Network device security service enhancement method, system, device and program product

Abstract

The embodiment of the invention provides a network equipment security service enhancement method, system, equipment and program product, and relates to the technical field of network security. The method is executed by the network equipment and comprises the following steps of: when the network equipment is in an off-management state, determining whether the network equipment is locally configured with an active network disconnection isolation strategy or not; the active network disconnection isolation strategy is used for guiding the network equipment to actively perform network disconnection or isolation on target equipment connected with the network equipment so as to refuse to forward a service message of the target equipment; if yes, executing a service forwarding task of the network equipment according to the active network disconnection isolation strategy; if not, executing the service forwarding task according to a local basic service forwarding strategy of the network equipment; the basic service forwarding strategy is used for guiding the network equipment to forward a service message of each equipment connected with the network equipment; and operating the local additional security service of the network equipment. According to the embodiment of the invention, the security service of the network equipment can be enhanced from multiple aspects, and the risk controllability after the network equipment is out of control is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network device security service strengthening method, system, device and program product. BACKGROUND

[0002] In a classified unit, network device disconnection belongs to a high-risk event. However, the local processing mechanism of the current mainstream network device is usually designed based on the principle of decoupling of business forwarding and management functions, resulting in that the network device lacks a processing mechanism for active network isolation after disconnection, and it is difficult to meet the security requirements of the classified unit. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a network device security service strengthening method, system, device and program product, which can strengthen the security service of the network device from multiple aspects and ensure that the risk after the network device is disconnected is controllable.

[0004] In a first aspect, the embodiments of the present application provide a network device security service strengthening method applied to a network device, and the method comprises the following steps. In the case that the network device itself is in a disconnection state, it is determined whether there is a configured active network isolation strategy locally in the network device; wherein the active network isolation strategy is used to guide the network device to actively disconnect or isolate a target device connected with the network device to refuse to forward the business message of the target device; If yes, the business forwarding task of the network device is executed according to the active network isolation strategy; If no, the business forwarding task is executed according to the basic business forwarding strategy of the network device locally; wherein the basic business forwarding strategy is used to guide the network device to forward the business message of each device connected with the network device; Run the additional security service locally in the network device; wherein the additional security service comprises one or more of device network management service, device security protection service, log and alarm service and network management recovery service.

[0005] In the implementation process, the basic service forwarding policy is configured in the network device in advance, and one or more additional security services of device network management service, device security protection service, log and alarm service and network management recovery service are configured, and the active network isolation policy is configured, so that the network device executes the local service forwarding task according to the active network isolation policy after being disconnected, executes the local service forwarding task according to the basic service forwarding policy if the active network isolation policy is not configured, and runs the additional security service locally. Considering the risk of data leakage after the network device is disconnected, the active network isolation policy is configured locally, the service forwarding task is executed according to the active network isolation policy, the service packet of the disconnected or isolated device is refused to be forwarded, and the additional security service is configured and run, so as to ensure the comprehensiveness and availability of the local processing mechanism of the network device, thereby realizing the security service of the network device from multiple aspects, and ensuring the controllable risk of the network device after being disconnected.

[0006] Further, the method further comprises: obtaining the network connection state monitoring result and the device management function monitoring result sent by the network management device; wherein the network connection state monitoring result is whether the network device is connected with the network management device, and the device management function monitoring result is whether the management function of the network management device is running normally; if the network connection state monitoring result is that the network device is connected with the network management device, and the device management function monitoring result is that the management function of the network management device is running normally, it is determined that the network device itself is in the state of being managed; if the network connection state monitoring result is that the network device is not connected with the network management device, or the device management function monitoring result is that the management function of the network management device is abnormal, it is determined that the network device itself is in the state of being disconnected.

[0007] In the implementation process, the network device obtains the network connectivity state monitoring result and the device management function monitoring result sent by the network management device, and determines that the network device itself is in the managed state when the network connectivity state monitoring result indicates that the network device is connected with the network management device and the device management function monitoring result indicates that the management function of the network management device is running normally, and determines that the network device itself is in the unmanaged state when the network connectivity state monitoring result indicates that the network device is not connected with the network management device or the device management function monitoring result indicates that the management function of the network management device is running abnormally, so as to determine the network management state of the network device itself in combination with the monitoring results of the network management device on the two dimensions of network connectivity and management function effectiveness, thereby accurately monitoring the network management state of the network device itself.

[0008] Further, the network management device sends the network connectivity state monitoring result and the device management function monitoring result, comprising: In response to the ping request sent by the network management device, it is verified whether the source IP address carried by the ping request is the same as the IP address of the target network management device stored locally by the network device; If the source IP address carried by the ping request is the same as the IP address of the target network management device, a ping response is returned to the network management device, otherwise the ping request is discarded, so that the network management device sends the network connectivity state monitoring result to the network device by determining whether the ping request is timed out; In response to the encrypted management request sent by the network management device, it is verified whether the identity information carried by the encrypted management request is the same as the identity information of the target network management device, and whether the remote management instruction carried by the encrypted management request is a legal instruction; If the identity information carried by the encrypted management request is the same as the identity information of the target network management device, and the remote management instruction carried by the encrypted management request is a legal instruction, an encrypted management response is returned to the network management device, otherwise the encrypted management request is discarded, so that the network management device sends the device management function monitoring result to the network device by determining whether the encrypted management request is timed out;

[0009] In the implementation process, the network management device is monitored by the network management device in a ping monitoring mode and in an encrypted anti-fake monitoring mode, the network device determines whether to return a ping response to the network management device by verifying whether a source IP address carried in the ping request is the same as an IP address of the target network management device stored in the network device, the network management device sends a network connectivity state monitoring result to the network device by determining whether the ping request is a timeout response, the network management device determines whether to return an encrypted management response to the network management device by verifying whether identity information carried in the encrypted management request is the same as identity information of the target network management device and verifying whether a remote management instruction carried in the encrypted management request is a legal instruction, the network management device sends a device management function monitoring result to the network device by determining whether the encrypted management request is a timeout response, the network management device is interacted with to cooperatively monitor the network connectivity state and the device management function, and the network management state of the network device is accurately monitored.

[0010] Further, the performing the service forwarding task of the network device according to the active network isolation strategy comprises: For each device connected to the network device, it is determined whether the current device satisfies a trigger condition of the active network isolation strategy; wherein the trigger condition comprises one or more of a security threat existing in the device, a violation operation performed by the device, and a fault of the device; If yes, the current device is taken as the target device to be disconnected or isolated according to the active network isolation strategy, and service packets of the target device are refused to be forwarded; If no, service packets of the current device are forwarded according to the basic service forwarding strategy.

[0011] In the implementation process, the trigger condition of the active network isolation strategy is set in advance to comprise one or more of a security threat existing in the device, a violation operation performed by the device, and a fault of the device, the network device determines whether the current device satisfies the trigger condition of the active network isolation strategy for each device connected to the network device, if yes, the current device is taken as the target device to be disconnected or isolated according to the active network isolation strategy, and service packets of the target device are refused to be forwarded, and if no, service packets of the current device are forwarded according to the basic service forwarding strategy, the network device can accurately identify the device at risk to be disconnected or isolated, and the error and omission problems are effectively avoided.

