Network security protection method and device, terminal equipment and storage medium

Abstract

The invention provides a network security protection method and device, terminal equipment and a storage medium, and relates to the technical field of information security. The method is used for a driving end and comprises the steps that a filtering starting instruction sent by an agent end is responded, whether a network protection rule exists in a rule base or not is checked, and the network protection rule can be input through a configuration interface of the agent end; when the network protection rule exists in the rule base, processing operation is carried out on a network connection request of an application program according to the network protection rule, and the processing operation comprises releasing or stopping and alarming. By adopting the network security protection method disclosed by the invention, the security protection process is executed by the driving end, manual operation does not need to understand the bottom layer implementation of the firewall of each operating system, the operation is simple, clear and easy to understand, and the application range is expanded.

Description

Technical Field

[0001] The present disclosure generally relates to the field of information security technology, and specifically relates to a network security protection method, apparatus, terminal equipment and storage medium. Background Art

[0002] With the continuous deepening of intelligent manufacturing and the full deployment of the industrial Internet, the network situation faced by the industrial control environment is becoming increasingly severe and complex.

[0003] At present, in response to various attack methods, relevant technologies provide security protection by manually adding firewalls, but the prerequisite is that one needs to be familiar with how to use the firewall, and the firewalls of different operating systems are quite different, the operation is complicated, difficult to understand, and has limitations. Summary of the invention

[0004] In view of the above-mentioned defects or deficiencies in the related art, it is desired to provide a network security protection method, apparatus, terminal device and storage medium that are simple to operate and have a wide range of applications.

[0005] In a first aspect, the present disclosure provides a network security protection method, which is used on a driver end and includes:

[0006] In response to the filter-enabling instruction sent by the agent, check whether there is a network protection rule in the rule base, and the network protection rule can be input through the configuration interface of the agent;

[0007] When the network protection rule exists in the rule base, a processing operation is performed on the network connection request of the application program according to the network protection rule, and the processing operation includes releasing or blocking with an alarm.

[0008] Optionally, in some embodiments of the present disclosure, the network protection rule includes at least two protection strategies with different priorities, and when the network protection rule exists in the rule base, the network connection request of the application is processed according to the network protection rule, including:

[0009] The protection strategies are sorted in descending order according to the priority, and based on the descending order result, the network connection requests of the application are processed in sequence according to the protection strategies.

[0010] Optionally, in some embodiments of the present disclosure, the protection policy includes a privileged policy for ensuring normal operation of the service, and the priority of the privileged policy is the highest among the at least two protection policies with different priorities.

[0011] Optionally, in some embodiments of the present disclosure, the network protection rules include Internet Protocol address, port, protocol and data direction.

[0012] Optionally, in some embodiments of the present disclosure, the method further includes:

[0013] If the processing operation is to block and warn, the network connection request of the application is recorded in a violation log;

[0014] According to a preset policy format, the network protection rules are extracted from the violation log and added to the rule base.

[0015] Optionally, in some embodiments of the present disclosure, the rule base may be imported into a local host or exported from the local host.

[0016] Optionally, in some embodiments of the present disclosure, the method further includes:

[0017] When the network protection rule does not exist in the rule base, a failure message is fed back to the agent, and the agent is waited to send the filter-enabling instruction again.

[0018] In a second aspect, the present disclosure provides a network security protection device, which is used at a driver end and includes:

[0019] A checking module configured to respond to the filter-enabling instruction sent by the agent and check whether there is a network protection rule in the rule base, wherein the network protection rule can be input through the configuration interface of the agent;

[0020] The processing module is configured to perform a processing operation on the network connection request of the application program according to the network protection rule when the network protection rule exists in the rule base, and the processing operation includes releasing or blocking with an alarm.

[0021] In a third aspect, the present disclosure provides a terminal device, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the instruction, the program, the code set or the instruction set is loaded and executed by the processor to implement the steps of the network security protection method described in any one of the first aspects.

[0022] In a fourth aspect, the present disclosure provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the network security protection method described in any one of the first aspects.

