Safety management method and device

Abstract

The invention provides a security management method and device. The method comprises the following steps: in response to an access request carrying a target port number, determining a target security service module corresponding to the target port number in a plurality of security service modules; forwarding the access request to a target security service module through the first virtual switching device; wherein the working mode of the first virtual switching equipment is an NAT (Network Address Translation) mode. According to the method, the security management module is deployed in the form of a container, the resource consumption of the security management module is reduced, in addition, through the virtual switching equipment in the NAT mode and the Nginx proxy service, the external equipment can access each security service module only by managing the address and the port number of a network card, and the security management efficiency is improved. The problem that each security service module occupies one management address is avoided, and consumption of management network segment addresses is reduced.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a security management method and device. Background Art

[0002] Security management equipment refers to physical equipment that integrates multiple security services. Current security management equipment generally deploys security management services through virtual machines, so it takes up more CPU resources and memory resources. In addition, each security service in the security management equipment needs to occupy a management network segment address, which consumes more address resources. Summary of the invention

[0003] In order to overcome the problems existing in the related art, the present application provides a security management method and device.

[0004] According to a first aspect of an embodiment of the present application, a security management method is provided, the method being applied to a security management module deployed based on a containerized platform in a security management device, the security management device further comprising a first virtual switching device deployed based on a virtualized platform and a plurality of security service modules deployed based on a virtualized platform, the method comprising:

[0005] In response to an access request carrying a target port number, determining a target security service module corresponding to the target port number among the plurality of security service modules;

[0006] forwarding the access request to the target security service module through the first virtual switching device;

[0007] Wherein, the working mode of the first virtual switching device is NAT mode.

[0008] According to a second aspect of an embodiment of the present application, a security management device is provided, the device comprising: a security management module deployed based on a containerized platform, a first virtual switching device deployed based on a virtualized platform, and a plurality of security service modules deployed based on a virtualized platform;

[0009] The security management module determines, in response to the access request carrying the target port number, a target security service module corresponding to the target port number among the multiple security service modules, and forwards the access request to the target security service module through the first virtual switching device;

[0010] Wherein, the working mode of the first virtual switching device is NAT mode.

[0011] According to a third aspect of an embodiment of the present application, there is provided a computer-readable storage medium, comprising computer instructions, which, when executed on an electronic device, enables the electronic device to execute the method as described above.

[0012] According to a fourth aspect of the embodiments of the present application, a computer program product is provided. When the computer program product is run on a computer, the computer is enabled to execute the method as described above.

[0013] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0014] In the embodiment of the present application, the security management module is deployed in the form of a docker container, which reduces the resource consumption of the security management module. In addition, through the virtual switching device in NAT mode and the Nginx proxy service, the external network can access the security service module only through the address of the management network card, avoiding the problem of each security service module occupying a management address, reducing the consumption of the management network segment address, and improving the integrity of the entire security management device.

[0015] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0017] Figure 1 A schematic diagram of the first structure of the security management device provided in the embodiment of the present application;

[0018] Figure 2 A flowchart of a security management method provided in an embodiment of the present application;

[0019] Figure 3 A second structural diagram of the security management device provided in an embodiment of the present application;

[0020] Figure 4 A third structural diagram of the security management device provided in an embodiment of the present application;

[0021] Figure 5 A fourth structural diagram of the security management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application. In the description of the embodiments of the present application, the terms used in the following embodiments are only for the purpose of describing specific embodiments and are not intended to be limiting of the present application.

[0023] It should be noted that in this application, "at least one" means one or more, and "more than one" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The terms "first", "second", "third", etc. (if any) in the specification, claims and drawings of this application are used to distinguish similar objects, rather than to describe a specific order or sequence.

[0024] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0025] Next, the embodiments of the present application are described in detail.

[0026] The embodiment of the present application provides a security management method, which is applied to a security management module. The security management module is deployed in a security management device based on a containerized platform. The structure diagram of the security management device is as follows: Figure 1 As shown, it includes a security management module, a first virtual switching device and multiple security service modules, wherein the security management module is deployed based on a containerized platform, and the first virtual switching device and multiple security service modules are deployed based on a virtualized platform. The working mode of the first virtual switching device is NAT mode, and the security management module and multiple security service modules are associated with the first virtual switching device.

[0027] like Figure 2 As shown, the security management method provided in this embodiment may include the following steps:

[0028] Step 210: In response to the access request carrying the target port number, determine a target security service module corresponding to the target port number among the multiple security service modules;

[0029] Step 220: Forward the access request to the target security service module through the first virtual switching device.

[0030] The access request is a security request that enters the security management device through the management network card and requests access to the security service module. The transmission path of the access request inside the security management device is as follows: Figure 1 The blue arrow points to the direction shown.

