Autonomous controllable transformation method for network security equipment

Abstract

The invention provides an autonomous controllable transformation method for network security equipment. The method comprises the following steps: S1, establishing a basic data set of the network security equipment; s2, establishing an equipment ledger and equipment resume data set; s3, obtaining a state data set of the network security equipment; s4, establishing a maintenance data set of the network security equipment; s5, establishing a system security engineering replacement control model, and obtaining information of the network security equipment from ordering to scrapping and replacement; s6, establishing a network security platform, performing log recording and event warning on the purchased network security equipment, and collecting logs to the network security platform; and S7, the network security equipment is installed and implemented, and replacement control of the network security equipment is completed. According to the autonomous controllable transformation method for the network security equipment, the problems of too high cost and too long transformation period of old equipment transformation are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of power station networks, and in particular to an autonomous and controllable transformation method for network security equipment. Background Art

[0002] Network security issues have become increasingly severe. The rapid development of cloud computing, big data, and artificial intelligence has added great challenges to network security. If network equipment as an infrastructure is attacked, it will lead to the interruption of the company's production data and business, or even data theft. For relevant departments, there is no need to connect to the Internet, but the internal network equipment uses traditional routing and switching protocols. As long as traditional routing and switching protocols are used, there is a risk of being attacked specifically against network equipment, causing serious network security incidents. In particular, if certain special departments are attacked by cyber attacks during special periods, the disastrous consequences caused are immeasurable.

[0003] In the face of emerging network threats, network security equipment needs to be replaced, but the upgrading of equipment will bring many new problems, such as: the cost of transforming old equipment is too high and the transformation cycle is too long. These problems seriously affect the transformation of old equipment and the implementation of new technologies. Therefore, there is an urgent need for an autonomous and controllable transformation method for network security equipment to solve the above problems. Summary of the invention

[0004] The present invention provides an autonomous and controllable transformation method for network security equipment, which solves the problems of high cost and long transformation period for transforming old equipment.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: A method for autonomous and controllable transformation of network security equipment, comprising: S1. Obtain information about network security equipment at the workstation and establish a basic data set of network security equipment; S2. Obtain the ordering information, initial information before receipt, and unique number of the network security equipment at the workstation, and establish an equipment ledger and equipment history data set; S3, collecting status data of network security devices at the workstation to obtain a status data set of the network security devices; S4. Obtain maintenance information of network security equipment at the work station and establish a maintenance data set for network security equipment; S5. Based on the basic data set, equipment history data set, status data set and maintenance data set collected in S4, a system security engineering replacement control model is established to obtain information on the process of network security equipment from ordering to scrapping and replacement; S6. Based on the system security engineering replacement control model established in S5, plan and configure the protection rules of the newly commissioned network security equipment, establish a network security platform, record logs and event alarms for the purchased network security equipment, and collect logs on the network security platform to support the collection of network security big data, and conduct vulnerability and penetration testing on the established network security platform; S7. Install and implement network security equipment to complete the replacement control of network security equipment.

[0006] In the above-mentioned S7, before the equipment is installed, the required IP addresses and rack space are prepared, and the computer room reserves space and power interfaces for the network security equipment involved. All the information required for implementation is archived to form a customer management implementation project document and compiled on the network security platform.

[0007] The above-mentioned network security equipment includes firewalls, intrusion detection devices, data leakage prevention systems, operation and maintenance security management and auditing, log auditing devices, vulnerability scanning systems, hyper-converged software, servers and computing servers.

[0008] The information of network security equipment in S1 mentioned above includes basic information of network equipment, security network protection category, transmission output form classification, factory benchmark parameters, manufacturer, maintenance service provider, maintenance frequency, order unit price, and service life; management categories include non-repairable and repairable, so as to determine which equipment needs to be replaced through the system safety engineering replacement control model.

[0009] The implementation steps for judging replacement of the system security engineering replacement control model in the above S6 are as follows: when the management category is unrepairable, the replacement process is carried out directly, and the ordering resources are started to order the same type of equipment with higher configuration. When the management category is repairable, reasonable settings are made according to the specific needs of the network security industry. When the network security equipment cannot meet the needs, it needs to be replaced.

[0010] The above replacement conditions are set with thresholds from the dimensions of replacement cost, maintenance cost, service life and number of maintenance times.

[0011] During the installation and implementation of the above-mentioned S7, the technical solution and the safety fallback solution shall be implemented when the running equipment is cutover, switched or upgraded.

