Strategy separation system security reinforcement method and system, medium and product

Abstract

The invention discloses a strategy separation system security reinforcement method and system, a medium and a product, and the method comprises the steps: obtaining a default template or a customized template selected by a user in a strategy template library, the information of the reinforcing item in the template comprises basic information, scanning process logic, reinforcing process logic and restoring process logic of the reinforcing item; the system is scanned according to the scanning process logic in the template selected by the user, reinforcement operation is executed according to the reinforcement process logic for reinforcement items needing to be reinforced in the scanning report, and a reinforcement report is generated; and if the user needs to restore the specified reinforcement item, executing a restoration operation according to the restoration process logic for the specified reinforcement item to enable the system to restore the environment before reinforcement and generate a restoration report. The invention aims to realize a system security reinforcement solution which can be convenient for rollback, can quickly generate a new reinforcement item to quickly respond to the demand, and can realize flexible reinforcement meeting the demands of multiple industries.

Description

Technical Field

[0001] The present invention relates to the field of security technology of operating systems, and in particular to a policy-separated system security reinforcement method, system, medium and product. Background Art

[0002] With the development of Internet technology, all walks of life rely on computer applications, and computer security issues are attracting more and more attention. Many systems have system vulnerabilities, simple system authentication mechanisms, useless access control, and various Trojan viruses. Security reinforcement refers to a series of security configurations, vulnerability repairs, and optimization measures for the system in accordance with best security practices and security standards for operating systems (such as Linux systems) and their applications. Therefore, system security reinforcement is imminent. Existing common security reinforcement tools often only scan and reinforce, mainly through vulnerability scanning of the system, using patching, setting password strength, modifying security configuration, optimizing access control policies, adding security mechanisms, etc. to reinforce some system vulnerabilities and remedy them according to the scan results to complete the reinforcement work. Existing common security reinforcement technologies have some problems: 1) The reinforcement method cannot be rolled back, and users cannot roll back freely. 2) When the industry needs new reinforcement items, new reinforcement items cannot be generated immediately. After the code is modified, it needs to be compiled and packaged before it can be used, which cannot respond to the needs quickly. Among them, reinforcement items refer to specific tasks or operations that need to be performed during security reinforcement. Each item targets a specific security risk or weakness in the system. 3) Because each industry handles different businesses, its reinforcement needs and focuses will be different, and the reinforcement items included will also be different. There is also a need to restore the previous reinforcement content. Current reinforcement tools often cannot meet the needs of multiple industries. Summary of the invention

[0003] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a policy-separated system security reinforcement method, system, medium and product are provided. The present invention aims to realize a system security reinforcement solution that can be easily rolled back, can quickly generate new reinforcement items to quickly respond to needs, and realize flexible reinforcement to meet the needs of multiple industries.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is: A system security reinforcement method for policy separation includes the following steps: S1, obtaining a default template or a custom template selected by a user in a policy template library, wherein both the default template and the custom template include hardening item information, wherein the hardening item information includes basic information of the hardening item and hardening item process logic, wherein the hardening item process logic includes scanning process logic, hardening process logic and restoration process logic; S2, scans the system according to the scanning process logic in the template selected by the user, and performs reinforcement operations according to the reinforcement process logic for the reinforcement items that need to be reinforced in the scanning report and generates a reinforcement report; if the user needs to restore the specified reinforcement items, then performs the restoration operation according to the restoration process logic for the specified reinforcement items to restore the system to the environment before reinforcement and generate a restoration report.

[0005] Optionally, step S1 includes creating a new reinforcement item and a custom template: S101, determine whether the new reinforcement item needs a combination operation rule, if not, jump to step S102; otherwise, jump to step S103; S102, synthesizing new reinforcement items according to basic operation rules, wherein the basic operation rules include some or all of file rules, command rules, installation package rules, system service rules, special rules and other rules, wherein the file rules include rules related to querying and modifying configuration files, the command rules include rules for using shell commands, the installation package rules include querying whether a specified software package has been installed in the current system, the system service rules include rules for querying and changing service status, the special rules include rules for restarting the system and restarting certain services, and the other rules include rules other than file rules, command rules, installation package rules, system service rules and special rules; jump to step S104; S103, determining whether there is an available combined operation rule, if no combined operation rule is available, synthesizing the basic operation rules into a combined operation rule, and synthesizing a new reinforcement item according to the combined operation rule, otherwise directly synthesizing a new reinforcement item according to the combined operation rule; jumping to step S104; S104, adding basic information to the new reinforcement item to synthesize a complete reinforcement item and adding a custom template.