[0012] Further, the additional security service comprises a device network management service; and the running the additional security service locally in the network device comprises: The network management task of the network device is executed by the network device in response to a local management instruction input by a management user through a network management protocol local to the network device and / or a network management interface of the network device itself; wherein the network management protocol includes an SNMP protocol, and the network management interface includes one or more of a Telnet interface, an SSH interface, and a Web interface.

[0013] In the foregoing implementation process, by pre-configuring a network management protocol local to the network device and / or a network management interface of the network device itself, such as one or more of an SNMP protocol, a Telnet interface, an SSH interface, and a Web interface, the network device executes a network management task of the network device in response to a local management instruction input by a management user through the network management protocol local to the network device and / or the network management interface of the network device itself, which can support the management user in managing the network device in a local management manner after the network device is disengaged, meet the management requirement for the network device, and thus strengthen the security service of the network device from multiple aspects and ensure the controllable risk of the network device after being disengaged.

[0014] Further, the additional security service includes a device security protection service; and the running of the additional security service local to the network device includes: executing a device security protection task of the network device according to a device security protection policy local to the network device; wherein the device security protection policy includes one or more of a device access control policy, a device attack protection policy, and a traffic direction control policy.

[0015] In the foregoing implementation process, by pre-configuring one or more device security protection policies, such as a device access control policy, a device attack protection policy, and a traffic direction control policy, the network device executes a device security protection task of the network device according to a device security protection service policy local to the network device, which can protect the network device, ensure the security of the network device, and optimize the performance of the network device, and thus strengthen the security service of the network device from multiple aspects and ensure the controllable risk of the network device after being disengaged.

[0016] Further, the additional security service includes a log and alarm service; and the running of the additional security service local to the network device includes: generating a system log of the network device, and storing the system log locally to the network device; sending target alarm information according to an alarm processing policy local to the network device; wherein the target alarm information is used to indicate that the network device is in a disengaged state.

[0017] In the implementation process, the system log of the network device is generated by the network device, and the system log is stored locally in the network device, and the target alarm information indicating that the network device is in the out-of-management state is sent according to the alarm processing strategy locally in the network device, so that the system log and the alarm out-of-management event can be recorded locally in the network device automatically after the network device is out of management, the network device out-of-management is reminded to the management user in time, the system log is viewed quickly to make a response measure, and thus the safety service of the network device is strengthened from multiple aspects, and the risk after the network device is out of management is controllable.

[0018] Further, the additional safety service includes a network management recovery service; and the running of the additional safety service locally in the network device includes: performing a network management recovery task of the network device according to the network management recovery strategy configured locally in the network device, to recover the management of the network management device to the network device.

[0019] In the implementation process, the network management recovery service is configured locally in the network device in advance, and the network management recovery task of the network device is performed according to the network management recovery strategy, to recover the management of the network management device to the network device, so that the network device can automatically attempt to recover the network management state of the network device from the out-of-management state to the in-management state after the network device is out of management, and the management of the network device to the network device is recovered as soon as possible, thereby the safety service of the network device is strengthened from multiple aspects, and the risk after the network device is out of management is controllable.

[0020] Further, the network device includes one or more of a switch, a router, a firewall and a server.

[0021] In the implementation process, one or more of the switch, the router, the firewall and the server is selected as the network device, so that diversified application requirements can be met.

[0022] In a second aspect, an embodiment of the present application provides a network device safety service strengthening apparatus applied to a network device; the apparatus includes: a local configuration query module configured to determine whether a proactive network disconnection isolation strategy is configured locally in the network device in a case that the network device itself is in an out-of-management state; wherein the proactive network disconnection isolation strategy is used to guide the network device to actively disconnect or isolate a target device connected to the network device, to refuse to forward a service packet of the target device; a first service forwarding module configured to execute a service forwarding task of the network device according to the proactive network disconnection isolation strategy if the proactive network disconnection isolation strategy is configured locally in the network device; a second service forwarding module, configured to perform the service forwarding task according to a basic service forwarding policy of the network device if not. a security service running module, configured to run an additional security service of the network device; wherein the additional security service comprises one or more of a device network management service, a device security protection service, a log and alarm service, and a network management recovery service.

[0023] In a third aspect, an embodiment of the present application provides a network device security service strengthening system, comprising a network management device, and at least one network device connected to the network management device; each network device in the at least one network device is configured to: determine whether there is a proactive network isolation policy configured locally in the network device if the network device itself is in a disengagement state; wherein the proactive network isolation policy is configured to guide the network device to actively isolate or disconnect a target device connected to the network device, so as to refuse to forward a service packet of the target device; perform the service forwarding task of the network device according to the proactive network isolation policy if there is; perform the service forwarding task according to a basic service forwarding policy of the network device if not; wherein the basic service forwarding policy is configured to guide the network device to forward service packets of each device connected to the network device; run an additional security service of the network device; wherein the additional security service comprises one or more of a device network management service, a device security protection service, a log and alarm service, and a network management recovery service.

[0024] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the processor implements the method as described above when executing the computer program.

[0025] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising instructions which, when executed by a computer, cause the computer to implement the method as described above.

[0026] In a sixth aspect, an embodiment of the present application provides a computer readable storage medium, comprising a stored computer program; wherein the computer readable storage medium controls a device where the computer readable storage medium is located to perform the method as described above when the computer program runs. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments of the present application will be briefly introduced as follows. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0028] Figure 1 A flowchart of a network device security service enhancement method provided by the first embodiment of the present application; Figure 2 A structural diagram of a network device security service enhancement device provided by the second embodiment of the present application; Figure 3 A structural diagram of a network device security service enhancement system provided by the third embodiment of the present application; Figure 4 A structural diagram of an electronic device provided by the fourth embodiment of the present application. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

[0030] It should be noted that in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance. At the same time, the step numbers in the text are only for the convenience of the explanation of the embodiments of the present application, and do not serve as a limitation on the execution sequence of the steps. The method provided by the embodiments of the present application can be executed by the related terminal device, and the processor in the storage server is taken as an example for description.

[0031] In the secret level unit, network device disconnection belongs to a high-risk event. However, in the related art, the local processing mechanism of the network device is usually designed based on the principle of decoupling of "service forwarding and management function", which leads to the lack of active network isolation processing mechanism after the network device is disconnected, and it is difficult to meet the security requirements of the secret level unit.

[0032] To this end, the embodiment of the present application provides a network device security service strengthening method, which pre-configures a basic service forwarding strategy in a network device locally, and one or more additional security services in a device network management service, a device security protection service, a log and alarm service and a network management recovery service, and self-defines a proactive network isolation strategy, so that the network device executes a local service forwarding task according to the proactive network isolation strategy after being disengaged, executes a local service forwarding task according to the basic service forwarding strategy if no proactive network isolation strategy is configured locally, and runs the additional security service locally, which can consider the problem of data leakage and other risks after the network device is disengaged due to the inability to actively perform network isolation, support the configuration of the proactive network isolation strategy locally in the network device, preferentially execute the service forwarding task according to the proactive network isolation strategy, refuse to forward the service message of the disengaged or isolated device, and increase the configuration of the additional security service to run, so as to guarantee the comprehensiveness and availability of the local processing mechanism of the network device, thereby realizing the strengthening of the security service of the network device from multiple aspects and ensuring the controllability of the risk after the network device is disengaged.

