White list access control method and system based on intelligent network card and medium

Abstract

The invention discloses a white list access control method and system based on an intelligent network card, and a medium. The method comprises the following steps: installing the intelligent network card for a first server and deploying a security configuration management platform; configuring a white list rule for the first server based on the security configuration management platform; issuing the white list rule to the intelligent network card, and storing the white list rule in a chip UTB table entry of the intelligent network card; when the interface of the intelligent network card receives a network message flow, identifying message information from the network message flow and sending the message information to the NP engine; the NP engine matches the message information with a white list rule in a chip UTB table item of the intelligent network card, and judges whether the white list rule is hit; if the white list rule is hit, performing communication release on the network message; and if the white list rule is not hit, carrying out communication blocking on the network message. According to the method, the security is higher, the deployment and management configuration are more convenient and flexible, the security protection of high-speed data streams is supported, and the cpu resource occupancy rate is lower.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a whitelist access control method, system and medium based on an intelligent network card. Background Art

[0002] Network security access control is an important network security protection method used to protect computer systems and network resources from unauthorized access and malicious attacks. Whitelist access control is to limit the access rights of specific users or devices to systems, applications and data, ensuring that only legitimate users allowed by the rules can obtain the corresponding permissions.

[0003] When implementing network security access control, the common implementation methods include independent access control devices or host-based access control systems. Access control devices are generally used for external access control, and are very limited in preventing network threats such as abuse of authority or leakage of sensitive information caused by internal security. The host-side access control system runs on the upper layer of the system, and network messages need to enter and be sent to the system before rules can be matched, which brings security risks to the host. At the same time, such systems usually consume a lot of CPU resources to process network requests and maintain whitelist rules.

[0004] In view of this, this application is hereby filed. Summary of the invention

[0005] The technical problem to be solved by the present invention is that the existing whitelist access control method has low security and consumes a large amount of CPU resources to process network requests and maintain whitelist rules. The purpose of the present invention is to provide a whitelist access control method, system and medium based on smart network card, which has higher security, more convenient and flexible deployment and management configuration, supports security protection of high-speed data flow, and has lower CPU resource occupancy rate.

[0006] The present invention is achieved through the following technical solutions:

[0007] In a first aspect, the present invention provides a whitelist access control method based on a smart network card, the method comprising:

[0008] Installing a smart network card for the first server and deploying a security configuration management platform;

[0009] Based on the security configuration management platform, configure a whitelist rule for the first server;

[0010] The whitelist rules are sent to the smart network card and stored in the chip UTB table of the smart network card;

[0011] When the interface of the smart network card receives a network message flow, it identifies the message information from the network message flow and sends it to the NP engine;

[0012] The NP engine matches the message information with the whitelist rules in the UTB table of the smart network card chip to determine whether the whitelist rules are hit;

[0013] If the whitelist rule is matched, the network message is allowed to communicate; if the whitelist rule is not matched, the network message is blocked.

[0014] Furthermore, installing a smart network card on the first server and deploying a security configuration management platform include:

[0015] Install smart network card hardware with whitelist function on the first server, install the corresponding network card driver, and configure the network address for the network interface;

[0016] Through one-click installation and deployment of the Docker container-based security configuration management platform, the security configuration management service is automatically started.

[0017] Furthermore, the whitelist rules include the peer communication host IP address, the local host IP address and protocol;

[0018] The peer communication host IP address includes the network IP address of the second server to be tested, but does not include the network IP address of the third server to be tested;

[0019] The local host IP address refers to the network IP address of the first server;

[0020] The protocol supports IPv4 and IPv6 dual stacks, and also supports TCP, UDP, ICMP, ESP, AH and other protocols.

[0021] Further, based on the security configuration management platform, a whitelist rule is configured for the first server, including:

[0022] Log in to the webpage of the security configuration management platform of the first server, enable the whitelist access control function, and add whitelist rules to the network interface for business communication.