[0031] As shown above, the working mode of the first virtual switching device in this embodiment is NAT (Network Address Translation) mode, which can hide the real IP address of each security service module and protect the privacy and security of each security service module. Therefore, the security management module of this embodiment can access the internal network of the first virtual switching device through the first virtual switching device, while the devices outside the security management device cannot access the internal network of the first virtual switching device through the management network card.

[0032] In addition, the NAT mode allows devices outside the security management device to communicate with each security service module according to predefined port mapping rules. Specifically, the security management module of this embodiment can enable the port proxy mode, and then the external device can communicate with each security service module by accessing different ports of the management network card. In this communication mode, there is no need to allocate management IP addresses to each security service module, so management address resources can be saved.

[0033] The security management device of this embodiment refers to a device that integrates multiple security services. Various security services exist in the security management device in the form of security service modules. The security management device may specifically include any one or more of the following security service modules: network layer firewall module, Web application firewall WAF module, database audit module, log audit module, operation and maintenance audit module, Internet behavior audit module, and terminal security module.

[0034] It is understandable that each security service module has a first virtual network card, and the first virtual network card of each security service module is associated with the first virtual switching device.

[0035] Specifically, the virtualization platform can be implemented based on the virtualization management function library Libvirt and the virtualization module KVM (Kernel-based Virtual Machine), and the containerization platform can be docker.

[0036] Exemplarily, the security management module can monitor access requests entering through the management network card based on the Nginx service. As a specific implementation, the security management module has a built-in Nginx proxy unit, and the security management module determines the target security service module in the following manner: monitoring the access request carrying the target port number through the Nginx proxy unit; when monitoring the access request carrying the target port number, determining the target security service module corresponding to the target port number among the multiple security service modules.

[0037] The security management module of this embodiment refers to a module that provides security management services for each security service module. Each security management service is deployed based on the container and exists in the security management module in the form of a unit. Specifically, it may include any one or more of the following units: a high-availability Keepalive unit, a management Manager unit, an adapter unit, a database management MariaDB unit, and a distributed message RabbitMQ unit.

[0038] In the security management service, the above units together constitute a security management service infrastructure. Each unit plays a key role in ensuring the high availability, security and effectiveness of the service. The following is a description of each unit:

[0039] The Keepalive unit is an open source software that focuses on improving the reliability of network services. Its core function is to provide load balancing and high availability services.

[0040] Manager unit refers to management services, which provide unified monitoring alarm, unified user rights management and other functions. In addition, Manager also provides automatic health check and inspection functions to help users implement one-click system operation health inspection and audit.

[0041] The Adapter unit is used to enable originally incompatible interfaces to work together. In the security management service, the adapter pattern allows service classes (usually from third parties or legacy systems) whose clients are incompatible with their interfaces to be called by clients.

[0042] MariaDB unit is an open source relational database management system. In the security management service, MariaDB can be used to store user data, access control lists, security logs and other information.

[0043] RabbitMQ unit is a distributed message middleware that follows the AMQP protocol and is used to receive and distribute messages. In the security management service, RabbitMQ can be used to handle queue management of events and log messages to ensure reliable delivery and processing of messages.

[0044] In actual applications, in order to meet business needs, the security management device also includes a part that cooperates with the business network card. For example, each security service module has a second virtual network card, such as Figure 3 As shown, the second virtual network card of each security service module is associated with the second virtual switching device, and the second virtual switching device is bound to the service network card.

[0045] In this embodiment, the working mode of the second virtual switching device is a bridge mode. In the bridge mode, the second virtual network card of each security service module is directly connected to the business network card through a virtual bridge, so that the security service module can obtain an independent IP address and directly access the external network, which is convenient for network configuration and management.

[0046] It is worth mentioning that Figure 3 As shown, when the multiple security service modules of the security management device include a WAF module, the third virtual network card of the WAF module is bound to the first monitoring network card; when the multiple security service modules of the security management device include a database audit module, the third virtual network card of the database audit module is bound to the second monitoring network card.

[0047] It can be seen from the above technical solutions that the security management method provided by this embodiment no longer deploys the security management module in the form of a virtual machine, but deploys the security management module in the form of a docker container, thereby reducing the resource consumption of the security management module. In addition, this embodiment uses a virtual switching device in NAT mode and Nginx proxy service, so that the external network can access the security service module only through the address of the management network card, reducing the consumption of the management network segment address and improving the integrity of the entire security management device.

[0048] The following is a detailed description of the security management device using actual applications as an example. Specifically, the security management device is deployed on a physical server, which is a physical device that provides multiple security services to the outside world. The physical server includes at least four physical network cards, one of which is used as a management network card, one as a business network card, one as a monitoring network card for WAF, and one as a monitoring network card for database auditing.

