Method and system for establishing research and development environment in enterprise informatization construction process

Abstract

The invention discloses a research and development environment building method and system for an enterprise informatization construction process. The method comprises the following steps: acquiring a production system of an enterprise; the production systems of the enterprise are classified to obtain the types of the production systems; based on the type of the production system, a research and development simulation environment and a research and development test environment are constructed respectively; and combining the research and development simulation environment and the research and development test environment to obtain a research and development environment in the enterprise informatization construction process. According to an overall strategy of partition protection and hierarchical management and control, the network security protection level is effectively improved, and sensitive data leakage and illegal access can be prevented.

Description

Technical Field

[0001] The present invention relates to the field of data security protection technology, and more specifically, to a method and system for building a research and development environment during enterprise informatization construction. Background Art

[0002] With the rapid development of information technology, especially the widespread application of technologies such as cloud computing, big data, and artificial intelligence, the R&D environment is facing unprecedented challenges; while these new technologies improve R&D efficiency, they also bring more network security risks; at the same time, hacker attack methods are gradually diversified, and the technical complexity and harmfulness are constantly increasing. Traditional network security protection measures are difficult to effectively deal with new network threats.

[0003] The system development environment often involves a large amount of sensitive data, such as source code, design documents, user information, etc. Once these data are leaked or illegally used, they will cause significant losses to the company. Therefore, it is necessary to build a more secure, reliable and sound R&D environment that can support the smooth development of the company's various projects while ensuring security. Summary of the invention

[0004] In view of the above problems, the purpose of the present invention is to provide a method and system for building a research and development environment in the process of enterprise informatization construction, which can effectively improve the level of network security protection and help prevent sensitive data leakage and illegal access.

[0005] The first aspect of the present invention provides a method for building a research and development environment during enterprise informatization construction, comprising:

[0006] Obtain the enterprise's production system;

[0007] Classify the production system of the enterprise and obtain the type of production system;

[0008] Based on the type of production system, build R&D simulation environment and R&D test environment respectively;

[0009] The R&D simulation environment and the R&D test environment are combined to obtain the R&D environment in the process of enterprise informatization construction.

[0010] This plan also includes:

[0011] Divide the R&D simulation environment into R&D control area and R&D open area according to the network;

[0012] Based on the preset isolation devices, the R&D control area and the R&D open area are isolated;

[0013] The R&D control area is divided according to different uses to obtain multiple R&D control sub-areas, which are isolated based on the corresponding vlan.

[0014] This solution also includes: connecting the information intranet based on a preset core switch and firewall, and adopting a disaster recovery method with at least one master and one backup.

[0015] This plan also includes:

[0016] Obtain the facial information of R&D personnel and the corresponding terminal computer MAC information;

[0017] The facial information of the R&D personnel and the corresponding terminal computer MAC information are associated and stored in the preset blacklist;

[0018] Prohibit network access from MAC addresses in the preset blacklist;

[0019] When the login of the terminal computer passes the verification, the preset core switch will prohibit the MAC address of the corresponding face terminal from network access and remove it from the blacklist to enable Internet access.

[0020] This plan also includes:

[0021] Based on a preset first time period, obtaining addresses of all terminal computers and quantity values ​​of corresponding terminal computers;

[0022] Compare and analyze the addresses of all terminal computers with the preset addresses of the corresponding terminal computers. If they are the same in one-to-one correspondence and the number of terminal computers is the same as the preset number, all computer terminal addresses are sent to the preset blacklist for storage;

[0023] If there are different addresses or repeated addresses, extract the corresponding different addresses or repeated addresses and trigger a warning message;

[0024] The different addresses or duplicate addresses and warning information are sent to a preset management terminal for prompting.

[0025] This plan also includes:

[0026] When there is plug-in access on the terminal computer, a plug-in access prompt message is generated;

[0027] Send the plug-in access prompt information to the preset management end to obtain permission for access rights;

[0028] If access is allowed, the plug-in is allowed to connect to the corresponding terminal computer; if access is not allowed, the plug-in is not allowed to connect to the corresponding terminal computer.

[0029] In this plan, the R&D development zone is also used for:

[0030] Extracting data information stored in the research and development zone and setting it as development zone data;

[0031] Extract keywords from development zone data;

[0032] Compare and analyze the keywords in the development zone data with the preset sensitive keywords to obtain the keyword similarity value. If the keyword similarity value is greater than the preset similarity threshold, the keywords in the corresponding development zone data are set as sensitive keywords.

[0033] Based on the preset blocking tool, the corresponding sensitive keywords will be blocked.

