Equipment node management method

Abstract

The invention provides an equipment node management method, which belongs to the technical field of network security equipment, and comprises the following steps: configuring a management mode of equipment nodes; one management mode is as follows: the equipment node is only configured with a first-level management node and establishes a management channel with the first-level management node; the other management mode is that the equipment node is configured with a first-level management node and a second-level management node; management channel detection between the device node and the secondary management node is preferentially carried out, data transmission between the device node and the secondary management node is carried out after it is detected that the management channel is communicated, and the device node is switched to the primary management node when it is detected that the management channel is not communicated. The connectivity with the management nodes is detected in a management channel detection mode, self network parameters are automatically configured according to a detection result, self working modes and management channels are switched, automatic switching under different management nodes is completed, and equipment nodes normally enter a working state under a complex abnormal network condition.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for managing device nodes. Background Art

[0002] Network security devices are deployed between the enterprise's internal trusted network and the Internet, acting at the network layer to achieve network security protection. Due to the sensitivity of network security devices themselves, in order to prevent the leakage of network information in the enterprise's intranet, a set of management nodes are usually configured to remotely monitor and manage their status. Once the device is abnormal, effective measures can be taken immediately to ensure the security of the enterprise network. In the event of network anomalies or failures, the network security device cannot connect to the management node to exchange data. At this time, the network security device is in an unknown and uncontrollable state, which may cause hidden dangers to the enterprise's intranet network data.

[0003] In addition, network security equipment has the characteristics of large deployment, complex network environment, and difficulty in equipment activation, which creates certain difficulties for the activation and management of network security equipment. Summary of the invention

[0004] The present invention provides a method for managing device nodes, which is used to solve the problem in the prior art that network security devices cannot normally enter a working state or supervision fails due to network anomalies or device failures in a complex network topology environment.

[0005] The present invention provides a method for managing a device node, comprising:

[0006] Configure the management mode of the device node;

[0007] One management mode is: the device node is configured with only one primary management node, and a management channel is established with the primary management node for data transmission;

[0008] Another management mode is: the device node is configured with a primary management node and a secondary management node; the management channel between the device node and the secondary management node is detected first, and after detecting that the management channel is connected, data is transmitted between the device node and the secondary management node. When it is detected that the management channel is not connected, the device node is switched to the primary management node, and data is transmitted after the management channel is connected with the primary management node.

[0009] The device node management method provided by the present invention further includes: no matter which management mode the device node is in, a management channel is established with the primary management node after the device node is started.

[0010] The device node management method provided by the present invention also includes: after the device node enters the working state, by receiving the management node online switching service initiated by the first-level management node, the configuration information of the device node is replaced, so that the device node is switched to the corresponding management node for management; wherein the configuration information includes the management node type, the management node address, the central node address and related network routing information.

[0011] The device node management method provided by the present invention also includes: when the device node is only configured with a first-level management node, the device node only establishes a management channel with the first-level management node; when the device node is configured with both a first-level management node and a second-level management node, the device node simultaneously establishes a management channel with both the first-level management node and the second-level management node.

[0012] According to the device node management method provided by the present invention, after the device node is only configured with a first-level management node and enters a working state, the first-level management node initiates a management node online switching service to switch the management node, including: the first-level management node sends first-level management node information and second-level management node information to the device node; wherein the second-level management node information is arranged in front of the first-level management node information; after the device node receives valid data, it switches to the second-level management node for management.

[0013] The device node management method provided by the present invention also includes: when the device node is managed under a primary management node, it can perform all online management services with the primary management node, but cannot perform any online management services with the secondary management node; when the device node is managed under a secondary management node, it can perform all online management services with the secondary management node, but can only perform some emergency online services with the primary management node; wherein, some emergency online services include online switching services of management nodes.

[0014] The device node management method provided by the present invention further includes: when the device node is switched to a certain management node for management, regularly reporting device status and log information to the certain management node.

[0015] The device node management method provided by the present invention also includes: when the device node is managed by the secondary management node, the device node periodically reports node status information and log information to the secondary management node, and the secondary management node periodically synchronizes the device node reporting information with the primary management node to realize indirect management of the device node by the primary management node.

[0016] The device node management method provided by the present invention also includes: when the device node switches the management node, the original configuration information is first invalidated, and then new configuration information is configured; wherein the configuration information includes the management node type, the management node address, the central node address and related network routing information.

