Method and system for automatically identifying provisioning conforming to security network policy

Abstract

The invention relates to the technical field of network security, in particular to a method and a system for automatically identifying the opening of a security-conforming network policy, which comprises the following steps: collecting a network security policy in a whole power monitoring system area; constructing a set library of network security policies by importing the network security policies; establishing a high-risk port library, and inputting high-risk ports into the high-risk port library one by one for unified management; importing a policy opening list, and automatically comparing policies in the policy opening list, policies in a set library of network security policies and high-risk ports; and judging whether a network security policy is met or not according to a comparison result, and outputting a corresponding result according to the judgment. The method has the beneficial effects that by automatically importing and comparing the network security policy, the workload of manual auditing is reduced, and the compliance of the network security policy can be quickly and accurately judged. In addition, by establishing the high-risk port library, unified management and rapid identification of the high-risk ports are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for automatically identifying and opening a network that complies with a security network strategy. Background Art

[0002] As network security issues become increasingly prominent, the opening of network policies for various business systems has gradually attracted people's attention. One of the keys to ensuring network security is to implement effective access control policies. However, in the existing network operation and maintenance practices, judging whether access control policies comply with network security specifications mainly relies on manual operations. Network security operation and maintenance personnel usually evaluate the compliance of network security policies based on personal experience and knowledge. This process is not only time-consuming but also inefficient because it requires professionals to invest a lot of time to review policies one by one. In addition, due to the lack of support from automated tools, the review of network security policies relies entirely on the personal judgment of operation and maintenance personnel. This method that relies on personal experience is not only inefficient, but also has the risk of misjudgment. Different operation and maintenance personnel may have different understandings of the same policy, resulting in inconsistent audit results. In addition, manual review is difficult to ensure comprehensive coverage of all policy details and is prone to missing key security risk points. Due to the complexity and professionalism of network security policy review, this process requires high technical capabilities and experience of operation and maintenance personnel. However, not all operation and maintenance personnel have sufficient professional knowledge and experience, which limits the accuracy and reliability of the audit work. Therefore, the existing network security policy audit methods are not only inefficient, but also difficult to ensure the consistency and accuracy of the audit results, which to some extent affects the effectiveness of enterprise network security. Summary of the invention

[0003] In view of the above problems or problems existing in the prior art, the present invention is proposed.

[0004] Therefore, the purpose of the present invention is to provide a method for automatically identifying compliance with security network policy activation, which can solve the problem that the current network security policy review relies entirely on manual operation and lacks the support of automated tools, resulting in low review efficiency and prone to errors.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: a method for automatically identifying the activation of networks that meet the security network policy, which includes collecting the network security policy in the entire power monitoring system area;

[0006] By importing network security policies, a collection library of network security policies is built;

[0007] Establish a high-risk port database and enter the high-risk ports one by one into the database for unified management;

[0008] Import the policy activation form and automatically compare the policies in the policy activation form with the policies and high-risk ports in the collection library of network security policies;

[0009] Determine whether the network security policy is met based on the comparison results, and output the corresponding results based on the judgment.

[0010] As a preferred solution of the method for automatically identifying compliance with security network policy activation of the present invention, the network security policy includes the network protocol, the direction of business system access, the IP address of the business system, the source IP port, the IP of the accessed system, and the port of the accessed system.

[0011] As a preferred solution of the method of automatically identifying the activation of security network policies in accordance with the present invention, the collection library of network security policies includes building a "configuration single import", completely importing the collected network security policies into the "configuration single import", establishing a collection library of network security policies, and naming the collection library "configuration status".

[0012] As a preferred solution of the method of automatically identifying the activation of a secure network policy in accordance with the present invention, the collection library of network security policies is the basis for reviewing new policies, and the import process of network security policies involves data format conversion, data verification, and data cleaning.

[0013] As a preferred solution of the method for automatically identifying and activating policies that comply with security network policies of the present invention, the judgment result includes that the policy activation single policy that complies with the network security policy is activated, and the policy activation single policy that does not comply with the network security policy is returned for verification.

[0014] To solve the above technical problems, the present invention also provides the following technical solutions: a system for automatically identifying network policies that comply with security policies, including a display module for displaying network partitions of a power monitoring system and providing a user interaction interface;

[0015] Configuration sheet import module, used to import the actual operation configuration sheet strategy of the power monitoring system;

[0016] The audit module is used to automatically compare the policies in the policy activation form with the policies in the network security policy collection library and the ports in the high-risk port library, and automatically determine whether the policies meet the network security requirements based on the comparison results;

[0017] High-risk port management module allows users to define and manage high-risk ports, including adding, querying and maintaining the high-risk port list;

[0018] Communication module, used for data exchange with external devices.