[0012] The above-mentioned updated and replaced equipment must be debugged offline before cutover to ensure that it can be powered on and put into use immediately after replacement to avoid long business interruption time. The network equipment cutover work is completed first. Among the security devices, the regional firewall is cutover together with the network equipment, and the remaining security devices are implemented after other cutovers are completed.

[0013] The present invention provides an autonomous and controllable transformation method for network security equipment, plans and designs the deployment of existing network security equipment, obtains information on network security equipment on work stations, and establishes a basic data set for network security equipment; establishes a system security engineering replacement control model to obtain key information on the process from ordering to scrapping and replacement of network security equipment; plans and configures protection rules for newly commissioned network security equipment, establishes a network security platform, logs and events alarms are recorded for purchased network security equipment, and logs are collected on the network security platform to support the collection of network security big data, and vulnerability and penetration tests are performed on the constructed network security platform; the network security equipment is installed and implemented to complete the replacement control of the network security equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The present invention will be further described below in conjunction with the accompanying drawings and embodiments: Figure 1 A schematic diagram of the process of controllable transformation of the network security device of the present invention; Figure 2 It is a schematic diagram of the structure of the network security device of the present invention. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solutions and advantages of the present invention clearer, the following content will systematically and completely describe the specific technical solutions of the present invention in combination with the drawings provided according to the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0016] A method for autonomous and controllable transformation of network security equipment, comprising: S1. Obtain information about network security equipment at the workstation and establish a basic data set of network security equipment; S2. Obtain the ordering information, initial information before receipt, and unique number of the network security equipment at the workstation, and establish an equipment ledger and equipment history data set; S3, collecting status data of network security devices at the workstation to obtain a status data set of the network security devices; S4. Obtain maintenance information of network security equipment at the work station and establish a maintenance data set for network security equipment; S5. Based on the basic data set, equipment history data set, status data set and maintenance data set collected in S4, a system security engineering replacement control model is established to obtain information on the process of network security equipment from ordering to scrapping and replacement; S6. Based on the system security engineering replacement control model established in S5, plan and configure the protection rules of the newly commissioned network security equipment, establish a network security platform, record logs and event alarms for the purchased network security equipment, and collect logs on the network security platform to support the collection of network security big data, and conduct vulnerability and penetration testing on the established network security platform; S7. Install and implement network security equipment to complete the replacement control of network security equipment.

[0017] In the above-mentioned S7, before the equipment is installed, the required IP addresses and rack space are prepared, and the computer room reserves space and power interfaces for the network security equipment involved. All the information required for implementation is archived to form a customer management implementation project document and compiled on the network security platform.

[0018] The above-mentioned network security equipment includes firewalls, intrusion detection devices, data leakage prevention systems, operation and maintenance security management and auditing, log auditing devices, vulnerability scanning systems, hyper-converged software, servers and computing servers.

[0019] The information of network security equipment in S1 mentioned above includes basic information of network equipment, security network protection category, transmission output form classification, factory benchmark parameters, manufacturer, maintenance service provider, maintenance frequency, order unit price, and service life; management categories include non-repairable and repairable, so as to determine which equipment needs to be replaced through the system safety engineering replacement control model.

[0020] The implementation steps for judging replacement of the system security engineering replacement control model in the above S6 are as follows: when the management category is unrepairable, the replacement process is carried out directly, and the ordering resources are started to order the same type of equipment with higher configuration. When the management category is repairable, reasonable settings are made according to the specific needs of the network security industry. When the network security equipment cannot meet the needs, it needs to be replaced.

[0021] The above replacement conditions are set with thresholds from the dimensions of replacement cost, maintenance cost, service life and number of maintenance times.

[0022] During the installation and implementation of the above-mentioned S7, the technical solution and the safety fallback solution shall be implemented when the running equipment is cutover, switched or upgraded.

[0023] The above-mentioned updated and replaced equipment must be debugged offline before cutover to ensure that it can be powered on and put into use immediately after replacement to avoid long business interruption time. The network equipment cutover work is completed first. Among the security devices, the regional firewall is cutover together with the network equipment, and the remaining security devices are implemented after other cutovers are completed.

