resources authorized to access to the operation and maintenance user;

[0040] Step S2: review the permissions of the remote desktop operation and maintenance request link initiated by the operation and maintenance user, and record the operation and maintenance behavior and operation and maintenance goals;

[0041] Step S3: The operation and maintenance request link enters the network element management module, and the network element management module converts the user group mode into a network group mode based on network elements, creating a mutually isolated resource use environment for the operation and maintenance users;

[0042] Step S4: The network element management module dynamically adjusts network resources and obtains the network element control policy of the preset network group, executes network micro-segmentation authorization according to the network element control policy, and performs network micro-segmentation on the network access behavior of the operation and maintenance user;

[0043] Step S5: The operation and maintenance user uses the host application to initiate a request to a network target other than the operation and maintenance terminal. The request is forwarded through the network element management module for network micro-segmentation authorization. If the requested target is not within the authorized network element, the access is not responded to, and network micro-segmentation is completed.

[0044] Step S6: The service micro-isolation agent program deployed on the operation and maintenance terminal performs service micro-isolation on the application access behavior of the operation and maintenance user according to the network element management policy of the preset service group;

[0045] Step S7: The operation and maintenance user can only send requests to network targets other than the operation and maintenance terminal through the host application that has been authorized by business micro-isolation. The request is forwarded through the network element management module through network micro-isolation authorization. If the requested target is not in the authorized network element, or the executed stand-alone business program is not authorized by business micro-isolation, the request will be rejected, the access will not be responded to, and the business micro-isolation will be completed.

[0046] It can be seen from the above technical solution that the present invention proposes a secure operation and maintenance audit method based on network element management and micro-isolation technology, which effectively solves the problem of authenticity verification of operation and maintenance user identities and the problem of security isolation between operation and maintenance terminals and other network targets by strengthening identity authentication, refined network group division and dynamic resource isolation. This method not only improves the security of operation and maintenance operations, but also realizes all-round security control from user identity to network access to business applications. Its advantage is that it can significantly reduce the network attack surface when the operation and maintenance terminal is lost, reduce security risks such as identity information leakage, and expand the scope of operation and maintenance security governance, filling the deficiencies in the security protection of traditional operation and maintenance terminals, and providing a more solid security guarantee for the operation and maintenance environment.

[0047] In step S1, the operation and maintenance user logs in through the identity authentication privileged access management (PAM) system. The PAM system obtains and verifies the operation and maintenance user information being logged in, including user name, password, source address, source device, user fingerprint, login time period, availability, client certificate, etc. After the verification is passed, the PAM system displays the authorized access operation and maintenance terminal resources to the operation and maintenance user.

[0048] Among them, the PAM system plays a vital role in the security operation and maintenance audit method based on network element management and micro-isolation technology. Its main means of preventing bypass include:

[0049] Centralized account management: The PAM system provides a unified platform to manage the account information of all operation and maintenance users, including sensitive information such as usernames and passwords. This centralized management helps reduce the risk of password leakage and facilitates administrators to implement unified password policies, such as regular password changes and password complexity requirements.

[0050] Authentication management: The PAM system is responsible for verifying the identity of operation and maintenance users. When a user tries to log in to the system, PAM will collect and verify the user's authentication information, such as user name, password, source address, source device, user fingerprint, login time period, client certificate, etc. This multi-factor authentication mechanism can greatly improve the security of the system and prevent unauthorized access.

[0051] Authorization management: Once a user passes authentication, the PAM system will determine which resources the user can access based on the preset authorization policy. This includes determining the user's micro-isolation path access dependency, whether the user has the right to access a specific operation and maintenance terminal, network resources or application services, etc. Add user authentication information to the authorization management policy to generate a dynamically updated network element control policy. By distributing the network element control policy to network element management devices based on micro-isolation technology, it is ensured that operation and maintenance users can only access resources within the minimum permission range required for their work through the PAM system, thereby reducing the security risk of unauthorized access.

[0052] In summary, the identity authentication and privileged access management system plays a core role in the security operation and maintenance audit method and system based on network element management and micro-isolation technology. It provides strong security protection for the operation and maintenance environment through centralized account management, authentication management, authorization management and other functions.

