Infrastructure, namely code implementation method of secure resource pool

Abstract

The invention relates to an infrastructure, namely a code implementation method of a secure resource pool, and belongs to the technical field of computer network security. The method comprises the following steps: acquiring infrastructure configuration of a security resource pool and storing the infrastructure configuration in a version control system; and loading the configuration of the secure resource pool from the version control system and deploying the configuration to the secure resource pool. According to the method, after the infrastructure, namely the code, is realized in the security resource pool, the security resource pool has the capabilities of executing rollback for a specific network element and rolling back for the whole security resource pool, so that the security resource pool is supported to be quickly stopped after a fault occurs. Meanwhile, the security resource pool can restore the fault site conveniently by means of the capability, and verifies the recovery scheme of the fault in the subsequent fault drill.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network security, and in particular relates to an infrastructure-as-code implementation method for a security resource pool. Background Art

[0002] Security resource pool, that is, using server virtualization technology to run various security components in the form of virtual machines on the host server, by building a dedicated resource pool for exporting security capabilities. We can generally understand the security resource pool as a small data center, which includes: computing resources (CPU and memory), network resources (virtualized network switches), storage resources (virtualized shared storage), and security resources (virtualized security network elements). Through the security resource pool technology, various resources are organically integrated together.

[0003] According to the 2023 Thales Data Threat Report, 55% of organizations that experienced a data breach reported “human error” as the primary reason. This is further exacerbated by the fact that organizations now face increasingly sophisticated attacks from cybercriminals using a variety of automated tools. As organizations move more of their operations to the cloud, they must also become increasingly aware of the security risks and threats that come with it. It is no longer enough to simply have a set of policies that human operators must follow. Traditionally, setting up and managing IT infrastructure has been a manual and complex process that often leads to inconsistencies and inefficiencies due to human error. Therefore, a more proactive and automated strategy or approach must be implemented to avoid the above problems.

[0004] The present invention proposes an Infrastructure as Code (IaC) implementation method for a security resource pool. Infrastructure as Code is a method for managing infrastructure by referring to the code management form based on the code management practice in the software development process. Summary of the invention

[0005] 1. Technical issues to be resolved

[0006] The technical problem to be solved by the present invention is how to provide an infrastructure-as-code implementation method for a secure resource pool to solve the problem that setting up and managing IT infrastructure is a manual and complex process with low efficiency and high error rate.

[0007] (II) Technical solution

[0008] In order to solve the above technical problems, the present invention proposes an infrastructure as code implementation method for a security resource pool, which includes the following steps:

[0009] S1. Obtain the infrastructure configuration of the security resource pool and save it to the version control system;

[0010] S2. Load the configuration of the security resource pool from the version control system and deploy it to the security resource pool.

[0011] Furthermore, the S1 specifically includes:

[0012] Step S11, configure in the security resource pool interface;

[0013] Step S12: The configuration management module sends configurations to network elements in the security resource pool;

[0014] Step S13, the configuration management module saves the configuration;

[0015] Step S14: The infrastructure-as-code module obtains the network element configuration file and the topology connection relationship configuration whose configuration has been changed;

[0016] Step S15: The infrastructure as code module saves the complete configuration file and topology connection relationship configuration after the network element is changed to the version control system.

[0017] Furthermore, the security resource pool includes: network elements, configuration management modules, infrastructure as code modules and version control systems.

[0018] Furthermore, the configuration management module reads the configuration of the network element in the security resource pool, and is also used to send the configuration to the network element and save the configuration.

[0019] Furthermore, the infrastructure as code module describes the infrastructure as code text and performs the saving and rollback of network element configuration and topology relationships.

[0020] Furthermore, the version control system is used to save the historical configuration of the network elements. The security resource pool saves the configuration files of all the network elements it contains and the topological connection relationships between the network elements in the version control system in the form of text.

[0021] Furthermore, the security resource pool also includes a code comparison tool for comparing the security resource pool configurations at different time points to see what changes have occurred.