[0023] It can be seen from the above technical solutions that the embodiments of the present disclosure have the following advantages:

[0024] The disclosed embodiments provide a network security protection method, apparatus, terminal device and storage medium. By inputting network protection rules in the configuration interface of the agent end, it is convenient, intuitive and clear at a glance. Then, the driver end can respond to the filter start instruction sent by the agent end to check whether there are network protection rules in the rule base. When the network protection rules exist in the rule base, the network connection request of the application program can be processed accordingly according to the network protection rules. That is to say, the security protection process is executed by the driver end, and humans do not need to understand the underlying implementation of the firewall of each operating system. The operation is simple, clear and easy to understand, and the scope of application is expanded. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Other features, objects and advantages of the present disclosure will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0026] Figure 1 A schematic diagram of a flow chart of a network security protection method provided by an embodiment of the present disclosure;

[0027] Figure 2 A schematic diagram of information interaction between an agent end and a driver end provided in an embodiment of the present disclosure;

[0028] Figure 3 A specific example of a network security protection process provided by an embodiment of the present disclosure;

[0029] Figure 4 A flowchart of another network security protection method provided by an embodiment of the present disclosure;

[0030] Figure 5 A structural block diagram of a network security protection device provided by an embodiment of the present disclosure;

[0031] Figure 6 A structural block diagram of another network security protection device provided in an embodiment of the present disclosure;

[0032] Figure 7 A structural block diagram of another network security protection device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the disclosed solution, the technical solution in the disclosed embodiment will be clearly and completely described below in conjunction with the drawings in the disclosed embodiment. Obviously, the described embodiment is only a part of the disclosed embodiment, not all of the embodiments. Based on the embodiments in the disclosed embodiment, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the disclosed embodiment.

[0034] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described can be implemented in sequences other than those illustrated or described herein.

[0035] In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or modules is not necessarily limited to those steps or modules explicitly listed, but may include other steps or modules not explicitly listed or inherent to these processes, methods, products, or apparatuses.

[0036] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other. Figures 1 to 7 The network security protection method, apparatus, terminal device and storage medium provided by the embodiments of the present disclosure are described in detail.

[0037] Please refer to Figure 1 , which is a flowchart of a network security protection method provided by an embodiment of the present disclosure. The method can be applied to Figure 2 The driving end shown in the figure specifically includes the following steps:

[0038] S101, responding to the filter-enabling instruction sent by the agent, checking whether there is a network protection rule in the rule base, and the network protection rule can be input through the configuration interface of the agent.

[0039] For example, Figure 2 As shown, the network protection rules can be manually input through the configuration interface of the agent, and then the network protection rules are sent to the driver via the agent, that is, the network protection rules are added in a software-based way, which is convenient and intuitive. The human does not need to specifically understand the underlying implementation of each operating system firewall, and the operation is simple. For another example, the network protection rules in the embodiment of the present disclosure include but are not limited to Internet Protocol (IP) addresses, ports, protocols, and data directions, and the data direction can be receiving or sending. For another example, the rule base in the embodiment of the present disclosure can be imported into the local host or exported from the local host. The advantage of such a setting is that it is highly reusable, easy to process in batches, improves configuration efficiency, and also avoids repeated addition. In addition, during actual use, the embodiment of the present disclosure will automatically turn off the firewall that comes with Windows.

[0040] S102, when there are network protection rules in the rule base, a processing operation is performed on the network connection request of the application according to the network protection rules, and the processing operation includes releasing or blocking and alarming.

[0041] Exemplarily, the network protection rules in the disclosed embodiments may include at least two protection strategies with different priorities, thereby enabling progressive protection to ensure network security. For example, each protection strategy is sorted in descending order according to the priority, and based on the descending result, the network connection request of the application (NetworkApp) is processed in sequence according to the protection strategy, where descending order refers to arranging in order from high priority to low priority. For another example, the protection strategy may include a privileged strategy, and the priority of the privileged strategy is the highest among at least two protection strategies with different priorities. The advantage of such a setting is that it can ensure the normal operation of the business and is not affected by the rules. In addition, the protection strategy may also include a blocking strategy, a pass strategy, and a default strategy with decreasing priorities, for example Figure 3 As shown, when an application requests a network connection, the driver first checks whether the privileged policy includes the network connection request of the application. If the privileged policy includes the network connection request of the application, it is released. Otherwise, it is checked whether the blocking policy includes the network connection request of the application. If the blocking policy includes the network connection request of the application, it is blocked and an alarm is issued. Otherwise, it is released and checked whether the passing policy includes the network connection request of the application. If the passing policy includes the network connection request of the application, it is released. Otherwise, it enters the default policy, blocks and an alarm is issued. It should be noted that in the embodiment of the present disclosure, releasing refers to establishing a communication connection between the application and the network, while blocking refers to disconnecting the communication connection between the application and the network.

