Network security management method, system and equipment based on array server and storage medium

Abstract

The invention discloses a network security management method, system and device based on an array server and a storage medium, and the method comprises the steps: enabling a client device to be connected to a corresponding computing node, obtaining the login information of a client through a BMC system, and constructing a protocol text token based on the login information, the format of the protocol text token comprises a function type, a timestamp, an IP address, an on-off state and a verification value, the IP address is the IP address of the client equipment, then the protocol text token is transmitted to a corresponding computing node, the computing node performs timing verification on the protocol text token, the client equipment after successful verification is allowed to be accessed, and the protocol text token is transmitted to the corresponding computing node. The black list and the white list of the client equipment ip are precisely controlled through the self-defined protocol text token, and the attack surface of the computing unit board card in an open network environment is effectively reduced, so that the security protection capability of the computing unit board card is remarkably improved.

Description

[0001] Technology Neighborhood This invention relates to the field of computer network technology, and in particular to network security management methods, systems, devices, and storage media based on array servers. Background Technology

[0002] Array servers manage multiple computing unit cards within a standard server chassis. The network of each computing unit card is divided into a service network and a management network via a backplane. The backplane is a Layer 2 network switching card containing two sets of switching systems for management and service respectively. Because all computing unit cards are exposed to the open network environment through the service network, it is necessary to improve the security protection capabilities of the computing unit cards. Summary of the Invention

[0003] The purpose of this invention is to address the technical problems existing in the background art by proposing a network security management method, system, device, and storage medium based on an array server.

[0004] To achieve the above-mentioned technical objectives, the technical solution adopted by the present invention is as follows: A first implementation of the first aspect of the present invention provides a network security management method based on an array server, wherein the array server includes a BMC system and multiple computing nodes, wherein the BMC system is electrically connected to each computing node, and the network security management method based on the array server includes: S101. Connect the customer's equipment to the corresponding computing node and use the BMC system to obtain the customer's login information; S102. Based on the login information, construct a protocol text token. The protocol text token includes the function type, timestamp, IP address, switch status, and check value. The IP address is the IP address of the client device. S103. The protocol text token is transmitted to the corresponding computing node, which performs periodic verification of the protocol text token and allows access to the client device after successful verification.

[0005] Optionally, in a second implementation of the first aspect of the present invention, the login information includes a request to access some or all of the specified computing nodes, a whitelist application request, and an IP address.

[0006] Optionally, in a third implementation of the first aspect of the present invention, the function type includes iptables or nftables functions, the timestamp is an integer Unix timestamp, the switch state includes an open state representing acceptance and a closed state representing rejection, and the check value is the sum of the ASCII value of the function type and the ASCII value of each character in the string in the IP address.

[0007] Optionally, in a fourth implementation of the first aspect of the present invention, constructing the protocol text token includes: S1021. Determine if the IP address is entered in the correct format; S1022. If it is not normal, report that the IP address format is abnormal; S1023. If normal, fill in the function type, timestamp, IP address, switch status and check value in the preset protocol text, and construct the protocol text token.

[0008] Optionally, in a fifth implementation of the first aspect of the present invention, the timed verification includes verifying the protocol text token every 10 minutes. Optionally, in a sixth implementation of the first aspect of the present invention, step S103 includes: S1031. Use the corresponding computing node to parse the protocol text token to extract the format content of the protocol text token.

[0009] S1032. Determine if the protocol text token exists; S1033. If the protocol text token does not exist, the corresponding compute node will be forced into hibernation. S1034. If the protocol text token exists, determine whether the format of the protocol text token satisfies the requirement of allowing access. S1035. If the access requirement is met, then the client equipment is allowed to access the corresponding computing node.

[0010] Optionally, in the seventh implementation of the first aspect of the present invention, the conditions for allowing access are that the function type is iptables, the timestamp format is correct, the IP address format is correct, the checksum value is correct, and the switch state is an open state representing acceptance.

[0011] A first implementation of the second aspect of the present invention provides a network security management system based on an array-type server, comprising: The information acquisition module is used to connect customer devices to the corresponding computing nodes and use the BMC system to obtain customer login information. The token building module is used to build a protocol text token based on login information. The format of the protocol text token includes function type, timestamp, IP address, on / off status and check value. The IP address is the IP address of the client device. The verification and access module is used to transmit the protocol text token to the corresponding computing node, which then performs periodic verification on the protocol text token and allows access to the client device after successful verification.

[0012] A first implementation of the third aspect of the present invention provides a network security management device based on an array server, the network security management device based on an array server comprising: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a line; The at least one processor invokes the instructions in the memory to cause the array-based network security management device to perform the array-based network security management method as described in any one of the first aspects of the present invention.