[0024] Example: like Figure 1-2As shown in , a method for autonomous and controllable transformation of network security equipment includes planning and designing the deployment of existing network security equipment, S1. Obtain information about network security equipment at the workstation and establish a basic data set of network security equipment; S2. Obtain the ordering information, initial information before receipt, and unique number of the network security equipment at the workstation, and establish an equipment ledger and equipment history data set; S3, collecting status data of network security devices at the workstation to obtain a status data set of the network security devices; S4. Obtain maintenance information of network security equipment at the work station and establish a maintenance data set for network security equipment; S5. Based on the basic data set, equipment history data set, status data set and maintenance data set collected in S4, a system security engineering replacement control model is established to obtain key information on the process of network security equipment from ordering to scrapping and replacement; S6. Based on the system security engineering replacement control model established in S5, plan and configure the protection rules of the newly commissioned network security equipment, establish a network security platform, record logs and event alarms for the purchased network security equipment, and collect logs on the network security platform to support the collection of network security big data, and conduct vulnerability and penetration testing on the established network security platform; S7. Install and implement network security equipment to complete the replacement control of network security equipment.

[0025] The system security engineering replacement control model can be SSE-CMM. By dividing the network into different security areas, assigning corresponding addresses to each security area and setting default routes, network access control, network resource management and other security controls can be easily performed based on the security domain division, and targeted protection strategies for the boundaries of different security domains can be designed. Network resources include bandwidth and processing power. Based on the security domain division, the routing and switching equipment's own capabilities are used to divide different security domains in the internal network into different logical subnet VLANs, and access control rules ACL are defined between VLANs to achieve basic isolation between different security domains within the network.

[0026] The IP addresses and rack space required for equipment installation should be prepared in advance. The computer room needs to reserve space and power interfaces for the network security equipment involved. All information required for implementation should be archived to form customer management implementation project documents and compiled on the network security platform.

[0027] The equipment products involved in the replacement include firewalls, intrusion detection devices, data leakage prevention systems, operation and maintenance security management and auditing, log auditing devices, vulnerability scanning systems, hyper-converged software, servers and computing servers.

[0028] The firewall can use TopSec: model: NGFW4000-UF (FT-B12), the intrusion detection device can use TopSec: model: TopSentry3000 (FT-B20), the data leakage prevention system can use TopSec: model: TopDLP (HG-B40N) to provide network monitoring and network blocking functions, operation and maintenance security control and audit (bastion host) TopSec: (1) Operation and maintenance security management system V3 model: TopSAG (FT-B), security extension module system V3 model: TopSEC-KEY-GM3000B, the log audit device can use TopSec: model: TA-LOG (FT-A20), the vulnerability scanning system can use TopSec: model: TopScanner7000 (FT-A), and the hyper-convergence software can use TopSec: model: TopHC-SW-PACK.

[0029] The basic data information in S1 includes the basic information of network equipment, safety network protection category, transmission output form classification, factory benchmark parameters, manufacturer, maintenance service provider, maintenance frequency, order unit price, and service life; management categories include non-repairable and repairable, and the system safety engineering replacement control model is used to determine which equipment needs to be replaced.

[0030] The implementation steps of the system security engineering replacement control model in S6 to determine replacement are as follows: when the management category is unrepairable, the replacement process is carried out directly, and the ordering of resources is started to order equipment of the same type but with higher configuration. When the management category is repairable, reasonable settings are made for the specific needs of the network security industry. When the network security equipment cannot meet the needs, it needs to be replaced; if it meets the needs, the estimated usable time is based on the service life, and logs are recorded, and replacement is carried out after the scrapping time.

[0031] The replacement conditions can be set by thresholds based on dimensions such as replacement cost, maintenance cost, service life, and number of maintenance times.

[0032] The purchased network security equipment needs to be inspected upon arrival, mainly including the equipment quantity, appearance test, unpacking test and power-on test. After the arrival inspection is completed, the equipment acceptance document is filled in and compiled on the network security platform.

[0033] When checking the quantity of goods, it should be checked in the following order: complete machines are classified by device type, modules are classified by the inserted devices, the number of complete machines, the number of modules, and the number of software. When checking the number and type of equipment, the product serial number of the equipment should be recorded as the unique identifier of the equipment.

[0034] Equipment appearance test: The appearance of the equipment should be smooth and shiny, without scratches, rust or damage. The outer packaging should be intact and in the original box with the mark of origin printed on it. The goods must be carefully, properly and firmly packed according to the requirements of long-distance transportation and be resistant to moisture, water vapor, rust and corrosion.

[0035] Unpacking inspection: The hardware module and software of the machine are of the specified models and quantities, and the packing list in the cargo packaging is consistent with the actual product.

