Integrated management system based on Internet of Things
By designing an integrated management system based on the Internet of Things, combining data interface modules and wireless data transceiver modules, equipment identification and multiple access methods are realized, and the existing system is difficult to manage multiple devices and lacks unified protection, improving equipment security and management efficiency.
Patent Information
- Application Number
- CN202411662575.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-20
- Publication Date
- 2025-03-21
AI Technical Summary
The existing IoT device management system is difficult to effectively identify and manage multiple devices. The lack of a unified device access and vulnerability protection system is easy to lead to information leakage and external hacker invasion, and daily maintenance is cumbersome.
Design a comprehensive management system based on the Internet of Things, including a management server and a web terminal, adopts a data interface module and a wireless data transceiver module, sets the device identification function through the web terminal module, combines active/passive scanning to identify networked devices, supports multiple device access methods, and protects the equipment through traffic probes.
It realizes the rapid identification and management of networked devices, provides equipment access and security protection functions, reduces the risks of information leakage and hacker intrusion, and simplifies daily maintenance work.
Smart Images
Figure CN119676043A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of integrated management application of the Internet of Things, and in particular to an integrated management system based on the Internet of Things. Background Art
[0002] The Internet of Things (IoT) integrated management system is a system for managing and protecting networked devices in the intranet. The Internet of Things (IoT) is an information carrier based on the Internet, traditional telecommunications networks, etc., which enables all ordinary physical objects that can be independently addressed to be interconnected.
[0003] At present, many public security organizations have numerous and complex IoT devices, including various computers, servers, printers, cameras, etc., which are very labor-intensive to manage.
[0004] Many places lack equipment access and vulnerability protection systems, which can easily lead to internal information leakage or even external hacker intrusion. At the same time, even if there is some protection software or equipment, they still need to face the tedious work of daily maintenance such as vulnerability information updating. Summary of the invention
[0005] The technical problem to be solved by the present invention is to overcome the above technical defects and provide a comprehensive management system based on the Internet of Things that is easy to operate and use, can be used for comprehensive management of networked devices, and has device identification and security protection.
[0006] In order to solve the above technical problems, the technical solution provided by the present invention is: an integrated management system based on the Internet of Things, including a management server and a web terminal, the management server is also provided with a data interface module and a wireless data transceiver module, the wireless data transceiver module wirelessly communicates with the web terminal, and the data interface module includes access to the integrated management system through a physical interface;
[0007] The web terminal includes a login verification unit, a device handling unit, an access parameter configuration unit, a security protection unit, an asset management unit and a system management unit.
[0008] Preferably, the data interface module includes a Console port, a USB port, a multi-mode optical fiber module, an Ethernet electrical port, a COM port, a VGA port, a USB port, a KB port, and a power port.
[0009] Preferably, the device handling unit includes device access approval, access device status adjustment, access device information collection and device alarm;
[0010] The access device status adjustment includes waiting for access, host approval, admitted, and denied access. The device access approval includes displaying a list of all devices awaiting approval on the web. The device access approval includes external temporary device access approval. The device alarm includes displaying a list of devices in the denied access list.
[0011] Preferably, the admission parameter configuration unit includes adding, deleting, modifying, enabling and disabling the no-admission rules, automatic admission rules and vulnerability check item rules.
[0012] Preferably, the security protection unit includes monitoring IP resources, offline devices, video data quality, and device risk status, and the device risk status includes vulnerabilities, high-risk ports, weak passwords, and illegal boundaries.
[0013] Preferably, the asset management unit includes all asset information, pre-admission equipment information, historical equipment information, and also includes asset information modification: deletion, conversion to core or non-core assets, and enabling vulnerability checking.
[0014] Preferably, the system management unit includes security domain configuration, administrative department configuration, device type configuration, pending admission rule configuration, port configuration, user configuration, switch configuration and initialization.
[0015] Preferably, the security domain configuration includes configuring the IP segments of the integrated management system in the intranet, and the administrative department configuration divides the effective IP segments into various administrative departments;
[0016] The configuration of the pending access rules includes configuring the restricted access control of the pending access device, and the port configuration includes customizing the high-risk ports;
[0017] The user configuration includes adding new users and deleting users, the switch configuration includes controlling the switches of various modules in the system, and the initialization includes initializing the integrated management system.
