Equipment scanning request processing method and device

Abstract

The invention relates to an equipment scanning request processing method and device. The method comprises the following steps: generating an asset ledger through equipment information of equipment in a preset network segment; equipment information in the asset ledger is updated regularly; configuring a legal scanning source IP to generate a safe white list; receiving a scanning request for equipment and acquiring a scanning source IP; and when the scanned source IP is not in the safe white list, generating a scanning result according to the asset ledger and the equipment fingerprint information to respond to the scanning request. According to the equipment scanning request processing method and device, the real vulnerability information of the equipment can be effectively hidden while the legal scanning requirement is guaranteed, and the security and controllability of network assets are remarkably improved.

Description

Technical Field

[0001] This application relates to the field of computer information processing, and in particular, to a method and device for processing device scan requests. Background Art

[0002] With the increasing severity of network security threats, external scanning behavior has become a common preliminary means for hackers to obtain information about network devices and carry out vulnerability attacks. To address such scanning risks, existing technologies mainly use firewall technology and honeypot technology for identification and protection. However, these traditional solutions still have many technical limitations in practical applications and are difficult to balance the requirements of security, authenticity, and legality of asset management.

[0003] A firewall is the most basic network boundary security mechanism, which mainly filters and manages network traffic through access control policies. Generally, a firewall sets a series of rules for allowing or denying communication based on conditions such as source IP address, destination port, protocol type, and application layer characteristics, thereby preventing illegal access behaviors. For example, it can be set to only allow devices in a specific IP address segment to access certain service ports in the internal network. However, firewall technology lacks the ability to deeply identify the content of network data packets, is vulnerable to evasion attacks such as IP address forgery and packet fragmentation, and cannot distinguish the purpose attributes of scanning behaviors, such as legitimate asset inventory and malicious vulnerability detection, and lacks a targeted response mechanism. Therefore, a firewall is more used as a boundary control tool and is difficult to meet more complex scanning identification and protection requirements.

[0004] A honeypot is an active induction and deception-based network security technology that induces attackers to scan and invade it by constructing a highly realistic virtual system (such as a simulated server, database, Web application, etc.), and then records and analyzes the attack behaviors. In the early stage of an attack, a honeypot system can achieve threat warning by monitoring abnormal connection behaviors, making up for the lag of traditional passive protection means. However, this technology also has limitations in many aspects: complex configuration and maintenance: To maintain the simulation degree and induction effect, a honeypot system needs to continuously update the operating system, application programs, simulated vulnerabilities, etc., especially the maintenance cost increases significantly in a high-interaction environment. High resource consumption: Deploying a honeypot requires consuming a large amount of computing resources, manpower, and management resources, which poses a burden on devices, networks, and personnel. Involving privacy and compliance risks: A honeypot may collect data containing sensitive information when recording attacker behaviors. If not handled properly, it is easy to violate relevant data protection regulations. Insufficient scanning identification granularity: A honeypot cannot effectively distinguish between legitimate scans (such as network self-checks, superior reviews) and malicious scans, lacks a dynamic response mechanism, and there are problems of misjudgment or information feedback distortion.

[0005] In practical applications, when a superior management unit conducts a network security inspection on a subordinate unit, it is often necessary to verify the authenticity of the asset information of the devices within the unit, including device manufacturers, models, versions, etc. However, traditional firewalls cannot provide device information support, and honeypots, due to their simulation nature, cannot return true and reliable asset data.

[0006] In addition, current solutions cannot classify scanning behaviors, and cannot strategically decide whether to return device information and in what way based on the scanning source while ensuring the security of asset information.

[0007] Therefore, a new method and device for processing device scanning requests are needed.

[0008] The above information disclosed in the background art section is only used to enhance the understanding of the background of the present application, and thus it may include information that does not constitute the prior art known to those of ordinary skill in the art. Summary of the Invention

[0009] In view of this, the present application provides a method and device for processing device scanning requests, which can effectively hide the true vulnerability information of devices while ensuring legitimate scanning requirements, and significantly improve the security and controllability of network assets.