[0033] Please refer to Figure 1 , Figure 1 A flowchart of a network device security service strengthening method provided by the first embodiment of the present application is shown. The first embodiment of the present application provides a network device security service strengthening method, which is applied to a network device; the method comprises steps S101-S104: S101, in the case that the network device itself is in a disengaged state, determining whether a proactive network isolation strategy is configured locally in the network device; wherein the proactive network isolation strategy is used to guide the network device to actively disconnect or isolate a target device connected to the network device, so as to refuse to forward the service message of the target device.

[0034] As an example, the network of a secret-level unit usually includes a network management device and at least one network device connected to the network management device, and the network management device can be used to perform management operations on each network device in the at least one network device, such as managing the account information of each network device, monitoring the running state of each network device, detecting the running fault of each network device and upgrading the software version of each network device, etc. In order to meet the complex business needs of the secret-level unit, each network device in the network of the secret-level unit is usually connected to other devices such as user terminals or servers, so as to interact with the devices connected to each network device.

[0035] In view of the security requirements of the classified units in actual application scenarios, the proactive network isolation strategy can be defined in advance according to the security requirements of the classified units, and it is selected whether to configure the predefined proactive network isolation strategy locally in each network device, wherein the proactive network isolation strategy is used to guide the network device to actively isolate or disconnect the target device connected to the network device, so as to refuse to forward the service packet of the target device.

[0036] In actual application, the content of the proactive network isolation strategy can include but is not limited to: the operation object of isolation or disconnection, such as defining the type of the target device, and even refining any network segment or any area where the target device is located; the operation mode of isolation or disconnection; the operation time of isolation or disconnection. Different levels of proactive network isolation strategies can be defined according to network security regulations.

[0037] For any network device, the network device monitors the network management state of the network device itself in real time, and determines whether the network device itself is in the managed state or the unmanaged state.

[0038] It can be understood that if the network device itself is in the managed state, it means that the network management device can perform management operations on the network device; if the network device itself is in the unmanaged state, it means that the network management device cannot perform management operations on the network device.

[0039] In the case of monitoring that the network device itself is in the unmanaged state, it is determined whether the network device locally has a configured proactive network isolation strategy.

[0040] S102, if yes, performing the service forwarding task of the network device according to the proactive network isolation strategy.

[0041] As an example, the network device determines that the network device locally has a configured proactive network isolation strategy, and performs the service forwarding task of the network device according to the proactive network isolation strategy. Specifically, according to the proactive network isolation strategy, the target device connected to the network device itself and the operation mode of isolation or disconnection are determined, and the target device is disconnected according to the disconnection operation mode or isolated according to the isolation operation mode, and the service packet of the target device is refused to be forwarded, while the service packet of the remaining devices, that is, each device connected to the network device except the target device, is allowed to be forwarded, so as to perform service forwarding locally in the network device.

[0042] S103, if not, performing the service forwarding task according to the basic service forwarding strategy of the network device locally; wherein the basic service forwarding strategy is used to guide the network device to forward the service packet of each device connected to the network device.

[0043] As an example, the network device acquires a basic service forwarding policy configured locally on the network device in a case that the network device determines that no proactive network outage isolation policy is configured locally on the network device, wherein the basic service forwarding policy is used to guide the network device to forward service packets of each device connected to the network device.

[0044] In actual applications, the content of the basic service forwarding policy can include but is not limited to: a forwarding object, such as any service packet; a forwarding path; a forwarding mode, such as block transmission; and a special processing mechanism, such as packet encryption or digital signature.

[0045] After obtaining the basic service forwarding policy configured locally on the network device, the network device performs a service forwarding task according to the basic service forwarding policy configured locally on the network device. Specifically, the network device can determine the content of the forwarding object, the forwarding path and the forwarding mode according to the basic service forwarding policy, acquire a specified service packet, and transmit the specified service packet along the forwarding path according to the forwarding mode, so as to perform service forwarding locally on the network device.

[0046] S104, running an additional security service locally on the network device; wherein the additional security service includes one or more of a device network management service, a device security protection service, a log and alarm service, and a network management recovery service.

[0047] As an example, in order to guarantee the comprehensiveness and availability of the processing mechanism locally on the network device, one or more of the device network management service, the device security protection service, the log and alarm service, and the network management recovery service are pre-configured locally on the network device.

[0048] It should be noted that the device network management service is used to implement the network management function locally on the network device, the device security protection service is used to implement the security protection function locally on the network device, the log and alarm service is used to implement the log recording and abnormal alarm function locally on the network device, and the network management recovery service is used to recover the network management state of the network device itself from a state of being out of management to a state of being under management.

[0049] If the additional security service includes the device network management service, the device network management service locally on the network device is run; if the additional security service includes the device security protection service, the device security protection service locally on the network device is run; if the additional security service includes the log and alarm service, the log and alarm service locally on the network device is run; and if the additional security service includes the network management recovery service, the network management recovery service locally on the network device is run.

[0050] In actual applications, the service forwarding task and the running of the additional security service can be performed simultaneously, the service forwarding task can be performed first and then the additional security service is run, or the additional security service can be run first and then the service forwarding task is performed.

[0051] The embodiment of the application can pre-configure a basic service forwarding policy in a network device, and one or more additional security services such as a device network management service, a device security protection service, a log and alarm service, and a network management recovery service, and self-define a proactive network isolation policy. After the network device is disconnected, if the proactive network isolation policy is configured locally, the network device performs a local service forwarding task according to the proactive network isolation policy; if the proactive network isolation policy is not configured locally, the network device performs a local service forwarding task according to the basic service forwarding policy, and runs the additional security services locally. The embodiment can consider the risk of data leakage after the network device is disconnected because the network device cannot actively perform network isolation, support the configuration of the proactive network isolation policy locally in the network device, preferentially perform the service forwarding task according to the proactive network isolation policy, reject to forward the service message of the disconnected or isolated device, and increase the configuration of the additional security services to run, thereby guaranteeing the comprehensiveness and availability of the local processing mechanism of the network device, and achieving the enhancement of the security service of the network device from multiple aspects and the controllability of the risk of the network device after being disconnected.

[0052] In the optional embodiment, the method further includes steps S105-S107: S105, obtaining the network connectivity state monitoring result and the device management function monitoring result sent by the network management device; wherein the network connectivity state monitoring result is whether the network device is connected with the network management device, and the device management function monitoring result is whether the management function of the network management device is running normally.

