Distributed fast security configuration deployment system

Abstract

The present invention proposes a distributed rapid security configuration deployment system, including a target management cluster and a security deployment server; the security deployment server includes multiple servers, adopts a distributed cluster architecture, and is an important part to meet low latency and efficient transmission. With the support of this distributed cluster architecture, the distributed efficient processing capabilities can be fully utilized for batch and personalized service requests. The server in the security deployment server and the target host in the target management cluster realize the rapid distribution and acquisition of data in the publish or subscribe mode based on the RTPS-UDP communication protocol. In this way, the distributed service cluster combines the underlying RTPS-UDP communication protocol at the same time, takes the tree shape as the main data storage structure, and constructs a solution for the rapid publication and acquisition of data in the publish or subscribe mode.

Description

Technical Field

[0001] The invention mainly relates to the technical field of computer information security, in particular to a distributed rapid security configuration deployment system. Background Art

[0002] At present, there is still a big gap in the development of large-scale security configuration systems. Many computer and network administrators are not security experts. Most domestically produced operating system security configuration systems are also based on Linux security configuration systems. With the continuous development of domestically produced operating systems and the full penetration of information technology, traditional security configuration is still at the stage of manual configuration management, lacking real-time performance and compatibility, and there are many potential configuration threats, which can no longer meet the operation and maintenance requirements of operating system security configuration systems in complex environments. In addition, the current security configuration system has a small scope of application, and it is difficult to perform security configuration of operating systems in large-scale cluster scenarios.

[0003] At this stage, the security configuration of domestically produced independent operating systems is still completed when users are not familiar with the security configuration of the operating system. There is still a gap in using the platform to help users automatically implement security policy configuration. The user's tasks are complex, require a lot of energy, and are difficult to get started. The security configuration of domestically produced independent operating systems at this stage has limitations. It cannot achieve real-time monitoring of changes in the security configuration of the operating system, and cannot respond to configuration deployment in a timely manner in terms of security configuration change detection, which greatly reduces the security protection level of the operating system. The security configuration deployment and monitoring of existing domestically produced independent security operating systems are still in the initial stage, and the research on the security configuration of domestic operating systems only stays in the security of the operating system itself. There is still a big gap in the professional deployment and real-time audit research of various security configurations of domestically produced independent operating systems.

[0004] Under the demand for the development of existing operating systems, large-scale security configuration systems are still in urgent need of further meeting users' needs for security, stability, and autonomy. Automated, large-scale security configuration deployment for domestically produced independent operating systems is an important direction for the future development of security configuration systems. Summary of the invention

[0005] In view of the technical problems existing in the prior art, the present invention proposes a distributed rapid security configuration deployment system.

[0006] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0007] On the one hand, the present invention provides a distributed rapid security configuration deployment system, including a target management cluster and a security deployment server;

[0008] The target management cluster includes multiple target host terminals; the security deployment server constructs a data tree for storing information of each target host terminal in the target management cluster in a tree-shaped data storage structure; the security deployment server adopts a distributed cluster architecture, including n servers, which share a data tree and have the authority to access and update the data tree, one of which is a leader server and the other servers are follower servers; the leader server is used to update the system status of the security deployment server, including currently available servers and currently unavailable servers; the follower server is responsible for participating in the election of the leader server and responding to security configuration deployment service requests from target host terminals in the target management cluster;

[0009] The target host requests the security configuration deployment service from the security deployment server, and uploads the encrypted local information and negotiated key information to the security deployment server. Any follower server in the security deployment server that is in an available state receives the security configuration deployment service request from the target host, responds to the security configuration deployment service request from the target host and generates an encrypted security configuration file. At the same time, it obtains the information of the corresponding target host by querying the data tree, so as to quickly and directionally distribute the encrypted security configuration file to the corresponding target host. The target host completes the real-time acquisition, download and decryption of the encrypted security configuration file, performs local deployment of the security configuration, and continues to obtain the latest security configuration file in real time and update the local security configuration.