[0049] This application deploys the underlying operating system on the physical server, deploys a virtualization platform on the underlying operating system, and deploys various security service modules on the virtualization platform. Docker is deployed on the underlying operating system as a containerization platform, and the security management module is deployed using the Docker image.

[0050] In this application, the mode of the virtual switch associated with the security management module is NAT mode; the security management module includes an Nginx proxy unit, which can monitor the ports (proxy ports) in the operating system respectively and forward requests to the specified IP address and port combination. Users can access the security service module inside the physical server by accessing the management network card address + proxy port.

[0051] Refer to the following Figure 4 The deployment process of the security management device is described in detail, including the following steps:

[0052] Step 1: Deploy the underlying operating system on the server;

[0053] Step 2: Execute the rpm command line to deploy the installation packages and dependent packages of the libvirt program and KVM program in the underlying operating system, complete the installation of the virtualization platform program, and build a virtualization platform; start the libvirt program and KVM program;

[0054] Step 3. Create a virtual switch vswitch0, set the mode to NAT mode, and set the address to 192.168.122.1 / 24;

[0055] Step 4. Create a virtual switch vswitch1, bind the service network card, and set the mode to bridge mode;

[0056] Step 5. Based on the ISO image of WAF, create a virtual machine waf1 on the virtualization platform, set the default virtual network card address of the virtual machine waf1 to 192.168.122.3 / 24, and associate it with vswitch0; add a virtual network card and associate it with vswitch1; add a second virtual network card and bind it to monitoring network card 1;

[0057] Step 6. Based on the ISO image of the database audit, create a virtual machine dba1 on the virtualization platform, set the default virtual network card address of the virtual machine dba1 to 192.168.122.4 / 24, and associate it with vswitch0; add a virtual network card and associate it with vswitch1; add a second virtual network card and bind it to monitoring network card 2;

[0058] Step 7. On the virtualization platform, create a log audit virtual machine log1 based on the ISO image of each security product, set the default virtual network card address of the log audit virtual machine log1 to 192.168.122.5 / 24, and associate it with vswitch0; add a virtual network card and associate it with vswitch1;

[0059] Step 8. Create an operation and maintenance audit virtual machine oa1 based on the ISO images of various security products on the virtualization platform, set the default virtual network card address of the operation and maintenance audit virtual machine oa1 to 192.168.122.6 / 24, and associate it with vswitch0; add a virtual network card and associate it with vswitch1;

[0060] Step 9: Create a firewall virtual machine fw1 based on the ISO images of various security products on the virtualization platform, set the default virtual network card address of the firewall virtual machine fw1 to 192.168.122.2 / 24, and associate it with vswitch0; add a virtual network card and associate it with vswitch1;

[0061] Step 10: Create an Internet behavior audit virtual machine acg1 based on the ISO images of various security products on the virtualization platform, set the default virtual network card address of the Internet behavior audit virtual machine acg1 to 192.168.122.7 / 24, and associate it with vswitch0; add a virtual network card and associate it with vswitch1;

[0062] Step 11: Create a terminal security virtual machine esm1 based on the ISO image of each security product on the virtualization platform, set the default virtual network card address of the terminal security virtual machine esm1 to 192.168.122.8 / 24, associate it to vswitch0, add a virtual network card, and associate it to vswitch1;

[0063] Step 12: Deploy the Docker installation package on the operating system to build a containerized platform.

[0064] Step 13. Use the docker image of the nginx service to create a container and set the network mode to host mode;

[0065] Step 14: Use the docker images of Keepalive, Manager, Adapter, MariaDB, and RabbitMQ to create containers respectively to obtain the various units of the security management module;

[0066] Step 15. Modify the Nginx configuration file and create firewall proxy configuration, WAF proxy configuration, database audit proxy configuration, log audit proxy configuration, operation and maintenance audit proxy configuration, Internet behavior audit proxy configuration, and terminal security proxy configuration.

[0067] Based on the same inventive concept, the present application also provides a security management device, the structural diagram of which is as follows: Figure 5 As shown, it specifically includes: a security management module deployed based on a containerized platform, a first virtual switching device deployed based on a virtualized platform, and multiple security service modules deployed based on a virtualized platform;

[0068] The security management module determines, in response to the access request carrying the target port number, a target security service module corresponding to the target port number among the multiple security service modules, and forwards the access request to the target security service module through the first virtual switching device;

[0069] Wherein, the working mode of the first virtual switching device is NAT mode.

[0070] As a specific implementation, the security management module includes an Nginx proxy unit;

[0071] The Nginx proxy unit monitors the access request carrying the target port number, and when monitoring the access request carrying the target port number, determines the target security service module corresponding to the target port number among the multiple security service modules.

