Heterogeneous security mechanism-oriented centralized management and control system
By generating a unique APIKey in the security product and dynamically generating a token based on the timestamp, the problems of interface failure and multi-login conflicts caused by administrator account changes in the communication between the security management platform and heterogeneous security products are solved, achieving efficient and secure data transmission and simplifying the operation and maintenance process, thereby improving system stability and management efficiency.
Patent Information
- Application Number
- CN202510982643.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-16
- Publication Date
- 2025-09-05
AI Technical Summary
When existing security management platforms communicate with multiple heterogeneous security products, there are problems such as administrator account and password changes leading to interface call failures and multi-person login conflicts, which affect the stability and efficiency of operation and maintenance operations.
By generating a unique APIKey in security products and dynamically generating a token based on the timestamp, efficient and secure communication between the security management platform and various heterogeneous security products is achieved. HTTPS encrypted transmission and time synchronization mechanisms are used to avoid interface failures caused by administrator account changes, support concurrent access, and do not interfere with manual operation and maintenance.
It achieves efficient and secure communication between the security management platform and various heterogeneous security products, avoids interface failure problems, supports concurrent access, improves system stability and management efficiency, simplifies operation and maintenance processes, and improves data transmission security and system security.
Smart Images
Figure CN120602086A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security management, and in particular to a centralized control system for heterogeneous security mechanisms. Background Art
[0002] With the deepening of informatization construction, the business systems of government and enterprise units generally deploy a variety of security protection products, such as firewalls, bastion hosts, host security protection software, etc., to meet compliance requirements such as level protection. The security management platform, as an auxiliary operation and maintenance tool, manages security products of different manufacturers and types through a centralized interface, which can simplify the work process of operation and maintenance personnel, realize unified viewing of device information, unified issuance of policies and unified processing of alarms, and improve operation and maintenance efficiency. Such platforms usually need to communicate data with each managed product and call its open interface to realize configuration management and single sign-on functions.
[0003] In the existing technology, security management platforms mostly store the administrator account information of the managed security products and use this account for identity authentication when calling the product interface. This method has the following shortcomings: First, if the administrator of the security product changes the account password, the platform needs to manually synchronize and update the account information, otherwise it will cause the interface call to fail and the policy issuance error; second, some security products restrict simultaneous logins of the same administrator account. When the platform uses the administrator account to communicate with the product, it may cause the operation and maintenance personnel to be unable to log in to the product interface at the same time, or even be forced to go offline by the system, affecting daily operation and maintenance operations. Summary of the Invention
[0004] The present invention aims to provide a centralized control system for heterogeneous security mechanisms to solve the problems raised in the above-mentioned background technology. This solution generates a unique APIKey in the security product and dynamically generates a token in combination with the timestamp, thereby achieving efficient and secure communication between the security management platform and a variety of heterogeneous security products, avoiding the interface failure problem caused by administrator account changes, supporting concurrent access without interfering with manual operation and maintenance, and using HTTPS encrypted transmission and time synchronization mechanism to improve data transmission security and system stability. At the same time, it supports log recording to facilitate audit management, which significantly simplifies the operation and maintenance process as a whole and improves management efficiency and system security.
[0005] In order to achieve the above object, the present invention provides the following technical solutions: Centralized control system for heterogeneous security mechanisms, including: A security management platform, which is used to centrally manage multiple security products and configure the IP address, port, communication protocol, and pre-generated authentication key apiKey for each security product; Multiple security products, each of which generates and stores a unique 20-bit APIKey based on a local 12-bit MAC address and an 8-bit random number when first started; The communication authentication module is located in the security management platform and is used to generate a temporary authentication credential token based on the configured APIKey and the current timestamp when interacting with security products. The token generation formula is: token=base64(md5(apiKey+timestamp)+timestamp); The token verification module is located in the security product and is used to parse the token and perform the following steps when receiving an interface call request from the security management platform: S1: Decode the token using base64 and extract the timestamp. S2: Verify whether the difference between the extracted timestamp and the current system time of the security product is within the preset time range; S3: Regenerates a local token based on the local apiKey and the extracted timestamp, and compares it with the request token; If the comparison is consistent, data exchange is allowed; if it is inconsistent or the time difference is out of range, the request is rejected and an error code is returned.