[0006] Optionally, the basic information includes an ID, an item name and description information of the new reinforcement item.

[0007] Optionally, the rules related to querying and modifying the configuration file include: determining whether a file exists, determining whether a file is empty, determining whether a file contains a line containing a keyword, adding a line to a file, deleting a line to a file, modifying a line to a file, adding a line after the line where the file keyword is located, adding a line before the line where the file keyword is located, creating a file, deleting a file, renaming a file, and file permissions.

[0008] Optionally, in step S103, combining the basic operation rules into combined operation rules means combining the basic operation rules into combined operation rules by using operation symbols, wherein the operators include logical operations and brackets, and the logical operations include part and all of AND, OR, and NOT.

[0009] Optionally, in step S2, scanning the system according to the scanning process logic in the template selected by the user and performing reinforcement operations according to the reinforcement process logic for the reinforcement items that need to be reinforced in the scanning report and generating a reinforcement report include: S201, parsing the template selected by the user through a template parsing interface to extract template content; S202, extracting reinforcement item information from the extracted template content using a reinforcement item parsing module, wherein the reinforcement item information includes basic information of the reinforcement item and reinforcement item process logic, wherein the reinforcement item process logic includes scanning process logic, reinforcement process logic and restoration process logic, wherein the scanning process logic includes basic operation rules or combined operation rules and operators required for scanning the system, wherein the operators include some or all of the four operators of AND, OR, NOT and brackets; the reinforcement process logic includes basic operation rules or combined operation rules and operators required for reinforcement of the system; and the restoration process logic includes basic operation rules or combined operation rules and operators required for restoration of the system; S203, determining whether there is a combination operation rule in the scanning process logic. If there is a combination operation rule in the scanning process logic, calling the combination rule parsing interface to parse the combination operation rule to obtain a basic operation rule for synthesizing the combination operation rule, thereby converting the scanning process logic into a policy atomic operation based on the basic operation rule; scanning the system according to the policy atomic operation of the scanning process logic and generating a scanning report; S204, determine whether there are combination operation rules in the reinforcement process logic. If there are combination operation rules in the reinforcement process logic, call the combination rule parsing interface to parse the combination operation rules to obtain the basic operation rules of the synthetic combination operation rules, thereby converting the reinforcement process logic into a set of policy atomic operations based on the basic operation rules; reinforce the system according to the policy atomic operations of the reinforcement process logic and generate a reinforcement report.

[0010] Optionally, in step S2, a restore operation is performed for the specified reinforcement item according to the restoration process logic to restore the system to the environment before reinforcement and generate a restoration report, including: determining whether there is a combination operation rule in the restoration process logic; if there is a combination operation rule in the restoration process logic, calling the combination rule parsing interface to parse the combination operation rule to obtain the basic operation rule of the synthetic combination operation rule, thereby converting the restoration process logic into a set of policy atomic operations based on the basic operation rules; restoring the system according to the policy atomic operations of the restoration process logic to restore the system to the environment before reinforcement and generate a restoration report.

[0011] In addition, the present invention also provides a policy-separated system security reinforcement system, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the policy-separated system security reinforcement method.

[0012] In addition, the present invention also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the policy-separated system security reinforcement method through a processor.

[0013] In addition, the present invention also provides a computer program product, including a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the policy separation system security reinforcement method through a processor.

[0014] Compared with the prior art, the present invention mainly has the following advantages: the present invention provides a security reinforcement mechanism that is separated from the policy. The user can use the default policy file (default template) of the tool, which contains many default reinforcement items and can be used freely. When the default reinforcement items do not meet the needs, you can use a custom policy file (custom template) to add new reinforcement items according to the policy rules. After the reinforcement items are added, they can be added to the custom template. Different reinforcement requirements can be met by configuring different baseline templates. In addition, when the reinforcement is completed and needs to be restored to the state before reinforcement, it can be restored conveniently and quickly. The present invention realizes a system security reinforcement solution that can be easily rolled back, can quickly generate new reinforcement items to quickly respond to needs, and can achieve flexible reinforcement to meet the needs of multiple industries. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 Schematic diagram of the basic flow of the method of the embodiment of the present invention.