[0034] A second aspect of the present invention provides a system for building a research and development environment during enterprise informatization construction, including a memory and a processor, wherein the memory stores a method program for building a research and development environment during enterprise informatization construction, and the method program for building a research and development environment during enterprise informatization construction implements the following steps when executed by the processor:

[0035] Obtain the enterprise's production system;

[0036] Classify the production system of the enterprise and obtain the type of production system;

[0037] Based on the type of production system, build R&D simulation environment and R&D test environment respectively;

[0038] The R&D simulation environment and the R&D test environment are combined to obtain the R&D environment in the process of enterprise informatization construction.

[0039] This plan also includes:

[0040] Divide the R&D simulation environment into R&D control area and R&D open area according to the network;

[0041] Based on the preset isolation devices, the R&D control area and the R&D open area are isolated;

[0042] The R&D control area is divided according to different uses to obtain multiple R&D control sub-areas, which are isolated based on the corresponding vlan.

[0043] In this solution, the R&D control area is also used to: connect to the information intranet based on a preset core switch and firewall, and adopt a disaster recovery method with at least one master and one backup.

[0044] The present invention discloses a method and system for establishing a research and development environment during the process of enterprise informatization construction. The present invention effectively improves the level of network security protection according to the overall strategy of partition protection and hierarchical control, and helps prevent sensitive data leakage and illegal access. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A flow chart of a method for building a research and development environment in the process of enterprise informatization construction according to the present invention is shown;

[0046] Figure 2 The security deployment diagram of the research and development simulation environment of the present invention is shown;

[0047] Figure 3 A block diagram of a system for building a research and development environment in the process of enterprise informatization construction according to the present invention is shown. DETAILED DESCRIPTION

[0048] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0049] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0050] Figure 1 A flow chart of a method for building a research and development environment during enterprise informatization construction according to the present invention is shown.

[0051] like Figure 1 As shown, the present invention discloses a method for building a research and development environment in the process of enterprise informatization construction, including:

[0052] S101, obtain the enterprise's production system;

[0053] S102, classify the production system of the enterprise to obtain the type of production system;

[0054] S103, based on the production system type, construct a R&D simulation environment and a R&D test environment respectively;

[0055] S104, combining the R&D simulation environment and the R&D test environment to obtain the R&D environment in the process of enterprise informatization construction.

[0056] According to an embodiment of the present invention, a research and development simulation environment and a research and development test environment are first built according to each production system of the enterprise. The research and development simulation environment is a system copied from the production system, and the data therein is real and complete for the purpose of data verification. For example, the research and development simulation environment is built during research and development of the production system based on the safety of research and development personnel, research and development data security, and research and development process security; the research and development test environment is a system copied from the production system, and the data therein is real and complete for the purpose of business testing. For example, the research and development test environment is built during testing of the production system based on the safety of research and development personnel, research and development data security, and research and development process security.

[0057] According to an embodiment of the present invention, it also includes:

[0058] Divide the R&D simulation environment into R&D control area and R&D open area according to the network;

[0059] Based on the preset isolation devices, the R&D control area and the R&D open area are isolated;

[0060] The R&D control area is divided according to different uses to obtain multiple R&D control sub-areas, which are isolated based on the corresponding vlan.

[0061] It should be noted that the R&D simulation environment and the management information area are isolated by an isolation device, and the R&D control area and the R&D open area within the R&D simulation environment are isolated by an isolation device. The R&D simulation environment and the R&D simulation environments of other branches have opened up code and image push channels, and different vlan areas are divided within the R&D control area to isolate areas for different purposes, and a firewall is added in the middle to improve security.

[0062] According to an embodiment of the present invention, it also includes: connecting the information intranet based on a preset core switch and a firewall, and adopting a disaster recovery mode of at least one master and one backup.

[0063] It should be noted that the information intranet and the R&D network are isolated. The R&D network is equipped with at least one primary and one backup firewalls, and at least two R&D network core switches. Each R&D network core switch is connected to the switches of all branches, and the R&D network is connected to the enterprise's main router or backup router through the R&D network firewall; the information intranet is also equipped with at least one primary and one backup intranet firewalls, and at least two core switches. Each core switch is connected to the switches of all branches, and the information intranet is connected to the enterprise's main router or backup router through the intranet firewall.