[0053] In step S2, the remote desktop operation and maintenance request link initiated by the operation and maintenance user is reviewed for permissions to ensure that the user has the right to access the requested resources; at the same time, the operation and maintenance behavior and operation and maintenance goals are recorded to facilitate subsequent behavior audits.

[0054] In step S3, the operation and maintenance request link enters the network element management module, which converts the original user group mode based on the operation and maintenance terminal into a network group mode based on the network element, realizes fine-grained resource representation and access control, and creates a mutually isolated resource usage environment for operation and maintenance users.

[0055] The network element management module includes the following functions:

[0056] Network element grouping and conversion: The network element management module converts the original user group mode based on operation and maintenance terminals to a network group mode based on network elements. This means that the system will logically divide users, devices or services into smaller, independent network elements for more fine-grained access control and resource management.

[0057] Resource isolation environment: Through the network element management module, an isolated resource usage environment is created for operation and maintenance users. This isolation mechanism helps to reduce or block the network attack surface accessible to the operation and maintenance terminal when the operation and maintenance terminal is lost, thereby improving the overall security of the system.

[0058] Policy execution preparation: The network element management module prepares for subsequent access control and policy execution. It ensures that all access requests to resources will be verified and authorized through this module, thereby achieving comprehensive monitoring and management of operation and maintenance operations.

[0059] As an optional specific implementation method, the network element management module is an independent grouping device, which is generally in the form of a switch or firewall device with network boundary computing capabilities.

[0060] As an optional specific implementation method, the specific form of the network element includes an operation and maintenance terminal, a terminal stand-alone service, a terminal browser service, and a comprehensive unit composed of multiple independent terminal stand-alone services. Specifically, the present invention forms a network element with a certain operation and maintenance terminal, a certain terminal stand-alone service, or a certain terminal browser service, or with several independent terminal stand-alone services, and only allows the service to communicate or execute itself within the network element.

[0061] In step S4, based on the created isolated resource usage environment, the network element management module dynamically adjusts the network resources according to the actual situation, and obtains the network element control policy of the preset network group. The preset network element control policy of the network group includes: the operation of the operation and maintenance terminal being removed from the network element will end the current operation and maintenance session, interrupting the ongoing terminal operation and maintenance behavior, which is regarded as a security defense measure between the operation and maintenance terminals. The above method can realize refined management and access control of network resources, and improve the security and isolation of the network.

[0062] Furthermore, in the process of dynamically adjusting network resources, the network element management module will monitor the network status and user behavior in real time and adjust the strategy or resource allocation as needed. At the same time, it will also keep in sync with the security operation and maintenance audit system to ensure the timely update and effectiveness of the network element control strategy.

[0063] In this embodiment, in step S4, the network element management module executes network micro-isolation authorization according to the network element control policy of the preset network group, and performs network micro-isolation on the network access behavior of the operation and maintenance user.

[0064] Furthermore, when performing network micro-segmentation authorization, the network element management module will first verify the identity and permissions of the operation and maintenance user, and then determine whether the access request is legal based on the network element control policy. If the request is legal, it will be allowed to pass; otherwise, access will be denied and relevant logs will be recorded. In addition, the network element management module will also monitor and audit the access process to ensure the security and compliance of the access behavior.

[0065] From step S3 and step S4, it can be seen that the present invention provides a method for implementing resource management and access control based on network micro-isolation technology. This method dynamically adjusts network resources through a network element management module and performs network micro-isolation authorization according to a preset network element control policy to enhance the security and isolation of the network. The method includes the following steps:

[0066] Resource environment isolation: First, a mutually isolated resource usage environment is created. This isolation ensures the independence between different network groups or applications and reduces potential security threats.

[0067] Dynamic resource adjustment: The network element management module dynamically adjusts network resources according to the actual operation and needs of the network, including bandwidth allocation, routing selection, load balancing and other aspects to optimize network performance and resource utilization.

[0068] Network element control policy acquisition: The network element management module obtains network element control policies from the preset network groups. These policies define access rights and security rules within the network group, and are the basis for executing network micro-segmentation authorization.

[0069] Network micro-segmentation authorization: Based on the obtained network element control policy, the network element management module performs network micro-segmentation authorization. This means fine-grained control of the network access behavior of operation and maintenance users, allowing only access behaviors that comply with the policy to pass, thereby protecting sensitive resources or key applications.