[0010] Furthermore, the security deployment server constructs a data tree for storing information of each target host in the target management cluster in a tree-shaped data storage structure, including:

[0011] The security deployment server uses " / config" as the root node provided by the security configuration deployment service, and stores the system public key information;

[0012] Build a Znode node with the IP address of the target host as its node name, that is, " / config / xxx.xxx.xxx.xxx", as the storage node for the encrypted security configuration file of the corresponding target host;

[0013] Build the Znode node of " / config / xxx.xxx.xxx.xxx / info" as the storage location of the encrypted target host's local operating system information;

[0014] Construct the Znode node of " / config / xxx.xxx.xxx.xxx / key" as the storage location of the negotiated key information used for encryption.

[0015] Further, the follower server receives a security configuration deployment service request from the target host, and generates an encrypted security configuration file in response to the security configuration deployment service from the target host, including:

[0016] The follower server accesses the data tree to query whether there is information about the target host. If the current data tree does not have information about the target host, it creates a storage structure for the target host information, including using the IP address of the target host as its Znode node name, that is, " / config / xxx.xxx.xxx.xxx", as the storage node for the encrypted security configuration file of the corresponding target host; constructs the Znode node of " / config / xxx.xxx.xxx.xxx / info" as the storage location for the encrypted local operating system information of the target host; constructs the Znode node of " / config / xxx.xxx.xxx.xxx / key" as the storage location for the encrypted negotiation key information, stores the IP address of the target host, the encrypted local operating system information of the target host, and the negotiation key information for encryption carried in the security configuration deployment service request to the corresponding location, and updates the data tree;

[0017] The follower server analyzes the security configuration requirements based on the local operating system information of the target host carried in the security deployment server request and selects security configuration items;

[0018] After the follower server has finished selecting the security configuration items, it generates the corresponding security configuration file according to the configuration selection vector;

[0019] After the security profile is generated, the security profile deployment test will be carried out in a virtual environment corresponding to the system structure of the target host, and the judgment and operation will be made based on the deployment test results of the security profile;

[0020] When the security configuration file deployment test returns a positive result, the data tree is accessed to query the corresponding negotiated key information, the security configuration file is encrypted according to the negotiated key information and the encrypted security configuration file is stored in the corresponding node position of the data tree. At the same time, the data tree is accessed to query the IP address of the corresponding target host so that the security deployment server can quickly distribute the encrypted security configuration file to the corresponding target host.

[0021] Furthermore, the server in the security deployment service end and the target host end in the target management cluster realize rapid distribution and acquisition of data in a publish or subscribe mode based on the RTPS-UDP communication protocol.

[0022] Furthermore, the servers of the security deployment server communicate with each other based on the Zab protocol. The Zab protocol has two modes, namely election mode and broadcast mode. During the initial stage of activation of the security deployment server and when the current leader server in the security deployment server is unavailable, the security deployment server enters the election mode and elects a leader server from all available servers in the security deployment server.

[0023] Furthermore, in the election mode, all available servers on the security deployment server can send leader self-recommendation proposals to all other servers. When other servers receive the proposals, they process the proposals and vote, and return a response indicating that the proposals have been processed. The process is repeated until the leader server with the highest number of votes is elected.

[0024] Further, when the security deployment server is initially enabled or after the system status of the security deployment server is updated, the system public key information stored in the corresponding root node in the data tree is published, and the system public key information is the SM2 system public key; the target host in the target management cluster obtains the SM2 system public key stored by the security deployment server under the corresponding root node of the data tree by monitoring the root node data storing the system public key information in the data tree, encrypts the SM4 symmetric key randomly generated locally by the target host, and obtains the encrypted negotiated key information;

[0025] Before the target host requests the security configuration deployment service from the security deployment server, the local information of the target host is packaged, and then the packaged information and the encrypted negotiation key information are sent together with the security configuration deployment service request;

[0026] The follower server of the secure deployment server encrypts the security configuration file according to the SM4 symmetric key provided by the target host.