[0019] As a preferred solution for the present invention to automatically identify systems that comply with security network policy activation, the display module includes three network partitions of the power monitoring system, namely, Zone I, Zone II, and Zone III, and provides corresponding operation entrances, and for each operation entrance.

[0020] As a preferred solution for the present invention to automatically identify systems that comply with the security network policy activation, the configuration sheet import module includes building a collection library of network security policies by importing existing network security policies, and allowing users to import actual operating configuration sheet policies of the power monitoring system. The configuration sheet import module transmits the two sets of imported data to the audit module, so that the actual operating configuration sheet policy can be automatically compared and identified with the network security policy collection library.

[0021] As a preferred solution for the present invention to automatically identify systems that comply with security network policy activation, the audit module includes comparing the data collected by the configuration sheet import module with the policies controlled by the network security policy collection library. Based on the comparison results, it automatically determines whether the policies comply with network security requirements and gives corresponding marks, which are divided into compliance marks "√" and non-compliance marks "×".

[0022] As a preferred solution of the present invention for automatically identifying systems that comply with the security network policy, the communication module includes a standard interface and a data transmission protocol;

[0023] Standard interfaces allow tools to exchange data with external devices;

[0024] The data transmission protocol encrypts the data transmitted between different devices and adds an authentication mechanism to the data transmitted between devices.

[0025] Beneficial effects of the present invention: The present invention reduces the workload of manual review by automatically importing and comparing network security policies, and can also quickly and accurately determine the compliance of network security policies. In addition, by establishing a high-risk port library, unified management and rapid identification of high-risk ports are achieved. Through the setting of the review module, the imported policy is automatically judged and marked for compliance, which improves the review accuracy and work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0027] Figure 1 A flowchart of a method for automatically identifying compliance with secure network policy activation.

[0028] Figure 2 A diagram of the operation logic for automatically identifying methods that comply with secure network policy provisioning.

[0029] Figure 3 An implementation method for automatically identifying systems that comply with secure network policy provisioning. DETAILED DESCRIPTION

[0030] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0031] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0032] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0033] Example 1

[0034] Reference Figure 1-2 , is an embodiment of the present invention, which provides a method for automatically identifying compliance with security network policy activation, which can solve the problem that the current network security policy review is completely dependent on manual operation and lacks the support of automated tools, resulting in low review efficiency and prone to errors.

[0035] Specifically, collect network security strategies in the entire power monitoring system area;

[0036] By importing network security policies, a collection library of network security policies is built;

[0037] Establish a high-risk port database and enter the high-risk ports one by one into the database for unified management;

[0038] Import the policy activation form and automatically compare the policies in the policy activation form with the policies and high-risk ports in the collection library of network security policies;

[0039] Determine whether the network security policy is met based on the comparison results, and output the corresponding results based on the judgment.

[0040] Specifically, the network administrator collects all relevant network security policies in the power monitoring system area. This includes extracting policy information from the network devices of each substation and control center. For example, assuming that there are 50 substations in Area I of the power monitoring system, each substation runs its own access control policy. The administrator needs to log in to the routers and switches of each substation and export a policy list containing information such as source IP, destination IP, port number, etc. Further, the network administrator imports the collected policy data into the network security policy collection library, which will serve as the basis for reviewing new policies, further establish a high-risk port library, and enter the high-risk ports one by one into the high-risk port library for unified management. It should be noted that the administrator needs to identify and define high-risk ports and enter these port numbers into the high-risk port library.

[0041] When new policies need to be activated, the administrator imports the activation orders of these policies, and automatically compares the policies in the newly imported policy activation orders with the policies in the collection library and the ports in the high-risk port library. The comparison results are finally output accordingly. Those that meet the policies in the collection library will be activated, and those that do not meet the policies in the collection library will be returned for review.

[0042] In summary, the present invention reduces the workload of manual review by automatically importing and comparing network security policies, and can also quickly and accurately determine the compliance of network security policies. In addition, by establishing a high-risk port library, unified management and rapid identification of high-risk ports are achieved. Through the setting of the review module, the imported policy is automatically judged and marked for compliance, which improves the review accuracy and work efficiency.

[0043] Example 2

[0044] Reference Figure 1-2 , which is the second embodiment of the present invention, provides a method for automatically identifying compliance with security network policy activation, which can solve the problem that the current network security policy review is completely dependent on manual operation and lacks the support of automated tools, resulting in low review efficiency and prone to errors.