[0006] Preferably, the preset time range is 0-3 minutes, which is used to ensure that the system time of the security management platform and the security product are synchronized.
[0007] Preferably, the security management platform further includes setting communication timeout and retry number parameters when configuring each type of security product information.
[0008] Preferably, the security product supports calling the single sign-on function through an interface URL, and its interface format is: https: / / IP:PORT / v1 / ssoLoginwetoken=xxx.
[0009] Preferably, when the communication authentication module of the security management platform generates a token, SHA-256 or a higher-strength hash algorithm is used instead of the MD5 algorithm to enhance security.
[0010] Preferably, the token verification module returns an HTTP 401 status code after authentication fails, and records an authentication failure log for audit analysis.
[0011] Preferably, the apiKey remains unchanged during the life cycle of the security product unless the security product undergoes a factory reset operation.
[0012] Preferably, the security management platform supports centralized management of security products from multiple different manufacturers, and displays the operating status and policy issuance results of each security product through a unified interface.
[0013] Preferably, the communication between the communication authentication module and the token verification module adopts the HTTPS encryption protocol to ensure the security of the data transmission process.
[0014] Compared with the existing technology, this technical solution has the following beneficial effects: This solution generates a unique APIKey in security products and dynamically generates a token based on the timestamp, enabling efficient and secure communication between the security management platform and various heterogeneous security products. It avoids interface failures caused by administrator account changes, supports concurrent access without interfering with manual operation and maintenance, and uses HTTPS encrypted transmission and time synchronization mechanisms to improve data transmission security and system stability. It also supports logging for easy audit management, significantly simplifying the operation and maintenance process overall and improving management efficiency and system security. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] Figure 1 Provide a working schematic diagram for the present invention. DETAILED DESCRIPTION
[0016] With the deepening of informatization construction, the business systems of government and enterprise units generally deploy a variety of security protection products, such as firewalls, bastion hosts, host security protection software, etc., to meet compliance requirements such as level protection. The security management platform, as an auxiliary operation and maintenance tool, manages security products of different manufacturers and types through a centralized interface, which can simplify the work process of operation and maintenance personnel, realize unified viewing of device information, unified issuance of policies and unified processing of alarms, and improve operation and maintenance efficiency. Such platforms usually need to communicate data with each managed product and call its open interface to realize configuration management and single sign-on functions.
[0017] In the existing technology, security management platforms mostly store the administrator account information of the managed security products and use this account for identity authentication when calling the product interface. This method has the following shortcomings: First, if the administrator of the security product changes the account password, the platform needs to manually synchronize and update the account information, otherwise it will cause the interface call to fail and the policy issuance error; second, some security products restrict simultaneous logins of the same administrator account. When the platform uses the administrator account to communicate with the product, it may cause the operation and maintenance personnel to be unable to log in to the product interface at the same time, or even be forced to go offline by the system, affecting daily operation and maintenance operations.
[0018] In view of the above problems, the present invention provides an improved communication and authentication mechanism between the security management platform and security products, which can avoid relying on administrator account information for interface calls while ensuring the security of data interaction, thereby improving the continuity and stability of operation and maintenance management, and realizing efficient centralized control of multiple heterogeneous security products.
[0019] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments: like Figure 1 The centralized control system for heterogeneous security mechanisms shown in the figure includes: Security management platform: The security management platform is used to centrally manage multiple security products and configure the IP address, port, communication protocol, and pre-generated authentication key apiKey for each security product; Multiple security products: Each security product generates and stores a unique 20-bit APIKey based on the local 12-bit MAC address and 8-bit random number when it is first started. The communication authentication module is located in the security management platform and is used to generate a temporary authentication credential token based on the configured APIKey and the current timestamp when interacting with security products. The token generation formula is: token=base64(md5(apiKey+timestamp)+timestamp); The token verification module is located in the security product and is used to parse the token and perform the following steps when receiving an interface call request from the security management platform: S1: Decode the token using base64 and extract the timestamp. S2: Verify whether the difference between the extracted timestamp and the current system time of the security product is within the preset time range; S3: Regenerates a local token based on the local apiKey and the extracted timestamp, and compares it with the request token; If the comparison is consistent, data exchange is allowed; if it is inconsistent or the time difference is out of range, the request is rejected and an error code is returned.