[0027] Furthermore, it also includes a virtual environment cluster, which is managed in a distributed manner as a whole, including multiple sub-virtual environment clusters composed of multiple virtual environments, and the security profile deployment test is implemented by the virtual environment in the virtual environment cluster corresponding to the system structure of the target host.

[0028] Compared with the prior art, the technical effects of the present invention are:

[0029] The security deployment service end of the present invention includes multiple servers, and adopts a distributed cluster architecture, which is an important part of meeting low latency and efficient transmission. With the support of this distributed cluster architecture, the distributed efficient processing capability can be fully utilized for batch and personalized service requests. The distributed cluster architecture has excellent expansion capabilities. While the service volume is increased, the performance of some processing terminals in the distributed cluster can be simultaneously improved, or the number of service machines can be increased. Based on this design, the scheme solves the problems such as single point failure caused by traditional centralized design, and directly reduces or avoids the impact of some network attacks in the design. Based on the advantage of the fast data processing capability of the distributed service cluster, rapid distribution can be achieved, providing reliable and stable support for the real-time nature of the scheme. Further, the server in the security deployment service end and the target host end in the target management cluster realize the rapid distribution and acquisition of data in the publish or subscribe mode based on the RTPS-UDP communication protocol. In this way, the distributed service cluster combines the underlying RTPS-UDP communication protocol at the same time, and uses the tree shape as the main data storage structure to construct a scheme for rapid publication and acquisition of data in the publish or subscribe mode. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0031] Figure 1 is a schematic diagram of the structure of a distributed rapid security configuration deployment system provided in an embodiment;

[0032] Figure 2 This is a Znode node data structure design diagram in one embodiment;

[0033] Figure 3 is a flow chart of a security configuration deployment service of an embodiment;

[0034] Figure 4 is an architecture diagram of a secure deployment server in one embodiment;

[0035] Figure 5 It is a schematic diagram of a virtual environment cluster architecture of a secure deployment server in one embodiment;

[0036] Figure 6 is a flow chart of a security configuration test in an embodiment;

[0037] Figure 7 It is a data security technology model diagram adopted by the present invention. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] In one embodiment of the present invention, referring to Figure 1 , providing a distributed rapid security configuration deployment system, including a security deployment server 100 and a target management cluster;

[0040] The target management cluster includes multiple target hosts 200; the security deployment server 100 constructs a data tree for storing information of each target host in the target management cluster in a tree-shaped data storage structure; the security deployment server 100 adopts a distributed cluster architecture, including n servers 101, and the n servers 101 share the data tree and have the authority to access and update the data tree. The data tree includes a root node and a series of Znode nodes.

[0041] Reference Figure 4 , an architecture diagram of a security deployment server in an embodiment, wherein one server in the security deployment server 100 is a leader server, and the remaining servers are follower servers; the leader server is used to update the system status of the security deployment server, including currently available servers and currently unavailable servers; the follower servers are responsible for participating in the election of the leader server and responding to security configuration deployment service requests from the target host in the target management cluster.

[0042] Furthermore, the security deployment server 100 also includes a locally maintained security configuration database, which is used to prevent service downtime due to damage to cloud data, which is beneficial to maintaining the stability of the service.

[0043] The target host 200 requests the security configuration deployment service from the security deployment server, and uploads the encrypted local information and the negotiated key information to the security deployment server. Any follower server in the security deployment server that is in an available state receives the security configuration deployment service request from the target host, responds to the security configuration deployment service request from the target host and generates an encrypted security configuration file. At the same time, it obtains the information of the corresponding target host by querying the data tree, so as to quickly and directedly distribute the encrypted security configuration file to the corresponding target host. The target host completes the real-time acquisition, downloading and decryption of the encrypted security configuration file, performs local deployment of the security configuration, and continues to obtain the latest security configuration file in real time and update the local security configuration.

