A method of deploying a gateway system and related devices

Abstract

The application relates to a gateway system deployment method and related equipment. The method comprises the following steps: in response to server booting based on a PXE mode, obtaining an authorization token, a gateway address and a filling control center IP address from an approval center according to server device information; wherein the authorization token is generated by the approval center when the server's download permission is approved according to the server device information; when the approval is passed, the approval center is also used for generating a device key and synchronizing the device key to the filling control center; cross-segment routing is established according to the gateway address, and the device key and a system image file are obtained from the filling control center via the cross-segment routing according to the authorization token; the check information ciphertext is decrypted according to the device key, the boot image is checked according to the check policy and the check value obtained through decryption, and the boot image is installed when the check is passed. The method embodiment realizes automatic deployment of the gateway system and improves the security of the gateway system.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method for deploying a gateway system and related equipment. Background Technology

[0002] In scenarios such as data centers, edge computing, and the Internet of Things (IoT), a large number of gateway hardware devices need to undergo batch "installation" (configuration) of operating systems and business software before leaving the factory or going online to achieve a ready-to-use effect. Most related solutions use manual installation and deployment or pre-installed image cloning.

[0003] Although the above-mentioned solutions in related technologies can achieve batch deployment, they have problems such as high labor costs, low degree of system deployment automation, and poor security of the deployed gateway system due to numerous security vulnerabilities.

[0004] There is currently no effective solution to the aforementioned problems in the relevant technologies. Summary of the Invention

[0005] The present invention provides a gateway system deployment method and related equipment, which at least solves the problems of high labor costs, low automation and poor security in the gateway system deployment schemes of related technologies.

[0006] To address the aforementioned problems, one aspect of this invention provides a deployment method for a gateway system, applied to a server, the method comprising:

[0007] In response to the server starting in PXE mode, the system obtains an authorization token, gateway address, and filling control center IP address from the approval center based on the server device information and the approval center IP address. The authorization token is generated when the approval center approves the server's download permissions based on the server device information and the approval is successful. Upon successful approval, the approval center also uses the token to generate a device key and synchronize the device key to the filling control center.

[0008] A cross-network segment route is established based on the gateway address, and the device key and system image file are obtained from the filling control center via the cross-network segment route based on the authorization token; the system image file includes a boot image and encrypted verification information.

[0009] The verification information is decrypted using the device key. The boot image is then verified using the decrypted verification policy and verification value. If the verification passes, the boot image is installed.

[0010] In some embodiments, the system image file also includes firewall policies; after the boot image is successfully installed, the method further includes:

[0011] Establish a connection with the business system to obtain the first business port to be monitored, and configure firewall rules according to the firewall policy and the first business port to be monitored.

[0012] Generate a second service port, establish a mapping relationship between the second service port and the first service port, and use the second service port as the port exposed by the gateway system to the public network and / or the front-end network.

[0013] In some embodiments, the method further includes:

[0014] Based on a preset period, random service ports are generated periodically, and the second service port is updated based on the random service ports, as well as the mapping relationship.

[0015] In some embodiments, after the boot image is successfully installed, the method further includes:

[0016] Send test data packets to the business system and receive the processing results returned by the business system to verify the system functions and integrity of the installed gateway system based on the test data packets and processing results.

[0017] In some embodiments, the steps of obtaining the authorization token, gateway address, and filling control center IP address from the approval center based on server device information and the approval center IP address include:

[0018] In response to the server starting in PXE mode, it sends an address allocation request to the DHCP server, and after receiving the server IP address allocated by the DHCP server, it broadcasts an ARP request within its network segment to obtain the approval center IP address.

[0019] Based on the IP address of the approval center, server device information is sent to the approval center so that: the approval center approves the download permission of the server based on the server device information, generates an authorization token and device key when the approval is approved, and sends the authorization token, gateway address, and filling control center IP address to the server, and synchronizes the device key to the filling control center.

[0020] In some embodiments, the steps of starting the server in PXE mode include:

[0021] In response to the server being connected to the network cable, the system selects PXE mode for booting based on the pre-configuration of the Basic Input / Output System (BIOS).

[0022] In some embodiments, the verification information ciphertext includes verification policy ciphertext and verification value ciphertext encrypted with a device key; the step of decrypting the verification information ciphertext according to the device key and verifying the boot image according to the decrypted verification policy and verification value includes:

[0023] The ciphertext of the verification information is decrypted using the device key to obtain the plaintext of the verification policy and the plaintext of the verification value.

[0024] According to the verification policy, the digest value of the fragment to be verified is obtained from the boot image in plaintext. The digest value of the fragment to be verified is verified in plaintext according to the verification value. If all verifications pass, the boot image is installed.

[0025] If any segment to be verified fails verification, the system image file will be retrieved again from the filling control center.