[0013] A first implementation of the fourth aspect of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the network security management method based on an array-type server as described in any one of the first aspects of the present invention.

[0014] Compared with existing technologies, this invention has the following beneficial technical effects: By connecting customer devices to corresponding computing nodes and using the BMC system to obtain customer login information, a protocol text token is constructed based on the login information. The protocol text token format includes function type, timestamp, IP address, on / off status, and checksum. The IP address is the IP address of the customer device. The protocol text token is then transmitted to the corresponding computing node, which performs periodic verification on the protocol text token and allows access to customer devices that have successfully verified the token. By using a custom protocol text token, the blacklist and whitelist of customer device IPs can be precisely controlled, effectively reducing the attack surface of computing unit cards in open network environments, thereby significantly improving the security protection capabilities of computing unit cards. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the first embodiment of the network security management method based on an array server in this invention; Figure 2 This is a schematic diagram of the fourth embodiment of the network security management method based on an array server in this invention. Figure 3 This is a schematic diagram of the sixth embodiment of the network security management method based on an array server in this invention. Figure 4This is a schematic diagram of an embodiment of a network security management system based on an array server according to the present invention; Figure 5 This is a schematic diagram of one embodiment of a network security management device based on an array server, as described in this invention. Detailed Implementation

[0016] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0017] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figures 1-3 The network security management method based on an array server in this embodiment of the invention includes a BMC system and multiple computing nodes, wherein the BMC system is electrically connected to each computing node, and the network security management based on the array server includes: S101. Connect the customer's equipment to the corresponding computing node and use the BMC system to obtain the customer's login information; It should be noted that the computing node is specifically a computing unit board. As described in the background technology, the array server also includes a switching board module and a backplane. The switching board module connects the management network and service network of the backplane and the computing unit board. The backplane is responsible for connecting each computing unit board. The BMC system is used to manage and control the management network and service network of the computing unit board. The computing unit board is responsible for all service-related functions. The BMC system has a web interface (implemented by Nginx + HTML). The login interface displayed on this web interface is used to add the IP address of the client device when connecting to the client device.

[0018] Alternatively, the IP address of the client device can be read automatically. For example, a dedicated program for reading IP addresses can be built into the BMC system. When the client device connects to the corresponding computing node, the program reads the IP address built into the client device through the interface.

[0019] It should be added that the login information includes requests to access some or all of the specified computing nodes, whitelist application requests, and IP addresses.

[0020] S102. Based on the login information, construct a protocol text token. The protocol text token includes the function type, timestamp, IP address, switch status, and check value. The IP address is the IP address of the client device. It should be noted that the function type includes iptables or nftables functions, the timestamp uses an integer Unix timestamp, the switch status includes an open state representing acceptance and a closed state representing rejection, and the checksum is the sum of the ASCII value of the function type and the ASCII value of each character in the string of the IP address. It's important to clarify that iptables and nftables are firewall tools in Linux systems based on the netfilter framework, used to manage network packet processing rules (such as filtering, transformation, and forwarding). While their functions are similar, nftables, as the successor to iptables, is more modern and efficient in its design. The iptables function is mainly used to configure filtering and transformation rules for IPv4 packets. Its core is to control the "allow," "deny," "modify," or "log" behavior of packets by defining rules. This includes: packet filtering functions that allow or deny packets based on source / destination IP, port, protocol (TCP / UDP / ICMP, etc.); network address translation functions that modify the source or destination IP of packets to achieve shared Internet access (such as source NAT in a home router) and port mapping (such as mapping a public network port to an internal network service); port forwarding functions that forward packets from a specific port to other IPs or ports (based on NAT); packet modification functions that modify fields of packets (such as TTL, DSCP flags, etc.) for network debugging or traffic control; and logging of packets that meet specific conditions (such as abnormal connections) for easy auditing and troubleshooting. The core features of nftables include unified management via nft commands, enhanced packet filtering, efficient NAT and forwarding, dynamic rule management, and support for structures such as "set" and "map", which can simplify advanced data structures for a large number of similar rules (such as matching multiple IPs or ports at once).