[0017] The device node management method provided by the present invention has the following beneficial effects compared with the prior art:

[0018] (1) The present invention detects connectivity with the management node by means of management channel detection, automatically configures its own network parameters according to the detection results, switches its own working mode and management channel, completes automatic switching under different management nodes, and enables the device node to enter the working state normally under complex and abnormal network conditions.

[0019] (2) The present invention performs management node switching processing on the device node according to the actual deployment network topology of the device node and the management needs of the device node by actively switching the first-level management node;

[0020] (3) The present invention realizes direct and indirect management of device nodes by the primary management node through the coordinated cooperation of the primary management node and the secondary management node, thereby greatly reducing the burden on the primary management node. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 It is a network topology diagram for installation and deployment of device nodes provided by the present invention;

[0023] Figure 2 It is a flow chart of the device node switching management node provided by the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] It should be noted that, in the description of the embodiments of the present invention, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "include one..." do not exclude the presence of other identical elements in the process, method, article or device including the elements. The orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the accompanying drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0026] The device node management method provided by the present invention includes the following contents:

[0027] (1) The device node can be configured into two management modes by importing network access information. One is to configure only one set of management node information, namely the first-level management node. At this time, the device only accepts management from this management node. The other is to configure two sets of management node information, the first-level management node and the second-level management node. At this time, the device node will be connected to the second-level management node first. If it is not connected to the second-level management node, it can be switched to the first-level management node in an emergency to receive management from the first-level management node. Regardless of the management mode configured for the device node, after the device node enters the working state, it can switch the management node from the first-level management node to the management node according to the actual network topology requirements, and accept management from different management nodes in a time-sharing manner.

[0028] Among them, the management node information is a very important component of the network security device automatic switching management system, which includes various parameters and configuration information required for the device (device node) to communicate with the management node.

[0029] (2) Regardless of the mode in which the device node is configured, after the device is started, it always establishes a management channel with the primary management node and responds to the management node online switching service initiated by the primary management node.

[0030] (3) When the device node is activated, one or two sets of management node information are configured through the network access file. After the device node enters the working state, it changes the device node configuration by accepting the management node online switching service initiated by the management node. The configuration information mainly includes the management node type, management node address, central node address and related network routing information, so that the device node is switched to the corresponding management node for management.

[0031] (4) When a device node is configured with one set of management node information, it can only configure the primary management node information, and cannot configure the secondary management node information. When a device node is configured with two sets of management node information, after the device node is powered on, it will preferentially connect to the secondary management node, automatically detect connectivity with the secondary management node, and when the line is disconnected, it will switch to the primary management node to connect to the primary management node.

[0032] (5) After the device node is configured with only one set of management node information and enters the working state, the first-level management node can initiate the management node online switching service and send two sets of management node information, the first-level management node and the second-level management node, to the device node, with the second-level management node information arranged in front and the first-level management node information arranged in the back. After receiving valid data, the device node can switch to the second-level management node for management.

[0033] (6) When the device node switches the management node, it first invalidates the original network configuration information, including the central node address information, the management node address information, and the routing information of the relevant network ports on the processor, and then configures the new network configuration information.

[0034] (7) When a device node switches a management node, the original management policy information is first invalidated, and then the management policy information under the new management node is configured.

[0035] (8) When the device node is configured with only the primary management node information, the device node only establishes a management channel with the primary management node. When the device node is configured with both the primary and secondary management node information, the device establishes a management channel with both sets of management nodes.

[0036] (9) When a device node is managed by a primary management node, it can perform all online management services with the primary management node, but cannot perform any online management services with the secondary management node. When a device node is managed by a secondary management node, it can perform all online management services with the secondary management node, but can only perform some emergency online services with the primary management node.

[0037] Among them, some emergency online services include online switching services for management nodes.

[0038] (10) The management node online switching service can only be initiated by the first-level management node, not by the second-level management node.

[0039] (11) The device node regularly reports the device status and log information to the management node to which it is switched.

[0040] (12) The primary management node and the secondary management node exchange data through dedicated services. The primary management node obtains management information data of the device node from the secondary management node, including device status, device log and other information, to achieve indirect management of the device node by the primary management node.

[0041] Figure 1 It is the installation and deployment network topology diagram of the device node provided by the present invention, such as Figure 1 As shown, the process of opening device node 1 and device node 2 to enter the working state depends on obtaining key management data from the primary management node or the secondary management node. Device node 1 and device node 2 can be connected to the primary management node by establishing management channel 1 with central node 1, and can also be connected to the secondary management node by establishing management channel 2 with central node 2 and the secondary management node.

