Security product deployment method and system based on hybrid networking

Abstract

The invention provides a hybrid networking-based security product deployment method and system. The method comprises the following steps of: installing a security product management end on a server; a security product client is installed on the localized information device; an identity authentication client, an equipment auditing client and a three-piece client are installed on non-domestic information equipment; and the security product management end is in butt joint with the security product client, the identity authentication client, the equipment auditing client and the three-piece client. The invention provides a hybrid networking-based security product deployment method and system, which are used for deploying security products and performing security protection on localized information equipment and non-localized information equipment at the same time.

Description

Technical Field

[0001] The present invention relates to the field of network security infrastructure construction, and in particular to a method and system for deploying security products based on hybrid networking. Background Art

[0002] Hybrid networking refers to the deployment of both domestic and non-domestic information equipment in the same internal LAN. Domestic information equipment refers to information equipment whose basic software and hardware are independently developed and produced by domestic manufacturers. Since 2014, Microsoft Corporation of the United States has stopped providing service support for the Windows operating system, which has attracted widespread attention and concerns about information security from the society and users. In the past many years, most of the domestic IT underlying standards, architectures, and ecosystems were formulated by foreign IT giants, which has caused many security risks. Therefore, it is necessary to gradually establish its own IT underlying architecture and standards to form an open ecological environment. At present, with the gradual exploration of the country and the continuous iteration and maturity of industry technology, domestic servers and terminal equipment are gradually being promoted in enterprises and institutions. At the same time, before domestic information equipment is fully mature, some research and development units still need to retain some non-domestic information equipment for research and development design, forming a hybrid networking deployment model. In this case, deploying security products to provide security protection for both domestic and non-domestic information equipment has become an urgent problem to be solved. Summary of the invention

[0003] The present invention provides a hybrid networking-based security product deployment method and system for deploying security products and providing security protection for both domestic information equipment and non-domestic information equipment.

[0004] On the one hand, the present invention provides a method for deploying a security product based on hybrid networking, comprising:

[0005] Install a security product management terminal on the server, wherein the security product management terminal includes a first identity authentication module, a first device audit module, a first media control module, a first external monitoring module, a first device access control module, a first operation and maintenance management module, and a log module;

[0006] Install a security product client on the domestic information equipment, wherein the security product client includes a second identity authentication module, a second device audit module, a second media control module, a second external monitoring module, a second device access control module, and a second operation and maintenance management module;

[0007] Install an identity authentication client, a device audit client, and a three-piece client on the non-domestic information device, wherein the three-piece client includes a third media management and control module, a third external monitoring module, and a third device access control module;

[0008] The security product management terminal is connected to the security product client, the identity authentication client, the device audit client and the three-piece client respectively.

[0009] This solution is highly consistent with the development trend of domestic informatization, and effectively provides a solution for security protection of domestic information equipment and non-domestic information equipment using the same set of management terminals. While meeting the security protection requirements, it can more efficiently and conveniently protect and manage information equipment with different architectures within the local area network.

[0010] Optionally, the server is a domestic server or a non-domestic server.

[0011] Optionally, there is at least one of the domestically produced information equipment and at least one of the non-domesticated information equipment.

[0012] Optionally, the connecting the security product management terminal to the security product client, the identity authentication client, the device audit client, and the three-piece client respectively includes:

[0013] An interface is configured for each module of the security product management terminal to be connected to the security product client, the identity authentication client, the device audit client and the three-piece client respectively, and the HTTPS protocol is used to encapsulate the messages passing through the interface.

[0014] Optionally, also include:

[0015] Administrator accounts with different permissions are set on the security product management end, and the administrator account uniformly manages the security product client, the identity authentication client, the device audit client and the three-piece client.

[0016] In the above solution, the same set of administrator accounts is used to uniformly manage all clients, eliminating the need to log in to multiple platforms with multiple accounts, reducing the tedious operations and time of multiple identity authentications. At the same time, similar information can be compared on the same platform, and can also be uniformly displayed through the security product management platform, effectively reducing the workload of administrators during operation and maintenance.

[0017] On the other hand, the present invention provides a security product system based on hybrid networking, including a security product management terminal installed on a server, a security product client installed on a domestic information device, and an identity authentication client, a device audit client, and a three-piece client installed on a non-domestic information device, wherein:

[0018] The security product management terminal includes a first identity authentication module, a first device audit module, a first media control module, a first external monitoring module, a first device access control module, a first operation and maintenance management module and a log module;

[0019] The security product client includes a second identity authentication module, a second device audit module, a second media control module, a second external monitoring module, a second device access control module and a second operation and maintenance management module;

[0020] The three-piece client includes a third media management and control module, a third external monitoring module and a third device access control module;

[0021] The security product management terminal is connected to the security product client, the identity authentication client, the device audit client and the three-piece client respectively.