[0026] To address the aforementioned problems, one aspect of this invention provides a deployment apparatus for a gateway system, including a server, a filling control center, and an approval center; wherein...

[0027] The server is used to respond to the server starting in PXE mode. Based on the server device information and the approval center IP address, it obtains the authorization token, gateway address, and filling control center IP address from the approval center. It establishes a cross-network segment route based on the gateway address to obtain the device key and system image file from the filling control center. The system image file includes a boot image and encrypted verification information. The encrypted verification information is decrypted based on the device key. The boot image is verified based on the decrypted verification policy and verification value. If the verification passes, the boot image is installed.

[0028] The approval center is used to approve the download permissions of the server based on the server device information. When the approval is approved, it generates an authorization token and a device key, and sends the authorization token, gateway address, and filling control center IP address to the server, and synchronizes the device key to the filling control center.

[0029] The filling control center is used to receive authorization tokens sent by the server via cross-network segment routing, and to send device keys and system image files to the server.

[0030] To address the aforementioned problems, one aspect of this invention provides an electronic device, including: a processor and a memory storing a program, the program including instructions that, when executed by the processor, cause the processor to perform any of the above-described gateway system deployment methods.

[0031] To address the aforementioned problems, one aspect of this invention provides a non-transitory machine-readable medium storing computer instructions for causing a computer to execute any of the above-described gateway system deployment methods.

[0032] The beneficial effects of this invention are as follows: By adopting a PXE-based startup response server, the authorization token, gateway address, and filling control center IP address are obtained from the approval center based on the server device information and the approval center IP address. The authorization token is generated when the approval center approves the server's download permissions based on the server device information and the approval is successful. Upon successful approval, the approval center also generates a device key and synchronizes it to the filling control center. A cross-network segment route is established based on the gateway address, and the device key and system image file are obtained from the filling control center via the cross-network segment route based on the authorization token. The system image file includes a boot image and verification information. The method involves decrypting the encrypted verification information using the device key, verifying the boot image based on the decrypted verification policy and value, and installing the boot image if the verification passes. This approach overcomes the problems of high manual costs, low automation, and poor security in related gateway system deployment schemes. It achieves pre-installation of the operating system using PXE technology, reducing manual intervention and labor costs, automating gateway system deployment, improving deployment efficiency, and enhancing the security of the deployed gateway system by approving server download permissions before installation and verifying the boot image using the verification policy after download.

[0033] Details of one or more embodiments of the present invention are set forth in the following drawings and description, so that other features, objects and advantages of the invention will be more readily understood. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a schematic diagram of the main process of deploying a gateway system according to one embodiment of the present invention.

[0036] Figure 2 This is a schematic diagram illustrating the main process of server startup and obtaining system image file in one embodiment of the present invention.

[0037] Figure 3 This is a schematic diagram illustrating the main process of installing a boot image, configuring a firewall, and performing a system self-test through a server, as described in one embodiment of the present invention.

[0038] Figure 4This is a schematic diagram of the main framework of a gateway system deployment device according to one embodiment of the present invention.

[0039] Figure 5 This is a schematic diagram of the electronic device of the present invention. Detailed Implementation

[0040] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the invention. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention.

[0041] The main solutions based on manual installation and deployment in related technologies involve maintenance personnel carrying CDs, USB drives, or external hard drives to install the operating system on each device, followed by manual configuration of business software, firewall policies, and security hardening. The main solutions based on pre-installed image cloning involve using tools such as Ghost, Kickstart, and WDS at the factory or integrator to clone the system image to the device's hard drive in one go, and then shipping it in bulk.

[0042] Although the above solution can achieve batch deployment, the applicant found at least the following problems during implementation: (1) Lack of security mechanism: There is no identification of hardware identity before installation, which means that any device that has obtained the image can be directly installed, and it cannot prevent unauthorized devices from accessing; during the installation process, the image file is transmitted in plaintext or simple verification, which is easy to be intercepted, tampered with or implanted with malicious code by man-in-the-middle; after installation, the system ports, services and firewall policies are all statically configured, which do not match the actual business ports, resulting in a large exposure surface and easy to be scanned and attacked. (2) Static configuration leads to low security: Firewall rules need to be manually sorted out and then manually issued, which is time-consuming and prone to errors. Moreover, the business ports are usually fixed, and attackers can carry out brute-force cracking or vulnerability exploitation on known ports for a long time. (3) High labor cost and low efficiency: Manual or semi-automatic methods result in long deployment cycle and high cost, and it is difficult to complete the functional integrity self-check before the device goes online.

[0043] To address the aforementioned problems, embodiments of the present invention provide a deployment method for a gateway system, applied to a server, such as... Figure 1 As shown, the deployment method of this gateway system mainly includes:

[0044] Step S101: In response to the server starting in PXE mode, the authorization token, gateway address, and filling control center IP address are obtained from the approval center based on the server device information and the approval center IP address. The authorization token is generated when the approval center approves the server's download permission based on the server device information and the approval is successful. When the approval is successful, the approval center also uses it to generate a device key and synchronize the device key to the filling control center.