[0010] Other features and advantages of the present application will become apparent through the following detailed description, or be learned in part through the practice of the present application.

[0011] According to one aspect of the present application, a method for processing device scanning requests is proposed. The method includes: generating an asset ledger through the device information of devices within a preset network segment; periodically updating the device information in the asset ledger; configuring legitimate scanning source IPs to generate a security whitelist; receiving a scanning request for a device and obtaining the scanning source IP; when the scanning source IP is not in the security whitelist, generating a scanning result according to the asset ledger and device fingerprint information to respond to the scanning request.

[0012] In an exemplary embodiment of the present application, it further includes: when the scanning source IP is in the security whitelist, forwarding the scanning request to the corresponding device; the device generates its own device information and responds to the scanning request.

[0013] In an exemplary embodiment of the present application, generating an asset ledger through the device information of devices within a preset network segment includes: obtaining the IP, MAC address, manufacturer, model, and version number of devices within the preset network segment; using the IP of the device as the key identification value, and storing the MAC address, manufacturer, model, and version number as the device information.

[0014] In an exemplary embodiment of the present application, the device information in the asset ledger is updated regularly, including: regularly obtaining the device version number without vulnerabilities from the official vulnerability website; updating the version number of the corresponding device information in the asset ledger with the device version number without vulnerabilities.

[0015] In an exemplary embodiment of the present application, receiving a scan request for a device and obtaining the scan source IP includes: obtaining a scan request for the device; parsing the scan request and obtaining the scan source IP.

[0016] In an exemplary embodiment of the present application, when the scan source IP is not in the security whitelist, generating a scan result according to the asset ledger and device fingerprint information to respond to the scan request includes: when the scan source IP is not in the security whitelist, parsing the scan information to obtain the scan port; allowing the scan source to establish a connection with the device corresponding to the scan port; querying the device fingerprint information through the connection; generating a scan result according to the asset ledger to respond to the scan request.

[0017] In an exemplary embodiment of the present application, it further includes: generating an asset identification fingerprint library, which stores the correspondence between device ports and device fingerprint information.

[0018] In an exemplary embodiment of the present application, generating a scan result according to the asset ledger to respond to the scan request includes: comparing the device fingerprint information with the device fingerprint information in the asset identification fingerprint library; when the comparison hits, generating a scan result according to the asset ledger to respond to the scan request.

[0019] In an exemplary embodiment of the present application, it further includes: when the comparison does not hit, responding to the scan request with a null value.

[0020] According to one aspect of the present application, a device scan request processing device is proposed. The device includes: a ledger module for generating an asset ledger through the device information of devices within a preset network segment; an update module for regularly updating the device information in the asset ledger; a list module for generating a security whitelist through legitimate scan source IPs; a request module for receiving a scan request for a device and obtaining the scan source IP; a response module for generating a scan result according to the asset ledger and device fingerprint information to respond to the scan request when the scan source IP is not in the security whitelist.

[0021] According to one aspect of the present application, an electronic device is proposed. The electronic device includes: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the method as described above.

[0022] According to one aspect of the present application, there is provided a computer-readable medium having stored thereon a computer program, which when executed by a processor implements the method as described above.

[0023] According to the method and device for processing device scan requests of the present application, an asset ledger is generated through device information of devices within a preset network segment; the device information in the asset ledger is updated regularly; a legitimate scan source IP is configured to generate a security whitelist; a scan request for a device is received and the scan source IP is obtained; when the scan source IP is not in the security whitelist, a scan result is generated according to the asset ledger and device fingerprint information to respond to the scan request, so that while ensuring legitimate scan requirements, the true vulnerability information of the device can be effectively hidden, and the security and controllability of network assets are significantly improved.