[0064] According to an embodiment of the present invention, it also includes:

[0065] Obtain the facial information of R&D personnel and the corresponding terminal computer MAC information;

[0066] The facial information of the R&D personnel and the corresponding terminal computer MAC information are associated and stored in the preset blacklist;

[0067] Prohibit network access from MAC addresses in the preset blacklist;

[0068] When the login of the terminal computer passes the verification, the preset core switch will prohibit the MAC address of the corresponding face terminal from network access and remove it from the blacklist to enable Internet access.

[0069] It should be noted that the MAC information of all R&D personnel's terminal computers must match their facial information. All terminal computers are configured with ACL (Access Control) using the switch's policy. First, the MAC addresses of all terminals in the switch are obtained. When the R&D personnel log in with their faces and pass the verification, the switch will prohibit the MAC address of the terminal that has passed the verification from network access and remove it from the blacklist, allowing them to access the Internet.

[0070] According to an embodiment of the present invention, it also includes:

[0071] Based on a preset first time period, obtaining addresses of all terminal computers and quantity values ​​of corresponding terminal computers;

[0072] Compare and analyze the addresses of all terminal computers with the preset addresses of the corresponding terminal computers. If they are the same in one-to-one correspondence and the number of terminal computers is the same as the preset number, all computer terminal addresses are sent to the preset blacklist for storage;

[0073] If there are different addresses or repeated addresses, extract the corresponding different addresses or repeated addresses and trigger a warning message;

[0074] The different addresses or duplicate addresses and warning information are sent to a preset management terminal for prompting.

[0075] It should be noted that, for example, if the first time period is preset to 1 day and the fixed time is 4 a.m., then at 4 a.m. every day, the preset program will be started to write the MAC addresses of all terminals to ensure that all terminals are included in the blacklist, and the MAC addresses of the terminals written into the blacklist and the preset addresses will be compared and analyzed one by one. If they correspond one to one, the MAC address of the terminal written into the blacklist this time is normal; if there is a repeated, missing or different MAC address, a warning message will be triggered.

[0076] According to an embodiment of the present invention, it also includes:

[0077] When there is plug-in access on the terminal computer, a plug-in access prompt message is generated;

[0078] Send the plug-in access prompt information to the preset management end to obtain permission for access rights;

[0079] If access is allowed, the plug-in is allowed to connect to the corresponding terminal computer; if access is not allowed, the plug-in is not allowed to connect to the corresponding terminal computer.

[0080] It should be noted that for fixed terminals, the main risks are leakage of important data through network sharing, CD burning, USB flash drive copying and other operations, loading of unsafe plug-ins or malicious software that endangers internal network security, and risks such as weak passwords and virus infections. Therefore, access to plug-ins to computer terminals is strictly controlled, and only plug-ins with access permissions allowed by the preset management end are allowed to access.

[0081] According to an embodiment of the present invention, the R&D development zone is also used for:

[0082] Extracting data information stored in the research and development zone and setting it as development zone data;

[0083] Extract keywords from development zone data;

[0084] Compare and analyze the keywords in the development zone data with the preset sensitive keywords to obtain the keyword similarity value. If the keyword similarity value is greater than the preset similarity threshold, the keywords in the corresponding development zone data are set as sensitive keywords.

[0085] Based on the preset blocking tool, the corresponding sensitive keywords will be blocked.

[0086] It should be noted that the R&D open area does not allow the storage of sensitive data. When sensitive keywords are detected, they will be blocked using preset blocking tools.

[0087] According to an embodiment of the present invention, the R&D development zone is also used for:

[0088] When sensitive keywords appear, extract the publishing end corresponding to the sensitive keywords and set it as the sensitive publishing end;

[0089] Based on the preset second time period, all sensitive keywords released by the sensitive publishing end in the R&D open area are obtained;

[0090] Classify the corresponding sensitive keywords and set the sensitivity score for each type of sensitive keywords;

[0091] When the same sensitive keyword appears multiple times, the cumulative number of the corresponding sensitive keyword is recorded;

[0092] The cumulative number of times the sensitive keyword appears is multiplied by the sensitivity score of the corresponding type of sensitive keyword and the preset cumulative weight to obtain the violation score of the corresponding publishing end for the sensitive keyword;

[0093] Accumulating the violation scores of all sensitive keywords published by the publishing terminal within the preset second time period to obtain a total violation score;

[0094] If the total violation score is greater than the preset score threshold, a danger warning message is triggered, and the MAC address corresponding to the publisher is prohibited from network access based on the danger warning message.