[0045] Step S102: Establish a cross-network segment route based on the gateway address, and obtain the device key and system image file from the filling control center via the cross-network segment route based on the authorization token; wherein, the system image file includes a boot image and encrypted verification information.

[0046] Step S103: Decrypt the ciphertext of the verification information according to the device key, verify the boot image according to the verification policy and verification value obtained from the decryption, and install the boot image if the verification passes.

[0047] Based on the above settings, the gateway system deployment scheme provided in this application triggers a fully automated process upon PXE (Preboot Execution Environment, a network boot specification that allows a computer to download a boot image and enter an installation or running state using only the firmware in its network card before loading any local operating system) startup. This process mainly includes obtaining a token and gateway address; establishing a route; acquiring resources; verifying resources; and installing resources. This significantly reduces manual intervention, lowers labor costs, and improves deployment efficiency and automation. Furthermore, based on the interconnected design of device information approval and authorization, security token verification, encrypted transmission of verification information, secure distribution of device keys, and mandatory pre-installation decryption verification, while significantly improving deployment automation and reducing labor costs, it overcomes the two key security issues of missing identity authentication and easy tampering of image transmission in related technologies, thereby achieving the core effect of improving the security of gateway system deployment.

[0048] Specifically, according to step S101 of the embodiments of this application, the server only needs to connect to the network and be configured for PXE boot (usually pre-set in the BIOS (Basic Input Output System)) to automatically trigger the entire deployment process. This eliminates the need for manual insertion of installation media or manual startup of the installation program, directly reducing labor costs and increasing automation. Simultaneously, using the approval center server as the core security control point, the server approves download permissions for received server device information, ensuring that only approved and legitimate server devices (to which authorization tokens are issued) can enter the subsequent deployment process.

[0049] Furthermore, in this embodiment of the application, when the approval is granted, a device key is generated using a trusted approval center. This device key is not directly sent to the server, but is instead sent to the filling control center. This achieves separate management of the device key and the authorization token, thereby further improving security.

[0050] The server device information provided in this application serves as a unique identifier for the server. It can be information such as MAC address and serial number, or it can be device fingerprint information calculated using information such as the server's CPU, OS, hard disk size, hardware manufacturer, and geographical location.

[0051] In the solution provided in this application, the server and the filling control center are deployed on different network segments. The ordinary network and the filling-specific network are isolated by a gateway, which is equivalent to adding physical isolation to the transmission channel and reducing the risk that the filling control center may be compromised by an unauthorized server and obtain the boot image.

[0052] For example, according to step S102 of the embodiments of this application, a route is established through the gateway address, enabling the server to access the filling control center across network segments, thus providing network reachability for automated deployment. When the server requests resources (device key, system image file) from the filling control center, it must provide an authorization token. The filling control center verifies the validity of the authorization token (whether it was issued by the approval center, whether it corresponds to an approved device, whether it is within the validity period, etc.). Only when the token validity verification is passed will the filling control center issue resources. Based on the above steps, it is ensured that only legitimate servers approved by S101 can obtain the deployment image and key. Through server identity verification and download access control, the security and reliability before the download of the boot image corresponding to the gateway system is increased.

[0053] Meanwhile, the verification information included in the system image file is in encrypted form, making it impossible for attackers to easily obtain or tamper with valid verification information to conceal their tampering with the boot image even if they intercept the system image file package during transmission. Furthermore, it is understandable that the boot image can also be encrypted to prevent its leakage.

[0054] In some examples, according to step S103 of the embodiments of this application, before installation, the device key is used to decrypt the ciphertext of the verification information to obtain the plaintext verification strategy and verification value, and the obtained boot image is strongly verified to prevent the installation of an image that has been tampered with or injected with malicious code, thereby providing a guarantee for the secure operation of the subsequent gateway system.

[0055] In some embodiments, the system image file also includes firewall policies; after the boot image is successfully installed, the method further includes: establishing a connection with the business system to obtain a first business port to be monitored, configuring firewall rules according to the firewall policies and the first business port to be monitored; generating a second business port, constructing a mapping relationship between the second business port and the first business port, and using the second business port as the port exposed by the gateway system to the public network and / or the front-end network.

[0056] Based on the above settings, this application achieves dynamic and automated firewall configuration through several key operations: "pre-setting basic firewall policy templates in the system image file, actively obtaining the actual business ports of the business system after installation, and dynamically generating public network mapping ports." This solves the problems of inefficiency and error-proneness caused by manually sorting out business ports and manually configuring firewall rules in related technical solutions. Moreover, by dynamically generating public network mapping ports, the number of fixed ports exposed to the public network or front-end network that are available for attackers to scan and attack is significantly reduced, increasing the difficulty for attackers to detect and attack.