[0042] Furthermore, when the processing operation is to block and warn, the embodiment of the present disclosure can also record the network connection request of the application in the violation log, and extract the network protection rules from the violation log and add them to the rule base according to the preset policy format. The preset policy format can be IP address-port-protocol-data direction, so that protection rules can be added flexibly and more real-time. Optionally, the embodiment of the present disclosure can also display the warning information in the configuration interface of the agent end, so as to remind the relevant personnel in time.

[0043] The network security protection method provided by the embodiment of the present disclosure inputs network protection rules in the configuration interface of the agent end, which is convenient, intuitive and clear at a glance. Then, the driver end can respond to the filter enable instruction sent by the agent end to check whether there are network protection rules in the rule base, and when there are network protection rules in the rule base, the network connection request of the application program can be processed accordingly according to the network protection rules. That is to say, the security protection process is executed by the driver end, and humans do not need to understand the underlying implementation of each operating system firewall. The operation is simple, clear and easy to understand, and the scope of application is expanded.

[0044] Based on the above examples, please refer to Figure 4 , which is a flow chart of another network security protection method provided by the embodiment of the present disclosure. This method can still be applied to Figure 2 The driving end shown in the figure specifically includes the following steps:

[0045] S201, responding to the filter-enabling instruction sent by the agent, checking whether there is a network protection rule in the rule base, and the network protection rule can be input through the configuration interface of the agent.

[0046] S202, when there are network protection rules in the rule base, a processing operation is performed on the network connection request of the application according to the network protection rules, and the processing operation includes releasing or blocking and alarming.

[0047] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0048] S203, when there is no network protection rule in the rule base, a failure message is fed back to the agent, and the agent is waited for sending a filter start instruction again.

[0049] Exemplarily, the disclosed embodiment can promptly remind relevant personnel to input network protection rules through the configuration interface of the agent by feeding back a failure message to the agent, thereby avoiding affecting the normal network connection of the application for a long time, which is more humane.

[0050] The network security protection method provided by the embodiment of the present disclosure inputs network protection rules in the configuration interface of the agent end, which is convenient, intuitive and clear at a glance. Then, the driver end can respond to the filter enable instruction sent by the agent end to check whether there are network protection rules in the rule base, and when there are network protection rules in the rule base, the network connection request of the application program can be processed accordingly according to the network protection rules. That is to say, the security protection process is executed by the driver end, and humans do not need to understand the underlying implementation of each operating system firewall. The operation is simple, clear and easy to understand, and the scope of application is expanded.

[0051] Based on the above embodiments, the present disclosure provides a network security protection device. The network security protection device 100 can be applied to Figure 1 to Figure 4 In the network security protection method of the corresponding embodiment. Please refer to Figure 5 , the network security protection device 100 comprises:

[0052] A checking module 101 is configured to respond to the filter-enabling instruction sent by the agent and check whether there is a network protection rule in the rule base, and the network protection rule can be input through the configuration interface of the agent;

[0053] The processing module 102 is configured to process the network connection request of the application according to the network protection rule when there is a network protection rule in the rule base. The processing operation includes releasing or blocking with an alarm.

[0054] Optionally, in some embodiments of the present disclosure, the network protection rules include at least two protection strategies with different priorities. The processing module 102 is specifically used to sort the protection strategies in descending order according to the priority, and based on the descending result, process the network connection request of the application in sequence according to the protection strategies.

[0055] Optionally, in some embodiments of the present disclosure, the protection policy includes a privileged policy for ensuring normal operation of a service, and the priority of the privileged policy is the highest among at least two protection policies with different priorities.

[0056] Optionally, in some embodiments of the present disclosure, the network protection rules include Internet Protocol addresses, ports, protocols and data directions.