[0024] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] By referring to the accompanying drawings and describing its exemplary embodiments in detail, the above and other objects, features and advantages of the present application will become more apparent. The following described drawings are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0026] Figure 1 FIG. is a system schematic diagram of a method for processing device scan requests according to an exemplary embodiment.

[0027] Figure 2 FIG. is a flowchart of a method for processing device scan requests according to an exemplary embodiment.

[0028] Figure 3 FIG. is a flowchart of a method for processing device scan requests according to another exemplary embodiment.

[0029] Figure 4 FIG. is a flowchart of a method for processing device scan requests according to another exemplary embodiment.

[0030] Figure 5 FIG. is a block diagram of a device for processing device scan requests according to an exemplary embodiment.

[0031] Figure 6 FIG. is a block diagram of an electronic device according to an exemplary embodiment.

[0032] Figure 7 FIG. is a block diagram of a computer-readable medium according to an exemplary embodiment. DETAILED DESCRIPTION

[0033] Example embodiments will now be described more fully with reference to the accompanying drawings. However, the example embodiments can be implemented in various forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the concept of the example embodiments to those skilled in the art. Like reference numerals in the figures denote like or similar parts, and thus their repetitive description will be omitted.

[0034] In addition, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of the embodiments of this application. However, those skilled in the art will realize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be employed. In other cases, well-known methods, devices, implementations, or operations are not shown or described in detail to avoid obscuring aspects of this application.

[0035] The block diagrams shown in the drawings are only functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0036] The flowcharts shown in the drawings are merely illustrative and do not necessarily include all the content and operations / steps, nor do they necessarily have to be executed in the order described. For example, some operations / steps can be decomposed, while some operations / steps can be combined or partially combined, so the actual execution order may change according to the actual situation.

[0037] It should be understood that although terms such as first, second, and third may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Thus, the first component discussed below can be referred to as the second component without departing from the teachings of the concept of this application. As used herein, the term "and / or" includes any one of the associated listed items and all combinations of one or more of them.

[0038] Those skilled in the art can understand that the drawings are only schematic diagrams of the example embodiments, and the modules or processes in the drawings are not necessarily essential for implementing this application, so they cannot be used to limit the protection scope of this application.

[0039] The explanations of the technical abbreviations involved in this application are as follows:

[0040] Device Fingerprint: A device fingerprint is "fingerprint" data that is generated after collecting various characteristic information of a device and can uniquely identify the device. This characteristic information can be obtained from multiple aspects such as hardware, software, and network environment. For example, the device model, operating system version, and MAC address.

[0041] Firewall Technology: By defining a series of rules to allow or deny network traffic to pass through. The rules can be set based on factors such as IP address, port number, protocol type, and application. For example, it can be set to only allow devices in a specific IP address segment to access specific ports of the internal network.

[0042] Honeypot Technology: A honeypot is a carefully designed virtual system or a false environment that simulates real business. It looks like a real network resource, such as a server, website, database, etc.

[0043] Figure 1 It is a system schematic diagram of a device scan request processing method shown according to an exemplary embodiment.

[0044] As Figure 1 shown, the system architecture may include Device 1, Device 2, Device 3, a firewall, a request processing device, and an asset ledger.

[0045] Device 1, Device 2, Device 3: Located in the same network segment, they form a group of protected network assets. Each device has an independent IP address and network service port, and runs different versions of the system and service programs.

[0046] Firewall: Deployed at the network boundary, it is used to filter external illegal traffic to ensure that only data packets that meet the preset rules enter the internal network.

[0047] Request Processing Device: The core processing unit of this application, responsible for receiving and processing external scan requests, and dynamically generating response results in combination with the asset ledger, fingerprint database, and whitelist policy.

[0048] Asset Ledger: Used to store the key attribute information of each device, such as IP, MAC, manufacturer, model, and version number.