[0036] Equipment power-on test Before powering on the equipment, check in detail whether each module is properly installed. Each module should be installed firmly and in the correct position. Before powering on, check the power supply installation of the equipment. The power supply should be installed firmly and in the correct position. Make sure that the power supply conditions of the site meet the requirements before powering on. After the equipment is powered on and started, check all indicator lights to see if there is any alarm status, and then use relevant commands to display the information of each module. The equipment should be able to correctly identify each module without any error information. After the equipment power-on inspection is completed, press the switch to turn off the power. It is strictly forbidden to directly cut off the power.

[0037] During the installation and implementation of S7, a detailed technical implementation plan and a safe fallback plan should be formulated for the cutover, switchover or upgrade of running equipment.

[0038] When updating or replacing equipment, offline debugging must be done before cutover to ensure that it can be powered on and put into use immediately after replacement to avoid prolonged business downtime. The network equipment cutover should be completed first. Among security devices, the regional firewall should be cutover together with the network equipment. The remaining security equipment must be implemented after other cutovers are completed.

[0039] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0040] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for autonomous and controllable transformation of network security equipment, characterized in that: include: S1. Obtain information about network security equipment at the workstation and establish a basic data set of network security equipment; S2. Obtain the ordering information, initial information before receipt, and unique number of the network security equipment at the workstation, and establish an equipment ledger and equipment history data set; S3, collecting status data of network security devices at the workstation to obtain a status data set of the network security devices; S4. Obtain maintenance information of network security equipment at the work station and establish a maintenance data set for network security equipment; S5. Based on the basic data set, equipment history data set, status data set and maintenance data set collected in S4, a system security engineering replacement control model is established to obtain information on the process of network security equipment from ordering to scrapping and replacement; S6. Based on the system security engineering replacement control model established in S5, plan and configure the protection rules of the newly commissioned network security equipment, establish a network security platform, record logs and event alarms for the purchased network security equipment, and collect logs on the network security platform to support the collection of network security big data, and conduct vulnerability and penetration testing on the established network security platform; S7. Install and implement network security equipment to complete the replacement control of network security equipment.

2. According to the method for autonomous and controllable transformation of network security equipment described in claim 1, it is characterized in that: In the S7 described above, before the equipment is installed, the required IP addresses and rack space are prepared, and the computer room reserves space and power interfaces for the network security equipment involved. All the information required for implementation is archived to form a customer management implementation project document and compiled on the network security platform.

3. According to the method for autonomous and controllable transformation of network security equipment described in claim 2, it is characterized in that: The network security equipment includes firewalls, intrusion detection devices, data leakage prevention systems, operation and maintenance security management and auditing, log auditing devices, vulnerability scanning systems, hyper-convergence software, servers and computing power servers.

4. According to the method for autonomous and controllable transformation of network security equipment described in claim 3, it is characterized in that: The information of the network security equipment in S1 includes the basic information of the network equipment, the security network protection category, the transmission output form classification, the factory benchmark parameters, the manufacturer, the maintenance service provider, the maintenance frequency, the order unit price, and the service life; the management categories include non-repairable and repairable, so as to determine which equipment needs to be replaced through the system safety engineering replacement control model.

5. According to the method for autonomous and controllable transformation of network security equipment described in claim 4, it is characterized in that: The implementation steps of the system security engineering replacement control model in S6 for judging replacement are as follows: when the management category is unrepairable, the replacement process is carried out directly, and the ordering of resources is started to order equipment of the same type but with higher configuration. When the management category is repairable, reasonable settings are made according to the specific needs of the network security industry. When the network security equipment cannot meet the needs, it needs to be replaced.

6. According to the method for autonomous and controllable transformation of network security equipment described in claim 5, it is characterized in that: The replacement conditions are set by setting thresholds from the dimensions of replacement cost, maintenance cost, service life and number of maintenance times.

7. According to the method for autonomous and controllable transformation of network security equipment described in claim 6, it is characterized in that: During the installation and implementation of S7, the technical solution and the safety fallback solution are implemented when the running equipment is cutover, switched or upgraded.

8. According to the method for autonomous and controllable transformation of network security equipment described in claim 7, it is characterized in that: The updated and replaced equipment is debugged offline before cutover to ensure that it can be powered on and put into use immediately after replacement to avoid long service suspension time. The network equipment cutover is completed first. Among the security devices, the regional firewall is cutover together with the network equipment, and the remaining security devices are implemented after other cutovers are completed.

Images