[0057] Alternatively, if Figure 6 As shown, in some embodiments of the present disclosure, the network security protection device 100 further includes:

[0058] The recording module 103 is configured to record the network connection request of the application program in a violation log if the processing operation is to block and warn;

[0059] The extraction module 104 is configured to extract network protection rules from the violation log according to a preset policy format and add the rules to the rule base.

[0060] Optionally, in some embodiments of the present disclosure, the rule base may be imported into or exported from a local host.

[0061] Alternatively, if Figure 7 As shown, in some embodiments of the present disclosure, the network security protection device 100 further includes:

[0062] The feedback module 105 is configured to feedback a failure message to the agent when there is no network protection rule in the rule base, and wait for the agent to send a filtering start instruction again.

[0063] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0064] The network security protection device provided by the embodiment of the present disclosure has an inspection module in which the inspection module can respond to the filter-enabling instruction sent by the agent to check whether there are network protection rules in the rule base. The network protection rules are input through the configuration interface of the agent, which is convenient, intuitive and clear at a glance. Furthermore, when the network protection rules exist in the rule base, the processing module can process the network connection request of the application program accordingly according to the network protection rules. That is to say, the security protection process is executed by the network security protection device, and humans do not need to understand the underlying implementation of the firewalls of each operating system. The operation is simple, clear and easy to understand, and the scope of application is expanded.

[0065] Based on the above embodiments, the present disclosure provides a terminal device, which includes a processor and a memory. The memory stores at least one instruction, at least one program, code set or instruction set, which is loaded and executed by the processor to implement Figure 1 to Figure 4 The steps of the network security protection method of the corresponding embodiment.

[0066] As another aspect, the present disclosure provides a computer-readable storage medium for storing program code, the program code for executing the aforementioned Figure 1 to Figure 4 Any implementation method of the network security protection method of the corresponding embodiment.

[0067] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0068] In the several embodiments provided in the present disclosure, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms. The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0069] In addition, each functional module in each embodiment of the present disclosure may be integrated into a processing unit, or each module may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium.

[0070] Based on this understanding, the technical solution of the present disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the network security protection method of each embodiment of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0071] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A network security protection method, characterized in that: The method is used at the driving end, and the method comprises: In response to the filter-enabling instruction sent by the agent, check whether there is a network protection rule in the rule base, and the network protection rule can be input through the configuration interface of the agent; When the network protection rule exists in the rule base, a processing operation is performed on the network connection request of the application program according to the network protection rule, and the processing operation includes releasing or blocking with an alarm.

2. The network security protection method according to claim 1, characterized in that: The network protection rule includes at least two protection strategies with different priorities. When the network protection rule exists in the rule base, the network connection request of the application is processed according to the network protection rule, including: The protection strategies are sorted in descending order according to the priority, and based on the descending order result, the network connection requests of the application are processed in sequence according to the protection strategies.

3. The network security protection method according to claim 2, characterized in that: The protection policy includes a privileged policy for ensuring normal operation of a service, and the priority of the privileged policy is the highest among the at least two protection policies with different priorities.

4. The network security protection method according to claim 1, characterized in that: The network protection rules include Internet Protocol addresses, ports, protocols and data directions.

5. The network security protection method according to any one of claims 1 to 4, characterized in that: The method further comprises: If the processing operation is to block and warn, the network connection request of the application is recorded in a violation log; According to a preset policy format, the network protection rules are extracted from the violation log and added to the rule base.

6. The network security protection method according to claim 5, characterized in that: The rule base may be imported to or exported from a local host.

7. The network security protection method according to any one of claims 1 to 4, characterized in that: The method further comprises: When the network protection rule does not exist in the rule base, a failure message is fed back to the agent, and the agent is waited to send the filter-enabling instruction again.

8. A network security protection device, characterized in that: The device is used for the driving end, and the device comprises: A checking module configured to respond to the filter-enabling instruction sent by the agent and check whether there is a network protection rule in the rule base, wherein the network protection rule can be input through the configuration interface of the agent; The processing module is configured to perform a processing operation on the network connection request of the application program according to the network protection rule when the network protection rule exists in the rule base, and the processing operation includes releasing or blocking with an alarm.

9. A terminal device, characterized in that: The terminal device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the instruction, the program, the code set or the instruction set is loaded and executed by the processor to implement the steps of the network security protection method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the network security protection method described in any one of claims 1 to 7.

Images