[0044] The servers of the security deployment server communicate with each other based on the Zab protocol. The Zab protocol has two modes, namely election mode and broadcast mode. In the initial stage of the activation of the security deployment server and when the current leader server in the security deployment server is unavailable, the security deployment server enters the election mode and elects a leader server from all available servers of the security deployment server. In the election mode, all available servers of the security deployment server can send leader self-recommendation proposals to all other servers. When other servers receive the proposal, they process the proposal and vote, and return a response that the proposal has been processed. The process is repeated until the leader server with the highest number of votes is elected.

[0045] With the support of the secure deployment server of this distributed cluster architecture, the present invention can give full play to the distributed efficient processing capabilities for batch and personalized service requests. Furthermore, the server in the secure deployment server and the target host in the target management cluster realize the rapid distribution and acquisition of data in the publish or subscribe mode based on the RTPS-UDP communication protocol. In this way, the distributed service cluster combines the underlying RTPS-UDP communication protocol at the same time, takes the tree shape as the main data storage structure, and constructs a solution for the rapid publication and acquisition of data in the publish or subscribe mode.

[0046] The present invention designs a human-machine separation interaction state, that is, the operation terminal of the security service management technician is not directly connected to the server in the security deployment service end. On the one hand, this method is convenient for many service management technicians to operate; on the other hand, the human-machine separation method facilitates further design and unified management of the security deployment service end. At the service management technician level, remote connection to the server is the main operation and management method.

[0047] The security deployment server of the present invention constructs a data tree for storing the information of each target host in the target management cluster with a tree-shaped data storage structure. The tree-shaped data storage structure facilitates the implementation of the publishing or subscription mode, facilitates targeted services, and also makes the service expansion of the system more convenient. The data stored in the tree structure is jointly maintained by all servers in the security deployment server. The operation updates of the service management technicians are also quickly synchronized to the data tree as the servers in the security deployment server reach a data consensus.

[0048] The service is expanded by sub-node expansion. When the service scale needs to be updated, there are two ways. One is for the service manager to apply in batches, directly add data nodes on the security deployment server, and automatically import preset data into it. It is generally used in the initialization stage of the security deployment server. The other is for the target host (i.e., client) in the target management cluster to apply for subscriber identity. After the security deployment server approves the application, it updates the node in the data tree and stores the corresponding data. The parallelism of the two methods takes into account both the needs of large-scale operations on the security deployment server and the independent requests of a single target host.

[0049] Security service management technicians are data writers, and the security deployment server plays the role of publisher. Some nodes in the data tree are the topics in the model, and the corresponding target host plays the role of subscriber. The publisher and the subscriber are decoupled. The publisher only cares about the maintenance of the topic data, while the subscriber only cares about the update changes of the topic data to which he subscribes. This realizes a relatively efficient and independent processing process in which the security deployment server uses its own computing performance to maintain the nodes of the data tree and the target host uses the computing processing power of the local machine to read only the topic data that it is concerned about.

[0050] Furthermore, an embodiment proposes that the security deployment server constructs a data tree for storing information of each target host in the target management cluster in a tree-shaped data storage structure, including:

[0051] The security deployment server uses " / config" as the root node provided by the security configuration deployment service, which stores the system public key information; constructs a Znode node with the IP address of the target host as its node name, that is, " / config / xxx.xxx.xxx.xxx", as the storage node of the encrypted security configuration file of the corresponding target host; constructs the Znode node of " / config / xxx.xxx.xxx.xxx / info" as the storage location of the encrypted local operating system information of the target host; constructs the Znode node of " / config / xxx.xxx.xxx.xxx / key" as the storage location for the encrypted negotiated key information. Reference Figure 2 , which is a Znode node data structure design diagram in one embodiment.