[0049] The request processing device pre-collects network information for all devices in the system architecture to obtain the device information of Device 1, Device 2, and Device 3. The request processing device sets a timed task to obtain the recommended version numbers without known vulnerabilities from authoritative vulnerability platforms (such as CNNVD, CNVD, NVD), and regularly updates the version fields of each device in the asset ledger. For example: If the original version of Device 2 has a CVE vulnerability, the system marks this entry as "risk" or replaces it with the recommended version number (such as OpenSSH 8.2). The system administrator configures a list of legal scanning source IPs, such as the IPs of the superior regulatory unit and the asset inventory tool (for example, 10.0.0.5), to generate a whitelist. The firewall obtains the scanning traffic, captures TCP / UDP probe packets, and parses the source IP address.

[0050] When the source IP is not in the whitelist, parse the scanned target port: Determine whether the scan request is directed at a certain port (such as 22 / 80 / 3306) among Devices 1 to 3; Allow the establishment of a three-way handshake connection or an initial UDP request to simulate a real service environment;

[0051] The target device returns a brief protocol response (such as the SSH version number, MySQL version banner) as a fingerprint; The processing device compares the received fingerprint with the pre-built asset identification fingerprint library; That is, it identifies that the scanned target is indeed a certain internal device; Generate response information: Return information such as the device manufacturer and model; Replace or mask the version information to prevent external identification of vulnerabilities;

[0052] When the comparison fails: Return a null value or a forged response to hide the true device characteristics.

[0053] When the scanning source IP belongs to the whitelist (such as the IP of the auditing agency): The request processing device transparently forwards the scan request to the corresponding device among Devices 1 to 3; The actual device responds to the scan request and returns the real system information, including the complete version number, for asset inventory and compliance review.

[0054] When facing scanning traffic, the technical solution of this application can ensure that no vulnerability information is leaked on the premise of moderately exposing asset information (only the version information is inaccurate). In this way, it can excellently handle the inspection work of the superior unit on the subordinate unit. Given that no vulnerability information will be exposed, this provides a strong guarantee against possible vulnerability attacks on the device after a malicious scan, greatly enhancing the security of the device.

[0055] In this application, first, the scanning traffic is reasonably allocated; then, a comparison operation between the scanning traffic and the fingerprint database is performed to judge relevant information through precise comparison; then, the device version information (and it is a vulnerability-free version) is updated regularly to ensure the accuracy and security of the device information; finally, in the device information return link, the processed and screened device information is accurately returned to the corresponding scanning device. This series of processes are closely linked and operate in coordination, jointly constituting a complete and efficient solution operation system. This application can effectively solve the problems of high operating costs and possible privacy theft faced by honeypots when dealing with hidden devices, and provides a more optimized solution for the development of related work.

[0056] Figure 2 It is a flowchart of a device scan request processing method shown according to an exemplary embodiment. The device scan request processing method 20 includes steps S202 to S212.

[0057] As Figure 2 shown, in S202, an asset ledger is generated through the device information of devices within a preset network segment. For example, the IP, MAC address, manufacturer, model, and version number of devices within the preset network segment are obtained; the IP of the device is used as the key identification value, and the MAC address, manufacturer, model, and version number are stored as the device information.

[0058] The system can pre-configure the scanning network segment (such as 192.168.1.0 / 24); through automatic scanning or manual entry of this network segment, device information fields are collected, and an asset ledger database can be established using the device IP as the unique identification key.

[0059] In S204, the device information in the asset ledger is updated regularly. For example, the device version number without vulnerabilities is obtained from the official vulnerability website regularly; the version number of the corresponding device information in the asset ledger is updated through the device version number without vulnerabilities.

[0060] The system regularly updates the version information in the asset ledger to ensure the security of device data. In a specific embodiment, the system can set a scheduled task (such as 3 am every day), obtain the latest list of device version numbers without known vulnerabilities from a third-party vulnerability database (such as NVD, CNVD, CNNVD) through API or crawler methods; compare the version information recorded in the current ledger, and if a vulnerable version is found, it is updated or marked with the recommended secure version.

[0061] In S206, a legal scanning source IP is configured to generate a security whitelist. The system pre-configures a list of IP addresses of a group of legal scanning sources to identify internal scanning tasks or audit operations by superior units.