[0053] As an example, the network management device can perform network connectivity state monitoring on the network device, monitor the network connectivity state between the network management device itself and the network device, obtain the network connectivity state monitoring result, and perform device management function monitoring on the network device, monitor whether the network management device itself can effectively manage the network device after issuing a management instruction to the network device, obtain the device management function monitoring result, and send the network connectivity state monitoring result and the device management function monitoring result to the network device.

[0054] The network device obtains the network connectivity state monitoring result and the device management function monitoring result sent by the network management device, determines whether the obtained network connectivity state monitoring result is that the network device is connected with the network management device or that the network device is not connected with the network management device, and determines whether the obtained device management function monitoring result is that the management function of the network management device is running normally or that the management function of the network management device is running abnormally.

[0055] S106, if the network connectivity state monitoring result is that the network device is connected with the network management device and the device management function monitoring result is that the management function of the network management device is running normally, it is determined that the network device itself is in the managed state.

[0056] For example, if the network device determines that the obtained network connectivity state monitoring result is that the network device is connected with the network management device and the obtained device management function monitoring result is that the management function of the network management device is running normally, it is considered that the network management device can perform management operation on the network device, and at this time, it is determined that the network device itself is in the managed state.

[0057] S107, if the network connectivity state monitoring result is that the network device is not connected with the network management device or the device management function monitoring result is that the management function of the network management device is running abnormally, it is determined that the network device itself is in the unmanaged state.

[0058] For example, if the network device determines that the obtained network connectivity monitoring result is that the network device is not connected with the network management device or the device management function monitoring result is that the management function of the network management device is running abnormally, it is considered that the network management device cannot perform management operation on the network device, and at this time, it is determined that the network device itself is in the unmanaged state.

[0059] The embodiment of the present application can obtain the network connectivity state monitoring result and the device management function monitoring result sent by the network management device by the network device, in the case that the network connectivity state monitoring result is that the network device is connected with the network management device and the device management function monitoring result is that the management function of the network management device is running normally, it is determined that the network device itself is in the managed state, in the case that the network connectivity state monitoring result is that the network device is not connected with the network management device or the device management function monitoring result is that the management function of the network management device is running abnormally, it is determined that the network device itself is in the unmanaged state, the network management state of the network device itself can be determined by combining the network management device monitoring results of the two dimensions of network connectivity and management function effectiveness, so as to realize accurate monitoring of the network management state of the network device itself.

[0060] In an optional embodiment, the obtaining the network connectivity state monitoring result and the device management function monitoring result sent by the network management device comprises: in response to a ping request sent by the network management device, verifying whether a source IP address carried by the ping request is the same as an IP address of the target network management device stored locally by the network device; if the source IP address carried by the ping request is the same as the IP address of the target network management device, returning a ping response to the network management device, otherwise discarding the ping request, so that the network management device sends the network connectivity state monitoring result to the network device by determining whether the ping request is a timeout response; in response to an encrypted management request sent by the network management device, verifying whether identity information carried by the encrypted management request is the same as identity information of the target network management device, and verifying whether a remote management instruction carried by the encrypted management request is a legal instruction; if the identity information carried by the encrypted management request is the same as the identity information of the target network management device, and the remote management instruction carried by the encrypted management request is a legal instruction, returning an encrypted management response to the network management device, otherwise discarding the encrypted management request, so that the network management device sends the device management function monitoring result to the network device by determining whether the encrypted management request is a timeout response.

[0061] For example, the network management device can use a ping monitoring method to monitor the network connectivity state of the network device, and use an encrypted anti-fake monitoring method to monitor the device management function of the network device.

[0062] For the network connectivity state monitoring of the network device using the ping monitoring method, the network management device can set a first monitoring period in advance, and after the first monitoring period arrives, send a ping request to the network device, the ping request carrying a source IP address of the network management device.

[0063] After the network device receives the ping request sent by the network management device, the network device responds to the ping request, verifies whether the source IP address carried by the ping request is the same as the IP address of the target network management device stored locally by the network device, if the source IP address carried by the ping request is the same as the IP address of the target network management device, returns a ping response to the network management device, if the source IP address carried by the ping request is not the same as the IP address of the target network management device, directly discards the ping request.

[0064] It should be noted that the target network management device is a network management device allowed to manage the network device pre-configured locally in the network device, such as a network management device white list.

[0065] The network management device can pre-set a first waiting time, determine whether a ping response is received within the first waiting time after the ping request is sent, if yes, determine that the ping request is not timeout response, if not, determine that the ping request is timeout response, in the case of determining that the ping request is not timeout response, the generated network connectivity state monitoring result is that the network device is connected with the network management device, in the case of determining that the ping request is timeout response, the generated network connectivity state monitoring result is that the network device is not connected with the network management device, thereby sending the network connectivity state monitoring result to the network device.

[0066] For monitoring the device management function of the network device by using the encryption anti-fake monitoring mode, the network management device can pre-set a second monitoring period, and send an encrypted management request to the network device after the second monitoring period arrives, the encrypted management request carries a device identifier of the network management device, such as a device ID (Identity document, identity number), and encrypted information obtained by encrypting a remote management instruction specified by the network management device, the remote management instruction is used to instruct the network management device to perform a management operation on the network device.

[0067] After receiving the encrypted management request sent by the network management device, the network device responds to the encrypted management request, determines the device identifier and the encryption information carried by the encrypted management request, decrypts the encryption information carried by the encrypted management request to obtain the digital signature of the network management device and the remote management instruction specified by the network management device, and verifies whether the identity information carried by the encrypted management request is the same as the identity information of the target network management device by verifying whether the device identifier of the network management device is the same as the device identifier of the target network management device and whether the digital signature of the network management device is the same as the digital signature generated based on the key of the target network management device. It can be understood that if the device identifier of the network management device is the same as the device identifier of the target network management device and the digital signature of the network management device is the same as the digital signature of the target network management device, it is determined that the identity information carried by the encrypted management request is the same as the identity information of the target network management device. If the device identifier of the network management device is not the same as the device identifier of the target network management device or the digital signature of the network management device is not the same as the digital signature of the target network management device, it is determined that the identity information carried by the encrypted management request is not the same as the identity information of the target network management device. The remote management instruction specified by the network management device is also verified to be a legal instruction, such as verifying whether the remote management instruction is within the management authority range of the network management device, etc. In the case where it is determined that the identity information carried by the encrypted management request is the same as the identity information of the target network management device and the remote management instruction carried by the encrypted management request is a legal instruction, an encrypted management response is returned to the network management device. In the case where it is determined that the identity information carried by the encrypted management request is not the same as the identity information of the target network management device or the remote management instruction carried by the encrypted management request is not a legal instruction, the encrypted management request is directly discarded.

[0068] The network management device can pre-set a second waiting time, determine whether there is a received encrypted management response within the second waiting time after sending the encrypted management request. If yes, it is determined that the encrypted management request is not timed out. If no, it is determined that the encrypted management request is timed out. In the case where it is determined that the encrypted management request is not timed out, the generated device management function monitoring result is that the management function of the network management device is running normally. In the case where it is determined that the encrypted management request is timed out, the generated device management function monitoring result is that the management function of the network management device is running abnormally, so as to send the device management function monitoring result to the network device.