[0070] Security operation and maintenance audit and terminal management: Network element control policies must be obtained from the security operation and maintenance audit system to ensure the effectiveness and compliance of the policies. At the same time, when the operation and maintenance terminal is removed from the network element, the operation and maintenance session will be ended and the ongoing terminal operation and maintenance behavior will be interrupted. This is an effective security defense measure that can prevent unauthorized access and operation.

[0071] In step S5, after logging into the operation and maintenance terminal, the operation and maintenance user uses the host application of the operation and maintenance terminal to initiate a request to a network target outside the operation and maintenance terminal. The request is forwarded through the network element management module to perform network micro-isolation authorization. If the requested target is not in the authorized network element, the access is not responded to, and the network micro-isolation is completed. Specifically, the network element management module checks whether the requested target is in the authorized network element list. If so, the request is forwarded to the target network; if not, the request is rejected and the access is not responded to, thereby achieving micro-isolation at the network level.

[0072] In step S6, the business micro-isolation agent deployed on the operation and maintenance terminal is used to obtain the network element management policy of the preset business group. The business micro-isolation agent is synchronized with the security operation and maintenance audit system to obtain the latest network element management policy in real time, wherein the network element management policy of the preset business group includes: any operation of the operation and maintenance terminal will be reviewed by the business micro-isolation agent.

[0073] In step S6, the business micro-isolation agent executes business micro-isolation authorization according to the network element management policy of the preset business group, and performs business micro-isolation on the application access behavior of the operation and maintenance user.

[0074] In step S7, after the operation and maintenance user logs in to the operation and maintenance terminal, the operation and maintenance user can only send requests to network targets outside the operation and maintenance terminal through the host application authorized by business micro-isolation. The request is forwarded through the network element management module through network micro-isolation authorization; if the requested target is not in the authorized network element, or the executed stand-alone business program is not authorized by business micro-isolation, the request will be rejected, the access will not be responded to, and the business micro-isolation will be completed.

[0075] Specifically, after the operation and maintenance user logs in to the operation and maintenance terminal, he will use the host application authorized by the business micro-isolation to execute the request to the network target. This process reflects the highly detailed access control and security policy implementation, ensuring the security of the system and the confidentiality of the data. The following is a detailed explanation of the process:

[0076] (1) Operation and maintenance user login: The operation and maintenance user logs in to the operation and maintenance terminal through an identity authentication mechanism (such as user name and password, two-factor authentication, etc.).

[0077] (2) Use authorized host applications: Users can only use host applications that have been authorized by business micro-segmentation. These applications have been designed to comply with specific security policies and standards.

[0078] (3) Initiating network requests: Users initiate requests to network targets other than the operation and maintenance terminal (such as databases, servers, other network devices, etc.) through authorized host applications.

[0079] (4) Network micro-segmentation authorized forwarding: The request is first sent to the network element management module, which is responsible for executing the network micro-segmentation policy. The network element management module checks whether the target IP address, port number and other information of the request are in the authorized network element list. If the target is in the authorized network element, the request will be forwarded to the target network; if not, the request will be rejected and the access will not be responded, thus achieving micro-segmentation at the network level.

[0080] (5) Business micro-segmentation authorization check: In addition to micro-segmentation at the network level, if the operation and maintenance user attempts to execute any stand-alone business program (such as locally installed software, scripts, etc.) on the operation and maintenance terminal, these operations will also be monitored and audited by the business micro-segmentation agent. The business micro-segmentation agent will check whether these operations have obtained the corresponding business micro-segmentation authorization. If the operation is unauthorized, the business micro-segmentation agent will block the operation and may record relevant logs or issue an alarm, thereby achieving micro-segmentation at the business level.

[0081] (6) Complete micro-isolation: Through the dual control of network micro-isolation and business micro-isolation, the system can ensure that only requests and operations that have been strictly authorized and reviewed can be executed. This micro-isolation mechanism effectively reduces the risk of unauthorized access and data leakage, and improves the overall security of the system.

[0082] In summary, this process shows how to implement strict management of network requests and business operations through fine-grained access control and security policy implementation in the operation and maintenance environment. It ensures that operation and maintenance activities are carried out within a safe and controllable scope, thereby protecting the security of systems and data.