[0045] Specifically, collect network security strategies in the entire power monitoring system area;

[0046] By importing network security policies, a collection library of network security policies is built;

[0047] Establish a high-risk port database and enter the high-risk ports one by one into the database for unified management;

[0048] Import the policy activation form and automatically compare the policies in the policy activation form with the policies and high-risk ports in the collection library of network security policies;

[0049] Determine whether the network security policy is met based on the comparison results, and output the corresponding results based on the judgment.

[0050] Furthermore, the network security policy includes the network protocol, the direction of business system access, the IP address of the business system, the source IP port, the IP of the accessed system, and the port of the accessed system.

[0051] Specifically, the network protocol includes TCP / UDP, the direction of business system access includes unidirectional or bidirectional, the IP address of the business system includes the source IP and the source IP port, the IP of the accessed system includes the destination IP, and the port of the accessed system includes the destination port;

[0052] Among them, TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are the two most common network protocols. TCP is a connection-oriented, reliable protocol that ensures that data is transmitted correctly from the source to the destination, and guarantees the integrity and order of data through confirmation and retransmission mechanisms; UDP is a connectionless, unreliable protocol that does not guarantee the arrival of data, but provides faster transmission speeds;

[0053] One-way business system access means that data can only flow from one system to another, and reverse communication is not allowed. For example, importing the actual operation configuration single policy of the power monitoring system, the imported configuration single policy will not affect the client's operation regardless of the comparison result; two-way access allows data to flow in both directions between two systems. This communication method is common in applications that require real-time interaction, such as video conferencing or instant messaging;

[0054] Source IP refers to the IP address of the device that initiates the network request. In network security policies, source IP is used to specify which devices or networks can initiate connections;

[0055] The destination IP address refers to the IP address of the target device of the network request. In the network security policy, the destination IP address is used to specify the system or network that can be accessed.

[0056] Furthermore, the collection library of network security policies includes building a "configuration list import", completely importing the collected network security policies into the "configuration list import", establishing a collection library of network security policies, and naming the collection library "configuration status".

[0057] Furthermore, the collection library of network security policies serves as a benchmark for reviewing new policies, and the process of importing network security policies involves data format conversion, data verification, and data cleaning.

[0058] Furthermore, the judgment result includes that the policy that complies with the network security policy is activated within the policy, and is activated; the policy that does not comply with the network security policy is activated within the policy and is returned for verification.

[0059] It should be noted that for activation orders that comply with network security policies, the judgment result is marked as “√” and the order is activated; for activation orders that do not comply with network security policies, the judgment result is marked as “×” and the order is returned for review.

[0060] The basis for the determination is that if the following four conditions are met at the same time, the determination result is marked as "√"; if the following four conditions cannot be met at the same time, the determination result is marked as "×". The conditions are as follows:

[0061] Condition 1: The "Source IP" in the policy activation form is included in the network security policy in the "Source IP" in the "Configuration";

[0062] Condition 2: The "Destination IP" in the policy activation form is included in the network security policy in the "Destination IP" in the "Configuration Status";

[0063] Condition 3: The "Destination Port" in the policy activation form is included in the network security policy in the "Destination Port" in the "Configuration Status";

[0064] Condition 4: The "destination port" in the policy activation form is not in the high-risk port database.

[0065] In summary, the present invention reduces the workload of manual review by automatically importing and comparing network security policies, and can also quickly and accurately determine the compliance of network security policies. In addition, by establishing a high-risk port library, unified management and rapid identification of high-risk ports are achieved. Through the setting of the review module, the imported policy is automatically judged and marked for compliance, which improves the review accuracy and work efficiency.

[0066] Example 3

[0067] Reference Figure 3 , which is the third embodiment of the present invention, provides a system for automatically identifying compliance with security network policy activation, which can solve the problem that the current network security policy review is completely dependent on manual operation and lacks the support of automated tools, resulting in low review efficiency and prone to errors.

[0068] Specifically, the display module 100 is used to display the network partitions of the power monitoring system and provide a user interaction interface;

[0069] The configuration sheet import module 200 is used to import the actual operation configuration sheet strategy of the power monitoring system;

[0070] The audit module 300 is used to automatically compare the policies in the policy activation form with the policies in the network security policy collection library and the ports in the high-risk port library, and automatically determine whether the policies meet the network security requirements based on the comparison results;

[0071] High-risk port management module 400 allows users to define and manage high-risk ports, including adding, querying and maintaining a list of high-risk ports;

[0072] The communication module 500 is used for exchanging data with external devices.