[0018] The advantages of the present invention compared with the prior art are: in the present invention, each module on the web side is provided with a device identification function, and a combination of active / passive scanning is used to quickly identify networked devices, display the network architecture and the working status of each device, support automatic access, special device access, access after approval, pre-access and other methods, and can flexibly respond to various scenarios. At the same time, a flow probe is used to collect device flow to learn the network behavior between devices, block abnormal flow, and protect against various attacks such as viruses, Trojans, DDOS, etc., which is convenient for operation and maintenance and management. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] Figure 1 is a schematic diagram of the management server.
[0020] Figure 2It is a schematic diagram of an integrated management system based on the Internet of Things. DETAILED DESCRIPTION
[0021] The present invention is further described in detail below in conjunction with the accompanying drawings.
[0022] Combined with Figure 1 As shown, an integrated management system based on the Internet of Things includes a management server and a web terminal. The management server is also provided with a data interface module and a wireless data transceiver module. The wireless data transceiver module communicates wirelessly with the web terminal. The data interface module includes access to the integrated management system through a physical interface, wherein the data interface module includes a Console port, a USB interface, a multi-mode optical fiber module, an Ethernet electrical port, a COM interface, a VGA interface, a USB interface, a KB interface, and a power interface.
[0023] When used specifically:
[0024] The web end includes a login verification unit, a device handling unit, an access parameter configuration unit, a security protection unit, an asset management unit and a system management unit.
[0025] The equipment disposal unit includes equipment access approval, access equipment status adjustment, access equipment information collection and equipment alarm;
[0026] The access device status adjustment includes waiting for access, host approval, accessed, and denied access. The device access approval includes displaying a list of all devices to be approved on the web. The device access approval includes external temporary device access approval. The device alarm includes displaying a list of devices in the denied access list, specifically:
[0027] The information of devices to be approved involves statistical charts related to this module, as well as a list of devices to be approved and a list of host approvals. For devices in the system to be approved, you can perform operations such as admission / disapproval and export. Select the device to select the status, including admission, disapproval and data export. Host approval is an external temporary access device entrance, which can be used in conjunction with another website for filling out the application form. After filling in the information on the web page, upload the admission application. Enter the host approval page of the device information to be approved, click the operation column icon of the device to be approved, enter the approval information page, and approve it according to the process. The device access information is used to view the admitted / disapproved status of the device and manually operate the access status of the device.
[0028] The alarm center includes the devices that enter the alarm center after hitting the no-entry rules, and you can manually choose to block / unblock the devices that are reported.
[0029] The admission configuration module is used to configure non-admission rules / automatic admission rules and vulnerability checks. The non-admission rules are used to add, modify, delete and enable / disable non-admission rules, the automatic admission rules are used to add, modify, delete and enable / disable automatic admission rules, and the vulnerability check is used to add, modify, delete and enable / disable vulnerability check item rules.
[0030] Operation management is a module used to monitor IP resources, offline devices, video quality, and device risk status during system operation. IP resource management displays IP usage and corresponding device connection information in each segment by department / security domain. After selecting a department, enter the IP information displayed from the perspective of the security domain;
[0031] Offline devices display relevant information of offline devices, set offline devices offline, display video devices with abnormal video quality, and risk status displays vulnerabilities, high-risk ports, weak passwords, and illegal boundaries (dual network cards, NAT devices) in devices under the department;
[0032] Vulnerabilities are used to display the vulnerabilities existing in the devices under each department. The corresponding detailed information is displayed in the vulnerability perspective / device perspective page. High-risk ports are used to display the high-risk ports existing in the devices under each department. The information in the corresponding table in the port perspective will be displayed from different angles.
[0033] Weak passwords are used to display the weak passwords that exist on devices under each department. Devices with weak passwords can be blocked. Illegal boundaries are used to display the illegal boundaries that exist on devices under each department.
[0034] Asset management includes three parts: all assets, pre-access devices, and historical devices. All assets come from the device information detected by the system probe in the corresponding LAN. Pre-access devices are used to manually import devices when the system is initially launched. Historical devices are devices that have been deleted after being offline for a long time. All assets include the device information detected by the system probe in the corresponding LAN, which can be manually modified, deleted, converted to core / non-core assets, and vulnerability checks can be enabled. Pre-access devices can add, modify, delete pre-access devices and perform pre-access settings on pre-access devices. Assets deleted from historical devices in all assets enter historical devices.
