Protection system for block chain management server

Abstract

The invention discloses a protection system for a block chain management server, the protection system comprises a gateway deployment, a security agent, an application deployment, a security center and a management center, the gateway deployment is deployed on a protection wall and is used for protecting the edge security of a virtual platform, providing DHCP, NAT, a unified firewall, and being responsible for balancing, VPN and port isolation functions, and the management center is used for managing the edge security of the virtual platform. The security agent is deployed in a block chain server. Through the block chain server security protection system, comprehensive protection is realized in the aspects of virus protection, patch protection, malicious software protection, intrusion detection and protection, access control and integrity monitoring; according to the method and the device, the security risks of mutual attacks among the servers, inconsistent security states, inconsistent operating environments and resource occupation storm existing in the block chain server are solved, so that the security threat of the system is reduced, the system has the capability of resisting the latest security threat, the security of the server is improved, and the high availability of block chain service application is ensured.

Description

Technical Field

[0002] The present invention relates to the technical field of protection systems, and in particular to a protection system for a blockchain management server. Background Art

[0003] With the rapid development of blockchain technology, the security of blockchain servers has attracted more and more attention. Blockchain servers are called nodes in the blockchain system, and they provide storage space and computing power support for the entire blockchain system.

[0004] However, the current blockchain servers do not have security protection measures during operation, and blockchain servers are prone to mutual attacks. At the same time, there are technical problems such as inconsistent security status, inconsistent operating environment, and resource occupation storm security risks among blockchain servers, which brings security risks to the use of blockchain servers. Summary of the invention

[0005] The purpose of the present invention is to provide a protection system for a blockchain management server to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: a protection system for a blockchain management server, the protection system includes gateway deployment, security agent, application deployment, security center and management center, the gateway deployment is deployed in the protection wall, used to protect the edge security of the virtual platform, and provide DHCP, NAT, unified firewall, responsible for balancing, VPN, port isolation functions, the security agent is deployed in the blockchain server, and provides an anti-virus engine and anti-virus database for the entire blockchain server, the application is deployed in the blockchain server, and provides agentless virus detection, IDS / IPS, program protection, program control, integrity monitoring and log auditing, the security center is responsible for unified updating of the virus library and providing trusted data access, and saves files that have been security scanned by establishing and maintaining a global cache of scanned files, and the management center enables administrators to manage security policies and apply security policies to servers, as well as security updates and report generation, which can be used to manage, deploy, report, record and integrate third-party security services to achieve role-based access control and separation of duties; The protection system also includes: virus protection module, patch protection module, malware protection module, Web application protection module, intrusion protection module, access control module, intrusion detection module, integrity detection module, application isolation module and stateful firewall.

[0007] Preferably, the virus protection module: for the inconsistent security status and resource occupation storm problems existing in the blockchain server service environment, the virus protection module is implemented to provide agentless virus protection, and heuristic scanning is used to detect and kill viruses in a timely manner; Patch protection module: evaluates blockchain servers through patch technology and automatically provides comprehensive vulnerability patches for each blockchain server, blocking vulnerability attacks before the patch is installed; Preferably, the malware protection module: integrates VMware vShield Endpoint API to prevent the blockchain server from being attacked by viruses and Trojan malware, thereby providing protection against complex attacks interfering with security in the blockchain server environment; Web Application Protection Module: Prevents cross-site scripting attacks and other web application vulnerabilities, and provides automatic notifications with summary information such as the attacker and the time of the attack.

[0008] Preferably, the intrusion protection module provides high security protection for the blockchain server by blocking SQL injection attacks, denial of service attacks, worm virus intrusion attacks, etc., checks all incoming and outgoing data packets, and does not allow protocol modifications or content that violates security policies to cause attacks; Access control module: provides access control function based on state detection, implements access control based on blockchain server network port, realizes logical isolation between blockchain servers, identifies and intercepts various flood attacks, blocks illegal traffic according to traffic management protocol, and optimizes traffic distribution; Intrusion detection module: Based on the protocol, it provides policy-based monitoring and analysis tools to more accurately monitor, analyze and control access to traffic, and perform network behavior analysis at the same time. In order to quickly and accurately detect intrusion behavior in an unattended environment, it matches attack features with the feature library, records new attack features, and continuously improves the feature library.

[0009] Preferably, the integrity detection module: supports the key file monitoring functions such as files, directories, and registries based on the baseline. If these key locations are maliciously tampered with or infected with viruses, the system automatically sends an alarm to the administrator and records the problem; Application isolation module: supports separation of virtual applications to avoid mutual infection between blockchain server applications, and uses signature-based intrusion prevention functions to protect HTTP and FTP services; Stateful Firewall: Provides fine-grained filtering, network-specific design policies, and IP-based location awareness to reduce the attack surface of the server, centrally manage server firewall policies, prevent denial of service attacks, and detect reconnaissance scans.

