Unified management and control method and system for network security policy of information system

Abstract

The invention relates to a unified management and control method and system for network security policies of an information system. The method comprises the following steps: S1, acquiring state information of network security protection equipment; s2, generating strategy information according to a service network demand newly proposed by a user; s3, updating a strategy configuration data table based on the strategy information; s4, the updated strategy configuration data tables are respectively issued to network security protection equipment in the service network link; and S5, after the strategy issuing takes effect, displaying the strategy information updating condition of the network security protection equipment in real time. According to the invention, situation awareness of the network security protection equipment, network demand analysis, automatic generation of the security protection strategy and issuing to the network security protection equipment can be realized, cross-regional manual field operation can be further reduced, and the efficiency of newly adding the demand configuration strategy of the network security protection equipment is improved; and unified management and control of the security policy of the network security protection equipment are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network security policies, and in particular to a method and system for unified management and control of network security policies of an information system. Background Art

[0002] With the continuous development of computer network technology, more and more information system network architectures are showing characteristics such as diverse connection methods and wide terminal distribution, which greatly increases the possibility of network security risks. Therefore, it is necessary to design relevant security protection equipment within the network structure. However, in a complex network architecture, a large number of security devices are usually not in the same area or the same network segment. When new network requirements are added, the network security strategy must be configured accordingly before the information link can be connected.

[0003] The existing network security protection policy management only manages the devices in the same area or network segment, and a large number of network security protection devices are from different manufacturers, which makes it impossible to better centrally configure and manage the policies of security devices. When adding new network access requirements according to business needs, it is necessary to configure policies separately on all network security protection devices that the business network passes through, which greatly consumes manpower and material resources. Therefore, it is of great significance to realize the unified management and control of security policies of network security protection devices. Summary of the invention

[0004] In order to solve the technical problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a method and system for unified management and control of network security policies of an information system, which can realize unified management and control of security policies of network security protection equipment.

[0005] To achieve the above-mentioned object of the invention, the present invention provides a method for unified management and control of network security policies of an information system, comprising the following steps:

[0006] Step S1, obtaining network security protection device status information;

[0007] Step S2: Generate policy information based on the new service network requirements proposed by the user;

[0008] Step S3: based on the policy information, update the policy configuration data table;

[0009] Step S4: Send the updated policy configuration data table to the network security protection devices in the service network link respectively;

[0010] Step S5: After the policy takes effect, the updated status of the network security protection device policy information is displayed in real time.

[0011] According to a technical solution of the present invention, in step S1, the status information of all network security protection devices in the network link is collected, and the status information at least includes device status, alarm information, and policy configuration.

[0012] According to a technical solution of the present invention, in step S2, based on the new business network requirements proposed by the user, the business network path is analyzed through the business requirement quintuple information combined with the network equipment model, and the corresponding network security configuration is generated according to the network security protection equipment passed on the network path to generate policy information.

[0013] According to a technical solution of the present invention, in step S3, the newly added policy information is compared and analyzed with the existing network security policy, repeated or conflicting policies for the same device and security protection coordination policies between different devices on the same link are eliminated, and the policy configuration data table is updated.

[0014] According to one aspect of the present invention, a unified information system network security policy management and control system is proposed, comprising:

[0015] An acquisition module is used to obtain network security protection device status information;

[0016] A generation module is used to generate policy information based on new business network requirements proposed by users;

[0017] An update module, used for updating a policy configuration data table based on policy information;

[0018] A sending module, used to send the updated policy configuration data table to the network security protection devices in the service network link respectively;

[0019] The display module is used to display the updated status of network security protection device policy information in real time after the policy takes effect.

[0020] According to a technical solution of the present invention, the acquisition module completes the collection by collecting the status information of all network security protection devices in the network link, and the status information at least includes device status, alarm information, and policy configuration.

[0021] According to a technical solution of the present invention, the generation module analyzes the business network path based on the new business network requirements proposed by the user through the business requirement quintuple information combined with the network equipment model, and generates corresponding network security configuration and policy information based on the network security protection equipment passed on the network path.

[0022] According to a technical solution of the present invention, the update module compares and analyzes the newly added policy information with the existing network security policy, eliminates repeated or conflicting policies for the same device and security protection coordination policies between different devices on the same link, and updates the policy configuration data table.

[0023] According to one aspect of the present invention, there is provided an electronic device, comprising: one or more processors, one or more memories, and one or more computer programs; wherein the processor is connected to the memory, and the one or more computer programs are stored in the memory, and when the electronic device is running, the processor executes the one or more computer programs stored in the memory, so that the electronic device executes a method for unified management and control of network security policies of an information system as described in any one of the above technical solutions.