[0023] Furthermore, the whitelist rules are sent to the smart network card and stored in the chip UTB table of the smart network card, including:

[0024] The security configuration management platform sends the whitelist rules and the internal API channel of the smart network card chip to the smart network card, and stores them in the UTB table of the smart network card chip;

[0025] At the same time, the security configuration management platform can modify, query and delete the whitelist rules stored on the smart network card.

[0026] Furthermore, when the interface of the smart network card receives a network message flow, the message information is identified from the network message flow and sent to the NP engine, including:

[0027] When the interface of the smart network card receives a network message flow, the network message flow is stored in the MMU module in the chip of the smart network card. At the same time, the microcode program in the chip of the smart network card is used to perform packet header detection on the network message flow packet by packet.

[0028] Identify message information from the network message flow, and send each identified message information to the NP engine; the message information includes the source IP address of the message, the destination IP address of the message, and the protocol number of the message.

[0029] Furthermore, if the whitelist rule is matched, the network message is allowed to communicate; if the whitelist rule is not matched, the network message is blocked, including:

[0030] If the whitelist rule is hit, it means that the network message is allowed to pass by the whitelist rule. The NP engine notifies the FCU module to pass the grid message in the MMU module to the network protocol stack through the network card driver, and then sends it to the upper layer application of the first server, that is, the communication is released;

[0031] If the whitelist rule is not hit, it means that the network message is not allowed to pass by the whitelist rule. The NP engine notifies the FCU module to discard the grid message in the MMU module, that is, the communication is blocked.

[0032] In a second aspect, the present invention further provides a whitelist access control system based on a smart network card, the system comprising:

[0033] A platform deployment unit, used to install a smart network card for the first server and deploy a security configuration management platform;

[0034] A whitelist rule configuration unit, configured to configure a whitelist rule for the first server based on the security configuration management platform;

[0035] A whitelist rule issuing unit, used to issue the whitelist rule to the smart network card and store it in the chip UTB table of the smart network card;

[0036] A message information identification unit, used for identifying message information from the network message flow and sending it to the NP engine when the interface of the intelligent network card receives the network message flow;

[0037] The message matching unit is used for the NP engine to match the message information with the whitelist rules in the chip UTB table of the smart network card to determine whether the whitelist rules are hit;

[0038] The message communication unit is used to allow the network message to communicate if the whitelist rule is hit; if the whitelist rule is not hit, the network message is blocked.

[0039] Furthermore, the whitelist rules include the peer communication host IP address, the local host IP address and protocol;

[0040] The peer communication host IP address includes the network IP address of the second server to be tested, but does not include the network IP address of the third server to be tested;

[0041] The local host IP address refers to the network IP address of the first server;

[0042] The protocol supports IPv4 and IPv6 dual stacks, and also supports TCP, UDP, ICMP, ESP, AH and other protocols.

[0043] In a third aspect, the present invention further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned whitelist access control method based on the smart network card is implemented.

[0044] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0045] 1. The present invention is more secure. Since the smart network card can be deployed to each host terminal instead of a centralized gateway deployment, network security protection is more end-side and refined, so that each host can be effectively protected, preventing internal access security risks, greatly reducing the risk of network access control, and improving the security of the entire network.

[0046] 2. The deployment and management configuration of the present invention is more convenient and flexible. First, users only need to install a smart network card on the terminal host, and use Docker to deploy the backend web configuration management platform with one click to easily implement whitelist access control management for a single host. Secondly, whitelist access control has a switch function, supports IPv4 and IPv6 dual stack management, and supports TCP, UDP, ICMP, ESP, AH and other protocols, which can flexibly implement refined management of server-specific service access rights, thereby improving the security of the server.

[0047] 3. The present invention supports security protection for high-speed data streams. Through the intelligent network card, access control is performed on all network data requests accessing the host end at the entrance, and security protection under high-speed bandwidth transmission such as 10G, 25G, 40G, and 100G is easily achieved without affecting the network transmission rate, so that the host can take into account both security and performance.