[0057] Specifically, by pre-setting firewall policies in the system image file and dynamically obtaining the actual business port (first business port) after installation, the system can automatically merge the two to generate specific firewall rules, thereby eliminating the delay and error risk of manual configuration and significantly improving deployment efficiency and configuration accuracy.

[0058] The firewall rules provided in this application can be configured automatically and accurately based on actual business needs (the first business port).

[0059] In addition, the firewall policy provided in this application can automatically generate firewall rules in combination with the business port to be monitored, and can also be set to perform more granular control based on the characteristics of business traffic (such as protocol type, traffic size, etc.).

[0060] According to a specific implementation of this application, after successful installation, the gateway system actively connects to the business system to query or obtain the port number (first business port) that the business system actually needs to listen to and provide services for, to ensure that the obtained port number is the current real and accurate port requirement of the business system; then, it configures firewall rules according to the firewall policy and the first business port: the gateway system populates or applies the obtained dynamic information of the first business port into a preset firewall policy template. For example, the firewall policy template may contain a rule: "Allow public network access to port".<business_port> "TCP traffic", the gateway system will<business_port> The first service port value (e.g., 8080) is replaced with the actual obtained first service port value, thus generating a specific firewall rule that allows access to that particular port. To further enhance security, the gateway system dynamically generates a new, random port number (second service port) at runtime. This random port has no direct or predictable association with the first service port actually used by the service system (e.g., 8080). The gateway system only exposes the dynamically generated second service port to the public network or front-end network, thereby hiding the first service port actually used by the service system (e.g., 8080) behind the gateway, making it completely invisible to the outside world. Furthermore, during the process of establishing the mapping relationship between the second service port and the first service port, network address translation rules or port forwarding rules established internally by the gateway system can be used to redirect traffic sent to the second service port to the first service port that the service system is listening on.

[0061] In some instances, port remapping can be performed by combining factors such as timestamps and random numbers to increase the unpredictability of the mapping relationships. Additionally, when periodically changing the mapping relationships of service ports, the old mapping relationships need to be invalidated to prevent malicious exploitation.

[0062] In some embodiments, the method further includes: periodically generating random service ports according to a preset period duration, updating the second service port based on the random service ports, and updating the mapping relationship.

[0063] Based on the above settings, the proactive defense mechanism of "periodic forced switching of randomly exposed ports" further introduces two key security dimensions: "time limit" and "dynamic change," building upon the existing mechanism of hiding (reducing the static exposure surface) the actual business ports (first business ports) of the business system. By forcibly and periodically rotating the exposed ports (second business ports) and maintaining their high degree of randomness, the network exposure surface of the gateway system is transformed from "statically fixed" to "dynamically drifting," effectively countering continuous attacks based on port scanning. Even if an attacker successfully scans or detects the currently exposed port (the old second business port), the port will become invalid after a preset time, preventing the attacker from using this information for long-term, continuous attacks.

[0064] In some embodiments, after the boot image is successfully installed, the method further includes: sending a test data packet to the business system and receiving the processing result returned by the business system, so as to verify the system function and system integrity of the installed gateway system based on the test data packet and the processing result.

[0065] The test data packets provided in this application embodiment include at least: test data covering key functional points of the gateway, such as requests containing specific protocols, traffic that needs to be allowed by security policies, and target addresses that need to be routed and forwarded, so as to test whether the various preset functions of the gateway system can work normally.

[0066] Based on the above settings, after the installation process is complete, automatic self-checks are performed on the core business functions of the gateway system (such as routing, forwarding, protocol processing, and security policy execution) and system status (such as whether critical services are running normally and whether configurations are effective), without waiting for manual testing after deployment. This enables the early detection of functional defects or integrity issues caused by installation errors, image corruption, missing or incompatible configurations, or service startup failures on server devices with the installed gateway system installed, before they are officially put into business operation. This avoids exposing problematic systems directly to the production environment. Through post-installation verification operations, the confidence in successful deployment is significantly improved, ensuring the availability of the deployed gateway system.

[0067] In some instances, in addition to verifying the accuracy of functions, performance testing and security vulnerability scanning can be incorporated into the system self-test process to further improve the security and reliability of the deployed gateway system.

[0068] According to a specific embodiment of this application, the steps for a gateway system to verify the system functionality and integrity of the installed gateway system based on test data packets and processing results may include: first, determining whether a processing result has been received to verify the basic network connectivity between the gateway system and the business system and the basic forwarding function of the gateway; then, verifying whether the processing result meets expectations, such as verifying whether the gateway system correctly parses the data packet, applies security policies (e.g., allows passage), executes correct routing / forwarding rules, and whether protocol processing is normal. For example, sending an encrypted test packet and receiving a confirmation of successful decryption from the business system verifies the gateway's encrypted transmission function; sending a packet that should be blocked by the firewall and receiving no response or a rejection response from the business system verifies the firewall policy function.