[0062] In S208, receive a scan request for the device and obtain the scan source IP. For example, obtain a scan request for the device; parse the scan request and obtain the scan source IP.

[0063] In a specific embodiment, the system may be pre-configured with a list of IP addresses of a set of legitimate scan sources for identifying internal scan tasks or audit operations by superior units.

[0064] In S210, when the scan source IP is not in the security whitelist, generate a scan result according to the asset ledger and device fingerprint information to respond to the scan request.

[0065] More specifically, when the scan source IP is not in the security whitelist, parse the scan information to obtain the scan port; allow the scan source to establish a connection with the device corresponding to the scan port; query the device fingerprint information through the connection; generate a scan result according to the asset ledger to respond to the scan request.

[0066] In one embodiment, it further includes: generating an asset identification fingerprint library, which stores the correspondence between device ports and device fingerprint information.

[0067] When the scan source IP is not in the security whitelist, the system constructs a controlled response according to the asset ledger and device fingerprint information to avoid exposing real vulnerability information. More specifically, it includes the following steps:

[0068] Parse the scan port information: Determine the ports opened by the scanned target device (such as 22, 80, 3306, etc.);

[0069] Map out the service types that the scanner attempts to identify (such as SSH, HTTP, MySQL).

[0070] Allow the establishment of a limited connection: To ensure the simulation effect, allow the scan source to establish a TCP handshake or UDP initial connection with the target device.

[0071] Query the device fingerprint information: The device returns a preliminary identification (such as a service banner or response code) as a fingerprint feature.

[0072] Compare the received fingerprint with the fingerprint library:

[0073] For example, compare the device fingerprint information with the device fingerprint information in the asset identification fingerprint library; when the comparison hits, generate a scan result according to the asset ledger to respond to the scan request. When the comparison misses, respond to the scan request with a null value. When the comparison hits, the system constructs a simulation response according to the asset ledger, returns the device manufacturer and model information, but the version information is the pre-stored "default non-vulnerable version".

[0074] In S212, when the scan source IP is in the security whitelist, the scan request is sent to the corresponding device with device information and responds to the scan request.

[0075] When the scan source IP belongs to the security whitelist, the system will directly delegate the scan request to the target device, allowing the device to return complete and authentic asset information.

[0076] After the system identifies the legitimacy of the source IP, it can forward the scanned data packet to the corresponding device; the target device responds on its own and returns information such as the complete banner or version for asset inventory or auditing.

[0077] In this application, a fingerprint library comparison scheme is adopted to match all real information except version information for the scanned fingerprint information and feedback it to the scanning device. Once the scanned fingerprint is found to match the device with the corresponding IP, the relevant information is returned from the device list, thereby effectively avoiding the exposure of device vulnerabilities.

[0078] According to the device scanning request processing method of the present application, an asset ledger is generated through the device information of the devices in a preset network segment; the device information in the asset ledger is updated regularly; a legal scanning source IP is configured to generate a security whitelist; a scanning request for the device is received and the scanning source IP is obtained; when the scanning source IP is not in the security whitelist, a scanning result is generated according to the asset ledger and the device fingerprint information to respond to the scanning request. This method can effectively hide the real vulnerability information of the device while ensuring legal scanning needs, thereby significantly improving the security and controllability of network assets.

[0079] It should be clearly understood that the present application describes how to form and use specific examples, but the principles of the present application are not limited to any details of these examples. On the contrary, based on the teaching of the content disclosed in the present application, these principles can be applied to many other embodiments.

[0080] Figure 3 The figure is a flowchart of a method for processing a device scan request according to another exemplary embodiment. Figure 3 The process 30 shown is for Figure 2 Detailed description of the process shown.

[0081] like Figure 3 As shown, in S302, the firewall obtains the scanning device traffic.

[0082] In S304, it is determined whether the scanning device is in the whitelist.