[0022] Furthermore, the S2 specifically includes the following steps:

[0023] Step S21: Select the time point to which you want to roll back the configuration in the security resource pool interface, and perform the rollback operation;

[0024] Step S22: The infrastructure as code module pulls the configuration files and topology connection relationship configurations of the network elements on a specified date from the version control system and sends them to the configuration management module;

[0025] Step S23: The configuration management module sends configurations to network elements in the security resource pool;

[0026] Step S24: The configuration management module saves the configuration.

[0027] Furthermore, in step S21, a specific network element is selected to perform rollback or the entire security resource pool is selected to perform rollback.

[0028] Furthermore, in step S21, after a failure occurs in the security resource pool, a time point before the failure is selected for rollback.

[0029] (III) Beneficial effects

[0030] The present invention proposes a method for implementing infrastructure as code for a security resource pool. After the security resource pool implements infrastructure as code, the security resource pool will have the ability to perform rollback for specific network elements and the entire security resource pool, thereby supporting the security resource pool to quickly stop losses after a failure occurs. At the same time, the security resource pool can also rely on this ability to conveniently restore the fault site and verify the fault recovery plan in subsequent fault drills.

[0031] A secure resource pool that adopts an infrastructure-as-code approach can achieve the following benefits:

[0032] 1. It helps to roll back the security resource pool to the state before the failure when a failure occurs;

[0033] 2. The security resource pool can be restored to the configuration state at a specified time;

[0034] 3. You can easily use code comparison tools to compare the security resource pool configurations at different time points to see what changes have occurred. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A process for preserving the secure resource pool infrastructure of the present invention;

[0036] Figure 2 This is the security resource pool infrastructure recovery process of the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0038] The present invention utilizes the infrastructure as code module, and the security resource pool can save the configuration files of all network elements it contains and the topological connection relationships between network elements in the form of text to the version control system to form an infrastructure configuration library of the security resource pool.

[0039] IaC: Infrastructure as Code

[0040] The present invention discloses a method for implementing infrastructure as code of a security resource pool, which includes two processes:

[0041] S1. Obtain the infrastructure configuration of the security resource pool and save it to the version control system;

[0042] S2. Load the configuration of the security resource pool from the version control system and deploy it to the security resource pool.

[0043] (I) The process of obtaining the infrastructure configuration of the security resource pool and saving it to the version control system is as follows (the flowchart is as follows Figure 1 shown):

[0044] Step S11, configure in the security resource pool interface;

[0045] Step S12: The configuration management module sends configurations to network elements in the security resource pool;

[0046] Step S13, the configuration management module saves the configuration;

[0047] The security resource pool includes: network elements, configuration management modules, infrastructure as code modules, and version control systems;

[0048] The configuration management module is used to read the configuration of the network elements in the security resource pool, and is also used to send the configuration to the network elements and save the configuration;

[0049] The infrastructure as code module is used to describe the infrastructure as code text and perform network element configuration and topology relationship saving and rollback;

[0050] The version control system is used to save the historical configuration of network elements. The security resource pool can save the configuration files of all network elements it contains and the topological connection relationships between network elements in the version control system in text form.

[0051] Step S14: The infrastructure as code module obtains the network element configuration file whose configuration has been changed, and the topology connection relationship configuration;

[0052] Step S15: The infrastructure as code module saves the complete configuration file and topology connection relationship configuration after the network element is changed to the version control system.

[0053] Furthermore, the security resource pool also includes a code comparison tool for comparing the security resource pool configurations at different time points to see what changes have occurred.

[0054] (II) The process of loading the configuration of the security resource pool from the version control system and deploying it to the security resource pool is as follows (the flowchart is as follows Figure 2 shown):

[0055] Step S21: Select the time point to which you want to roll back the configuration in the security resource pool interface, and perform the rollback operation;

[0056] Further, a specific network element is selected to perform rollback;

[0057] Further, the entire security resource pool is selected for rollback.