[0069] In actual application, the first monitoring period can be equal to the second monitoring period, that is, the network management device can send the network connectivity state monitoring request and the device management function monitoring request to the network device at the same time, or the first monitoring period can be less than the second monitoring period, that is, the network management device can send the network connectivity state monitoring request to the network device first and then send the device management function monitoring request to the network device. The first waiting time and the second waiting time can be the same or different.

[0070] The embodiment of the application supports the network management device to monitor the network connectivity state of the network device by using the ping monitoring mode and to monitor the device management function of the network device by using the encrypted anti-fake monitoring mode. The network device selects whether to return the ping response to the network management device by verifying whether the source IP address carried in the ping request is the same as the IP address of the target network management device stored locally by the network device. The network management device sends the network connectivity state monitoring result to the network device by determining whether the ping request is timed out, and selects whether to return the encrypted management response to the network management device by verifying whether the identity information carried in the encrypted management request is the same as the identity information of the target network management device and verifying whether the remote management instruction carried in the encrypted management request is a legal instruction. The network management device sends the device management function monitoring result to the network device by determining whether the encrypted management request is timed out. The network device can interact with the network management device to cooperatively monitor the network connectivity state and the device management function, thereby ensuring accurate monitoring of the network management state of the network device itself.

[0071] In the optional embodiment, the performing the service forwarding task of the network device according to the active network isolation strategy includes: determining whether a current device meets a trigger condition of the active network isolation strategy for each device connected with the network device; wherein the trigger condition includes one or more of a security threat existing in the device, a violation operation performed by the device, and a fault of the device; if yes, the current device is taken as a target device to be isolated according to the active network isolation strategy, and the service packet of the target device is refused to be forwarded; if not, the service packet of the current device is forwarded according to the basic service forwarding strategy.

[0072] For example, in order to ensure that the network device accurately identifies the device at risk to be isolated, the trigger condition of the active network isolation strategy can be set in advance, wherein the trigger condition includes one or more of a security threat existing in the device, a violation operation performed by the device, and a fault of the device.

[0073] The network device determines whether the current device meets the trigger condition of the active network isolation policy for each device connected to the network device itself, and specifically can determine whether the current device meets the trigger condition of the active network isolation policy by performing a series of risk monitoring operations, such as identifying a security threat of the current device, checking whether an execution operation of the current device is compliant, and detecting whether the current device fails, etc. If the current device meets the trigger condition of the active network isolation policy, it is considered that the current device has a risk, and at this time, the current device is taken as a target device according to the active network isolation policy, the current device is isolated or disconnected, and the service packet of the current device is refused to be forwarded. If the current device does not meet the trigger condition of the active network isolation policy, it is considered that the current device has no risk, and the service packet of the current device is directly forwarded according to the basic service forwarding policy configured locally by the network device, and the service packet of the current device is allowed to be forwarded, so that the service is forwarded locally in the network device.

[0074] The embodiment of the present application sets the trigger condition of the active network isolation policy to include one or more of a security threat of a device, a violation operation of the device, and a failure of the device, determines whether the current device meets the trigger condition of the active network isolation policy for each device connected to the network device, and if so, takes the current device as a target device according to the active network isolation policy, and disconnects or isolates the target device and refuses to forward the service packet of the target device. If not, the service packet of the current device is forwarded according to the basic service forwarding policy, which can ensure that the network device accurately identifies the device with a risk for disconnection or isolation, effectively avoiding the problem of missing or missing.

[0075] In an optional embodiment, the additional security service includes a device network management service; the additional security service running locally in the network device includes: responding to a local management instruction input by a management user through a network management protocol locally in the network device and / or a network management interface of the network device itself, and executing a network management task of the network device; wherein the network management protocol includes an SNMP protocol, and the network management interface includes one or more of a Telnet interface, an SSH interface, and a Web interface.

[0076] As an example, in order to support the management user to manage the network device in a local management manner after the network device is detached, a device network management service protocol and / or a network management interface of the network device itself can be pre-configured locally in the network device, so that the management user can input a local management instruction through the network management protocol locally in the network device and / or the network management interface of the network device itself, wherein the network management protocol includes an SNMP protocol, and the network management interface includes one or more of a Telnet interface, an SSH interface, and a Web interface, and the local management instruction is used to instruct the management operation of the network device by the management user.

[0077] SNMP protocol (Simple Network Management Protocol) is composed of a set of network management standards, including an application layer protocol, a database schema and a set of data objects. The protocol can support network management systems to monitor whether the devices connected to the network have any management concerns.

[0078] Telnet protocol is a member of TCP / IP protocol family, and is the standard protocol and main way of Internet remote login service. It provides users with the ability to complete remote host work on a local computer. The terminal user uses the Telnet program on his computer to connect to the server. The terminal user can input commands in the Telnet program, which will run on the server, just like inputting commands directly on the server console, so as to control the server locally.

[0079] SSH protocol (Secure Shell) is a protocol for secure remote login and other secure network services over insecure networks. SSH protocol is a more reliable protocol designed to provide security for remote login sessions and other network services. Using SSH protocol can effectively prevent information leakage problems in remote management processes.

[0080] Web interface (Web API) is a standardized programming interface based on HTTP protocol (Hypertext Transfer Protocol), which is used to realize service calling and data interaction between different systems, supports JSON / XML data format transmission, and has stateless, cacheable and other characteristics. Its core value is to reduce the complexity of application development by remotely calling network services such as storage, messages and computing, and typical applications include enterprise-level storage services, cross-platform message communication and vertical field data processing.

[0081] The network device receives the local management instruction input by the management user through the network management protocol and / or the network management interface of the network device, and responds to the local management instruction to perform the network management task of the network device, so as to perform the corresponding management operation on the network device.

[0082] It should be noted that the network device locally responds to the local management instruction input by the management user through the network management protocol locally of the network device and / or the network management interface of the network device itself, including the following cases: the network device locally responds to the local management instruction input by the management user through the network management protocol locally of the network device; the network device locally responds to the local management instruction input by the management user through the network management interface of the network device itself; and the network device locally responds to the local management instruction input by the management user through the network management protocol locally of the network device and the network management interface of the network device itself.

[0083] The embodiment of the present application pre-configures the network management protocol and / or the network management interface of the network device itself, such as one or more of the SNMP protocol, the Telnet interface, the SSH interface and the Web interface, and the network device responds to the local management instruction input by the management user through the network management protocol locally of the network device and / or the network management interface of the network device itself, performs the network management task of the network device, can support the management user to manage the network device in the local management mode after the network device is disengaged, meets the management requirement of the network device, and thus realizes the security service of the network device from multiple aspects, and ensures the controllable risk of the network device after disengagement.

[0084] In the optional embodiment, the additional security service includes a device security protection service; and the running of the additional security service locally of the network device includes: performing a device security protection task of the network device according to a device security protection policy locally of the network device; and the device security protection policy includes one or more of a device access control policy, a device attack protection policy and a traffic direction control policy.