[0016] Figure 2 The figure is a schematic diagram of a process of creating a new reinforcement item in an embodiment of the present invention.

[0017] Figure 3 Schematic diagram of the composition of basic operating rules in an embodiment of the present invention.

[0018] Figure 4 Schematic diagram of the system module structure in an embodiment of the present invention.

[0019] Figure 5 The figure is a schematic diagram of the module calling flow in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the technical solution of the present invention, the technical solution of the present invention will be further described in detail below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0021] like Figure 1 As shown, the system security reinforcement method of policy separation in this embodiment includes the following steps: S1, obtaining a default template or a custom template selected by a user in a policy template library, wherein both the default template and the custom template include hardening item information, wherein the hardening item information includes basic information of the hardening item and hardening item process logic, wherein the hardening item process logic includes scanning process logic, hardening process logic and restoration process logic; S2, scans the system according to the scanning process logic in the template selected by the user (default template or custom template), and performs reinforcement operations according to the reinforcement process logic for the reinforcement items that need to be reinforced in the scanning report and generates a reinforcement report; if the user needs to restore the specified reinforcement items, then performs the restoration operation according to the restoration process logic for the specified reinforcement items to restore the system to the environment before reinforcement and generate a restoration report.

[0022] The template selected by the user (default template or custom template) contains a series of security reinforcement measures and configurations, that is, a collection of reinforcement items. Scanning and reinforcement are performed according to the reinforcement items contained in the template. This embodiment realizes the separation of policy and reinforcement mechanism through templates, so that it can conveniently respond to the needs of different industries. The separation of policy and reinforcement mechanism can add new reinforcement items to the policy file according to the established policy rules. In this way, even if the industry needs to have new reinforcement items, they can be generated according to the policy file. This makes it convenient and quick to customize reinforcement items to meet various reinforcement needs. And when it is necessary to restore to the environment before reinforcement, the restoration can be completed quickly to ensure the normal use of the business. Figure 2 As shown, before step S1 of this embodiment, the steps include creating a new reinforcement item and a custom template: S101, determine whether the new reinforcement item needs a combination operation rule, if not, jump to step S102; otherwise, jump to step S103; S102, synthesizing new reinforcement items according to basic operation rules, wherein the basic operation rules include file rules, command rules, installation package rules, system service rules, special rules and some or all of other rules, wherein the file rules include rules related to querying and modifying configuration files, the command rules include rules for using shell commands, the installation package rules include querying whether the specified software package has been installed in the current system (the server system and the desktop system may be different), the system service rules include rules for querying and changing the service status (including the self-starting status and the running status, etc.), the special rules include rules for restarting the system and restarting certain services (because some reinforcement items have some common operations, but they only need to be executed once during the entire operation process, special rules are needed at this time, which currently include restarting the system and restarting certain services), and other rules include file rules, command rules, installation package rules, system service rules, and rules other than special rules; jump to step S104; S103, determining whether there is an available combined operation rule, if no combined operation rule is available, synthesizing the basic operation rules into a combined operation rule, and synthesizing a new reinforcement item according to the combined operation rule, otherwise directly synthesizing a new reinforcement item according to the combined operation rule; jumping to step S104; S104, adding basic information to the new reinforcement item to synthesize a complete reinforcement item and adding a custom template.

[0023] In this embodiment, the basic information includes the ID, item name and description information of the new reinforcement item.

[0024] In this embodiment, the rules related to querying and modifying configuration files mainly refer to the rules related to querying and modifying configuration files, which are divided into 12 categories of rules, including: determining whether a file exists, determining whether a file is empty, determining whether a file contains a line containing a keyword, adding a line to a file, deleting a line to a file, modifying a line to a file, adding a line after the line where the file keyword is located, adding a line before the line where the file keyword is located, creating a file, deleting a file, renaming a file, and file permissions.