[0042] Figure 2 The flowchart of the device node switching management node provided by the present invention is as follows, through a VPN device embodiment, combined with the attached Figures 1 to 2 This method is further explained. The process is as follows:

[0043] (1) Import network access files

[0044] When the device is powered on, the network access file is first imported. The network access file is generated by the first-level management node after comprehensive analysis of the network topology environment where the device is located. The network access file mainly contains the device node address information, the central node address information, the first-level management node address, port, serial number, type and other information. The network access file may contain the second-level management node address, port, serial number, type and other information.

[0045] (2) Network access file analysis

[0046] According to the data format of the design plan, the local configuration is completed after the relevant data fields are parsed out from the network access file in sequence. The local configuration includes the local basic network configuration and the management channel policy configuration. In the process of local basic network configuration, the local address and the central node address are compared to determine whether the local is a central node or a remote node. The management channel policy information consists of the device address, port, protocol, the management node address, port, protocol, and some data fields for protection. The management channel policy information will be configured into the kernel, combined with the kernel network protocol stack, to protect the data interacting with the management node.

[0047] (3) Establishment of management channels

[0048] After the device is configured with the management strategy, it interacts and processes data with the central node according to the management strategy, and finally generates the same protection factor in the device node and the central node, which protects the data interacting between the device and the management node. When there are multiple sets of management nodes in the network access file, the device node will establish multiple sets of management strategies.

[0049] (4) Device data configuration

[0050] After the management channel is established, the device node needs to obtain the necessary data from the management node before it can enter the normal working state. The device node determines whether to initiate management channel detection based on the establishment of the management channel. When the device is only configured with a primary management node, it directly connects to the management node and sends data; when the device is configured with both primary and secondary management nodes, the device first detects the management channel with the secondary node, and after detecting that the management channel is connected, it connects to the secondary node and sends data. When it detects that the management channel is not connected, the device switches to the primary management node and sends data after connecting to the primary node.

[0051] (5)Node switching management

[0052] After the device enters the working state, the device can be switched and managed according to the actual network topology and the need for device management, switching back and forth between the primary management node and the secondary management node. The management system switching is performed in the primary management node management configuration web page interface. When the device node is switched from the primary management node to the secondary management node, the device node is removed from the primary management node node management system on the primary management node management configuration web page and attached to the secondary management node node management system. At this time, the management node information to be sent to the device node includes both primary and secondary management node information. When the device is switched from the secondary management node to the primary management node, the device node is removed from the secondary management node node management system on the primary management node management configuration web page and attached to the primary management node node management system. At this time, the management node information to be sent to the device node only includes primary management system node information.

[0053] (6) Synchronize node information between management nodes

[0054] After the device node configuration is completed, the node information synchronization between the primary management node and the secondary management node is completed first. This process is completed through the interaction of the designed and planned special format data protocol. After the node information synchronization is completed, when the device is configured under the primary management node, only the primary management node responds to the active online business of the device node, and the secondary node does not respond to the active online business of the device node; when the device is configured under the secondary management node, the primary management node only responds to the emergency online business of the device node, and does not respond to the general online business of the device node. The secondary management node responds to all online businesses of the device node.

[0055] (7) Switch the management node of the device node.

[0056] Initiate the node switching service on the first-level management node management configuration webpage, and send the management node information to the device node through the management channel. After receiving the management node data, the device node verifies the data integrity and parses the first set of management node information in the management node information, and configures it to the local device. This management node is the device's active interactive management node. Then, the original management strategy and protection factor are invalidated, and then a new management strategy is reconfigured according to the management node information, a new protection factor is generated, and a new management channel is constructed to complete the management node switching.

[0057] (8) Regularly report device node status and log information.

[0058] The device node periodically reports the device node status and log information to the currently configured management node. These reports are sent to the management node through the management channel. If the management node does not receive the report information within the predetermined periodic interval, it can initiate an emergency response process.

[0059] (9) Synchronize device node reporting information between management nodes

[0060] When a device node is configured as a secondary management node, the device node periodically reports node status information and log information to the secondary management node. The secondary management node periodically synchronizes the device node reporting information with the primary node to implement indirect management of the device node by the primary node.