[0085] For example, in order to guarantee the security of the network device and optimize the performance of the network device, the device security protection service can be pre-configured locally of the network device, wherein the device security protection policy includes one or more of the device access control policy, the device attack protection policy and the traffic direction control policy.

[0086] It should be noted that the device access control policy is a pre-defined policy for managing device access permission, the device attack protection policy is a pre-defined policy for taking security protection measures on the device, and the traffic direction control policy is a pre-defined policy for controlling the network traffic transmission of the device. The specific content of these device security protection policies can be defined according to actual application requirements.

[0087] In actual applications, the device access control policy can include an ACL (Access Control List) policy to prevent unauthorized access, etc. The ACL policy is a processing mechanism for implementing access control and traffic filtering in a network device. By defining a series of rules for passing or intercepting network traffic, the ACL policy can finely control the flow direction and permissions of network traffic based on the source / destination address, port, and protocol of a data packet, and is an indispensable tool for guaranteeing network security and optimizing network performance. The device attack protection policy can include setting an identity authentication method, an attack defense method, and a virus scanning method, etc. The traffic direction control policy can include redirecting target traffic such as audit traffic to a security gateway, limiting access to a target IP address or a URL (uniform resource locator) of a data packet, etc.

[0088] The network device performs a device security protection task of the network device according to a device security protection policy of the network device locally, to protect the network device.

[0089] The embodiments of the present application can pre-configure one or more device security protection policies of a device access control policy, a device attack protection policy, and a traffic direction control policy in the network device locally. The network device performs a device security protection task of the network device according to a device security protection policy of the network device locally, to protect the network device, guarantee the security of the network device, and optimize the performance of the network device, thereby realizing the security service of the network device from multiple aspects, and ensuring the controllable risk of the network device after being detached.

[0090] In optional embodiments, the additional security service includes a log and alarm service. The running of the additional security service in the network device locally includes: generating a system log of the network device, and storing the system log in the network device locally; and sending target alarm information according to an alarm processing policy of the network device locally; wherein the target alarm information is used to indicate that the network device is in a detached state.

[0091] As an example, in order to support the network device to automatically record system logs and alarm detached events locally after the network device is detached, facilitate the timely reminding of a management user of the network device detachment, and quickly view the system logs to make a response measure, a log and alarm service can be pre-configured in the network device locally, and an alarm processing policy relied on by the running of the log and alarm service can be configured.

[0092] In practical applications, a log processing strategy can also be configured, which can include setting an encryption algorithm, a storage path, a storage location (such as storage to a local buffer or a flash NVRAM), and a download mode of a system log, such as setting the storage location to a local buffer (Buffer) or a NVRAM (Non-Volatile Random Access Memory). An alarm processing strategy can include setting an alarm event, such as a network attack event and a virus intrusion event in addition to a network device disconnection event, setting an alarm object, such as an LED lamp, a buzzer, a mail server, or an SMS network management, and setting an alarm information template.

[0093] The network device records various operation commands of the network device in real time by running the log and alarm service locally configured by the network device, generates a system log of the network device, stores the system log locally in the network device, and sends target alarm information indicating that the network device is in a disconnection state according to the alarm processing strategy locally configured by the network device.

[0094] The embodiments of the present application can support the network device to automatically record a system log and an alarm disconnection event locally after the network device is disconnected, facilitate timely reminding a management user of the network device disconnection, and quickly view the system log to take measures, thereby realizing the strengthening of the security service of the network device from multiple aspects and ensuring the controllability of the risk after the network device is disconnected.

[0095] In optional embodiments, the additional security service includes a network management recovery service; and the running of the additional security service locally in the network device includes: performing a network management recovery task of the network device according to a network management recovery strategy locally configured by the network device, to recover the management of the network device by the network management device.

[0096] As an example, in order to recover the network management state of the network device from a disconnection state to a connection state as soon as possible and help the network management device to recover the management function of the network device as soon as possible, the network management recovery service can be pre-configured locally in the network device, and a network management recovery strategy relied on by the running of the network management recovery service can be configured.

[0097] It should be noted that the network management recovery strategy is a strategy pre-defined for guiding the network device to recover the management function of the network device. The specific content of the network management recovery strategy can be defined according to actual application requirements.

[0098] In actual application, the network management recovery strategy can include triggering the network device to re-establish connection with the network management device, and triggering the network device to establish connection with a backup network management device.

[0099] The network device executes the network management recovery task of the network device according to the network management recovery strategy configured locally in the network device, and recovers the management of the network device by the network management device, so as to recover the network management state of the network device from the unmanaged state to the managed state.

[0100] The embodiment of the application can support the network device to automatically attempt to recover the network management state of the network device from the unmanaged state to the managed state after the network device is unmanaged, and help the network management device to recover the management of the network device as soon as possible, so as to strengthen the security service of the network device from multiple aspects and ensure the controllability of the risk after the network device is unmanaged.

[0101] In optional embodiments, the network device includes one or more of a switch, a router, a firewall and a server.

[0102] As an example, considering that the network architecture of the secret-level unit network is relatively complex, usually including network interconnection devices such as switches and routers, and network service devices such as servers, and the security requirements of the secret-level unit network are relatively high, usually including network security devices such as firewalls, one or more of the switch, the router, the firewall and the server can be selected as the network device to construct the secret-level unit network according to actual application requirements.

[0103] The embodiment of the application can meet diversified application requirements by selecting one or more of the switch, the router, the firewall and the server as the network device.

[0104] By applying the network device security service strengthening method provided by the first embodiment of the application, the network device can preferentially execute the service forwarding task according to the active network disconnection isolation strategy after being unmanaged, and refuse to forward the service packet of the network disconnection or isolation device, so as to realize the optional configuration of access users in different ranges and different levels, and simultaneously run one or more additional security services of the device network management service, the device security protection service, the log and alarm service and the network management recovery service, so as to guarantee the comprehensiveness and availability of the local processing mechanism of the network device, and thus strengthen the security service of the network device from multiple aspects and ensure the controllability of the risk after the network device is unmanaged.

[0105] Please refer to Figure 2 , Figure 2A structural schematic diagram of a network device security service enhancement device provided by a second embodiment of the application. The second embodiment of the application provides a network device security service enhancement device, which is applied to a network device; the device comprises: a local configuration query module 201, configured to determine whether a network device has a configuration active network isolation strategy locally in a case that the network device itself is in a state of being out of management; wherein the active network isolation strategy is used to guide the network device to actively perform network disconnection or isolation on a target device connected to the network device, so as to refuse to forward a service packet of the target device; a first service forwarding module 202, configured to perform a service forwarding task of the network device according to the active network isolation strategy if there is the active network isolation strategy; a second service forwarding module 203, configured to perform the service forwarding task according to a basic service forwarding strategy of the network device if there is no the active network isolation strategy; wherein the basic service forwarding strategy is used to guide the network device to forward service packets of each device connected to the network device; and a security service running module 204, configured to run an additional security service of the network device locally; wherein the additional security service comprises one or more of a device network management service, a device security protection service, a log and alarm service, and a network management recovery service.