[0083] In S306, forward the scanning traffic to the device, and the device responds itself. Parse the scanning traffic. If the IP of the scanning device is within the allowed scanning list, then forward the scanning traffic to the corresponding device. At this time, although the traffic does not pass through this device, it will return information such as the real IP, MAC address, manufacturer, version, and model to the scanning device to meet the needs of self-asset inventory.

[0084] In S308, parse the scanning traffic.

[0085] In S310, establish a connection. If the scanning IP is not in the list of devices allowed to be scanned, then parse whether the scanning port exists in the port information of the device. Allow the device to establish a tcp or udp connection with the scanning traffic.

[0086] In S312, query the device fingerprint.

[0087] In S314, check whether the device fingerprint hits the device fingerprint in the asset identification fingerprint library.

[0088] In S316, obtain the device information from the asset ledger as a response.

[0089] In S318, return null.

[0090] Receive the fingerprint information and port information sent by the scanning device, and compare the scanned information with the information in the fingerprint library. If the received fingerprint information matches the fingerprint in the library, then query the information in the device library and return it to the scanning device; if the scanned fingerprint information does not match the device information, then return a null value

[0091] Figure 4 It is a flowchart of a method for processing device scanning requests shown according to another exemplary embodiment. Figure 4 The shown process 40 is for Figure 2 The supplementary description of the shown process.

[0092] Such as Figure 4 As shown, in S402, create an asset ledger.

[0093] An asset identification fingerprint library can be constructed, which is composed of a one-to-one correspondence combination of ports and fingerprint message dictionaries. Different ports correspond to different protocol information. For example, port 22 corresponds to the ssh protocol, port 3306 corresponds to the mysql protocol, etc. All fingerprint information and port information are integrated in the device library.

[0094] It is also possible to create an asset ledger based on all device information within the network segment. The ledger covers information such as device IP, MAC address, manufacturer, model, version, etc., where the IP is used as the key identification value of the device information.

[0095] In S404, traverse the assets.

[0096] In S406, query the stored version vulnerabilities.

[0097] In S408, update the device version in the asset ledger according to the version without vulnerabilities.

[0098] Set up a device library version information update module, whose main function is to regularly obtain the device version numbers without vulnerabilities from the official websites of vulnerability libraries such as NVDB, CNVD, and CNNVD, and fill these version numbers into the asset ledger.

[0099] Those skilled in the art can understand that all or part of the steps to implement the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, the above functions defined by the above method provided in this application are executed. The program can be stored in a computer-readable storage medium, and the storage medium can be a read-only memory, a disk, an optical disc, etc.

[0100] In addition, it should be noted that the above drawings are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, rather than for limiting purposes. It is easy to understand that the processes shown in the above drawings do not indicate or limit the time sequence of these processes. Additionally, it is also easy to understand that these processes can be executed synchronously or asynchronously in, for example, multiple modules.

[0101] The following is an embodiment of the device of the present application, which can be used to execute the method embodiment of the present application. For details not disclosed in the device embodiment of the present application, please refer to the method embodiment of the present application.

[0102] Figure 5 is a block diagram of a device scan request processing device shown according to an exemplary embodiment. As Figure 5 shown, the device scan request processing device 50 includes: a ledger module 502, an update module 504, a list module 506, a request module 508, a response module 510, and a delegation module 512.

[0103] The ledger module 502 is used to generate an asset ledger through the device information of devices within a preset network segment; the ledger module 502 is also used to obtain the IP, MAC address, manufacturer, model, and version number of devices within the preset network segment; use the IP of the device as the key identification value, and store the MAC address, manufacturer, model, and version number as the device information.

[0104] The update module 504 is used to regularly update the device information in the asset ledger; the update module 504 is also used to regularly obtain the device version numbers without vulnerabilities from the official vulnerability websites; update the version numbers of the corresponding device information in the asset ledger through the device version numbers without vulnerabilities.

[0105] The list module 506 is used to generate a security whitelist through legal scanned source IPs.