[0025] like Figure 3 As shown, in step S103 of this embodiment, the basic operation rules are combined into combined operation rules, which means that the basic operation rules are combined into combined operation rules by using operation symbols, and the operators include logical operations and brackets, and the logical operations include AND (using the symbol " ”), or (using the symbol “ ”) and non (using the symbol “ "). To combine them into a reinforcement item, you first need to know the scanning process and reinforcement process. If a reinforcement item requires two files to contain a keyword at the same time, you can combine the two file rules to see whether there is a line containing the keyword, and use the operator " " combination; if the hardening item scan needs to determine whether any of two files contains a certain keyword, the two file rule files can be combined to determine whether there is a line containing the keyword, with the operator " " to combine them; if the reinforcement item needs to obtain a certain field that does not exist in the row of a certain keyword in a certain file, you can use the operator " "; The operator brackets are used to combine different rules into a subset. For example, if the reinforcement item is to disable a service, the installation package rule is needed to determine whether the package containing the service is installed, and the system service rule is used to determine whether the service is automatically started and closed, and the system service rule is used to determine whether the service status is closed. Combined with &, a set of reinforcement item processes are added, and the reinforcement item id, reinforcement item name, and some operation descriptions of the reinforcement item are added to form a complete reinforcement item. Other methods are similar, and finally the addition of new reinforcement items is completed.

[0026] Figure 4 Schematic diagram of the system module structure in this embodiment. Figure 4 , In this embodiment, a security reinforcement mechanism separated from the policy is provided, and the mechanism includes three parts: the policy module, the template module and the tool background module. ①, The policy module includes the policy rule module and the reinforcement item module. The policy rule module mainly includes basic operation rules, operators and combined operation rules. The basic operation rules are divided into six categories of rules, including file rules, command rules, installation package rules, system (system) service rules, special rules and other rules. Operators include four types: and, or, not, and brackets. The combined operation rules are composed of basic operation rules combined with operators, and are mainly used for the reuse of some reinforcement items of the same type. The reinforcement item module is mainly divided into basic information of reinforcement items and process logic of reinforcement items. The reinforcement item process logic includes two parts: scanning and reinforcement restoration. These two parts are respectively composed of basic operation rules or combined operation rules combined with operators. The basic information of reinforcement items includes reinforcement item ID, item name and some result description information. ②, The template module contains a policy template library, in which the templates are mainly divided into default templates and custom templates. ③, the tool background module includes template parsing interface, reinforcement item parsing interface, combined rule parsing interface and policy atomic operation, among which policy atomic operation corresponds to the basic operation rules in the policy module one by one. For example, the policy atomic operation corresponding to the file rule includes file operations such as creating / deleting files, adding / deleting a line in a file, modifying files, and modifying file permissions. The two logics of reinforcement and restoration are completely opposite, and the two are combined into one atomic operation. For another example, the policy atomic operation corresponding to the command rule can pass two different commands of reinforcement and restoration into the background module through the policy file. The policy atomic operations corresponding to other basic operation rules are similar. Such as Figure 5 As shown, the overall process of the reinforcement mechanism separated from the policy in this embodiment is as follows: the reinforcement background module parses the template, calls the reinforcement item of the module, and parses out the combined strategy plan, parses the basic strategy plan based on the combined strategy plan, and calls the atomic strategy operation according to the basic strategy plan to perform scanning, reinforcement or restoration.

[0027] Specifically, in step S2 of this embodiment, scanning the system according to the scanning process logic in the template selected by the user and performing the reinforcement operation according to the reinforcement process logic for the reinforcement items that need to be reinforced in the scanning report and generating a reinforcement report include: S201, parsing the template selected by the user through a template parsing interface to extract template content; S202, extracting reinforcement item information from the extracted template content using a reinforcement item parsing module, wherein the reinforcement item information includes basic information of the reinforcement item and reinforcement item process logic, wherein the reinforcement item process logic includes scanning process logic, reinforcement process logic and restoration process logic, wherein the scanning process logic includes basic operation rules or combined operation rules and operators required for scanning the system, wherein the operators include some or all of the four operators of AND, OR, NOT and brackets; the reinforcement process logic includes basic operation rules or combined operation rules and operators required for reinforcement of the system; and the restoration process logic includes basic operation rules or combined operation rules and operators required for restoration of the system; S203, determining whether there is a combination operation rule in the scanning process logic. If there is a combination operation rule in the scanning process logic, calling the combination rule parsing interface to parse the combination operation rule to obtain the basic operation rule of the synthesis combination operation rule, thereby converting the scanning process logic into a policy atomic operation based on the basic operation rule; scanning the system according to the policy atomic operation of the scanning process logic and generating a scanning report; wherein the atomic operation is a series of inseparable operation sequences that must all succeed or all fail; S204, determine whether there are combined operation rules in the reinforcement process logic. If there are combined operation rules in the reinforcement process logic, call the combined rule parsing interface to parse the combined operation rules to obtain the basic operation rules of the synthetic combined operation rules, thereby converting the reinforcement process logic into a set of policy atomic operations based on the basic operation rules; according to the policy atomic operations of the reinforcement process logic, the system is reinforced and a reinforcement report is generated. The scanning report can show which ones are already safe and which ones need to be reinforced. The system can be reinforced according to the scanning results. Before reinforcement, the initial data will be stored in the database, and a reinforcement report will be generated after the reinforcement is completed. The reinforcement report checks the system reinforcement status, and you can see the specific reinforcement item information of successful and failed reinforcement.