[0106] In optional embodiments, the device further comprises a management state monitoring module, configured to: acquire a network connectivity state monitoring result and a device management function monitoring result sent by the network management device; wherein the network connectivity state monitoring result is whether the network device is connected to the network management device, and the device management function monitoring result is whether a management function of the network management device is running normally; if the network connectivity state monitoring result is that the network device is connected to the network management device, and the device management function monitoring result is that the management function of the network management device is running normally, it is determined that the network device itself is in a state of being in management; if the network connectivity state monitoring result is that the network device is not connected to the network management device, or the device management function monitoring result is that the management function of the network management device is running abnormally, it is determined that the network device itself is in a state of being out of management.

[0107] In an optional embodiment, the obtaining the network connectivity state monitoring result and the device management function monitoring result sent by the network management device comprises: in response to a ping request sent by the network management device, verifying whether a source IP address carried by the ping request is the same as an IP address of the target network management device stored locally by the network device; if the source IP address carried by the ping request is the same as the IP address of the target network management device, returning a ping response to the network management device, otherwise discarding the ping request, so that the network management device sends the network connectivity state monitoring result to the network device by determining whether the ping request is a timeout response; in response to an encrypted management request sent by the network management device, verifying whether identity information carried by the encrypted management request is the same as identity information of the target network management device, and verifying whether a remote management instruction carried by the encrypted management request is a legal instruction; if the identity information carried by the encrypted management request is the same as the identity information of the target network management device, and the remote management instruction carried by the encrypted management request is the legal instruction, returning an encrypted management response to the network management device, otherwise discarding the encrypted management request, so that the network management device sends the device management function monitoring result to the network device by determining whether the encrypted management request is a timeout response.

[0108] In an optional embodiment, the performing the service forwarding task of the network device according to the active network isolation strategy comprises: for each device connected to the network device, determining whether a current device satisfies a trigger condition of the active network isolation strategy; wherein the trigger condition comprises one or more of a security threat existing in the device, a violation operation performed by the device, and a failure of the device; if yes, regarding the current device as a target device to perform network disconnection or isolation according to the active network isolation strategy, and refusing to forward a service packet of the target device; if no, forwarding a service packet of the current device according to a basic service forwarding strategy.

[0109] In an optional embodiment, the additional security service comprises a device network management service; the running the additional security service locally of the network device comprises: responding to a local management instruction input by a management user through a network management protocol locally of the network device and / or a network management interface of the network device itself, and performing a network management task of the network device; wherein the network management protocol comprises an SNMP protocol, and the network management interface comprises one or more of a Telnet interface, an SSH interface, and a Web interface.

[0110] In an optional embodiment, the additional security service comprises a device security protection service; the running the additional security service locally of the network device comprises: performing a device security protection task of the network device according to a device security protection strategy locally of the network device; wherein the device security protection strategy comprises one or more of a device access control strategy, a device attack protection strategy, and a traffic direction control strategy.

[0111] In an optional embodiment, the additional security service includes a log and alarm service; the additional security service running locally on the network device includes: generating a system log of the network device, and storing the system log locally on the network device; sending target alarm information according to an alarm processing strategy locally on the network device; wherein the target alarm information is used to indicate that the network device is in the unmanaged state.

[0112] In an optional embodiment, the additional security service includes a network management recovery service; the additional security service running locally on the network device includes: performing a network management recovery task of the network device according to a network management recovery strategy configured locally on the network device, to recover management of the network device on the network device by the network management device.

[0113] In an optional embodiment, the network device includes one or more of a switch, a router, a firewall, and a server.

[0114] The implementation process of the functions and roles of the various modules in the apparatus is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0115] Please refer to Figure 3 , Figure 3 A structure diagram of a network device security service strengthening system provided by the third embodiment of the present application. The third embodiment of the present application provides a network device security service strengthening system 30, which includes a network management device 301, and at least one network device 302 connected with the network management device 301; each network device 302 in the at least one network device 302 is configured to: in a case where the network device 302 itself is in an unmanaged state, determine whether there is a configured active network isolation strategy locally on the network device 302; wherein the active network isolation strategy is used to guide the network device 302 to actively perform network isolation or disconnection on a target device connected with the network device 302, to refuse to forward a service packet of the target device; if there is, performing a service forwarding task of the network device 302 according to the active network isolation strategy; if there is not, performing a service forwarding task according to a basic service forwarding strategy locally on the network device 302; wherein the basic service forwarding strategy is used to guide the network device 302 to forward service packets of each device connected with the network device 302; running an additional security service locally on the network device 302; wherein the additional security service includes one or more of a device network management service, a device security protection service, a log and alarm service, and a network management recovery service.

[0116] The implementation process of the functions and roles of the various network devices 302 in the system is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0117] Please refer to Figure 4 , Figure 4A structural schematic diagram of an electronic device is provided in the fourth embodiment of the present application. The fourth embodiment of the present application provides an electronic device 40, which comprises a processor 401, a memory 402, and a computer program stored in the memory 402 and configured to be executed by the processor 401; the processor 401 implements the method described in the first embodiment of the present application when executing the computer program, and can achieve the same beneficial effects.

[0118] The processor 401 reads the computer program from the memory 402 through the bus 403 and executes the computer program, and can implement the method described in the first embodiment of the present application.

[0119] The processor 401 can process digital signals, and can include various computing structures. For example, a complex instruction set computer structure, a reduced instruction set computer structure, or a structure implementing a combination of multiple instruction sets. In some examples, the processor 401 can be a microprocessor.

[0120] The memory 402 can be used to store instructions executed by the processor 401 or data related to the execution process of the instructions. These instructions and / or data can include code for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 401 of the embodiments of the present disclosure can be used to execute instructions in the memory 402 to implement the method described in the first embodiment of the present application. The memory 402 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memories well known to those skilled in the art.

[0121] The fifth embodiment of the present application provides a computer program product, which comprises instructions for causing a computer to implement the method described in the first embodiment of the present application when the instructions are executed by the computer, and can achieve the same beneficial effects.

[0122] The method described in the first embodiment of the present application can be implemented by software, hardware, firmware, or any combination thereof, in whole or in part. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product comprises one or more computer programs or instructions. When the computer programs or instructions are loaded and executed on a computer, the processes or functions described in the various embodiments of the present application are executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model), or other programmable devices.

[0123] The computer program or instructions can be stored in or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center through wired or wireless mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center and the like integrated with one or more available media. The available medium can be a magnetic medium, for example, a floppy disk, a hard disk, a magnetic tape; or an optical medium, for example, a digital video disc; or a semiconductor medium, for example, a solid state disk. The computer-readable storage medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0124] The sixth embodiment of the present application provides a computer-readable storage medium, which comprises a stored computer program; wherein the computer program controls the device where the computer-readable storage medium is located to perform the method as described in the first embodiment of the present application when the computer program runs, and can achieve the same beneficial effects.