[0052] Reference Figure 3 , is a flow chart of a security configuration deployment service according to an embodiment, specifically including:

[0053] Security service request: The target host requests the security configuration deployment service from the security deployment server, and uploads the local information and negotiated key information to the security deployment server;

[0054] Next, any follower server in the security deployment server that is in an available state receives the security configuration deployment service request from the target host, and generates an encrypted security configuration file in response to the security configuration deployment service from the target host, including:

[0055] The follower server accesses the data tree to query whether there is information about the target host. If the current data tree does not have information about the target host, it creates a storage structure for the target host information, including using the IP address of the target host as its Znode node name, that is, " / config / xxx.xxx.xxx.xxx", as the storage node for the encrypted security configuration file of the corresponding target host; constructs the Znode node of " / config / xxx.xxx.xxx.xxx / info" as the storage location for the encrypted local operating system information of the target host; constructs the Znode node of " / config / xxx.xxx.xxx.xxx / key" as the storage location for the encrypted negotiation key information, stores the IP address of the target host, the encrypted local operating system information of the target host, and the negotiation key information for encryption carried in the security configuration deployment service request to the corresponding location, and updates the data tree;

[0056] Security requirements analysis: The follower server performs security configuration requirements analysis based on the local operating system information of the target host carried in the security deployment server request and selects security configuration items;

[0057] Security configuration generation: After the follower server has selected the security configuration items, it generates the corresponding security configuration file based on the configuration selection vector;

[0058] Virtual environment test: After the security configuration file is generated, the security configuration file deployment test will be carried out in the virtual environment corresponding to the system structure of the target host. The deployment test results of the security configuration file will be used to make judgments and operations. If the deployment test of the security configuration file fails, the security configuration will be generated again.

[0059] Security configuration distribution: When the security configuration file deployment test returns a positive result, that is, the deployment test of the security configuration file is successful, the data tree is accessed to query the corresponding negotiated key information, the security configuration file is encrypted according to the negotiated key information and the encrypted security configuration file is stored in the corresponding node position of the data tree. At the same time, the data tree is accessed to query the IP address of the corresponding target host so that the security deployment server can quickly distribute the encrypted security configuration file to the corresponding target host.

[0060] Configure local deployment: The target host completes the real-time acquisition, download, and decryption of the encrypted security configuration file, performs local deployment of the security configuration, and continuously acquires the latest security configuration file in real time and updates the local security configuration.

[0061] Further, when the security deployment server is initially enabled or after the system status of the security deployment server is updated, the system public key information stored in the corresponding root node in the data tree is published, and the system public key information is the SM2 system public key; the target host in the target management cluster obtains the SM2 system public key stored by the security deployment server under the corresponding root node of the data tree by monitoring the root node data storing the system public key information in the data tree, encrypts the SM4 symmetric key randomly generated locally by the target host, and obtains the encrypted negotiated key information;

[0062] Before the target host requests the security configuration deployment service from the security deployment server, the local information of the target host is packaged, and then the packaged information and the encrypted negotiation key information are sent together with the security configuration deployment service request;

[0063] The follower server of the secure deployment server encrypts the security configuration file according to the SM4 symmetric key provided by the target host.

[0064] Furthermore, the security deployment server in the present invention also designs a virtual environment cluster. Figure 5, is a schematic diagram of the virtual environment cluster architecture of the security deployment server in an embodiment. The virtual environment cluster is distributedly managed as a whole, including multiple virtual environments forming multiple sub-virtual environment clusters. The security profile deployment test is implemented by the virtual environment in the virtual environment cluster corresponding to the system structure of the target host. Different sub-virtual environment clusters can be installed with different operating systems. Figure 6 This is a flow chart of security configuration testing in an embodiment. Based on the security configuration generation step, the system information of the target host is matched with the information in the virtual environment cluster information library to find a virtual environment with a high degree of fit, and then the generated security configuration file is transmitted to the Znode node corresponding to the virtual environment. The running program in the virtual environment will obtain the security test configuration in real time and download and deploy it locally, record the deployment results, and feedback the results by writing them to the corresponding Znode node. After obtaining the feedback results, the system makes a judgment based on the deployment situation and decides to roll back or distribute the next configuration.