[0073] It should be noted that the user defines and manages high-risk ports, including clicking the high-risk port management button displayed on the user motor display module 100, entering the high-risk port management page, clicking "Add", and entering the port number, port name, description, and status defined as the high-risk port according to the window prompts. After entering, click "Save" to complete the definition of a single high-risk port. When the user imports all high-risk ports, a high-risk port library is established, and all high-risk ports can be intuitively viewed and queried through the display module 100.

[0074] Specifically, the definition of high-risk ports follows the general definition of high-risk ports on the network, such as the default port of remote management service and the default port of database. Usually, only necessary ports are opened on specific devices, and unnecessary ports should be closed immediately. If there are ports that are not actively opened in the network, please check whether the system host has been implanted with a Trojan program.

[0075] Therefore, in terms of port opening, the system will automatically compare the "source port" and "destination port" on the opening form through the audit module 300 in cooperation with the high-risk port management module 400 to see if there are any high-risk ports. If one of the following conditions is met, it is defined as a high-risk port and marked by the audit module 300:

[0076] Condition 1: There is a port in the "Source Port" of the activation form that is in the high-risk port list of this tool;

[0077] Condition 2: A port in the "Destination Port" of the activation form is included in the high-risk port list of this tool.

[0078] Furthermore, the display module 100 includes three network partitions of the display power monitoring system, namely, zone I, zone II, and zone III, and provides corresponding operation entrances for each operation entrance.

[0079] Furthermore, the configuration sheet import module 200 includes building a collection library of network security policies by importing existing network security policies, and allowing users to import actual operating configuration sheet policies of the power monitoring system. The configuration sheet import module 200 transmits the two sets of imported data to the review module 300, so that the actual operating configuration sheet policy can be automatically compared and identified with the network security policy collection library.

[0080] Furthermore, the audit module 300 includes comparing the data collected by the configuration single import module 200 with the policies controlled by the network security policy collection library. Based on the comparison results, it automatically determines whether the policies meet the network security requirements and gives corresponding marks, which are divided into compliance marks "√" and non-compliance marks "×".

[0081] Furthermore, the communication module 500 includes a standard interface and a data transmission protocol;

[0082] Standard interfaces allow tools to exchange data with external devices;

[0083] The data transmission protocol encrypts the data transmitted between different devices and adds an authentication mechanism to the data transmitted between devices.

[0084] It should be noted that data transmission protocols include HTTP / HTTPS, FTP, and SSH;

[0085] Among them, HTTP (Hypertext Transfer Protocol) is an application layer protocol for distributed, collaborative, hypermedia information systems. It is mainly used to transmit hypertext data between Web browsers and servers. It defines the format of requests and responses between clients and servers.

[0086] HTTPS (Secure Hypertext Transfer Protocol) is a secure version of HTTP. It provides data encryption, integrity verification and identity authentication based on HTTP to ensure the security of data during transmission and prevent data from being eavesdropped or tampered with.

[0087] FTP (File Transfer Protocol) is a protocol used for file transfer on the network. It allows users to download files from or upload files to a server. FTP usually runs on TCP port 21. It supports three modes: active mode, passive mode, and active-passive compatible mode to adapt to different network environments.

[0088] SSH (Secure Shell Protocol) is used to encrypt the communication of network services, especially remote login services. In this strategy, FTP is encrypted and protected, providing a secure channel for FTP to encrypt data and authenticate users to prevent eavesdropping, connection hijacking and other network attacks. Before transmitting data, the SSH protocol will perform key exchange and user authentication to ensure the security of the connection.

[0089] In summary, the present invention reduces the workload of manual review by automatically importing and comparing network security policies, and can also quickly and accurately determine the compliance of network security policies. In addition, by establishing a high-risk port library, unified management and rapid identification of high-risk ports are achieved, and through the setting of the review module 300, the imported policy is automatically judged and marked for compliance, thereby improving the review accuracy and work efficiency.