[0106] The request module 508 is used to receive a scan request for a device and obtain the scanned source IP; the request module 508 is also used to obtain a scan request for a device; parse the scan request and obtain the scanned source IP.

[0107] The response module 510 is used to generate a scan result to respond to the scan request according to the asset ledger and device fingerprint information when the scanned source IP is not in the security whitelist. The response module 510 is also used to, when the scanned source IP is not in the security whitelist, parse the scan information to obtain the scan port; allow the scanned source to establish a connection with the device corresponding to the scan port; query the device fingerprint information through the connection; generate a scan result according to the asset ledger to respond to the scan request.

[0108] The delegation module 512 is used to, when the scanned source IP is in the security whitelist, delegate the scan request to the corresponding device; the device generates its own device information and responds to the scan request.

[0109] The device scan request processing device according to the present application can generate an asset ledger through the device information of devices within a preset network segment; regularly update the device information in the asset ledger; configure legal scanned source IPs to generate a security whitelist; receive a scan request for a device and obtain the scanned source IP; and when the scanned source IP is not in the security whitelist, generate a scan result according to the asset ledger and device fingerprint information to respond to the scan request, so as to effectively hide the true vulnerability information of the device while ensuring legal scanning requirements, and significantly improve the security and controllability of network assets.

[0110] Figure 6 It is a block diagram of an electronic device shown according to an exemplary embodiment.

[0111] The following refers to Figure 6 to describe the electronic device 600 according to this embodiment of the present application. Figure 6 The shown electronic device 600 is only an example and should not bring any limitations to the functions and usage scope of the embodiments of the present application.

[0112] As Figure 6 shown, the electronic device 600 is presented in the form of a general computing device. The components of the electronic device 600 may include but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610), a display unit 640, etc.

[0113] Among them, the storage unit stores program code, which can be executed by the processing unit 610, so that the processing unit 610 executes the steps according to various exemplary embodiments of the present application described in this specification. For example, the processing unit 610 can execute as Figure 2 , Figure 3 , Figure 4 shown in.

[0114] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 6201 and / or a cache storage unit 6202, and may further include a read-only storage unit (ROM) 6203.

[0115] The storage unit 620 may further include a program / utilities 6204 having a set (at least one) of program modules 6206. Such program modules 6206 include but are not limited to: an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include the implementation of a network environment.

[0116] The bus 630 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus structures.

[0117] The electronic device 600 can also communicate with one or more external devices 600' (such as a keyboard, a pointing device, a Bluetooth device, etc.), so that the user can communicate with the device that can interact with the electronic device 600, and / or the electronic device 600 can communicate with any device that can communicate with one or more other computing devices (such as a router, a modem, etc.). Such communication can be carried out through the input / output (I / O) interface 660. And, the electronic device 600 can also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through the network adapter 660. The network adapter 660 can communicate with other modules of the electronic device 600 through the bus 630. It should be understood that although not shown in the figure, other hardware and / or software modules can be used in combination with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0118] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described here can be implemented by software, or can be implemented by the way of software combined with necessary hardware. Therefore, as Figure 7As shown, the technical solution according to the embodiment of the present application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (which can be a CD-ROM, USB flash drive, mobile hard disk, etc.) or on the network, including several instructions to enable a computing device (which can be a personal computer, server, or network device, etc.) to execute the above method according to the embodiment of the present application.

[0119] The software product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive list) of the readable storage medium include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0120] The computer-readable storage medium can include a data signal propagated in a baseband or as part of a carrier wave, in which the readable program code is carried. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable storage medium can also be any readable medium other than the readable storage medium, which can send, propagate, or transmit a program used by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium can be transmitted by any appropriate medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination of the above.

[0121] The program code for executing the operations of the present application can be written in any combination of one or more programming languages. The programming languages include object-oriented programming languages - such as Java, C++, etc., and also include conventional procedural programming languages - such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, executed as an independent software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, by using an Internet service provider to connect through the Internet).