[0021] Furthermore, constructing the protocol text token includes: S1021. Determine if the IP address is entered in the correct format; It should be noted that in network technology, IP addresses are divided into two types: IPv4 and IPv6. The verification logic needs to cover the characteristics of the two formats respectively. For IPv4 addresses, the standard format is four groups of decimal numbers (0-255), with each group separated by an English period ".", and each group of numbers cannot be omitted (e.g., "192.168.1.1" is a valid format, while "192.168.1", "192.168.01.1", and "192.168.256.1" are all invalid formats). The verification process requires three layers of checks: First, structural verification to confirm that the address is accurately divided into 4 groups and contains only numbers and periods; second, range verification to ensure that each group of numbers is between 0 and 255 (e.g., "256" exceeds the upper limit, and "-1" is a negative number, both of which are invalid); and third, special format exclusion, such as prohibiting leading zeros within a group (unless the group is 0, e.g., "192.168.001.1" is invalid, but "192.168.0.1" is valid).

[0022] For IPv6 addresses, the format is more complex, consisting of eight groups of hexadecimal numbers (0-9, af, AF), separated by colons ":". Consecutive zeros can be omitted using "::" (but only once). Verification requires checking: whether the number of groups is between 1 and 8; whether there are duplicate "::" characters; whether each group is a valid hexadecimal value (e.g., "g" and "1g" are illegal characters); and whether it contains embedded IPv4 format (e.g., "::ffff:192.168.1.1" is a valid mixed format, but the embedded IPv4 portion needs additional verification).

[0023] In this embodiment, the IP address is IPv4, so only the format compliance of IPv4 (such as "192.168.1.1") is checked.

[0024] S1022. If it is not normal, report that the IP address format is abnormal; It should be noted that there are generally three types of format errors: structural errors, numerical errors, and special format errors. Structural errors are as mentioned above, where an IPv4 address must contain four sets of numbers, but the currently entered IP address contains three sets. Numerical errors are out-of-range values. Special format errors may occur when "192.168.1.1" is written as "192.168.01.01", with an extra 0 added as a leading 1.

[0025] S1023. If normal, fill in the function type, timestamp, IP address, switch status and check value in the preset protocol text, and construct the protocol text token.

[0026] It should be noted that after the IP address format passes the S1021 verification, step S1023 requires filling in key information and generating the final protocol text token based on the preset protocol text template, providing a standardized format for data transmission or storage. This process must ensure information integrity, format standardization, and data security. It should be added that the protocol text token template is: [Function Type]|[Timestamp]|[IP Address]|[On / Off Status]|[Check Value].

[0027] S103. The protocol text token is transmitted to the corresponding computing node, which performs periodic verification of the protocol text token and allows access to the client device after successful verification.

[0028] It should be noted that the timed verification includes verifying the protocol text token every 10 minutes.

[0029] Furthermore, step S103 includes: S1031. Use the corresponding computing node to parse the protocol text token to extract the format content of the protocol text token.

[0030] S1032. Determine if the protocol text token exists; It's important to add that determining token existence requires combining system storage mechanisms and verification dimensions to ensure coverage of both "physical existence" and "logical validity." At the physical level: compute nodes need to check if the token is searchable in the preset storage location: if memory caching is used, a key-value lookup is performed using the token's unique ID; if persistent storage is relied upon, the token ID is used to retrieve data from the device registry. At the logical level: the token's "valid existence" needs further verification: even if a record exists in physical storage, if the token has expired (timestamp exceeds validity), is marked as "revoked" (e.g., manually deregistered after device shutdown), or the associated device has been blacklisted, it is still considered "non-existent." Existence checks need a timeout mechanism (e.g., if the query is not completed within 500ms, it is considered a "query failure"), and retry logic (maximum 2 times) is used to avoid misjudgments caused by momentary network or storage failures.

[0031] The judgment result needs to be recorded synchronously in the audit log, including information such as query time, token ID, storage location, and judgment result, so as to facilitate the tracing of abnormal situations (such as frequent queries for non-existent tokens may indicate malicious attacks).

[0032] S1033. If the protocol text token does not exist, the corresponding compute node will be forced into hibernation. It's important to explain that compute nodes need to enter a sleep state to optimize resource usage. The core of this is a balanced design of "orderly resource release + controllable wake-up." Before sleeping, the node must perform a resource cleanup process: close temporary network connections associated with the token, release allocated memory buffers (such as field objects used during parsing), and submit unfinished tasks (such as log writing) to background threads before unbinding associated processes, ensuring resources are not ineffectively occupied. The sleep duration uses a dynamic adjustment strategy: the basic sleep cycle is 30 seconds, but it will adaptively adjust based on the frequency of token non-existence in recent times—if the token is determined to be non-existent 5 times consecutively within 10 minutes, it indicates that the current node may be in a low-load or ineffective listening state, and the sleep cycle is extended to 5 minutes; if it is only occasionally non-existent, the 30-second cycle is maintained to quickly respond to subsequent requests. During sleep, the node only retains core listening threads (such as port listening and timed wake-up triggers), and other non-essential processes (such as data preprocessing threads) are suspended to reduce CPU and memory consumption.