[0090] Importantly, it should be noted that the construction and arrangement of the present application shown in a plurality of different exemplary embodiments are only exemplary. Although only a few embodiments are described in detail in this disclosure, it should be readily understood by those who refer to this disclosure that many modifications are possible without substantially departing from the novel teachings and advantages of the subject matter described in the application (e.g., mounting arrangements, use of materials, color, changes in orientation, etc.). For example, the element shown as integrally formed may be composed of a plurality of parts or elements, the position of the element may be inverted or otherwise changed, and the nature or number or position of the discrete element may be altered or changed. Therefore, all such modifications are intended to be included within the scope of the present invention. The order or sequence of any process or method steps may be changed or reordered according to an alternative embodiment. In the claims, any "bracket plus function" clause is intended to cover the structure of the execution function described herein, and is not only structurally equivalent but also equivalent structure. Without departing from the scope of the present invention, other replacements, modifications, changes and omissions may be made in the design, operating conditions and arrangement of the exemplary embodiments. Therefore, the present invention is not limited to a specific embodiment, but extends to a variety of modifications that still fall within the scope of the appended claims.

[0091] Additionally, in an effort to provide a concise description of example embodiments, all features of an actual implementation may not be described.

[0092] It should be understood that in the development of any actual implementation, as in any engineering or design project, numerous implementation-specific decisions may be made. Such a development effort may be complex and time-consuming, but for those of ordinary skill having the benefit of this disclosure, the development effort will be a routine task of design, fabrication, and production without undue experimentation.

[0093] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for automatically identifying and opening a network that complies with a secure network policy, characterized in that: include, Collect network security strategies in the entire power monitoring system area; By importing network security policies, a collection library of network security policies is built; Establish a high-risk port database and enter the high-risk ports one by one into the database for unified management; Import the policy activation form and automatically compare the policies in the policy activation form with the policies and high-risk ports in the collection library of network security policies; Determine whether the network security policy is met based on the comparison results, and output the corresponding results based on the judgment.

2. The method for automatically identifying and opening a network that complies with a secure network policy as claimed in claim 1, characterized in that: The network security strategy includes the network protocol, the direction of business system access, the IP address of the business system, the source IP port, the IP of the accessed system, and the port of the accessed system.

3. The method for automatically identifying and opening a network that complies with a secure network policy as claimed in claim 2, characterized in that: The network security policy collection library includes building a "configuration list import", importing the collected network security policies into the "configuration list import", establishing a network security policy collection library, and naming the collection library "configuration status".

4. The method for automatically identifying and opening a network that complies with a secure network policy as claimed in claim 3, characterized in that: The collection library of network security policies is a benchmark for reviewing new policies. The import process of network security policies involves data format conversion, data verification, and data cleaning.

5. The method for automatically identifying and opening a network that complies with a secure network policy as claimed in claim 4, characterized in that: The judgment result includes the policy in the policy activation order that complies with the network security policy, and the policy is activated; Strategies that do not comply with network security policies will be returned for review.

6. A system for automatically identifying services that comply with a secure network policy, suitable for automatically identifying services that comply with a secure network policy, characterized in that: include, A display module (100), used to display the network partitions of the power monitoring system and provide a user interaction interface; A configuration sheet import module (200) is used to import the actual operation configuration sheet strategy of the power monitoring system; The audit module (300) is used to automatically compare the policies in the policy activation form with the policies in the network security policy collection library and the ports in the high-risk port library, and automatically determine whether the policies meet the network security requirements based on the comparison results; A high-risk port management module (400) allows users to define and manage high-risk ports, including adding, querying and maintaining a high-risk port list; The communication module (500) is used for exchanging data with external devices.

7. The system for automatically identifying and opening a network that complies with a secure network policy as claimed in claim 6, characterized in that: The display module (100) includes three network partitions for displaying the power monitoring system, namely, zone I, zone II, and zone III, and provides corresponding operation entrances for each operation entrance.

8. The system for automatically identifying and opening a network that complies with a secure network policy as claimed in claim 7, characterized in that: The configuration sheet import module (200) includes building a collection library of network security policies by importing existing network security policies, and allowing users to import actual operation configuration sheet policies of the power monitoring system. The configuration sheet import module (200) transmits the two imported sets of data to the audit module (300), so that the actual operation configuration sheet policy and the network security policy collection library are automatically compared and identified.

9. The system for automatically identifying and opening a network that complies with a secure network policy as claimed in claim 8, characterized in that: The audit module (300) includes comparing the data collected by the configuration sheet import module (200) with the policies controlled by the network security policy collection library, automatically determining whether the policies meet the network security requirements based on the comparison results, and giving corresponding marks, which are divided into a compliance mark "√" and a non-compliance mark "×".

10. The system for automatically identifying and opening a network that complies with a secure network policy as claimed in claim 9, characterized in that: The communication module (500) includes a standard interface and a data transmission protocol; The standard interface allows the tool to exchange data with external devices; The data transmission protocol encrypts the data transmitted between different devices and adds an authentication mechanism to the data transmitted between devices.

Images