[0024] According to one aspect of the present invention, a computer-readable storage medium is provided for storing computer instructions. When the computer instructions are executed by a processor, a method for unified management and control of network security policies of an information system as described in any one of the above technical solutions is implemented.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] The present invention proposes a method and system for unified management and control of network security policies of information systems, which can realize situational awareness of network security protection equipment, network demand analysis, and automatic generation of security protection policies and distribution to network security protection equipment, further reduce cross-regional manual on-site operations, improve the efficiency of new demand configuration strategies for network security protection equipment, and realize unified management and control of security policies for network security protection equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 A flowchart schematically showing a method for unified management and control of information system network security policies in an implementation case of the present invention;

[0029] Figure 2 A schematic diagram schematically shows the composition of an information system network security policy unified management and control system in an implementation case according to the present invention;

[0030] Figure 3 The flowchart of the method for unified management and control of network security policies of information systems in another implementation case of the present invention is schematically shown. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] like Figure 1 As shown, a method for unified management and control of network security policies of an information system of the present invention comprises the following steps:

[0033] Step S1, obtaining network security protection device status information;

[0034] Step S2: Generate policy information based on the new service network requirements proposed by the user;

[0035] Step S3: based on the policy information, update the policy configuration data table;

[0036] Step S4: Send the updated policy configuration data table to the network security protection devices in the service network link respectively;

[0037] Step S5: After the policy takes effect, the updated status of the network security protection device policy information is displayed in real time.

[0038] In some embodiments of the present invention, in step S1, the collection is completed by collecting status information of all network security protection devices in the network link, and the status information at least includes device status, alarm information, and policy configuration.

[0039] In some embodiments of the present invention, in step S2, based on the new business network requirements proposed by the user, the business network path is analyzed through the business requirement quintuple information combined with the network equipment model, and the corresponding network security configuration is generated according to the network security protection equipment passed on the network path to generate policy information.

[0040] In some embodiments of the present invention, in step S3, the newly added policy information is compared and analyzed with the existing network security policy, repeated or conflicting policies for the same device and security protection coordination policies between different devices on the same link are eliminated, and the policy configuration data table is updated.

[0041] like Figure 2 As shown, according to one aspect of the present invention, a unified management and control system for network security policies of an information system is proposed, comprising:

[0042] An acquisition module is used to obtain network security protection device status information;

[0043] A generation module is used to generate policy information based on new business network requirements proposed by users;

[0044] An update module, used for updating a policy configuration data table based on policy information;

[0045] A sending module, used to send the updated policy configuration data table to the network security protection devices in the service network link respectively;

[0046] The display module is used to display the updated status of network security protection device policy information in real time after the policy takes effect.

[0047] In some embodiments of the present invention, the acquisition module completes the collection by collecting status information of all network security protection devices in the network link, and the status information at least includes device status, alarm information, and policy configuration.

[0048] In some embodiments of the present invention, the generation module analyzes the business network path based on the new business network requirements proposed by the user through the business requirement quintuple information combined with the network equipment model, and generates corresponding network security configuration and policy information based on the network security protection devices passed through the network path.

[0049] In some embodiments of the present invention, the update module compares and analyzes the newly added policy information with the existing network security policy, eliminates repeated or conflicting policies for the same device and security protection coordination policies between different devices on the same link, and updates the policy configuration data table.

[0050] According to one aspect of the present invention, there is provided an electronic device, comprising: one or more processors, one or more memories, and one or more computer programs; wherein the processor is connected to the memory, and the one or more computer programs are stored in the memory, and when the electronic device is running, the processor executes the one or more computer programs stored in the memory, so that the electronic device executes a method for unified management and control of network security policies of an information system as described in any one of the above technical solutions.

[0051] According to one aspect of the present invention, a computer-readable storage medium is provided for storing computer instructions. When the computer instructions are executed by a processor, a method for unified management and control of network security policies of an information system as described in any one of the above technical solutions is implemented.

[0052] The following is a detailed description of a method for unified management and control of network security policies of an information system of the present invention with reference to a specific embodiment.

[0053] like Figure 3As shown, in the network architecture of the network security policy unified management of the present invention, the network security devices have established link models, and the device status information and policy configuration information can be obtained in real time and displayed on the interface. New network requirements can be filled in the new requirements page.

[0054] When a new network demand is added, service A terminal needs to access service B terminal, where service A terminal and service B terminal belong to different areas and different network segments. The switch on the network path has been configured with routing policies. The specific information of the access demand is shown in Table 1:

[0055] Table 1 Network new access requirements

[0056]

[0057] Step S1: Based on the existing business demand information and network security equipment model, it can be analyzed that this demand needs to go through commercial trusted protection equipment A, firewall A, and integrated protection equipment A (all of which are general network security protection equipment), a total of three layers of network security protection equipment.