[0072] As a specific implementation manner, the first virtual network card of each security service module in the multiple security service modules is associated with the first virtual switching device, the second virtual network card of each security service module in the multiple security service modules is associated with the second virtual switching device, the working mode of the second virtual switching device is a bridging mode, and the second virtual switching device is bound to the service network card.

[0073] As a specific implementation, the multiple security service modules include at least one of the following: a network layer firewall module, an application layer firewall WAF module, a database audit module, a log audit module, an operation and maintenance audit module, an Internet behavior audit module, and a terminal security module.

[0074] As a specific implementation, when the multiple security service modules include a WAF module, the third virtual network card of the WAF module is bound to the first monitoring network card; when the multiple security service modules include a database audit module, the third virtual network card of the database audit module is bound to the second monitoring network card.

[0075] An embodiment of the present application also provides a computer-readable storage medium, which includes computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes each function or step of the above method embodiment.

[0076] The computer-readable storage medium includes but is not limited to any one of the following: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0077] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer is enabled to perform each function or step of the above method embodiment.

[0078] Among them, the electronic device, computer-readable storage medium, and computer program product provided in the embodiments of the present application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0079] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0080] In the several embodiments provided in the present application, it should be understood that the disclosed method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of modules or units, which can be electrical, mechanical or other forms.

[0081] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0082] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A safety management method, characterized in that: The method is applied to a security management module deployed on a containerized platform in a security management device, wherein the security management device further comprises a first virtual switching device deployed on a virtualized platform and a plurality of security service modules deployed on a virtualized platform. The method comprises: In response to an access request carrying a target port number, determining a target security service module corresponding to the target port number among the plurality of security service modules; forwarding the access request to the target security service module through the first virtual switching device; Wherein, the working mode of the first virtual switching device is NAT mode.

2. The method according to claim 1, characterized in that The security management module includes an Nginx proxy unit, and the method specifically determines the target security service module in the following manner: The access request carrying the target port number is monitored by the Nginx proxy unit; when the access request carrying the target port number is monitored, a target security service module corresponding to the target port number among the multiple security service modules is determined.

3. The method according to claim 1, characterized in that The first virtual network card of each of the multiple security service modules is associated with the first virtual switching device, the second virtual network card of each of the multiple security service modules is associated with the second virtual switching device, the working mode of the second virtual switching device is a bridging mode, and the second virtual switching device is bound to the service network card.

4. The method according to claim 3, characterized in that The multiple security service modules include at least one of the following: a network layer firewall module, an application layer firewall WAF module, a database audit module, a log audit module, an operation and maintenance audit module, an Internet behavior audit module, and a terminal security module.

5. The method according to claim 4, characterized in that When the multiple security service modules include a WAF module, a third virtual network card of the WAF module is bound to the first monitoring network card; When the multiple security service modules include a database audit module, a binding relationship exists between the third virtual network card of the database audit module and the second monitoring network card.

6. The method according to claim 1, characterized in that The security management module includes at least one of the following: a high-availability Keepalive unit, a management Manager unit, an adapter unit, a database management MariaDB unit, and a distributed message RabbitMQ unit.

7. A security management device, characterized in that: The device comprises: a security management module deployed based on a containerized platform, a first virtual switching device deployed based on a virtualized platform, and a plurality of security service modules deployed based on a virtualized platform; The security management module determines, in response to the access request carrying the target port number, a target security service module corresponding to the target port number among the multiple security service modules, and forwards the access request to the target security service module through the first virtual switching device; Wherein, the working mode of the first virtual switching device is NAT mode.

8. The device according to claim 7, characterized in that The security management module includes an Nginx proxy unit; The Nginx proxy unit monitors the access request carrying the target port number, and when monitoring the access request carrying the target port number, determines the target security service module corresponding to the target port number among the multiple security service modules.

9. The device according to claim 7, characterized in that The first virtual network card of each of the multiple security service modules is associated with the first virtual switching device, the second virtual network card of each of the multiple security service modules is associated with the second virtual switching device, the working mode of the second virtual switching device is a bridging mode, and the second virtual switching device is bound to the service network card.

10. The device according to claim 9, characterized in that The multiple security service modules include at least one of the following: a network layer firewall module, an application layer firewall WAF module, a database audit module, a log audit module, an operation and maintenance audit module, an Internet behavior audit module, and a terminal security module.

11. The device according to claim 10, characterized in that When the multiple security service modules include a WAF module, a third virtual network card of the WAF module is bound to the first monitoring network card; When the multiple security service modules include a database audit module, a binding relationship exists between the third virtual network card of the database audit module and the second monitoring network card.

12. A computer-readable storage medium comprising computer instructions, characterized in that: When the computer instructions are executed on an electronic device, the electronic device is caused to execute the method according to any one of claims 1 to 6.

13. A computer program product, characterized in that When the computer program product is executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 6.

Images