[0022] Optionally, the server is a domestic server or a non-domestic server.

[0023] Optionally, there is at least one of the domestically produced information equipment and at least one of the non-domesticated information equipment.

[0024] Optionally, the security product management terminal is connected with the security product client, the identity authentication client, the device audit client and the three-piece client respectively, including:

[0025] Each module of the security product management end is configured with an interface to connect with the security product client, the identity authentication client, the device audit client and the three-piece client respectively, and the HTTPS protocol is used to encapsulate the messages passing through the interface.

[0026] Optionally, also include:

[0027] The security product management terminal is provided with administrator accounts with different permissions, and the administrator account uniformly manages the security product client, the identity authentication client, the device audit client and the three-piece client. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 A schematic diagram of a flow chart of a method for deploying a security product based on hybrid networking provided by an embodiment of the present invention;

[0030] Figure 2 A schematic diagram of the structure of a hybrid networking-based security product system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] like Figure 1 As shown, a method for deploying a security product based on hybrid networking is provided in an embodiment of the present invention, comprising:

[0033] S101, install the security product management terminal on the server.

[0034] The security product management terminal is used to simultaneously manage the security product clients installed on domestic information equipment and the identity authentication clients, device audit clients, and three-piece clients installed on non-domestic information equipment.

[0035] Specifically, the security product management terminal includes a first identity authentication module, a first device audit module, a first media control module, a first external monitoring module, a first device access control module, a first operation and maintenance management module and a log module, wherein:

[0036] The first identity authentication module is used to distribute identity information policies to security product clients and identity authentication clients;

[0037] The first device audit module is used to distribute system and network policies to the security product client and the device audit client. The system and network policies include information input and output policies, device connection policies, Internet access policies, service policies, and port development policies.

[0038] The first media control module is used to distribute media control policies to security product clients and three-piece client;

[0039] The first external monitoring module is used to distribute external monitoring policies to security product clients and three-piece client;

[0040] The first device access control module is used to receive basic device information of the security product client and the three-piece client;

[0041] The first operation and maintenance management module is used to group and analyze the devices in the local area network and issue operation and maintenance instructions to the security product client;

[0042] The log module is used to receive logs from security product clients, identity authentication clients, device audit clients, and three-piece client, and to summarize and analyze the logs. The log module is also used to combine and classify logs. Combined display means displaying logs generated by all clients on the same interface, and classified display means classifying and displaying logs according to their types.

[0043] The server can be a domestic server or a non-domestic server, and the installed security product management end should correspond to the server architecture, which includes X86 architecture and ARM architecture.

[0044] S102, install security product clients on domestic information equipment.

[0045] The security client is used to provide security protection for domestic information equipment.

[0046] Specifically, the security product client includes a second identity authentication module, a second device audit module, a second media control module, a second external monitoring module, a second device access control module, and a second operation and maintenance management module, wherein:

[0047] The second identity authentication module is used to ensure that only authorized personnel log in to the domestic information equipment. It can verify the identity information of the operator through passwords or fingerprints and prohibit unauthorized personnel from operating;

[0048] The second equipment audit module is used to monitor, record and analyze the system and network of domestic information equipment, and can record the operations performed by domestic information equipment and determine whether there are any illegal operations;

[0049] The second media control module is used to audit whether domestic information equipment is connected to unauthorized storage devices. It can set whether to allow media access, allow a certain medium to access, and allow the medium to operate the domestic information equipment;

[0050] The second external monitoring module is used to audit whether the domestic information equipment is connected to the unauthorized network;

[0051] The second device access control module is used to audit whether there are unauthorized devices in the local area network, and can identify information devices connected to the local area network and prohibit unauthorized devices from connecting to the local area network;

[0052] The second operation and maintenance management module is used to receive operation and maintenance operation instructions issued by the security product management end, and can form a device ledger and topology map within the local area network.

[0053] The logs of the security product client include the identity authentication behavior log of the second identity authentication module, the operation behavior audit log of the second device audit module, the media access behavior audit log of the second media management and control module, and the external behavior audit log of the second external monitoring module.

[0054] It should be noted that the logs of the second identity authentication module, the second device audit module, the second media control module and the second external monitoring module are sent uniformly by the security product client.

[0055] One possible implementation is that there is at least one domestically produced information device.