[0048] 4. The CPU resource occupancy rate of the present invention is lower. The method offloads the security protection function from the host CPU to the smart network card to realize data processing such as identification and analysis, whitelist rule matching, etc. of all data messages received by the network port. The CPU is only responsible for the configuration management of the whitelist rules, and basically does not occupy the host CPU resources, thereby reducing the consumption of the host CPU by network data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of this application, and do not constitute a limitation of the embodiments of the present invention. In the drawings:

[0050] Figure 1 This is a general flow chart of a whitelist access control method based on a smart network card of the present invention;

[0051] Figure 2 A topological diagram of a whitelist access control method based on an intelligent network card according to the present invention;

[0052] Figure 3 This is a structural block diagram of a whitelist access control system based on an intelligent network card of the present invention. DETAILED DESCRIPTION

[0053] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0054] Example 1

[0055] like Figure 1 As shown, Figure 1 This is the overall flow chart of the present invention; the present invention is a whitelist access control method based on a smart network card, and the present invention is a whitelist network security access control method that can be more refined, safer, and more efficient. The core principle of the present invention is to send and store whitelist rules to the smart network card. When the whitelist access control function is turned on, the smart network card uses microcode programming to schedule the chip to identify and process network data requests to match the whitelist rules. Only requests that hit the rules are allowed to be sent to the host application through the network card, thereby realizing whitelist security access control on the network card side.

[0056] Figure 2This is the topology diagram of the present invention. Among them, the first server (server A) is installed with an intelligent network card and a security configuration management platform is deployed. Its whitelist rule contains the network IP address of the second server (server B) to be tested, but does not contain the network IP address of the third server (server C) to be tested. Server B and server C both initiate Ping communication to server A. Only the messages that hit the whitelist rule of server A can communicate successfully, that is, the messages from server B communicate successfully, and the messages from server C are discarded.

[0057] The specific implementation steps of the method of the present invention are as follows:

[0058] Step 1: Install a smart network card for the first server and deploy a security configuration management platform;

[0059] In this embodiment, step 1 specifically includes:

[0060] First, install the smart network card hardware with whitelist function on the first server (Server A), install the corresponding network card driver, and configure the network address for the network interface. For specific configuration, refer to Figure 2 ;

[0061] Secondly, the security configuration management platform based on Docker container is installed and deployed with one click, and the security configuration management service is automatically started.

[0062] Step 2: Based on the security configuration management platform, configure a whitelist rule for the first server;

[0063] In this embodiment, step 2 specifically includes:

[0064] Log in to the webpage of the security configuration management platform of the first server (Server A), enable the whitelist access control function, and add whitelist rules to the network interface for business communication.

[0065] Specifically, the whitelist rules include the peer communication host IP address, the local host IP address and protocol;

[0066] The peer communication host IP address includes the network IP address of the second server (server B) to be tested, but does not include the network IP address of the third server (server C) to be tested;

[0067] The local host IP address refers to the network IP address of the first server (Server A);

[0068] The protocol can support IPv4 and IPv6 dual stacks, and also supports TCP, UDP, ICMP, ESP, AH and other protocols.

[0069] It should be noted that the whitelist rules will be directly stored in the smart network card, and the host side will not store security rule data, which effectively avoids database security risks.

[0070] Step 3: Send the whitelist rules to the smart network card and store them in the chip UTB table of the smart network card;

[0071] In this embodiment, step 3 specifically includes:

[0072] The security configuration management platform sends the whitelist rules and the internal API channel of the smart network card chip to the smart network card, and stores them in the UTB table of the smart network card chip for matching the network messages received by the network interface.

[0073] At the same time, the security configuration management platform can modify, query and delete the whitelist rules stored on the smart network card.

[0074] Step 4: When the interface of the smart network card receives a network message flow, the message information is identified from the network message flow and sent to the NP engine;

[0075] In this embodiment, step 4 specifically includes:

[0076] When the interface of the smart network card receives a network message flow, the network message flow is stored in the MMU module in the chip of the smart network card. At the same time, the microcode program in the chip of the smart network card is used to perform packet header detection on the network message flow packet by packet.

[0077] Identify message information from the network message flow, and send each identified message information to the NP engine; each message information includes the source IP address of the message, the destination IP address of the message, and the protocol number of the message.