[0065] In the design of rapid distribution technology, the present invention proposes a distributed service cluster processing model based on the publish or subscribe mode, so that the solution has the core capabilities of efficient data processing and rapid distribution, and achieves the goal of real-time performance of the solution. Data security technology is an important guarantee for the safe transmission of data in an untrusted network environment. Combined with the tree-shaped data storage structure, the SM2 public key cryptography algorithm and the SM4 symmetric cryptography algorithm are used to design the corresponding data security technology model, realizing the secure interaction of data between the secure deployment server and the target host in the solution design. Figure 7 , which is a data security technology model diagram adopted by the present invention, combined with the "2+1" data security model of the tree data storage structure, in which the key negotiation phase and the data interaction phase are necessary working phases, and the management update phase is an optional phase.

[0066] The first stage is the key negotiation stage. Data security is something that both parties need to jointly maintain. When the security deployment server is initially enabled or after the system status of the security deployment server is updated, the system public key information stored in the corresponding root node in the data tree is announced in combination with the storage function of the root node of the data tree. The system public key information is the SM2 system public key. The target host in the target management cluster obtains the SM2 system public key stored by the security deployment server under the corresponding root node of the data tree by monitoring the root node data that stores the system public key information in the data tree, and uses the SM2 key negotiation algorithm to perform SM4 symmetric key negotiation with the security deployment server to obtain encrypted negotiated key information;

[0067] The second stage is the data interaction stage. After the key negotiation stage, the security deployment server and the target host use the interactive SM4 symmetric key to exchange data. The target host uploads key information or obtains encrypted data on the corresponding node of the data tree. The corresponding node of the security deployment server on the data tree can obtain the key information of the client and upload the encrypted target information accordingly.

[0068] Optional stage, management update stage. Security management technicians can decide the operation of this stage according to the system's usage environment and operating status. When in an open network channel, the update of keys within a certain period of time is an important means to reduce the probability of the system being attacked by the network. The security deployment server can choose to update the SM2 system public key, and the target host can choose to update the SM4 symmetric key. Generally speaking, the normal update of the SM4 symmetric key is more conducive to improving the security of the system. The management update stage must be accompanied by the operation of the first stage, that is, the key negotiation stage, so that multiple parties in the system can interact with data in the updated state. The data security technology model design provides technical guarantees for the safe use of the system in a network environment, and also makes the data tree completely become a data carrier, preventing security issues such as data leakage from the data level.

[0069] Matters not covered by the present invention are known technologies.

[0070] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0071] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

[0072] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. Distributed fast security configuration deployment system, characterized by: Includes target management cluster and secure deployment server; The target management cluster includes multiple target host terminals; the security deployment server constructs a data tree storing information of each target host terminal in the target management cluster in a tree-shaped data storage structure; the security deployment server adopts a distributed cluster architecture, including n servers, the n servers share the data tree, have the authority to access the data tree and update the data tree, one of the servers is a leader server, and the remaining servers are follower servers; The leader server is used to update the system status of the security deployment server, including currently available servers and currently unavailable servers; The follower server is responsible for participating in the election of the leader server and responding to the security configuration deployment service request from the target host in the target management cluster; The target host requests the security configuration deployment service from the security deployment server, and uploads the encrypted local information and the negotiated key information to the security deployment server. Any follower server in the security deployment server that is in an available state receives the security configuration deployment service request from the target host, responds to the security configuration deployment service request from the target host and generates an encrypted security configuration file. At the same time, the information of the corresponding target host is obtained by querying the data tree, so as to quickly and directionally distribute the encrypted security configuration file to the corresponding target host. The target host completes the real-time acquisition, download and decryption of the encrypted security configuration file, performs local deployment of the security configuration, and continuously acquires the latest security configuration file in real time and updates the local security configuration.

2. The distributed rapid security configuration deployment system according to claim 1, characterized in that: The security deployment server constructs a data tree storing information of each target host in the target management cluster in a tree-shaped data storage structure, including: The security deployment server uses " / config" as the root node provided by the security configuration deployment service, storing the system public key information; Build a Znode node with the IP address of the target host as its node name, that is, " / config / xxx.xxx.xxx.xxx", as the storage node for the encrypted security configuration file of the corresponding target host; Build the Znode node of " / config / xxx.xxx.xxx.xxx / info" as the storage location of the encrypted target host's local operating system information; Construct the Znode node of " / config / xxx.xxx.xxx.xxx / key" as the storage location of the negotiated key information used for encryption.