[0122] The above computer-readable medium carries one or more programs, which, when executed by the device, cause the computer-readable medium to implement the following functions: generating an asset ledger through the device information of devices within a preset network segment; periodically updating the device information in the asset ledger; configuring a legal scanning source IP to generate a security whitelist; receiving a scanning request for a device and obtaining the scanning source IP; when the scanning source IP is not in the security whitelist, generating a scanning result according to the asset ledger and device fingerprint information to respond to the scanning request.

[0123] Those skilled in the art can understand that the above-mentioned modules can be distributed in the device according to the description of the embodiments, or can be correspondingly changed and distributed in one or more devices that are uniquely different from this embodiment. The modules of the above embodiments can be combined into one module, or can be further split into multiple sub-modules.

[0124] Through the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software, or can be implemented by a combination of software and necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to cause a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present application.

[0125] The above specifically illustrates and describes the exemplary embodiments of the present application. It should be understood that the present application is not limited to the detailed structures, setting manners or implementation methods described herein; on the contrary, the present application is intended to cover various modifications and equivalent settings included within the spirit and scope of the appended claims.

Claims

1. A method for processing device scan requests, characterized in that, Including: Generating an asset ledger based on the device information of devices within a preset network segment; Regularly updating the device information in the asset ledger; Configuring a legal scanning source IP to generate a security whitelist; Receiving a scanning request for a device and obtaining the scanning source IP; When the scanning source IP is not in the security whitelist, generating a scanning result based on the asset ledger and device fingerprint information to respond to the scanning request.

2. The method according to claim 1, characterized in that, Also including: When the scanning source IP is in the security whitelist, forwarding the scanning request to the corresponding device; The device generating its own device information and responding to the scanning request.

3. The method according to claim 1, wherein Generating an asset ledger based on the device information of devices within a preset network segment, including: Obtaining the IP, MAC address, manufacturer, model, and version number of devices within the preset network segment; Using the IP of the device as the key identification value and storing the MAC address, manufacturer, model, and version number as the device information.

4. The method according to claim 1, wherein, Regularly updating the device information in the asset ledger, including: Regularly obtaining the device version number without vulnerabilities from the official vulnerability website; Updating the version number of the corresponding device information in the asset ledger with the device version number without vulnerabilities.

5. The method according to claim 1, wherein Receiving a scanning request for a device and obtaining the scanning source IP, including: Obtaining the scanning request for the device; Parsing the scanning request and obtaining the scanning source IP.

6. The method according to claim 1, characterized in that, When the scanning source IP is not in the security whitelist, generating a scanning result based on the asset ledger and device fingerprint information to respond to the scanning request, including: When the scanning source IP is not in the security whitelist, parsing the scanning information to obtain the scanning port; Allowing the scanning source to establish a connection with the device corresponding to the scanning port; Querying the device fingerprint information through the connection; Generating a scanning result based on the asset ledger to respond to the scanning request.

7. The method according to claim 6, characterized in that, Also including: Generating an asset identification fingerprint library that stores the correspondence between device ports and device fingerprint information.

8. The method according to claim 7, wherein Generating a scanning result based on the asset ledger to respond to the scanning request, including: Comparing the device fingerprint information with the device fingerprint information in the asset identification fingerprint library; When the comparison hits, generating a scanning result based on the asset ledger to respond to the scanning request.

9. The method according to claim 8, wherein Also including: When the comparison does not hit, responding to the scanning request with a null value.

10. An apparatus for processing device scan requests, characterized in that, Including: A ledger module for generating an asset ledger based on the device information of devices within a preset network segment; An update module for regularly updating the device information in the asset ledger; A list module for generating a security whitelist through a legal scanning source IP; A request module for receiving a scanning request for a device and obtaining the scanning source IP; A response module for generating a scanning result based on the asset ledger and device fingerprint information to respond to the scanning request when the scanning source IP is not in the security whitelist.

Images