[0078] Step 5: The NP engine matches the message information with the whitelist rules in the chip UTB table of the smart network card to determine whether the whitelist rules are hit;

[0079] If the whitelist rule is matched, the network message is allowed to communicate; if the whitelist rule is not matched, the network message is blocked.

[0080] In this embodiment, step 5 specifically includes:

[0081] The NP engine matches the extracted message information (triplet information) with the whitelist rules in the UTB table of the smart network card chip. If the whitelist rule is hit (i.e., the match is successful), it means that the network message is a message allowed to pass by the whitelist rule. The NP engine notifies the FCU module to pass the grid message in the MMU module to the network protocol stack through the network card driver, and then sends it up to the upper-layer application of the first server, that is, the communication is released; if the whitelist rule is not hit (i.e., the match fails), it means that the network message is a message not allowed to pass by the whitelist rule. The NP engine notifies the FCU module to discard the grid message in the MMU module, that is, the communication is blocked. In this way, the host application layer does not need to participate in the judgment of network communication. The message information that is not allowed to pass can only reach the physical layer of the network card, and does not reach the network protocol stack and application layer of the kernel. The unrecognized message information of the external network is isolated from the kernel application, thereby improving the security of the server host and reducing the CPU resource consumption of the host.

[0082] It should be noted that the chip of the smart network card contains the NP engine, UTB module, FCU module and MMU module, among which:

[0083] NP engine (Network Processor, network message data processing unit), responsible for message identification, parsing, editing and reorganization;

[0084] The FCU module (Flow control unit) is mainly responsible for thread scheduling, message scheduling, message order preservation, etc.

[0085] MMU module (Memory management unit), responsible for message cache, message aggregation and other functions;

[0086] UTB (Unite table) is a unified table that stores all large table entries inside the chip.

[0087] Example 2

[0088] like Figure 3 As shown, the difference between this embodiment and embodiment 1 is that this embodiment provides a whitelist access control system based on a smart network card, and the system corresponds to the whitelist access control method based on a smart network card in embodiment 1 in a one-to-one manner; the system includes:

[0089] A platform deployment unit, used to install a smart network card for the first server and deploy a security configuration management platform;

[0090] A whitelist rule configuration unit, configured to configure a whitelist rule for the first server based on the security configuration management platform;

[0091] A whitelist rule issuing unit, used to issue the whitelist rule to the smart network card and store it in the chip UTB table of the smart network card;

[0092] A message information identification unit, used for identifying message information from the network message flow and sending it to the NP engine when the interface of the intelligent network card receives the network message flow;

[0093] The message matching unit is used for the NP engine to match the message information with the whitelist rules in the chip UTB table of the smart network card to determine whether the whitelist rules are hit;

[0094] The message communication unit is used to allow the network message to communicate if the whitelist rule is hit; if the whitelist rule is not hit, the network message is blocked.

[0095] As a further implementation, the whitelist rules include the peer communication host IP address, the local host IP address and protocol;

[0096] The peer communication host IP address includes the network IP address of the second server to be tested, but does not include the network IP address of the third server to be tested;

[0097] The local host IP address refers to the network IP address of the first server.

[0098] Among them, the execution process of each unit can be executed according to the process steps of a whitelist access control method based on an intelligent network card in Example 1, and will not be repeated one by one in this embodiment.

[0099] At the same time, the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned whitelist access control method based on the smart network card is implemented.

[0100] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0101] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0102] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0103] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0104] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A whitelist access control method based on smart network card, characterized in that: The method includes: Installing a smart network card for the first server and deploying a security configuration management platform; Based on the security configuration management platform, configure a whitelist rule for the first server; Send the whitelist rules to the smart network card and store them in the chip UTB table of the smart network card; When the interface of the smart network card receives a network message flow, it identifies message information from the network message flow and sends it to the NP engine; The NP engine matches the message information with the whitelist rule in the chip UTB table entry of the smart network card to determine whether the whitelist rule is hit; If the whitelist rule is matched, the network message is allowed to communicate; if the whitelist rule is not matched, the network message is blocked from communicating.