3. The distributed rapid security configuration deployment system according to claim 2, characterized in that: The follower server receives the security configuration deployment service request from the target host, and generates an encrypted security configuration file in response to the security configuration deployment service from the target host, including: The follower server accesses the data tree to query whether there is information about the target host. If the current data tree does not have information about the target host, it creates a storage structure for the target host information, including using the IP address of the target host as its Znode node name, that is, " / config / xxx.xxx.xxx.xxx", as the storage node for the encrypted security configuration file of the corresponding target host; constructs the Znode node of " / config / xxx.xxx.xxx.xxx / info" as the storage location for the encrypted local operating system information of the target host; constructs the Znode node of " / config / xxx.xxx.xxx.xxx / key" as the storage location for the encrypted negotiation key information, stores the IP address of the target host, the encrypted local operating system information of the target host, and the negotiation key information for encryption carried in the security configuration deployment service request to the corresponding location, and updates the data tree; The follower server analyzes the security configuration requirements based on the local operating system information of the target host carried in the security deployment server request and selects security configuration items; After the follower server has finished selecting the security configuration items, it generates the corresponding security configuration file according to the configuration selection vector; After the security profile is generated, the security profile deployment test will be carried out in a virtual environment corresponding to the system structure of the target host, and the judgment and operation will be made based on the deployment test results of the security profile; When the security configuration file deployment test returns a positive result, the data tree is accessed to query the corresponding negotiated key information, the security configuration file is encrypted according to the negotiated key information and the encrypted security configuration file is stored in the corresponding node position of the data tree. At the same time, the data tree is accessed to query the IP address of the corresponding target host so that the security deployment server can quickly distribute the encrypted security configuration file to the corresponding target host.

4. The distributed rapid security configuration deployment system according to claim 3, characterized in that: The server in the security deployment service end and the target host end in the target management cluster realize the rapid distribution and acquisition of data in the publishing or subscription mode based on the RTPS-UDP communication protocol.

5. The distributed rapid security configuration deployment system according to any one of claims 1 to 4, characterized in that: The servers of the security deployment server communicate with each other based on the Zab protocol. The Zab protocol has two modes, namely election mode and broadcast mode. During the initial stage of enabling the security deployment server and when the current leader server in the security deployment server is unavailable, the security deployment server enters the election mode and elects a leader server from all available servers in the security deployment server.

6. The distributed rapid security configuration deployment system according to claim 5, characterized in that: In election mode, all available servers on the security deployment server can send leader self-recommendation proposals to all other servers. When other servers receive the proposals, they process the proposals and vote, and return a response indicating that the proposals have been processed. The process is repeated until the leader server with the highest number of votes is elected.

7. The distributed rapid security configuration deployment system according to claim 2, characterized in that: When the security deployment server is initially enabled or after the system status of the security deployment server is updated, the system public key information stored in the corresponding root node in the data tree is published, and the system public key information is the SM2 system public key; The target host in the target management cluster obtains the SM2 system public key stored in the corresponding root node of the data tree by monitoring the root node data storing the system public key information in the data tree of the security deployment server, encrypts the SM4 symmetric key randomly generated locally on the target host, and obtains the encrypted negotiation key information; Before the target host requests the security configuration deployment service from the security deployment server, the local information of the target host is packaged, and then the packaged information and the encrypted negotiation key information are sent together with the security configuration deployment service request; The follower server of the secure deployment server encrypts the security configuration file according to the SM4 symmetric key provided by the target host.

8. The distributed rapid security configuration deployment system according to claim 2, characterized in that: It also includes a virtual environment cluster. The virtual environment cluster is managed in a distributed manner as a whole, including multiple sub-virtual environment clusters composed of multiple virtual environments. The security profile deployment test is implemented by a virtual environment in the virtual environment cluster that corresponds to the system structure of the target host.

Images