[0083] Embodiment 2

[0084] like Figure 2 As shown, the present invention provides a security operation and maintenance audit system based on network element management and micro-isolation technology, which is used to implement the security operation and maintenance audit method based on network element management and micro-isolation technology of the above-mentioned embodiment 1, specifically including:

[0085] The operation and maintenance user login and authentication unit 100 is used for the operation and maintenance user to log in through the identity authentication privileged access management system. After the identity authentication privileged access management system verifies the operation and maintenance user information, it displays the operation and maintenance terminal resources authorized to access to the operation and maintenance user;

[0086] The remote desktop operation and maintenance request and authority review unit 200 is used to review the authority of the remote desktop operation and maintenance request link initiated by the operation and maintenance user, and record the operation and maintenance behavior and operation and maintenance goals;

[0087] The network element management module is involved in the network element grouping unit 300, which is used for the operation and maintenance request link to enter the network element management module. The network element management module converts the user group mode into a network group mode based on network elements, and creates a mutually isolated resource use environment for the operation and maintenance users;

[0088] The dynamic resource adjustment and network micro-isolation unit 400 is used for the network element management module to dynamically adjust network resources, obtain the network element control policy of the preset network group, execute network micro-isolation authorization according to the network element control policy, and perform network micro-isolation on the network access behavior of the operation and maintenance user;

[0089] The business micro-isolation and access control unit 500 is used for the operation and maintenance user to use the host application to initiate a request to the network target outside the operation and maintenance terminal. The request is forwarded through the network micro-isolation authorization through the network element management module; if the requested target is not in the authorized network element, the access is not responded to, and the network micro-isolation is completed; the business micro-isolation agent deployed on the operation and maintenance terminal performs business micro-isolation on the application access behavior of the operation and maintenance user according to the network element management policy of the preset business group; the operation and maintenance user can only send a request to the network target outside the operation and maintenance terminal through the host application authorized by the business micro-isolation, and the request is forwarded through the network micro-isolation authorization through the network element management module; if the requested target is not in the authorized network element, or the executed stand-alone business program is not authorized by the business micro-isolation, the request will be rejected, the access is not responded to, and the business micro-isolation is completed.

[0090] A security operation and maintenance audit system based on network element management and micro-isolation technology in this embodiment is used to implement the aforementioned security operation and maintenance audit method based on network element management and micro-isolation technology. Therefore, the specific implementation method of the security operation and maintenance audit system based on network element management and micro-isolation technology can be seen in the implementation example part of the security operation and maintenance audit method based on network element management and micro-isolation technology in the previous text. Therefore, its specific implementation method can refer to the description of the corresponding embodiments of each part. In order to avoid redundancy, it will not be repeated here.

[0091] Embodiment 3

[0092] An embodiment of the present invention provides an electronic device, which includes a processor, a memory and a bus system. The processor and the memory are connected through the bus system. The memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the above-mentioned security operation and maintenance audit method based on network element management and micro-isolation technology.

[0093] Embodiment 4

[0094] An embodiment of the present invention provides a computer storage medium, which stores a computer software product. The computer software product includes a number of instructions for enabling a computer device to execute the above-mentioned security operation and maintenance audit method based on network element management and micro-isolation technology.

[0095] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0096] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0097] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0098] Obviously, the above embodiments are merely examples for clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from them are still within the protection scope of the invention.

Claims

1. A security operation and maintenance audit method based on network element management and micro-isolation technology, characterized in that: include: The operation and maintenance user logs in through the identity authentication privileged access management system. After verifying the operation and maintenance user information, the identity authentication privileged access management system displays the operation and maintenance terminal resources authorized to access to the operation and maintenance user; Review the permissions of remote desktop operation and maintenance request links initiated by operation and maintenance users, and record operation and maintenance behaviors and goals; The operation and maintenance request link enters the network element management module, which converts the user group mode into a network group mode based on network elements, creating an isolated resource usage environment for operation and maintenance users; The network element management module dynamically adjusts network resources and obtains the network element control policy of the preset network group. It executes network micro-segmentation authorization according to the network element control policy and performs network micro-segmentation on the network access behavior of operation and maintenance users. The operation and maintenance user uses the host application to initiate a request to a network target other than the operation and maintenance terminal. The request is forwarded through the network element management module for network micro-isolation authorization. If the target of the request is not within the authorized network element, the access is not responded to, and network micro-isolation is completed; The service micro-isolation agent deployed on the operation and maintenance terminal performs service micro-isolation on the application access behavior of the operation and maintenance user according to the network element management policy of the preset business group; Operation and maintenance users can only send requests to network targets other than operation and maintenance terminals through host applications that have been authorized by business micro-segmentation. The request is forwarded through network micro-segmentation authorization by the network element management module. If the target of the request is not within the authorized network element, or the executed stand-alone business program is not authorized by business micro-isolation, the request will be rejected, the access will not be responded to, and business micro-isolation will be completed.