[0028] In step S2 of this embodiment, for the specified reinforcement item, the restoration operation is performed according to the restoration process logic to restore the system to the environment before reinforcement and generate a restoration report, including: judging whether there is a combination operation rule in the restoration process logic, if there is a combination operation rule in the restoration process logic, calling the combination rule parsing interface to parse the combination operation rule to obtain the basic operation rule of the synthetic combination operation rule, thereby converting the restoration process logic into a set of policy atomic operations based on the basic operation rules; restoring the system according to the policy atomic operations of the restoration process logic to restore the system to the environment before reinforcement and generate a restoration report. After the restoration report is generated, the current situation can be analyzed according to the restoration report.

[0029] In summary, the policy-separated system security reinforcement method of this embodiment provides a security reinforcement mechanism separated from the policy. Based on the simplest basic operation rules, various complex combination operation rules and complex reinforcement item logic are synthesized to meet the different reinforcement needs of various industries. When restoration is required, the environment before reinforcement can be restored conveniently and quickly. The solution has high availability, and the basic operation rules can be expanded when necessary to increase its coverage. In the policy-separated system security reinforcement method of this embodiment, the policy module contains many basic operation rules, and users can easily and quickly add new reinforcement items. The basic operation rules can be continuously expanded, as long as they correspond to the policy atomic operations in the reinforcement background module, they can be used normally. The combined operation rules can be arbitrarily combined according to the basic operation rules and operators, and the reinforcement items can reuse the combined rules at any time, and similar reinforcement items do not need to repeatedly combine the basic operation rules. After the reinforcement items are added, they can be immediately added to the custom template for subsequent reinforcement operations. Users can operate dynamically and restore to the original environment after reinforcement. Therefore, the method of this embodiment realizes a system security reinforcement solution that can be easily rolled back, can quickly generate new reinforcement items to quickly respond to needs, and realizes flexible reinforcement that meets the needs of multiple industries.

[0030] In addition, this embodiment also provides a policy-separated system security reinforcement system, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the policy-separated system security reinforcement method.

[0031] In addition, this embodiment also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the policy separation system security reinforcement method through a processor.

[0032] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the policy separation system security reinforcement method through a processor.

[0033] Those skilled in the art should understand that the technical solutions provided by the embodiments of the present application may be in the form of methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0034] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A system security reinforcement method with policy separation, characterized in that: The steps include: S1, obtaining a default template or a custom template selected by a user in a policy template library, wherein both the default template and the custom template include hardening item information, wherein the hardening item information includes basic information of the hardening item and hardening item process logic, wherein the hardening item process logic includes scanning process logic, hardening process logic and restoration process logic; S2, scans the system according to the scanning process logic in the template selected by the user, and performs reinforcement operations according to the reinforcement process logic for the reinforcement items that need to be reinforced in the scanning report and generates a reinforcement report; if the user needs to restore the specified reinforcement items, then performs the restoration operation according to the restoration process logic for the specified reinforcement items to restore the system to the environment before reinforcement and generate a restoration report.