[0056] S103, install the identity authentication client, device audit client and three-piece client on non-domestic information equipment.

[0057] The identity authentication client, device audit client and three-piece client are used to provide security protection for non-local information equipment, including:

[0058] The identity authentication client is used to ensure that only authorized personnel log in to non-domestic information equipment;

[0059] The equipment audit client is used to monitor, record and analyze the systems and networks of non-domestic information equipment;

[0060] The three-piece client is used to audit whether non-domestic information equipment is connected to unauthorized storage devices, whether it is connected to unauthorized networks, and whether there are unauthorized devices in the local area network.

[0061] Specifically, the three-piece client includes a third media management and control module, a third external monitoring module and a third device access control module, wherein:

[0062] The third media control module is used to audit whether non-local information devices are connected to unauthorized storage devices;

[0063] The third external monitoring module is used to audit whether non-domestic information equipment is connected to an unauthorized network;

[0064] The third device access control module is used to audit whether there are unauthorized devices in the local area network.

[0065] The log of the identity authentication client is the identity authentication behavior log, the log of the device audit client is the operation behavior audit log, and the log of the three-piece client includes the media access behavior audit log of the third media control module and the external behavior audit log of the third external monitoring module.

[0066] It should be noted that the logs of the third media control module and the third external monitoring module are sent uniformly by the three-piece client.

[0067] One possible implementation is that there is at least one non-domestic information device.

[0068] It should be noted that there is no order requirement for S101, S102 and S103, and they can be executed in any order.

[0069] S104, connect the security product management terminal to the security product client, identity authentication client, device audit client and three-piece client respectively.

[0070] One possible implementation is to connect the security product management end with the security product client, identity authentication client, device audit client, and three-piece client respectively, including:

[0071] Configure interfaces for each module on the security product management side to connect to the security product client, identity authentication client, device audit client, and three-piece client respectively, and use the HTTPS protocol to encapsulate the messages passing through the interface.

[0072] A possible implementation is that the interface includes a first interface, a second interface, a third interface, a fourth interface, a fifth interface, a sixth interface and a seventh interface, wherein:

[0073] The second identity authentication module and the identity authentication client request the identity information policy from the first identity authentication module through the first interface;

[0074] The second device audit module and the device audit client request the system and network policies from the first device audit module at predetermined intervals through the second interface;

[0075] The second media control module and the third media control module request the first media control module for a media control strategy at predetermined intervals through the third interface;

[0076] The second external monitoring module and the third external monitoring module request the external monitoring strategy from the first external monitoring module at predetermined intervals through the fourth interface;

[0077] The second device admission control module and the third device admission control module push basic device information to the first device admission module at predetermined intervals through the fifth interface;

[0078] The second operation and maintenance management module requests the first operation and maintenance management module for operation and maintenance instructions at predetermined intervals through the sixth interface;

[0079] The security product client, identity authentication client, device audit client and three-piece client upload logs to the log module through the seventh interface.

[0080] One possible implementation is that the predetermined time period is every 10 seconds.

[0081] One possible implementation is that the log format is Syslog.

[0082] The above-mentioned security product deployment method is highly consistent with the development trend of domestic informatization, and effectively provides a solution for security protection of domestic information equipment and non-domestic information equipment using the same set of management terminals. While meeting the security protection requirements, it can more efficiently and conveniently protect and manage information equipment with different architectures within the local area network.

[0083] In a possible implementation, a hybrid networking-based security product deployment method provided by an embodiment of the present invention further includes:

[0084] Administrator accounts with different permissions are set up on the security product management side. The administrator account manages the security product client, identity authentication client, device audit client and three-piece client in a unified manner.

[0085] Management includes status viewing, policy issuance, log analysis and other operations, including:

[0086] Status checking includes checking whether the client is online, activated, and whether the policy is updated. All modules on the security product management end include status checking operations.

[0087] Log analysis includes reviewing and analyzing logs, determining whether there are any violations or unapproved operations, and whether any abnormal conditions occur.

[0088] Administrator rights include policy settings, user changes, user rights configuration, and log viewing.

[0089] In the above solution, the same set of administrator accounts is used to uniformly manage all clients, eliminating the need to log in to multiple platforms with multiple accounts, reducing the tedious operations and time of multiple identity authentications. At the same time, similar information can be compared on the same platform, and can also be uniformly displayed through the security product management platform, effectively reducing the workload of administrators during operation and maintenance.