2. The security operation and maintenance audit method based on network element management and micro-isolation technology according to claim 1 is characterized in that: The operation and maintenance user information includes user name, password, source address, source device, user fingerprint, login time period, availability and client certificate.

3. The security operation and maintenance audit method based on network element management and micro-isolation technology according to claim 1 is characterized in that: The network element management module is an independent grouping device, including a switch or a firewall with network boundary computing capability.

4. The security operation and maintenance audit method based on network element management and micro-isolation technology according to claim 1 is characterized in that: The specific forms of the network element include operation and maintenance terminals, terminal stand-alone services, terminal browser services, and a comprehensive unit composed of multiple independent terminal stand-alone services.

5. The security operation and maintenance audit method based on network element management and micro-isolation technology according to claim 1 or 4 is characterized in that: All services communicate or execute autonomously within the network element.

6. The security operation and maintenance audit method based on network element management and micro-isolation technology according to claim 1 is characterized in that: The network element control strategy of the preset network group includes: the operation of removing the operation and maintenance terminal from the network element will end the current operation and maintenance session and interrupt the ongoing terminal operation and maintenance behavior.

7. The security operation and maintenance audit method based on network element management and micro-isolation technology according to claim 1 is characterized in that: The network element management strategy of the preset business group includes: any operation of the operation and maintenance terminal will be reviewed by the business micro-isolation agent program.

8. A security operation and maintenance audit system based on network element management and micro-isolation technology, characterized in that: The system is used to implement the security operation and maintenance audit method based on network element management and micro-isolation technology as described in any one of claims 1 to 7, specifically including: The operation and maintenance user login and authentication unit is used for the operation and maintenance user to log in through the identity authentication privileged access management system. After the identity authentication privileged access management system verifies the operation and maintenance user information, it displays the operation and maintenance terminal resources authorized to access to the operation and maintenance user; The remote desktop operation and maintenance request and permission review unit is used to review the permission of the remote desktop operation and maintenance request link initiated by the operation and maintenance user, and record the operation and maintenance behavior and operation and maintenance goals; The network element management module is involved in the network element grouping unit, and is used for the operation and maintenance request link to enter the network element management module. The network element management module converts the user group mode into a network group mode based on network elements, and creates a mutually isolated resource use environment for operation and maintenance users; Dynamic resource adjustment and network micro-isolation unit, which is used by the network element management module to dynamically adjust network resources, obtain the network element control policy of the preset network group, execute network micro-isolation authorization according to the network element control policy, and perform network micro-isolation on the network access behavior of the operation and maintenance user; The business micro-isolation and access control unit is used for operation and maintenance users to use host applications to initiate requests to network targets other than operation and maintenance terminals. The request is forwarded through network micro-isolation authorization through the network element management module. If the requested target is not in the authorized network element, the access is not responded to, and the network micro-isolation is completed. The business micro-isolation agent deployed on the operation and maintenance terminal performs business micro-isolation on the application access behavior of the operation and maintenance user according to the network element management policy of the preset business group. The operation and maintenance user can only send requests to network targets other than the operation and maintenance terminal through host applications authorized by business micro-isolation. The request is forwarded through network micro-isolation authorization through the network element management module. If the requested target is not in the authorized network element, or the executed stand-alone business program is not authorized by business micro-isolation, the request will be rejected, the access will not be responded to, and the business micro-isolation is completed.

9. An electronic device, characterized in that: The electronic device includes a processor, a memory and a bus system, the processor and the memory are connected through the bus system, the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the security operation and maintenance audit method based on network element management and micro-isolation technology as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores a computer software product, which includes a number of instructions for enabling a computer device to execute the security operation and maintenance audit method based on network element management and micro-isolation technology as described in any one of claims 1 to 7.

Images