[0020] In this embodiment, the system includes a security management platform and several security devices. The security devices are common network security products such as firewalls, bastion hosts, host security software, etc. When these devices are started for the first time, a "device-specific key" (i.e., apiKey) will be automatically generated. This key is generated based on the device's MAC address (device unique identifier) and a random number to ensure that each device is unique. After generation, the key will be saved locally on the device and subsequently used for identity authentication.
[0021] When entering device information, the security management platform will require the device's IP address, port number, communication protocol, and the unique key (apiKey) generated by the device. In this way, when the platform needs to access a device, it no longer uses the device administrator's account and password, but uses the apiKey for communication authentication.
[0022] During actual communication, the security management platform will first generate a "temporary pass" (i.e., token). This token is generated by performing an encryption calculation (MD5 operation followed by Base64 encoding) using the API Key and the current time, and then attaching the current timestamp. This ensures that the generated token is time-sensitive and prevents misuse.
[0023] When the platform sends a request to the device (policy delivery or single sign-on), the request address is: https: / / IP: PORT / v1 / ssoLoginwetoken= Temporary pass.
[0024] After receiving the request, the security device will first decode the temporary pass, extract the time information, and check whether the time difference is within the allowable range (no more than 3 minutes). This is done to avoid authentication errors caused by device time asynchrony. Then, the device will regenerate a local pass based on the saved apiKey and timestamp, and compare it with the pass in the request. If the two are consistent, the authentication is passed and the platform is allowed to access the device data; otherwise, the request is rejected and an error prompt (HTTP401 status code) is returned. At the same time, the device will also record the failure information for subsequent investigation.
[0025] During the entire process, the security management platform and each device are configured with time synchronization services to ensure that the time error between the two parties is no more than 3 minutes, so as to ensure the success rate of authentication.
[0026] After adopting this solution, operation and maintenance personnel do not need to worry about platform communication failure due to administrator password changes when managing multiple devices. It also avoids the "multi-login conflict" problem caused by using administrator accounts. The communication between the platform and devices is more secure and stable, and does not affect other people logging into the device management interface at the same time.
[0027] The preset time range is 0-3 minutes, which is used to ensure the system time synchronization between the security management platform and security products.
[0028] In this embodiment, such a time difference range is designed because a large time error may cause the token generated during authentication to be inconsistent with the token generated locally on the device, thereby causing authentication failure. By setting a reasonable time window, the timeliness of authentication is guaranteed, and slight time deviations between devices are allowed, which helps to improve the stability and fault tolerance of the system.
[0029] When configuring each security product information, the security management platform further includes setting communication timeout and retry parameters.
[0030] In this embodiment, the communication timeout is used to limit the maximum time the platform waits for a device response after sending an interface request, preventing the system from being stuck due to a long period of no response; the number of retries is the number of automatic retries after the first request fails, which improves the success rate of interface calls when the network environment is unstable, making the entire system more reliable.
[0031] Security products support calling the single sign-on function through the interface URL. The interface format is: https: / / IP:PORT / v1 / ssoLoginwetoken=xxx.
[0032] In this embodiment, the single sign-on interface allows operation and maintenance personnel to directly log in to the management interface of the security product through the security management platform without entering an account and password, thereby improving operational convenience and efficiency. This design is particularly useful for managing multiple devices of different brands, avoiding the tedious operation of frequently memorizing and entering multiple account information.
[0033] When the communication authentication module of the security management platform generates a token, it uses SHA-256 or a higher-strength hash algorithm instead of the MD5 algorithm to enhance security.
[0034] In this embodiment, compared with MD5, SHA-256 has stronger anti-collision ability and higher encryption strength, which can effectively resist security threats such as brute force cracking and hash collision, thereby improving the overall security of the communication process between the platform and the device.
[0035] The token verification module returns an HTTP 401 status code after authentication fails and records the authentication failure log for audit analysis.
[0036] In this embodiment, returning a 401 status code can clearly indicate to the caller that the authentication failed, facilitating quick problem location; recording logs makes it easier for subsequent operation and maintenance personnel to investigate the cause of the authentication failure, such as time synchronization failure, token calculation error, etc., further improving the maintainability and security audit capabilities of the system.
[0037] The apiKey remains unchanged during the life cycle of the security product unless the security product is reset to factory settings.