[0061] In summary, the device node management method provided by the present invention has the following beneficial effects compared with the prior art:

[0062] (1) The present invention detects connectivity with the management node by means of management channel detection, automatically configures its own network parameters according to the detection results, switches its own working mode and management channel, completes automatic switching under different management nodes, and enables the device node to enter the working state normally under complex and abnormal network conditions.

[0063] (2) The present invention performs management node switching processing on the device node according to the actual deployment network topology of the device node and the management needs of the device node by actively switching the first-level management node;

[0064] (3) The present invention realizes direct and indirect management of device nodes by the primary management node through the coordinated cooperation of the primary management node and the secondary management node, thereby greatly reducing the burden on the primary management node.

[0065] On the other hand, the present invention further provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, the computer can execute the device node management method provided in the above embodiments, the method comprising:

[0066] Configure the management mode of the device node;

[0067] One management mode is: the device node is configured with only one primary management node, and a management channel is established with the primary management node for data transmission;

[0068] Another management mode is: the device node is configured with a primary management node and a secondary management node; the management channel between the device node and the secondary management node is detected first, and after detecting that the management channel is connected, data is transmitted between the device node and the secondary management node. When it is detected that the management channel is not connected, the device node is switched to the primary management node, and data is transmitted after the management channel is connected with the primary management node.

[0069] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to perform the device node management method provided in the above embodiments, the method comprising:

[0070] Configure the management mode of the device node;

[0071] One management mode is: the device node is configured with only one primary management node, and a management channel is established with the primary management node for data transmission;

[0072] Another management mode is: the device node is configured with a primary management node and a secondary management node; the management channel between the device node and the secondary management node is detected first, and after detecting that the management channel is connected, data is transmitted between the device node and the secondary management node. When it is detected that the management channel is not connected, the device node is switched to the primary management node, and data is transmitted after the management channel is connected with the primary management node.

[0073] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of the implementation scheme of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

[0074] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0075] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for managing a device node, characterized in that: include: Configure the management mode of the device node; One management mode is: the device node is configured with only one primary management node, and a management channel is established with the primary management node for data transmission; Another management mode is: the device node is configured with a primary management node and a secondary management node; Priority is given to detecting the management channel between the device node and the secondary management node. After detecting that the management channel is connected, data transmission is performed between the device node and the secondary management node. When it is detected that the management channel is not connected, the device node is switched to the primary management node, and data transmission is performed after the management channel of the primary management node is connected.

2. The device node management method according to claim 1, characterized in that: Also includes: Regardless of the management mode the device node is in, a management channel is established with the primary management node after the device node is started.

3. The device node management method according to claim 1, characterized in that: Also includes: After the device node enters the working state, it receives the management node online switching service initiated by the primary management node, replaces the configuration information of the device node, and switches the device node to the corresponding management node for management; The configuration information includes the management node type, the management node address, the central node address and related network routing information.

4. The method for managing device nodes according to claim 1, characterized in that: Also includes: When the device node is configured with only the primary management node, the device node only establishes a management channel with the primary management node. When the device node is configured with both the primary management node and the secondary management node, the device node establishes a management channel with both the primary management node and the secondary management node.

5. The method for managing device nodes according to claim 1, characterized in that: After the device node is configured with only the primary management node and enters the working state, the primary management node initiates the management node online switching service to switch the management node, including: The primary management node sends primary management node information and secondary management node information to the device node; wherein the secondary management node information is arranged before the primary management node information; After the device node receives valid data, it switches to the secondary management node for management.

6. The method for managing device nodes according to claim 1, characterized in that: Also includes: When a device node is managed under a primary management node, it can perform all online management services with the primary management node, but cannot perform any online management services with the secondary management node. When a device node is managed under a secondary management node, it can perform all online management services with the secondary management node, and can only perform some emergency online services with the primary management node; Among them, some emergency online services include online switching services for management nodes.

7. The method for managing device nodes according to claim 1, characterized in that: Also includes: When a device node is switched to a certain management node for management, the device status and log information are regularly reported to the certain management node.

8. The method for managing device nodes according to claim 1, characterized in that: Also includes: When a device node is managed by a secondary management node, the device node periodically reports node status information and log information to the secondary management node, and the secondary management node periodically synchronizes the device node reporting information with the primary management node to implement indirect management of the device node by the primary management node.

9. The method for managing device nodes according to claim 1, characterized in that: Also includes: When a device node switches to a management node, it first invalidates the original configuration information and then configures the new configuration information; The configuration information includes the management node type, the management node address, the central node address and related network routing information.

Images