[0058] Furthermore, after a failure occurs in the security resource pool, a time point before the failure is selected for rollback.

[0059] Step S22: The infrastructure as code module pulls the configuration files and topology connection relationship configurations of the network elements on a specified date from the version control system and sends them to the configuration management module;

[0060] Step S23: The configuration management module sends configurations to network elements in the security resource pool;

[0061] Step S24: The configuration management module saves the configuration.

[0062] After the security resource pool realizes infrastructure as code, the security resource pool will have the ability to perform rollback for specific network elements and the entire security resource pool, thereby supporting the security resource pool to quickly stop losses after a failure occurs. At the same time, the security resource pool can also rely on this capability to conveniently restore the fault site and verify the fault recovery plan in subsequent fault drills.

[0063] A secure resource pool that adopts an infrastructure-as-code approach can achieve the following benefits:

[0064] 1. It helps to roll back the security resource pool to the state before the failure when a failure occurs;

[0065] 2. The security resource pool can be restored to the configuration state at a specified time;

[0066] 3. You can easily use code comparison tools to compare the security resource pool configurations at different time points to see what changes have occurred.

[0067] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for implementing infrastructure as code for a secure resource pool, characterized in that: The method comprises the following steps: S1. Obtain the infrastructure configuration of the security resource pool and save it to the version control system; S2. Load the configuration of the security resource pool from the version control system and deploy it to the security resource pool.

2. The method for implementing infrastructure as code for a secure resource pool according to claim 1, characterized in that: The S1 specifically includes: Step S11, configure in the security resource pool interface; Step S12: The configuration management module sends configurations to network elements in the security resource pool; Step S13, the configuration management module saves the configuration; Step S14: The infrastructure-as-code module obtains the network element configuration file and the topology connection relationship configuration whose configuration has been changed; Step S15: The infrastructure as code module saves the complete configuration file and topology connection relationship configuration after the network element is changed to the version control system.

3. The method for implementing infrastructure as code for a secure resource pool as claimed in claim 2, characterized in that: The security resource pool includes: network elements, configuration management modules, infrastructure as code modules and version control systems.

4. The method for implementing infrastructure as code for a secure resource pool as claimed in claim 3, characterized in that: The configuration management module reads the configuration of the network elements in the security resource pool, and is also used to send the configuration to the network elements and save the configuration.

5. The method for implementing infrastructure as code for a secure resource pool as claimed in claim 3, characterized in that: The infrastructure as code module describes the infrastructure as code text and performs the saving and rollback of network element configuration and topology relationships.

6. The method for implementing infrastructure as code for a secure resource pool as claimed in claim 3, characterized in that: The version control system is used to save the historical configuration of network elements. The security resource pool saves the configuration files of all network elements it contains and the topological connection relationships between network elements in the version control system in text form.

7. The method for implementing infrastructure as code for a secure resource pool as claimed in claim 3, characterized in that: The security resource pool also includes a code comparison tool that is used to compare the security resource pool configuration at different points in time to see what changes have occurred.

8. The method for implementing infrastructure as code for a secure resource pool according to any one of claims 1 to 7, characterized in that: The S2 specifically includes the following steps: Step S21: Select the time point to which you want to roll back the configuration in the security resource pool interface, and perform the rollback operation; Step S22: The infrastructure as code module pulls the configuration files and topology connection relationship configurations of the network elements on a specified date from the version control system and sends them to the configuration management module; Step S23: The configuration management module sends configurations to network elements in the security resource pool; Step S24: The configuration management module saves the configuration.

9. The method for implementing infrastructure as code for a secure resource pool as claimed in claim 8, characterized in that: In the step S21, a specific network element is selected to perform rollback or the entire security resource pool is selected to perform rollback.

10. The method for implementing infrastructure as code for a secure resource pool according to claim 8, characterized in that: In step S21, after a failure occurs in the security resource pool, a time point before the failure is selected for rollback.

Images