2. A whitelist access control method based on smart network card according to claim 1, characterized in that: Install the smart network card on the first server and deploy the security configuration management platform, including: Install smart network card hardware with whitelist function on the first server, install the corresponding network card driver, and configure the network address for the network interface; Through one-click installation and deployment of the Docker container-based security configuration management platform, the security configuration management service is automatically started.

3. A whitelist access control method based on smart network card according to claim 1, characterized in that: The whitelist rules include the peer communication host IP address, the local host IP address and protocol; The peer communication host IP address includes the network IP address of the second server to be tested, but does not include the network IP address of the third server to be tested; The local host IP address refers to the network IP address of the first server; The protocol supports IPv4 and IPv6 dual stacks, and also supports TCP, UDP, ICMP, ESP and AH protocols.

4. A whitelist access control method based on smart network card according to claim 1, characterized in that: Based on the security configuration management platform, configure whitelist rules for the first server, including: Log in to the webpage of the security configuration management platform of the first server, enable the whitelist access control function, and add whitelist rules to the network interface for business communication.

5. The whitelist access control method based on smart network card according to claim 1, characterized in that: The whitelist rule is sent to the smart network card and stored in the chip UTB table of the smart network card, including: The security configuration management platform sends the whitelist rules and the chip internal API channel of the smart network card to the smart network card, and stores them in the chip UTB table item of the smart network card; At the same time, the security configuration management platform can modify, query and delete the whitelist rules stored on the smart network card.

6. A whitelist access control method based on smart network card according to claim 1, characterized in that: When the interface of the smart network card receives a network message flow, the message information is identified from the network message flow and sent to the NP engine, including: When the interface of the smart network card receives a network message flow, the network message flow is stored in the MMU module in the chip of the smart network card, and at the same time, the microcode program in the chip of the smart network card is used to perform packet header detection on the network message flow packet by packet; Message information is identified from the network message flow, and each identified message information is sent to the NP engine; the message information includes a source IP address of the message, a destination IP address of the message, and a protocol number of the message.

7. A whitelist access control method based on smart network card according to claim 1, characterized in that: If the whitelist rule is matched, the network message will be allowed to communicate; If the whitelist rule is not matched, the network message will be blocked, including: If the whitelist rule is hit, it means that the network message is allowed to pass by the whitelist rule. The NP engine notifies the FCU module to pass the grid message in the MMU module to the network protocol stack through the network card driver, and then sends it to the upper layer application of the first server, that is, the communication is released; If the whitelist rule is not hit, it means that the network message is a message that is not allowed to pass by the whitelist rule, and the NP engine notifies the FCU module to discard the grid message in the MMU module, that is, the communication is blocked.

8. A whitelist access control system based on smart network card, characterized in that: The system includes: A platform deployment unit, used to install a smart network card for the first server and deploy a security configuration management platform; A whitelist rule configuration unit, configured to configure a whitelist rule for the first server based on the security configuration management platform; A whitelist rule issuing unit, configured to issue the whitelist rule to the smart network card and store it in a chip UTB table entry of the smart network card; A message information identification unit, configured to identify message information from the network message flow and send the message information to the NP engine when the interface of the intelligent network card receives the network message flow; A message matching unit, used for the NP engine to match the message information with the whitelist rule in the chip UTB table entry of the smart network card to determine whether the whitelist rule is hit; The message communication unit is used to allow the network message to communicate if the whitelist rule is hit; if the whitelist rule is not hit, block the network message from communicating.

9. A whitelist access control system based on smart network card according to claim 8, characterized in that: The whitelist rules include the peer communication host IP address, the local host IP address and protocol; The peer communication host IP address includes the network IP address of the second server to be tested, but does not include the network IP address of the third server to be tested; The local host IP address refers to the network IP address of the first server; The protocol supports IPv4 and IPv6 dual stacks, and also supports TCP, UDP, ICMP, ESP and AH protocols.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the whitelist access control method based on the smart network card as described in any one of claims 1 to 7 is implemented.

Images