2. The system security reinforcement method of policy separation according to claim 1 is characterized in that: Step S1 includes creating new hardening items and custom templates: S101, determining whether the new reinforcement item requires a combined operation rule, if not, jumping to step S102; Otherwise, jump to step S103; S102, synthesizing new reinforcement items according to basic operation rules, wherein the basic operation rules include file rules, command rules, installation package rules, system service rules, special rules and some or all of other rules, wherein the file rules include rules related to querying and modifying configuration files, the command rules include rules for using shell commands, the installation package rules include querying whether a specified software package has been installed in the current system, the system service rules include rules for querying and changing service status, the special rules include rules for restarting the system and restarting certain services, and the other rules include rules other than file rules, command rules, installation package rules, system service rules and special rules; jump to step S104; S103, determining whether there is an available combined operation rule, if no combined operation rule is available, synthesizing the basic operation rules into a combined operation rule, and synthesizing a new reinforcement item according to the combined operation rule, otherwise directly synthesizing a new reinforcement item according to the combined operation rule; Jump to step S104; S104, adding basic information to the new reinforcement item to synthesize a complete reinforcement item and adding a custom template.

3. The system security reinforcement method of policy separation according to claim 2 is characterized in that: The basic information includes the ID, item name and description information of the new reinforcement item.

4. The system security reinforcement method of policy separation according to claim 2 is characterized in that: The rules related to querying and modifying configuration files include: determining whether a file exists, determining whether a file is empty, determining whether a file contains a line containing a keyword, adding a line to a file, deleting a line from a file, modifying a line from a file, adding a line after the line where the file keyword is located, adding a line before the line where the file keyword is located, creating a file, deleting a file, renaming a file, and file permissions.

5. The system security reinforcement method of policy separation according to claim 2 is characterized in that: In step S103, combining the basic operation rules into combined operation rules means combining the basic operation rules into combined operation rules by using operation symbols, wherein the operators include logical operations and brackets, and the logical operations include part and all of AND, OR, and NOT.

6. The system security reinforcement method of policy separation according to claim 2 is characterized in that: In step S2, the system is scanned according to the scanning process logic in the template selected by the user, and the reinforcement operation is performed according to the reinforcement process logic for the reinforcement items that need to be reinforced in the scanning report, and a reinforcement report is generated, including: S201, parsing the template selected by the user through a template parsing interface to extract template content; S202, extracting reinforcement item information from the extracted template content using a reinforcement item parsing module, wherein the reinforcement item information includes basic information of the reinforcement item and reinforcement item process logic, wherein the reinforcement item process logic includes scanning process logic, reinforcement process logic and restoration process logic, wherein the scanning process logic includes basic operation rules or combined operation rules and operators required for scanning the system, wherein the operators include some or all of the four operators of AND, OR, NOT and brackets; the reinforcement process logic includes basic operation rules or combined operation rules and operators required for reinforcement of the system; and the restoration process logic includes basic operation rules or combined operation rules and operators required for restoration of the system; S203, determining whether there is a combination operation rule in the scanning process logic. If there is a combination operation rule in the scanning process logic, calling the combination rule parsing interface to parse the combination operation rule to obtain a basic operation rule for synthesizing the combination operation rule, thereby converting the scanning process logic into a policy atomic operation based on the basic operation rule; scanning the system according to the policy atomic operation of the scanning process logic and generating a scanning report; S204, determine whether there are combination operation rules in the reinforcement process logic. If there are combination operation rules in the reinforcement process logic, call the combination rule parsing interface to parse the combination operation rules to obtain the basic operation rules of the synthetic combination operation rules, thereby converting the reinforcement process logic into a set of policy atomic operations based on the basic operation rules; reinforce the system according to the policy atomic operations of the reinforcement process logic and generate a reinforcement report.

7. The system security reinforcement method of policy separation according to claim 6 is characterized in that: In step S2, a restore operation is performed for the specified reinforcement item according to the restore process logic to restore the system to the environment before reinforcement and generate a restore report, including: determining whether there is a combination operation rule in the restore process logic; if there is a combination operation rule in the restore process logic, calling the combination rule parsing interface to parse the combination operation rule to obtain the basic operation rule of the synthetic combination operation rule, thereby converting the restore process logic into a set of policy atomic operations based on the basic operation rules; restoring the system according to the policy atomic operations of the restore process logic to restore the system to the environment before reinforcement and generate a restore report.

8. A policy-separated system security reinforcement system, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the policy separation system security reinforcement method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the policy-separated system security reinforcement method according to any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the policy-separated system security reinforcement method according to any one of claims 1 to 7 through a processor.

Images