[0038] In this embodiment, this design avoids interface call failure and platform configuration confusion caused by frequent replacement of apiKey. The apiKey will only be regenerated when the device is completely restored to factory settings, thereby ensuring the long-term validity of the apiKey and the consistency of the platform configuration.
[0039] The security management platform supports centralized management of security products from multiple different manufacturers, and displays the operating status and policy issuance results of each security product through a unified interface.
[0040] In this embodiment, this function enables operation and maintenance personnel to view the operating status of all devices on one interface, detect anomalies in a timely manner, and issue configuration policies in batches, greatly improving management efficiency. It is particularly suitable for the security operation and maintenance needs of government and enterprise units and large data centers.
[0041] The communication between the communication authentication module and the token verification module uses the HTTPS encryption protocol to ensure the security of the data transmission process.
[0042] In this embodiment, the use of HTTPS can prevent data from being eavesdropped or tampered with by a third party during transmission, effectively resist security risks such as man-in-the-middle attacks, and ensure the confidentiality and integrity of information exchanged between the platform and the device.
[0043] The above is only an embodiment of the present invention, and the common knowledge such as the specific technical solutions and / or characteristics in the solution are not described in detail here. It should be pointed out that for those skilled in the art, without departing from the technical solution of the present invention, several variations and improvements can be made, which should also be regarded as the scope of protection of the present invention, and these will not affect the effect of the implementation of the present invention and the practicality of the patent. The scope of protection required by this application shall be based on the content of its claims, and the specific implementation methods and other records in the description can be used to interpret the content of the claims.
Claims
1. A centralized control system for heterogeneous security mechanisms, characterized by: include: A security management platform, which is used to centrally manage multiple security products and configure the IP address, port, communication protocol, and pre-generated authentication key apiKey for each security product; Multiple security products, each of which generates and stores a unique 20-bit APIKey based on a local 12-bit MAC address and an 8-bit random number when first started; The communication authentication module is located in the security management platform and is used to generate a temporary authentication credential token based on the configured APIKey and the current timestamp when interacting with security products. The token generation formula is: token=base64(md5(apiKey+timestamp)+timestamp); The token verification module is located in the security product and is used to parse the token and perform the following steps when receiving an interface call request from the security management platform: S1: Decode the token using base64 and extract the timestamp. S2: Verify whether the difference between the extracted timestamp and the current system time of the security product is within the preset time range; S3: Regenerates a local token based on the local apiKey and the extracted timestamp, and compares it with the request token; If the comparison is consistent, data exchange is allowed; if it is inconsistent or the time difference is out of range, the request is rejected and an error code is returned.
2. The centralized control system for heterogeneous security mechanisms according to claim 1, characterized in that: The preset time range is 0-3 minutes, which is used to ensure system time synchronization between the security management platform and the security product.
3. The centralized control system for heterogeneous security mechanisms according to claim 1, characterized in that: When configuring each type of security product information, the security management platform further includes setting communication timeout and retry number parameters.
4. The centralized control system for heterogeneous security mechanisms according to claim 1, characterized in that: The security product supports calling the single sign-on function through the interface URL, and its interface format is: https: / / IP:PORT / v1 / ssoLoginwetoken=xxx.
5. The centralized control system for heterogeneous security mechanisms according to claim 1, characterized in that: When the communication authentication module of the security management platform generates a token, SHA-256 or a higher-strength hash algorithm is used instead of the MD5 algorithm to enhance security.
6. The centralized control system for heterogeneous security mechanisms according to claim 1, characterized in that: The token verification module returns an HTTP 401 status code after authentication fails and records the authentication failure log for audit analysis.
7. The centralized control system for heterogeneous security mechanisms according to claim 1, characterized in that: The apiKey remains unchanged during the life cycle of the security product unless the security product is reset to factory settings.
8. The centralized control system for heterogeneous security mechanisms according to claim 1, characterized in that: The security management platform supports centralized management of security products from multiple different manufacturers, and displays the operating status and policy issuance results of each security product through a unified interface.
9. The centralized control system for heterogeneous security mechanisms according to claim 1, characterized in that: The communication between the communication authentication module and the token verification module adopts the HTTPS encryption protocol to ensure the security of the data transmission process.