[0069] By simulating real business interactions (sending test data packets and receiving processing results), the core business logic of the gateway system (routing, forwarding, security policies, protocol support, etc.) can be directly verified to ensure it functions as expected. Successful functional verification also depends on the integrity of the gateway system (e.g., all necessary services are started, configuration files are loaded correctly, and dependencies are not missing). For example, if the library files required by the encryption module are lost during installation (integrity breach), sending encryption test packets will inevitably lead to functional verification failure. Furthermore, the process of receiving and processing results also verifies the integrity of the network stack and service listening ports. Through the above post-installation self-checking operations, the probability of the deployed gateway system being fully functional and usable is significantly increased, achieving a ready-to-use effect.

[0070] Figure 3 This is a schematic diagram illustrating the main process of installing a boot image, configuring a firewall, and performing a system self-test through a server, as described in one embodiment of the present invention. Figure 3As shown, a specific implementation of this application includes: after the server downloads the system image file, it decrypts the encrypted verification information according to the device key to obtain the plaintext verification policy and the plaintext verification value; it obtains the digest value of the fragment to be verified from the boot image according to the plaintext verification policy, and verifies the digest value of the fragment to be verified according to the plaintext verification value. If any fragment to be verified fails verification, the corresponding fragment is re-obtained from the filling control center. If all verifications pass, the boot image is installed. After installation, a connection is established with the business system to obtain the first business port to be monitored. Firewall rules are configured according to the firewall policy and the first business port to be monitored. A second business port is generated, a mapping relationship between the second business port and the first business port is constructed, and the second business port is used as the port exposed by the gateway system to the public network and / or the front-end network. After successful installation, test data packets can also be sent to the business system, and the processing results returned by the business system can be received to verify the system function and system integrity of the installed gateway system based on the test data packets and processing results.

[0071] In some embodiments, the steps of obtaining the authorization token, gateway address, and filling control center IP address from the approval center based on server device information and approval center IP address include: in response to the server starting in PXE mode, sending an address allocation request to the DHCP server, and after receiving the server IP address allocated by the DHCP server, broadcasting an ARP request within the network segment to obtain the approval center IP address; and sending server device information to the approval center based on the approval center IP address, so that: the approval center approves the server's download permission based on the server device information, generates an authorization token and device key when the approval is passed, and sends the authorization token, gateway address, and filling control center IP address to the server, and synchronizes the device key to the filling control center.

[0072] Based on the above settings, by combining DHCP (to obtain its own address) and ARP broadcast (to dynamically discover the IP of the approval center in the same network segment), the zero-configuration automated discovery of the approval center address is achieved, which simplifies the preparation work before deployment. At the same time, the standard DHCP and ARP protocols complete the network configuration and critical service discovery without the need to introduce additional and complex service discovery protocols (such as DNS, mDNS, LLMNR, etc.), which reduces the implementation complexity and the requirements for the deployment environment.

[0073] This means that the server can automatically locate the approval center and initiate subsequent approval requests without needing to know or configure its specific IP address before startup, greatly simplifying the preparation work before deployment.

[0074] The ARP (Address Resolution Protocol) provided in this embodiment is a basic Layer 2 / IP address resolution protocol, built into all devices that support IP communication. Utilizing ARP broadcasting to discover the approval center within the local network segment offers the advantages of simple processes and low overhead.

[0075] Specifically, according to one embodiment of this application: After obtaining its own IP address, the server broadcasts an ARP request within its directly connected local network segment (VLAN or physical network segment). The essence of this broadcast is to ask, "Who is the approval center? Please tell me the MAC address corresponding to your IP address." An approval center pre-deployed within the same local network segment will receive this broadcast ARP request. If its IP address is valid within that network segment and configured to respond to such requests (usually its network interface only needs to be active), it will unicast its MAC address back to the requesting server. The server, through the received ARP response, naturally knows the IP address of the approval center within its network segment (because the ARP request queries the MAC address of a specific IP, and the response includes that IP). Based on the above operation, the need for pre-static configuration of the approval center's IP address in the server's BIOS, PXE scripts, or anywhere else is eliminated. This achieves "plug and play" functionality for the server; after plugging in the network cable and starting up, it can automatically find the approval center. This significantly improves the automation and flexibility of deployment, making it particularly suitable for large-scale deployment scenarios where the environment may change (such as factory production lines).

[0076] In some embodiments, the steps of booting the server in PXE mode include: in response to the server being connected to a network cable, selecting PXE mode for booting based on the pre-configuration of the Basic Input / Output System (BIOS).