[0033] Of course, compute nodes cannot remain in a dormant state indefinitely; an additional wake-up mechanism is required. This mechanism can be either active or passive: active wake-up is triggered by a built-in timer, automatically resuming normal operation after the required dormant period; passive wake-up can be triggered by remote commands from the management node (such as a "force wake-up" signal), suitable for emergency scheduling scenarios. After waking up, the node must first perform a self-check (such as storage connection testing and cache synchronization) to confirm its normal status before resuming the token parsing and verification process.

[0034] S1034. If the protocol text token exists, determine whether the format of the protocol text token satisfies the requirement of allowing access. It should be noted that the conditions for allowing access are: the function type is iptables, the timestamp format is correct, the IP address format is correct, the checksum value is correct, and the switch status is open, indicating acceptance. Among these, the order of judging the format of the protocol text token is as follows: function type, timestamp, IP address, checksum, and switch status.

[0035] It should be added that when the function type is nftables, the nftables process is executed directly and the extension of other formats is stopped. If the function type is other than iptables or nftables, the compute node enters sleep mode. The timestamp, IP address, and checksum are used to proceed to the next verification step when each verification step is successful. If any of the verification steps fails, the computing node enters a sleep state. When the switch is in the off state, which represents discarding, the compute node deletes the instruction for that IP address.

[0036] S1035. If the access requirement is met, then the client equipment is allowed to access the corresponding computing node.

[0037] It is important to note that after the format content of the IP address is successfully verified at each step, the compute node allows the client device with that IP address to access the network. However, the compute node will still perform periodic verification of the IP address. If verification fails during this period, the IP address and protocol text token will be deleted directly, and the node will enter a dormant state.

[0038] In this embodiment, by connecting the client device to the corresponding computing node and using the BMC system to obtain the client's login information, a protocol text token is constructed based on the login information. The protocol text token format includes function type, timestamp, IP address, on / off status, and checksum. The IP address is the client device's IP address. The protocol text token is then transmitted to the corresponding computing node, which performs periodic verification on the protocol text token and allows access to client devices that have successfully verified the token. By using a custom protocol text token, the blacklist and whitelist of client device IPs can be precisely controlled, effectively reducing the attack surface of the computing unit board in an open network environment, thereby significantly improving the security protection capability of the computing unit board.

[0039] The network security management method based on an array server in the embodiments of the present invention has been described above. The network security management system based on an array server in the embodiments of the present invention will be described below. Please refer to [link to relevant documentation]. Figure 4 The network security management system based on array servers includes: The information acquisition module 201 is used to connect the customer device to the corresponding computing node and use the BMC system to obtain the customer's login information. The token building module 202 is used to build a protocol text token based on login information. The format of the protocol text token includes function type, timestamp, IP address, switch status and check value. The IP address is the IP address of the client device. The verification and access module 203 is used to transmit the protocol text token to the corresponding computing node, whereby the computing node performs periodic verification of the protocol text token and allows access to the client device after successful verification.

[0040] The login information includes requests to access some or all of the specified computing nodes, whitelist application requests, and IP addresses.

[0041] The function type includes either iptables or nftables functions. The timestamp uses an integer Unix timestamp. The switch status includes an open state representing acceptance and a closed state representing rejection. The checksum is the sum of the ASCII value of the function type and the ASCII value of each character in the string of the IP address.

[0042] Specifically, the construction of the protocol text token in the token construction module 202 can also perform the following: Check if the IP address is entered in the correct format; If it is not normal, it will report that the IP address format is abnormal; If normal, fill in the function type, timestamp, IP address, switch status, and check value, and construct the protocol text token.

[0043] Specifically, the verification and access module 203 can also perform the following: The corresponding computing node is used to parse the protocol text token to extract its formatted content.

[0044] Determine if the protocol text token exists; If the protocol text token does not exist, the corresponding compute node will be forced into hibernation. If a protocol text token exists, determine whether the format of the protocol text token satisfies the requirement to allow access. If the access requirement is met, then the client device is allowed to connect to the corresponding computing node. The timed verification includes verifying the protocol text token every 10 minutes. The conditions for allowing access are: the function type is iptables, the timestamp format is correct, the IP address format is correct, the checksum value is correct, and the switch status is "on" indicating acceptance.