[0090] Based on the same idea, Figure 2 A structural schematic diagram of a security product system based on hybrid networking provided by an embodiment of the present invention is shown, including a security product management terminal installed on a server, a security product client installed on a domestic information device, and an identity authentication client, a device audit client, and a three-piece client installed on a non-domestic information device.

[0091] Specifically, the security product management end includes a first identity authentication module, a first device audit module, a first media management module, a first external monitoring module, a first device access control module, a first operation and maintenance management module and a log module.

[0092] Specifically, the security product client includes a second identity authentication module, a second device audit module, a second media control module, a second external monitoring module, a second device access control module and a second operation and maintenance management module.

[0093] Specifically, the three-piece client includes a third media management and control module, a third external monitoring module and a third device access control module.

[0094] Specifically, the security product management end is connected to the security product client, identity authentication client, device audit client and three-piece client respectively.

[0095] One possible implementation is that the server is a domestic server or a non-domestic server.

[0096] One possible implementation is that there is at least one domestic information device and at least one non-domestic information device.

[0097] One possible implementation is that the security product management end is connected with the security product client, identity authentication client, device audit client and three-piece client respectively, including:

[0098] Each module of the security product management end is configured with interfaces to connect to the security product client, identity authentication client, device audit client and three-piece client respectively, and uses the HTTPS protocol to encapsulate the messages passing through the interface.

[0099] In one possible implementation, a security product system based on hybrid networking provided by an embodiment of the present invention further includes:

[0100] The security product management end is equipped with administrator accounts with different permissions. The administrator account manages the security product client, identity authentication client, device audit client and three-piece client in a unified manner.

[0101] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0102] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0103] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0104] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0105] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0106] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A security product deployment method based on hybrid networking, characterized in that: include: Install a security product management terminal on the server, the security product management terminal including a first identity authentication module, a first device audit module, a first media control module, a first external monitoring module, a first device access control module, a first operation and maintenance management module and a log module; Install a security product client on the domestic information equipment, wherein the security product client includes a second identity authentication module, a second device audit module, a second media control module, a second external monitoring module, a second device access control module, and a second operation and maintenance management module; Install an identity authentication client, a device audit client, and a three-piece client on the non-domestic information device, wherein the three-piece client includes a third media management and control module, a third external monitoring module, and a third device access control module; The security product management terminal is connected to the security product client, the identity authentication client, the device audit client and the three-piece client respectively.

2. The method according to claim 1, characterized in that: The server is a domestic server or a non-domestic server.

3. The method according to claim 1, characterized in that: There is at least one of the domestically produced information equipment and at least one of the non-domesticated information equipment.

4. The method according to claim 1, characterized in that: The connecting the security product management terminal to the security product client, the identity authentication client, the device audit client and the three-piece client respectively includes: An interface is configured for each module of the security product management terminal to be connected to the security product client, the identity authentication client, the device audit client and the three-piece client respectively, and the HTTPS protocol is used to encapsulate the messages passing through the interface.

5. The method according to claim 1, characterized in that: Also includes: Administrator accounts with different permissions are set on the security product management end, and the administrator account uniformly manages the security product client, the identity authentication client, the device audit client and the three-piece client.

6. A security product system based on hybrid networking, characterized in that: It includes the security product management terminal installed on the server, the security product client installed on the domestic information equipment, and the identity authentication client, device audit client and three-piece client installed on the non-domestic information equipment, including: The security product management terminal includes a first identity authentication module, a first device audit module, a first media control module, a first external monitoring module, a first device access control module, a first operation and maintenance management module and a log module; The security product client includes a second identity authentication module, a second device audit module, a second media control module, a second external monitoring module, a second device access control module and a second operation and maintenance management module; The three-piece client includes a third media management and control module, a third external monitoring module and a third device access control module; The security product management terminal is connected to the security product client, the identity authentication client, the device audit client and the three-piece client respectively.

7. The system according to claim 6, characterized in that: The server is a domestic server or a non-domestic server.

8. The system according to claim 6, characterized in that: There is at least one of the domestically produced information equipment and at least one of the non-domesticated information equipment.

9. The system according to claim 6, characterized in that: The security product management terminal is connected with the security product client, the identity authentication client, the device audit client and the three-piece client respectively, including: Each module of the security product management end is configured with an interface to connect with the security product client, the identity authentication client, the device audit client and the three-piece client respectively, and the HTTPS protocol is used to encapsulate the messages passing through the interface.

10. The system according to claim 6, characterized in that: Also includes: The security product management terminal is provided with administrator accounts with different permissions, and the administrator account uniformly manages the security product client, the identity authentication client, the device audit client and the three-piece client.

Images