[0077] Based on the above settings, by leveraging the pre-configuration capabilities of the hardware firmware (BIOS / UEFI), the PXE boot mode is set as the default and highest priority behavior. This allows the server to automatically, forcefully, and consistently trigger the entire subsequent automated security deployment process once the basic physical conditions (connected network cable and powered on) are met. In other words, through the simple physical action of "connecting the network cable" and the firmware-level setting of "BIOS pre-configuration PXE priority," the entire automated deployment process achieves unmanned, forced, and consistent triggering, significantly simplifying on-site operations and improving deployment efficiency and reliability. This fundamentally solves the pain point of traditional methods requiring manual selection of boot options for each machine, and is a key foundation for achieving large-scale, high-efficiency, and highly reliable "zero-contact" or "minimal-contact" automated deployment.

[0078] In this embodiment, the server access network cable refers to connecting the server's network port to a network that supports PXE deployment (usually a network on the same network segment as the DHCP server and approval center).

[0079] In this embodiment, the pre-configuration of the basic input / output system refers to the pre-setting of the firmware layer (BIOS / UEFI) boot order before the server leaves the factory or is delivered. Specifically, the PXE network boot option is configured as the first boot option or has the highest priority (higher than local hard drive, USB, optical drive, etc.).

[0080] Figure 2 This is a schematic diagram illustrating the main process of server startup and obtaining the system image file in one embodiment of the present invention. Figure 2 As shown, a specific implementation of this application includes: After the server connects to the network cable, in response to the pre-configuration information of the hardware firmware (BIOS (Basic Input / Output System) / UEFI (Unified Extensible Firmware Interface)), it directly selects PXE mode for booting. Then, the server requests an IP address from the DHCP server, and after obtaining the assigned server IP address, it obtains the IP address of the approval center deployed in the same network segment via ARP broadcast. The server sends server device information to the approval center and receives the authorization token, gateway address, and filling control center IP address returned by the approval center upon approval of the server's download permission based on the server device information and upon successful approval (wherein, the approval center also generates a device key upon successful approval and synchronizes the device key to the filling control center). The server establishes a cross-network segment route based on the gateway address, and then sends the download request carrying the authorization token to the filling control center. The filling control center verifies the validity of the authorization token, and when the verification is successful, it uses the device key to encrypt the verification policy and verification value to generate verification information ciphertext, and then sends the system image file including the boot image and the verification information ciphertext to the server.

[0081] In some embodiments, the aforementioned ciphertext of verification information includes ciphertext of verification policy and ciphertext of verification value encrypted with a device key; the steps of decrypting the ciphertext of verification information according to the device key and verifying the boot image according to the decrypted verification policy and verification value include: decrypting the ciphertext of verification information according to the device key to obtain plaintext of verification policy and plaintext of verification value; obtaining the digest value of the segment to be verified from the boot image according to the plaintext of verification policy, verifying the digest value of the segment to be verified according to the plaintext of verification value, and if all verifications pass, installing the boot image; if any segment to be verified fails verification, re-obtaining the system image file from the filling control center.

[0082] Based on the above settings, the verification information in the system image file is in encrypted form, which helps prevent attackers from tampering with the verification strategy itself or the expected verification value during transmission (e.g., modifying the strategy to skip critical file verification, or providing a fake verification value that matches the tampered image), thereby bypassing the verification. The fragmented verification scheme not only verifies the integrity of the entire system image file, but also accurately verifies specific critical, sensitive, or easily tampered parts (fragments) of the boot image according to the verification strategy, ensuring the absolute trustworthiness of these core areas. Simultaneously, it absolutely prevents installation upon verification failure and triggers a mechanism to reacquire the image, fundamentally preventing the deployment of damaged or malicious boot images. Specifically, the verification strategy provided in this application determines how to verify the boot image (e.g., which specific fragments / regions in the image need digest values ​​to be calculated, and which digest algorithm, such as SHA-256, should be used). During the verification process, according to the requirements of the verification strategy, the actual digest value of the specified fragment / region in the boot image is calculated. Then, the calculated actual digest value is compared with the decrypted expected verification value in plaintext. If all fragments pass verification, the boot image installation is allowed; if any fragment fails verification, it is reacquired.

[0083] It should be noted that in actual operation, if one or more fragments fail to be verified, the corresponding fragment can be re-downloaded individually without having to re-download the entire system image file.

[0084] Meanwhile, in actual operation, the verification strategy should be set by comprehensively considering both security and verification efficiency. To balance both, the verification strategy can specify the critical, specific fragments / regions to be verified (e.g., kernel files, bootloaders, critical configuration files, etc.) and the hash algorithm used (e.g., SHA-256). This indicates the specific instructions and critical range for verification, allowing the verification to focus on calculating the hash values ​​of the critical fragments indicated in the strategy, avoiding the overhead of calculating a large number of fragments and improving verification efficiency. If the user has higher security requirements, a more granular fragmentation scheme or more specified fragments can be set in the verification strategy.