[0095] It should be noted that when a sensitive keyword appears, the sensitive keyword is traced back to find the publishing end of the sensitive keyword, and all sensitive keywords published by the corresponding publishing end within the preset second time period are found, and the total crisis score of the publishing end within the preset second time period is calculated, and a judgment is made based on the preset score threshold. When the total violation score is greater than the preset score threshold, the network access of the MAC address corresponding to the publishing end is promptly cut off, and a leakage prompt information of the publishing end is generated, and the leakage prompt information of the publishing end is sent to the preset management end for processing; when the total violation score is less than or equal to the preset score threshold, the corresponding sensitive keyword is set as an error of the publishing end, and the error prompt information of the publishing end is triggered at the same time, and the error prompt information of the publishing end is sent to the preset management end for processing.

[0096] According to an embodiment of the present invention, it also includes:

[0097] Get project team member information;

[0098] Divide the project team members into different levels according to preset rules and determine the levels of the project team members;

[0099] According to the information of project team members, the number of project team members with the same level is determined;

[0100] The resource allocation value of the corresponding level among the project team members is obtained by multiplying the number of the project team members of the same level by the preset resource allocation weight of the corresponding level;

[0101] The resource allocation values ​​of all levels of the project team members are accumulated to obtain the server resource allocation value of the corresponding project team.

[0102] It should be noted that strict resource usage management specifications should be formulated to strictly control the safety and efficiency of resource usage. Projects should be created uniformly by R&D managers or supervisors through the shared service portal. When creating a project, you can optionally associate it with an enterprise management and control platform project and submit the server resource allocation value for the corresponding project team. After the project is created, you can create a git repository through the shared service portal and use scaffolding to generate the project, which will be automatically pushed to the corresponding git repository to complete the initialization of the git repository.

[0103] It should be noted that the preset management end reasonably allocates server resources for continuous integration based on the resource applications submitted by the project team and the remaining available resources of the company, and allocates relevant middleware resources at the same time, and associates the relevant information to the shared service portal; first, the database model is created uniformly and users are assigned. Projects should avoid sharing the same library, and a regular backup mechanism should be added. Database master-slave nodes can be built to prevent the risk of data loss, and the data of accepted projects should be archived regularly to save the space occupied by data; second, the designated db is uniformly allocated to avoid mixing different projects to generate dirty data that interferes with development; third, the corresponding message topic ic is applied for when the project is created, and then the topic ic is uniformly created for R&D personnel to test; fourth, the server user, client token and corresponding bucket for file storage are allocated according to needs.

[0104] It should be noted that after the project development phase is completed (the system passes the online trial operation phase), the operation and maintenance personnel will notify the R&D manager to recycle resources, reducing resources to retain the minimum operating requirements until the project is completed and accepted, and all resources will be recycled after the project is accepted.

[0105] Figure 2 The security deployment diagram of the research and development simulation environment of the present invention is shown.

[0106] like Figure 2 As shown, multiple security lines are established between the R&D simulation environments of the branch and the headquarters, and the security protection capabilities of five types of network boundaries are enhanced. Network gate-type isolation devices are deployed at important network boundaries to ensure network security isolation. Security equipment such as protective walls, IPS, WAF, and full-flow monitoring and analysis are deployed according to the security requirements of each line of defense to ensure security and stability.

[0107] Figure 3 A block diagram of a system for building a research and development environment in the process of enterprise informatization construction according to the present invention is shown.

[0108] like Figure 3 As shown, the second aspect of the present invention provides a system 3 for building a research and development environment in the process of enterprise informatization construction, including a memory 31 and a processor 32, wherein the memory stores a method program for building a research and development environment in the process of enterprise informatization construction, and the method program for building a research and development environment in the process of enterprise informatization construction is executed by the processor to implement the following steps:

[0109] Obtain the enterprise's production system;

[0110] Classify the production system of the enterprise and obtain the type of production system;

[0111] Based on the type of production system, build R&D simulation environment and R&D test environment respectively;

[0112] The R&D simulation environment and the R&D test environment are combined to obtain the R&D environment in the process of enterprise informatization construction.

[0113] According to an embodiment of the present invention, it also includes:

[0114] Divide the R&D simulation environment into R&D control area and R&D open area according to the network;

[0115] Based on the preset isolation devices, the R&D control area and the R&D open area are isolated;

[0116] The R&D control area is divided according to different uses to obtain multiple R&D control sub-areas, which are isolated based on the corresponding vlan.

[0117] According to an embodiment of the present invention, the R&D control area is also used to: connect to the information intranet based on a preset core switch and firewall, and adopt a disaster recovery method of at least one master and one backup.