[0010] Preferably, the integrity detection module also includes suspicious file analysis, specifically: selecting parameters, analyzing the selected client system parameters, and using the disassembly technology of the instruction sequence in the analysis to obtain the data of interest and obtain the final result.

[0011] Preferably, the management center also includes establishing DNS communication with the blockchain couple.

[0012] Preferably, the Web application protection module also includes: setting IP access restrictions, screening users, checking whether the client has legal access rights, setting this function in the web server filtering module, and matching the IP address in the HTTP request with the IP address in the blacklist. When the user requests a page and runs a JSP program, the Web server will read the access control file and obtain access control information from this process. At the same time, the client is required to provide a user name and password, and then the browser transmits the user name and password to the server. After verification, the server will satisfy the user's request, such as sending back the requested page or executing the JSP program.

[0013] The technical effects and advantages of the present invention are as follows: Through the blockchain server security protection system, comprehensive protection is achieved in virus protection, patch protection, malware protection, intrusion detection and protection, access control, and integrity monitoring, solving the security risks of mutual attacks between servers, inconsistent security status, inconsistent operating environment, and resource occupation storms in the blockchain server. The system reduces security threats, has the ability to resist the latest security threats, improves the security of the server, and thus ensures the high availability of blockchain business applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a system block diagram of a protection system for a blockchain management server of the present invention. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] The present invention provides a protection system for a blockchain management server. The protection system includes gateway deployment, security agent, application deployment, security center and management center. The gateway is deployed in a protection wall to protect the edge security of a virtual platform and provide DHCP, NAT, unified firewall, responsible balancing, VPN and port isolation functions. The security agent is deployed in a blockchain server to provide an anti-virus engine and an anti-virus database for the entire blockchain server. The application is deployed in the blockchain server to provide agentless virus detection, IDS / IPS, program protection, program control, integrity monitoring and log auditing. The security center is responsible for uniformly updating the virus library and providing trusted data access. By establishing and maintaining a global cache of scanned files, files that have been security scanned are saved. The management center enables administrators to manage security policies and apply security policies to servers, as well as security updates and report generation. It can be used to manage, deploy, report, record and integrate third-party security services to achieve role-based access control and separation of duties. The risks of blockchain management servers specifically include: mutual attacks between blockchain services, inconsistent security status, inconsistent operating environment, resource occupation storms, tool vulnerability risks, data security risks and system replication risks.

[0017] The protection system also includes: virus protection module, patch protection module, malware protection module, Web application protection module, intrusion protection module, access control module, intrusion detection module, integrity detection module, application isolation module and stateful firewall.

[0018] Virus protection module: To address the inconsistent security status and resource occupation storm problems in the blockchain server service environment, the virus protection module provides agentless virus protection and uses heuristic scanning to detect and kill viruses in a timely manner; Patch protection module: evaluates blockchain servers through patch technology and automatically provides comprehensive vulnerability patches for each blockchain server, blocking vulnerability attacks before the patch is installed; Malware protection module: Integrates with VMware vShield Endpoint API to prevent blockchain servers from being compromised by viruses, Trojans, and malware, thereby providing protection against complex attacks that interfere with security in blockchain server environments; Web Application Protection Module: Prevents cross-site scripting attacks and other web application vulnerabilities, and provides automatic notifications with summary information such as the attacker and the time of the attack.

[0019] Intrusion protection module: It provides high-security protection for blockchain servers by blocking SQL injection attacks, denial of service attacks, worm virus intrusion attacks, etc. It checks all incoming and outgoing data packets and does not allow protocol modifications or content that violates security policies to cause attacks. Access control module: provides access control function based on state detection, implements access control based on blockchain server network port, realizes logical isolation between blockchain servers, identifies and intercepts various flood attacks, blocks illegal traffic according to traffic management protocol, and optimizes traffic distribution; Intrusion detection module: Based on the protocol, it provides policy-based monitoring and analysis tools to more accurately monitor, analyze and control access to traffic, and perform network behavior analysis at the same time. In order to quickly and accurately detect intrusion behavior in an unattended environment, it matches attack features with the feature library, records new attack features, and continuously improves the feature library.

[0020] Integrity detection module: supports baseline-based monitoring of key files such as files, directories, and registries. If these key locations are maliciously tampered with or infected with viruses, the system will automatically alert the administrator and record the problem. Application isolation module: supports separation of virtual applications to avoid mutual infection between blockchain server applications, and uses signature-based intrusion prevention functions to protect HTTP and FTP services; Stateful Firewall: Provides fine-grained filtering, network-specific design policies, and IP-based location awareness to reduce the attack surface of the server, centrally manage server firewall policies, prevent denial of service attacks, and detect reconnaissance scans.

[0021] The integrity detection module also includes suspicious file analysis, specifically: selecting parameters, analyzing the selected client system parameters, and using the disassembly technology of the instruction sequence in the analysis to obtain the data of interest and obtain the final result.