[0085] In some examples, the verification policy and checksum provided in this application are encrypted separately by the device key before transmission. They are then transmitted as a single encrypted unit (verification information ciphertext), but decryption yields two independent plaintext elements. Only a server with the correct device key can decrypt the original, unaltered verification policy plaintext and checksum plaintext. This ensures that any intermediate tampering with the verification information ciphertext will result in decryption failure or meaningless gibberish, failing subsequent verification logic. This ensures that the "instructions" (verification policy) and "standard answer" (checksum value) used by the server for verification are trustworthy and unmodified, thus avoiding the risk of "man-in-the-middle providing false policies or false checksum values."

[0086] The deployment method of the gateway system provided in this embodiment of the invention, in response to the server starting in PXE mode, obtains an authorization token, gateway address, and filling control center IP address from the approval center based on server device information and approval center IP address; wherein, the authorization token is generated by the approval center when it approves the server's download permission based on the server device information and the approval is successful; upon approval, the approval center also generates a device key and synchronizes the device key to the filling control center; a cross-network segment route is established based on the gateway address, and the device key and system image file are obtained from the filling control center via the cross-network segment route based on the authorization token; wherein, the system image file includes a boot image, The process involves verifying encrypted verification information; decrypting the encrypted verification information using the device key; verifying the boot image using the decrypted verification policy and verification value; and installing the boot image if the verification passes. This technique overcomes the problems of high manual costs, low automation, and poor security in related gateway system deployment schemes. It achieves pre-installation of the operating system using PXE technology, reducing manual intervention and labor costs, automating gateway system deployment, improving deployment efficiency, and enhancing the security of the deployed gateway system by approving server download permissions before installation and verifying the boot image using the verification policy after download.

[0087] Based on the gateway system deployment method provided in the embodiments of the present invention, the embodiments of the present invention also provide a gateway system deployment apparatus, such as... Figure 4 As shown, the deployment device 400 of the gateway system mainly includes:

[0088] Server 401 is used to respond to the server starting in PXE mode. Based on the server device information and the approval center IP address, it obtains the authorization token, gateway address, and filling control center IP address from the approval center. It establishes a cross-network segment route based on the gateway address to obtain the device key and system image file from the filling control center. The system image file includes a boot image and encrypted verification information. It decrypts the encrypted verification information based on the device key, verifies the boot image based on the decrypted verification policy and verification value, and installs the boot image if the verification passes.

[0089] Approval Center 402 is used to approve the download permissions of the server based on the server device information. When the approval is approved, an authorization token and a device key are generated, and the authorization token, gateway address, and filling control center IP address are sent to the server. The device key is synchronized to the filling control center.

[0090] The filling control center 403 is used to receive the authorization token sent by the server via cross-network segment routing, and to send the device key and system image file to the server.

[0091] Since the deployment device 400 of the above-mentioned gateway system is used to implement any of the above-mentioned gateway system deployment methods, the execution operations of each subsystem / module in the deployment device 400 of the above-mentioned gateway system are consistent with those in the aforementioned scheme, and can achieve all the beneficial effects corresponding to the aforementioned scheme. This application will not elaborate further here.

[0092] This invention also provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this invention.

[0093] This invention also provides a computer program product, including a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform the methods of embodiments of this invention. The computer program product should be understood as a software product that primarily implements the methods described above through a computer program.

[0094] This invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the electronic device to perform the method of this invention.

[0095] refer to Figure 5The present invention will now be described in the form of a structural block diagram of an electronic device that can serve as an embodiment of the present invention, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0096] like Figure 5 As shown, the electronic device includes a computing unit 501, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. The RAM 503 may also store various programs and data required for the operation of the electronic device. The computing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0097] Multiple components in the electronic device are connected to I / O interface 505, including: input unit 506, output unit 507, storage unit 508, and communication unit 509. Input unit 506 can be any type of device capable of inputting information into the electronic device. Input unit 506 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of the electronic device. Output unit 507 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 508 may include, but is not limited to, disks and optical discs. Communication unit 509 allows the electronic device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, and / or wireless communication transceivers, such as Bluetooth devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0098] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, CPUs, graphics processing units (GPUs), various special-purpose artificial intelligence (AI) computing units, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present invention can be implemented as a computer program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed on an electronic device via ROM 502 and / or communication unit 509. In some embodiments, the computing unit 501 can be configured to perform the methods described above by any other suitable means (e.g., by means of firmware).