[0125] In summary, the embodiment of the present application provides a network device security service strengthening method, system, device and program product. The network device security service strengthening method is applied to a network device; the method comprises: determining whether there is a proactive network isolation policy configured locally in the network device in the case that the network device itself is in a disconnection state; wherein the proactive network isolation policy is used to guide the network device to actively disconnect or isolate a target device connected to the network device to refuse to forward the service packet of the target device; if there is, performing the service forwarding task of the network device according to the proactive network isolation policy; if there is not, performing the service forwarding task according to the basic service forwarding policy of the network device; wherein the basic service forwarding policy is used to guide the network device to forward the service packet of each device connected to the network device; running an additional security service of the network device; wherein the additional security service comprises one or more of a device network management service, a device security protection service, a log and alarm service and a network management recovery service. The embodiment of the present application pre-configures the basic service forwarding policy and one or more additional security services of the device network management service, the device security protection service, the log and alarm service and the network management recovery service in the network device, and customizes the proactive network isolation policy, so that the network device executes the local service forwarding task according to the proactive network isolation policy if there is the proactive network isolation policy configured locally after disconnection, executes the local service forwarding task according to the basic service forwarding policy if there is no proactive network isolation policy configured locally, and runs the additional security service, which can consider the problem of data leakage risk after the network device is disconnected due to the inability to actively disconnect and isolate, support the configuration of the proactive network isolation policy locally in the network device, preferentially execute the service forwarding task according to the proactive network isolation policy, refuse to forward the service packet of the disconnected or isolated device, and increase the configuration of the additional security service to run, guarantee the comprehensiveness and availability of the local processing mechanism of the network device, and thus realize the strengthening of the security service of the network device from multiple aspects to ensure the controllability of the risk after the network device is disconnected.

[0126] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiments described above are merely illustrative, for example, the flowcharts and block diagrams in the drawings show the possible implementation architecture, function and operation of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders from those described in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and they can also be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for executing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0127] In addition, the functional modules in the embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0128] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0129] The above merely provides specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A network device security service enhancement method, characterized by, The application is applied to a network device, and the method comprises: In the case that the network device itself is in a state of being out of management, determining whether there is a configuration of an active network isolation strategy locally in the network device; wherein the active network isolation strategy is used to guide the network device to actively disconnect or isolate a target device connected to the network device to refuse to forward the business message of the target device; If there is, performing the business forwarding task of the network device according to the active network isolation strategy; If there is not, performing the business forwarding task according to the basic business forwarding strategy locally in the network device; wherein the basic business forwarding strategy is used to guide the network device to forward the business message of each device connected to the network device; Running an additional security service locally in the network device; wherein the additional security service comprises one or more of a device network management service, a device security protection service, a log and alarm service, and a network management recovery service.

2. The method of claim 1, wherein, The method further comprises: Obtaining the network connection state monitoring result and the device management function monitoring result sent by the network management device; wherein the network connection state monitoring result is whether the network device is connected to the network management device, and the device management function monitoring result is whether the management function of the network management device is running normally; If the network connection state monitoring result is that the network device is connected to the network management device, and the device management function monitoring result is that the management function of the network management device is running normally, it is determined that the network device itself is in a state of being in management; If the network connection state monitoring result is that the network device is not connected to the network management device, or the device management function monitoring result is that the management function of the network management device is running abnormally, it is determined that the network device itself is in a state of being out of management.

3. The method of claim 2, wherein, The method further comprises: In response to the ping request sent by the network management device, verifying whether the source IP address carried by the ping request is the same as the IP address of the target network management device stored locally in the network device; If the source IP address carried by the ping request is the same as the IP address of the target network management device, returning the ping response to the network management device, otherwise discarding the ping request, so that the network management device sends the network connection state monitoring result to the network device by determining whether the ping request is timed out; In response to the encrypted management request sent by the network management device, verifying whether the identity information carried by the encrypted management request is the same as the identity information of the target network management device, and verifying whether the remote management instruction carried by the encrypted management request is a legal instruction; If the identity information carried by the encrypted management request is the same as the identity information of the target network management device, and the remote management instruction carried by the encrypted management request is a legal instruction, an encrypted management response is returned to the network management device, otherwise the encrypted management request is discarded, and the network management device sends the device management function monitoring result to the network device by determining whether the encrypted management request is a timeout response.

4. The method of claim 1, wherein, The performing the service forwarding task of the network device according to the active network isolation strategy comprises: For each device connected to the network device, it is determined whether the current device satisfies the trigger condition of the active network isolation strategy; wherein the trigger condition comprises one or more of a security threat of the device, a violation operation performed by the device and a fault of the device; If yes, the current device is taken as the target device to be disconnected or isolated according to the active network isolation strategy, and the service packet of the target device is refused to be forwarded; If no, the service packet of the current device is forwarded according to the basic service forwarding strategy.

5. The method of claim 1, wherein, The additional security service comprises a device network management service; the additional security service running locally on the network device comprises: A network management protocol locally on the network device and / or a network management interface of the network device itself are used to respond to a local management instruction input by a management user, and perform a network management task of the network device; wherein the network management protocol comprises an SNMP protocol, and the network management interface comprises one or more of a Telnet interface, an SSH interface and a Web interface.

6. The method of claim 1, wherein, The additional security service comprises a device security protection service; the additional security service running locally on the network device comprises: A device security protection task of the network device is performed according to a device security protection strategy locally on the network device; wherein the device security protection strategy comprises one or more of a device access control strategy, a device attack protection strategy and a traffic direction control strategy.

7. The method of claim 1, wherein, The additional security service comprises a log and alarm service; The additional security service running locally on the network device comprises: A system log of the network device is generated, and the system log is stored locally on the network device; Target alarm information is sent according to an alarm processing strategy locally on the network device; wherein the target alarm information is used to indicate that the network device is in a disconnection state.

8. The method of claim 1, wherein, The additional security service comprises a network management recovery service; the additional security service running locally on the network device comprises: A network management recovery task of the network device is performed according to a network management recovery strategy configured locally on the network device, so as to recover the management of the network device by a network management device.

9. The method according to any one of claims 1 to 8, characterized in that, The network device comprises one or more of a switch, a router, a firewall and a server.

10. A network device security service enhancement system, characterized by, The network device comprises one or more of a switch, a router, a firewall and a server. In a case that the network device itself is in a disconnection state, it is determined whether there is a proactive network disconnection isolation policy configured locally at the network device; wherein the proactive network disconnection isolation policy is used to guide the network device to actively disconnect or isolate a target device connected to the network device to reject forwarding of a service packet of the target device; If yes, the network device performs a service forwarding task according to the proactive network disconnection isolation policy; If no, the network device performs the service forwarding task according to a basic service forwarding policy locally at the network device; wherein the basic service forwarding policy is used to guide the network device to forward service packets of each device connected to the network device; An additional security service locally at the network device is run; wherein the additional security service includes one or more of a device network management service, a device security protection service, a log and alarm service, and a network management recovery service.

11. An electronic device, comprising: The computer program product comprises instructions which, when executed by a computer, cause the computer to implement the method according to any one of claims 1 to 9.

12. A computer program product, characterised in that, The computer program product comprises instructions which, when executed by a computer, cause the computer to implement the method according to any one of claims 1 to 9.

Images