[0022] The management center also includes establishing DNS communication with the blockchain couple, which specifically includes the following steps: Step S1: The client sends a city name query request to the server, and puts forward specific query content. When the query content of the client belongs to the host name within the domain name of the server, the DNS server will directly respond to the client and inform the IP address. When the query content of the client belongs to other domain names, it will first query the server's own cache content to see if there is any relevant information. If found, it will respond to the client and inform the IP address; Step S2: If no relevant information is found in the server's own cache content, the server will turn to the root server for query. After receiving the server's query information, the root server will inform the server of the location of the next layer of authorized servers under the city name, that is, the IP address, which may include multiple next layer of authorized server addresses. The local server will then query one of the authorized servers and store the next layer of authorized server addresses in the cache. When the client requests similar content later, it can directly reply to the client; Step S3: The remote authorization server responds to the local server query. If the remote authorization server's response is not the answer to the last level, the query continues downward until the result required by the client is obtained. The local server responds to the client with the query result and stores the query result in the server's cache at the same time. If the local server receives the same query from the client again before the storage time has expired, the local server responds with the data stored in the server cache.

[0023] The Web application protection module also includes: setting IP access restrictions, screening users, checking whether the client has legal access rights, setting this function in the web server filtering module, and matching the IP address in the HTTP request with the IP address in the blacklist. When the user requests a page and runs a JSP program, the Web server will read the access control file and obtain access control information from this process. At the same time, the client is required to provide a user name and password, and then the browser passes the user name and password to the server. After verification, the server will satisfy the user's request, such as sending back the requested page or executing the JSP program.

[0024] The contents not described in detail in this specification belong to the prior art known to the professional and technical personnel in the field. The specific embodiments described herein are merely examples of the spirit of the present invention. The technical personnel in the technical field to which the present invention belongs can make various modifications or supplements to the specific embodiments described or replace them in a similar manner, but they will not deviate from the spirit of the present invention or exceed the scope defined by the attached claims.

Claims

1. A protection system for a blockchain management server, characterized in that: The protection system includes gateway deployment, security agent, application deployment, security center and management center. The gateway is deployed in the protection wall to protect the edge security of the virtual platform, providing DHCP, NAT, unified firewall, responsible for balancing, VPN, and port isolation functions. The security agent is deployed in the blockchain server to provide an anti-virus engine and anti-virus database for the entire blockchain server. The application is deployed in the blockchain server to provide agentless virus detection, IDS / IPS, program protection, program control, integrity monitoring and log auditing. The security center is responsible for unified updating of the virus library and providing trusted data access. By establishing and maintaining a global cache of scanned files, it saves files that have been security scanned. The management center enables administrators to manage security policies and apply security policies to servers, as well as security updates and report generation. It is used to manage, deploy, report, record and integrate third-party security services to achieve role-based access control and separation of duties. The protection system also includes: virus protection module, patch protection module, malware protection module, Web application protection module, intrusion protection module, access control module, intrusion detection module, integrity detection module, application isolation module and state firewall; in view of the inconsistent security status and resource occupation storm problems existing in the blockchain server service environment, the virus protection module is implemented to provide agentless virus protection, and heuristic scanning is used to detect and kill viruses in a timely manner; Patch protection module: evaluates blockchain servers through patch technology and automatically provides comprehensive vulnerability patches for each blockchain server, providing interception of vulnerability attacks before the patch is installed; Malware protection module: integrates VMware vShield Endpoint API to prevent blockchain servers from being infringed by viruses, Trojan malware, and thus provides protection against complex attacks in the blockchain server environment that interfere with security; Web application protection module: prevents cross-site scripting attacks and other web application vulnerabilities, and provides automatic notifications containing summary information of attackers and attack times; the intrusion protection module: protects blockchain servers by blocking SQL injection attacks, denial of service attacks, and worm virus intrusion attacks, checks all incoming and outgoing data packets, and avoids attacks caused by protocol modifications and violations of security policies; Access control module: provides access control function based on state detection, implements access control based on blockchain server network port, realizes logical isolation between blockchain servers, identifies and intercepts various flood attacks, blocks illegal traffic according to traffic management protocol, and optimizes traffic distribution; Intrusion detection module: Based on the protocol, it provides policy-based monitoring and analysis tools to monitor, analyze and control traffic, and conduct network behavior analysis at the same time. It can quickly and accurately detect intrusion behavior in an unattended environment, match attack features with feature libraries, record new attack features, and continuously improve feature libraries; The integrity detection module: supports baseline-based monitoring of key files of files, directories, and registries. If the key files are maliciously tampered with or infected with viruses, the system automatically sends an alarm to the administrator and records the problem; Application isolation module: supports separation of virtual applications to avoid mutual infection between blockchain server applications, and uses signature-based intrusion prevention functions to protect HTTP and FTP services; Stateful Firewall: Provides fine-grained filtering, network-specific design policies, and IP-based location awareness to reduce the attack surface of the server, centrally manage server firewall policies, prevent denial of service attacks, and detect reconnaissance scans.

Images