[0035] The system management module is used for basic configuration of the system, including security domain configuration, administrative department configuration, device type configuration, pending admission rules, port configuration, engine information configuration, system user configuration, switch linkage configuration, switch configuration and initialization;
[0036] Among them: Security domain configuration, this module is used to configure the IP segment that takes effect on the intranet, namely the security domain. Fill in / select each field of the newly added security domain to add the corresponding security domain; the department column of the newly added security domain is consistent with its parent security domain by default, and the global domain (root security domain) 0.0.0.0 / 0 exists by default; Administrative department configuration is used to divide each security domain into each department. Fill in / select each field of the newly added administrative department to add the corresponding administrative department; after the security domain is divided into a department, its department column is renamed to the corresponding department, and the security domain contained in the root department is the root security domain and exists by default;
[0037] Device type configuration: This module is used to configure device types, and is used to configure device types for no-admission / automatic-admission rules. After adding and filling in the type name on the page, the corresponding parent device type is added, and sub-type device types can also be added for parent devices.
[0038] Pending admission rules: This module is used to configure the restricted access of the pending admission device. Fill in / select the fields on the new rule page and confirm or modify the rules before confirming. Port configuration: This module is used to customize high-risk ports. Fill in the ports and add or delete them.
[0039] It also includes engine information configuration, such as the secure operation platform used to configure the management center engine server, including restarting the engine and configuring the detection engine;
[0040] System user configuration is used to add new users. Fill in / select the fields on the new user page to add or delete users. Switch linkage configuration is used to configure switch information in the LAN. Fill in / select the fields on the new switch linkage configuration page to add or delete users.
[0041] Switch configuration, this module acts as a master switch and can block all IPs except the IP of the device that has been connected to the network with one click, or enable host approval, access rule judgment, vulnerability inspection for loopholes, weak passwords, high-risk ports, and multiple network cards, alarm function for configured rules, blocking function of non-access rules for each security domain, and restricted access function configured for each security domain.
[0042] Initialization is used to initialize the system.
[0043] The present invention is easy to deploy and can be directly hung on the switch of the public security video network without affecting the normal operation of other devices of the user. It can accurately identify disguised devices and introduce artificial intelligence into the research and development of Internet of Things security products and deploy them on a large scale.
[0044] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.
[0045] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.
Claims
1. An integrated management system based on the Internet of Things, characterized by: It includes a management server and a web terminal. The management server is also provided with a data interface module and a wireless data transceiver module. The wireless data transceiver module communicates wirelessly with the web terminal. The data interface module includes access to the integrated management system through a physical interface. The web terminal includes a login verification unit, a device handling unit, an access parameter configuration unit, a security protection unit, an asset management unit and a system management unit.
2. According to claim 1, the integrated management system based on the Internet of Things is characterized by: The data interface module includes a Console port, a USB port, a multi-mode optical fiber module, an Ethernet electrical port, a COM port, a VGA port, a USB port, a KB port, and a power port.
3. According to claim 1, the integrated management system based on the Internet of Things is characterized by: The device handling unit includes device access approval, access device status adjustment, access device information collection and device alarm; The access device status adjustment includes waiting for access, host approval, admitted, and denied access. The device access approval includes displaying a list of all devices awaiting approval on the web. The device access approval includes external temporary device access approval. The device alarm includes displaying a list of devices in the denied access list.
4. The integrated management system based on the Internet of Things according to claim 1 is characterized in that: The admission parameter configuration unit includes adding, deleting, modifying, enabling and disabling the no-admission rules, automatic admission rules and vulnerability check item rules.
5. The integrated management system based on the Internet of Things according to claim 1 is characterized in that: The security protection unit includes monitoring IP resources, offline devices, video data quality, and device risk status, and the device risk status includes vulnerabilities, high-risk ports, weak passwords, and illegal boundaries.
6. The integrated management system based on the Internet of Things according to claim 1 is characterized in that: The asset management unit includes all asset information, pre-approved device information, historical device information, and also includes asset information modification: deletion, conversion to core or non-core assets, and enabling vulnerability checks.
7. The integrated management system based on the Internet of Things according to claim 1 is characterized in that: The system management unit includes security domain configuration, administrative department configuration, device type configuration, pending admission rule configuration, port configuration, user configuration, switch configuration and initialization.
8. The integrated management system based on the Internet of Things according to claim 7 is characterized in that: The security domain configuration includes configuring the IP segments that are effective in the intranet of the integrated management system, while the administrative department configuration divides the effective IP segments into various administrative departments; The configuration of the pending access rules includes configuring the restricted access control of the pending access device, and the port configuration includes customizing the high-risk ports; The user configuration includes adding new users and deleting users, the switch configuration includes controlling the switches of various modules in the system, and the initialization includes initializing the integrated management system.