[0118] The present invention discloses a method and system for establishing a research and development environment during the process of enterprise informatization construction. The present invention effectively improves the level of network security protection according to the overall strategy of partition protection and hierarchical control, and helps prevent sensitive data leakage and illegal access.

[0119] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0120] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0121] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0122] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks or optical disks, and other media that can store program codes.

[0123] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

Claims

1. A method for building a research and development environment in the process of enterprise informatization construction, characterized in that: include: Obtain the enterprise's production system; Classify the production system of the enterprise and obtain the type of production system; Based on the type of production system, build R&D simulation environment and R&D test environment respectively; The R&D simulation environment and the R&D test environment are combined to obtain the R&D environment in the process of enterprise informatization construction.

2. According to claim 1, a method for building a research and development environment in the process of enterprise informatization construction is characterized in that: Also includes: Divide the R&D simulation environment into R&D control area and R&D open area according to the network; Based on the preset isolation devices, the R&D control area and the R&D open area are isolated; The R&D control area is divided according to different uses to obtain multiple R&D control sub-areas, which are isolated based on corresponding VLANs.

3. According to claim 2, a method for building a research and development environment in the process of enterprise informatization construction is characterized in that: Also includes: Based on the preset core switch, firewall and information intranet connection, a disaster recovery method with at least one master and one backup is adopted.

4. According to claim 2, a method for building a research and development environment in the process of enterprise informatization construction is characterized in that: Also includes: Obtain the facial information of R&D personnel and the corresponding terminal computer MAC information; The facial information of the R&D personnel and the corresponding terminal computer MAC information are associated and stored in the preset blacklist; Prohibit network access from MAC addresses in the preset blacklist; When the login of the terminal computer passes the verification, the preset core switch will prohibit the MAC address of the corresponding face terminal from network access and remove it from the blacklist to enable Internet access.

5. A method for building a research and development environment in the process of enterprise informatization construction according to claim 4, characterized in that: Also includes: Based on a preset first time period, obtaining addresses of all terminal computers and quantity values ​​of corresponding terminal computers; Compare and analyze the addresses of all terminal computers with the preset addresses of the corresponding terminal computers. If they are the same in one-to-one correspondence and the number of terminal computers is the same as the preset number, all computer terminal addresses are sent to the preset blacklist for storage; If there are different addresses or repeated addresses, extract the corresponding different addresses or repeated addresses and trigger a warning message; The different addresses or duplicate addresses and warning information are sent to a preset management terminal for prompting.

6. A method for building a research and development environment in the process of enterprise informatization construction according to claim 5, characterized in that: Also includes: When there is plug-in access on the terminal computer, a plug-in access prompt message is generated; Send the plug-in access prompt information to the preset management end to obtain permission for access rights; If access is allowed, the plug-in is allowed to connect to the corresponding terminal computer; if access is not allowed, the plug-in is not allowed to connect to the corresponding terminal computer.

7. A method for building a research and development environment in the process of enterprise informatization construction according to claim 2, characterized in that: The R&D development zone is also used for: Extracting data information stored in the research and development zone and setting it as development zone data; Extract keywords from development zone data; Compare and analyze the keywords in the development zone data with the preset sensitive keywords to obtain a keyword similarity value. If the keyword similarity value is greater than the preset similarity threshold, the keyword in the corresponding development zone data is set as a sensitive keyword; Based on the preset blocking tool, the corresponding sensitive keywords will be blocked.

8. A system for building a research and development environment in the process of enterprise information construction, characterized in that: The invention comprises a memory and a processor, wherein the memory stores a method program for building a research and development environment during enterprise informatization construction, and the method program for building a research and development environment during enterprise informatization construction implements the following steps when executed by the processor: Obtain the enterprise's production system; Classify the production system of the enterprise and obtain the type of production system; Based on the type of production system, build R&D simulation environment and R&D test environment respectively; The R&D simulation environment and the R&D test environment are combined to obtain the R&D environment in the process of enterprise informatization construction.

9. A system for building a research and development environment in the process of enterprise informatization construction according to claim 8, characterized in that: Also includes: Divide the R&D simulation environment into R&D control area and R&D open area according to the network; Based on the preset isolation devices, the R&D control area and the R&D open area are isolated; The R&D control area is divided according to different uses to obtain multiple R&D control sub-areas, which are isolated based on corresponding VLANs.

10. A system for building a research and development environment in the process of enterprise informatization construction according to claim 9, characterized in that: The R&D control area is also used to: connect to the information intranet based on a preset core switch and firewall, and adopt a disaster recovery method with at least one master and one backup.

Images