[0045] In this embodiment, by connecting the client device to the corresponding computing node and using the BMC system to obtain the client's login information, a protocol text token is constructed based on the login information. The protocol text token format includes function type, timestamp, IP address, on / off status, and checksum. The IP address is the client device's IP address. The protocol text token is then transmitted to the corresponding computing node, which performs periodic verification on the protocol text token and allows access to client devices that have successfully verified the token. By using a custom protocol text token, the blacklist and whitelist of client device IPs can be precisely controlled, effectively reducing the attack surface of the computing unit board in an open network environment, thereby significantly improving the security protection capability of the computing unit board.

[0046] The above is attached Figure 4 The network security management method based on an array server in this embodiment of the invention will be described in detail from the perspective of unitized functional entities. The network security management device based on an array server in this embodiment of the invention will be described in detail from the perspective of hardware processing.

[0047] Figure 5 This is a schematic diagram of a network security management device based on an array server according to an embodiment of the present invention. The network security management device 300 based on the array server can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 310 (e.g., one or more processors) and memory 320, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 333 or data 332. The memory 320 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more units (not shown in the diagram), each unit may include a series of instruction operations on the network security management device 300 based on the array server. Furthermore, the processor 310 may be configured to communicate with the storage media 330 and execute the series of instruction operations in the storage media 330 on the network security management device 300 based on the array server.

[0048] The network security management device 300 based on an array-based server may also include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input / output interfaces 360, and / or one or more operating systems 331, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 5 The illustrated network security management device structure based on an array server does not constitute a limitation on communication protocol devices based on LAN projection. It may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0049] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the steps of the network security management method based on an array server.

[0050] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0051] The above describes a network security management method or various implementation methods based on array servers, but it is not intended that the specific implementation of this invention is limited to these descriptions. Any methods or structures that are similar to or identical to those of this invention, or any technical deductions or substitutions made based on the concept of this invention, should be considered within the scope of protection of this invention.

Claims

1. A network security management method based on an array server, wherein the array server includes a BMC system and multiple computing nodes, wherein, The BMC system is electrically connected to each of the computing nodes, characterized in that it includes: S101. Connect the customer device to the corresponding computing node and use the BMC system to obtain the customer's login information; S102. Based on the login information, construct a protocol text token, wherein the format of the protocol text token includes function type, timestamp, IP address, switch status and check value, and the IP address is the IP address of the client device; S103. The protocol text token is transmitted to the corresponding computing node, which performs periodic verification on the protocol text token and allows access to the client device after successful verification.

2. The network security management method based on an array server according to claim 1, characterized in that, The login information includes a request to access some or all of the specified computing nodes, a whitelist application request, and the IP address.

3. The network security management method based on an array server according to claim 2, characterized in that, The function type includes iptables or nftables functions, the timestamp is an integer Unix timestamp, the switch state includes an open state representing acceptance and a closed state representing rejection, and the checksum is the sum of the ASCII value of the function type and the ASCII value of each character in the string of the IP address.

4. The network security management method based on an array server according to claim 3, characterized in that, The constructed protocol text token includes. S1021. Determine whether the format of the IP address is correct; S1022. If it is not normal, report that the IP address format is abnormal; S1023. If normal, the function type, timestamp, IP address, switch status and verification value are filled into the preset protocol text, and a protocol text token is constructed.

5. A network security management method based on an array server according to claim 4, characterized in that, The timed verification includes verifying the protocol text token every 10 minutes.

6. A network security management method based on an array server according to claim 5, characterized in that, Step S103 includes: S1031. The corresponding computing node is used to parse the protocol text token to extract the format content of the protocol text token. S1032. Determine whether the protocol text token exists; S1033. If the protocol text token does not exist, the corresponding computing node is driven into hibernation. S1034. If the protocol text token exists, determine whether the format content of the protocol text token satisfies the requirement of allowing access. S1035. If the access permission is granted, then the client equipment is allowed to access the corresponding computing node.

7. A network security management method based on an array server according to claim 6, characterized in that, The conditions for allowing access are: the function type is iptables, the timestamp format is correct, the IP address format is correct, the checksum value is correct, and the switch status is the open state indicating acceptance.

8. A network security management system based on an array server, characterized in that, include: The information acquisition module is used to connect the customer device to the corresponding computing node and use the BMC system to acquire the customer's login information. The token construction module is used to construct a protocol text token based on the login information. The protocol text token includes a function type, timestamp, IP address, on / off status, and verification value. The IP address is the IP address of the client device. The verification and access module is used to transmit the protocol text token to the corresponding computing node, whereby the computing node performs periodic verification on the protocol text token and allows access to the client device after successful verification.

9. A network security management device based on an array server, characterized in that, The network security management device based on an array server includes: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a line; The at least one processor invokes the instructions in the memory to cause the array-based network security management device to execute the array-based network security management method as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the network security management method based on an array server as described in any one of claims 1-7.

Images