[0099] Computer programs for implementing the methods of embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0100] In the context of embodiments of the present invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, or infrared systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0101] It should be noted that the term "comprising" and its variations used in the embodiments of the present invention are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present invention are illustrative and not restrictive. Those skilled in the art should understand that, unless explicitly indicated otherwise in the context, they should be understood as "one or more".

[0102] The user information / data involved in the embodiments of this invention (including but not limited to user device information / data, user personal information / data, information / data used for analysis, stored information / data, displayed information / data, etc.) are all information / data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0103] The steps described in the method embodiments provided by this invention can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of protection of this invention is not limited in this respect.

[0104] The term "embodiment" in this specification refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of the invention. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply independence or alternativeity from other embodiments. The various embodiments in this specification are described in a related manner, with reference to each other for similar or identical parts. In particular, for apparatus, device, and system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, and relevant details are referred to in the description of the method embodiments.

[0105] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the appended claims.

Claims

1. A method of deploying a gateway system, characterized by, Applied to a server, the method comprises: In response to the server starting based on a PXE mode, obtaining an authorization token, a gateway address and a filling control center IP address from an approval center according to server device information, wherein the authorization token is generated by the approval center when the download permission of the server is approved according to the server device information and the approval is passed; when the approval is passed, the approval center is also used for generating a device key and synchronizing the device key to the filling control center; According to the gateway address, a cross-segment routing is established, and a device key and a system image file are obtained from the filling control center via the cross-segment routing according to the authorization token, wherein the system image file comprises a boot image and a check information ciphertext; According to the device key, the check information ciphertext is decrypted, and the boot image is checked according to the check policy and the check value obtained by decryption, and in the case of passing the check, the boot image is installed.

2. The method of claim 1, wherein, The system image file also comprises a firewall policy; after the boot image is successfully installed, the method further comprises: A connection is established with a business system to obtain a first business port to be monitored, and a firewall rule is configured according to the firewall policy and the first business port to be monitored; A second business port is generated, a mapping relationship between the second business port and the first business port is constructed, and the second business port is used as a port exposed to the public network and / or the front-end network by the gateway system.

3. The method of claim 2, wherein, The method further comprises: According to a preset period length, a random business port is periodically generated, the second business port is updated based on the random business port, and the mapping relationship is updated.

4. The method of claim 1, wherein, After the boot image is successfully installed, the method further comprises: A test data packet is sent to a business system, and a processing result returned by the business system is received, so as to verify the system function and system integrity of the installed gateway system according to the test data packet and the processing result.

5. The method of claim 1, wherein, The step of obtaining an authorization token, a gateway address and a filling control center IP address from an approval center according to server device information and an approval center IP address comprises: In response to the server starting based on a PXE mode, an address allocation request is sent to a DHCP server, and after receiving a server IP address allocated by the DHCP server, an ARP request is broadcasted in the network segment to obtain an approval center IP address; According to the approval center IP address, server device information is sent to the approval center, so that the approval center approves the download permission of the server according to the server device information, generates an authorization token and a device key when the approval is passed, and sends the authorization token, a gateway address and a filling control center IP address to the server, and synchronizes the device key to the filling control center.

6. The method of claim 5, wherein, The step of starting the server based on the PXE mode comprises: In response to the server accessing a network cable, a PXE mode is selected for starting based on the pre-configuration of a basic input and output system.

7. The method of claim 1, wherein, The check information ciphertext includes check policy ciphertext and check value ciphertext encrypted via the device key; and the step of decrypting the check information ciphertext according to the device key and checking the boot image according to the decrypted check policy and check value includes: decrypting the check information ciphertext according to the device key to obtain check policy plaintext and check value plaintext; obtaining the digest values of the to-be-checked slices from the boot image according to the check policy plaintext, checking the digest values of the to-be-checked slices according to the check value plaintext, and installing the boot image if all the to-be-checked slices pass the check; if any to-be-checked slice fails the check, reacquiring the system image file from the filling control center.

8. A deployment apparatus of a gateway system, characterized by, The system includes a server, a filling control center and an approval center, wherein the server is configured to, in response to server-based PXE mode startup, acquire an authorization token, a gateway address and a filling control center IP address from the approval center according to server device information; establish cross-segment routing according to the gateway address to acquire a device key and a system image file from the filling control center; the system image file includes a boot image and check information ciphertext; decrypt the check information ciphertext according to the device key, check the boot image according to the decrypted check policy and check value, and install the boot image if the check passes; the approval center is configured to approve the download authority of the server according to the server device information, generate an authorization token and a device key if the approval passes, and send the authorization token, the gateway address and the filling control center IP address to the server and synchronize the device key to the filling control center; the filling control center is configured to receive the authorization token sent by the server via the cross-segment routing, and send the device key and the system image file to the server.

9. An electronic device comprising: A processor and a memory storing a program, characterized in that the program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory machine-readable medium having stored thereon computer instructions, wherein: The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 7.

Images