[0058] Step S2: Generate policy configuration tables for three types of network security protection devices according to the business demand table, and generate a policy configuration data table. See Table 2 for specific information.

[0059] Table 2 Strategy configuration data table

[0060]

[0061] Step S3, compare and analyze the newly added policy configuration data with the existing network security policy of the same security protection device, and eliminate duplicate or conflicting policies; or collaboratively analyze the security policies of different network security protection devices on the access demand link. After the analysis is completed, update the analysis results to the policy configuration data table; if a policy configuration that exceeds the range and cannot be implemented occurs, feedback is given that the new requirement cannot be configured and please re-enter the requirement.

[0062] As shown in the table, after the comparison with the existing policy is completed in the example, it is found that the policy information has been configured in the integrated security protection device A, and there is no need to issue it again, and the policy status in the table is updated to enabled, as shown in Table 3 for details.

[0063] Table 3 Strategy configuration data table

[0064]

[0065] Step S4: Send the updated policy configuration data table to the commercial trusted protection device A, firewall A, and integrated protection device A respectively.

[0066] Step S5: The commercial trusted protection device A and the firewall A receive the policy configuration information and complete the configuration, and feedback policy information setting completion information.

[0067] After the policy takes effect, the update status of the network security protection device policy information is displayed in real time. The specific information is shown in Table 4.

[0068] Table 4 Policy configuration status information table

[0069]

[0070] In addition, it should be noted that the present invention can be provided as a method, an apparatus or a computer program product. Therefore, the embodiments of the present invention can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the embodiments of the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code.

[0071] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0072] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device, so that a series of operation steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable terminal device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0073] It should also be noted that, in the present invention, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0074] Finally, it should be noted that the above is a preferred embodiment of the present invention. It should be pointed out that although the preferred embodiment of the present invention has been described, for those skilled in the art, once the basic creative concept of the present invention is known, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be regarded as the protection scope of the present invention. Therefore, the attached claims are intended to be interpreted as including the preferred embodiment and all changes and modifications that fall within the scope of the embodiments of the present invention.

Claims

1. A method for unified management and control of network security strategies of information systems, characterized in that: The following steps are involved: Step S1, obtaining network security protection device status information; Step S2: Generate policy information based on the new service network requirements proposed by the user; Step S3: based on the policy information, update the policy configuration data table; Step S4: Send the updated policy configuration data table to the network security protection devices in the service network link respectively; Step S5: After the policy takes effect, the updated status of the network security protection device policy information is displayed in real time.

2. The method for unified management and control of information system network security policies according to claim 1 is characterized in that: In the step S1, the status information of all network security protection devices in the network link is collected, and the status information at least includes device status, alarm information, and policy configuration.

3. The method for unified management and control of information system network security strategies according to claim 2 is characterized in that: In step S2, according to the new business network demand proposed by the user, the business network path is analyzed through the business demand quintuple information combined with the network device model, and the corresponding network security configuration is generated according to the network security protection equipment passed on the network path to generate policy information.

4. The method for unified management and control of information system network security policies according to claim 3 is characterized in that: In step S3, the newly added policy information is compared and analyzed with the existing network security policy, repeated or conflicting policies for the same device and security protection coordination policies between different devices on the same link are eliminated, and the policy configuration data table is updated.

5. An information system network security strategy unified management and control system, characterized in that: include: An acquisition module is used to obtain network security protection device status information; A generation module is used to generate policy information based on new business network requirements proposed by users; An update module, used for updating a policy configuration data table based on policy information; A sending module, used to send the updated policy configuration data table to the network security protection devices in the service network link respectively; The display module is used to display the updated status of network security protection device policy information in real time after the policy takes effect.

6. The information system network security strategy unified management and control system according to claim 5 is characterized in that: The acquisition module completes the collection of status information of all network security protection devices in the network link, and the status information at least includes device status, alarm information, and policy configuration.

7. The information system network security strategy unified management and control system according to claim 5 is characterized in that: The generation module analyzes the business network path based on the business demand quintuple information and the network device model according to the new business network demand proposed by the user, and generates corresponding network security configuration and policy information according to the network security protection devices passed on the network path.

8. The information system network security strategy unified management and control system according to claim 5 is characterized in that: The update module compares and analyzes the newly added policy information with the existing network security policy, eliminates repeated or conflicting policies for the same device and security protection coordination policies between different devices on the same link, and updates the policy configuration data table.

9. An electronic device, characterized in that: include: One or more processors, one or more memories, and one or more computer programs; wherein the processor is connected to the memory, and the one or more computer programs are stored in the memory, and when the electronic device is running, the processor executes the one or more computer programs stored in the memory, so that the electronic device executes the information system network security policy unified management and control method as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that: Used to store computer instructions, which, when executed by a processor, implement the information system network security policy unified management and control method as described in any one of claims 1 to 4.

Images