CN114499989A - Security device management method and device - Google Patents

Abstract

The present invention provides a security device management method and device, wherein the method applied to the management device includes: receiving device registration information sent by one or more security devices; establishing a reverse proxy tunnel with each of the security devices, and the reverse proxy tunnel The tunnel to the proxy is actively requested to be established by the security device based on the SSH protocol; a configuration message is sent to each security device based on the reverse proxy tunnel, where the configuration message is used to configure the security device. The security device management method provided by the invention realizes the centralized management of the security device by the management device, and improves the security of the security device management.

Description

Safety equipment management method and device

technical field

The present invention relates to the field of computer technology, and in particular, to a method and device for managing security equipment.

Background technique

For a large network (such as an enterprise intranet), since different local area networks have different purposes, many border security devices such as firewalls will be deployed in different areas. However, due to the security settings of the firewall (such as ACL configuration), the management port of the firewall is inaccessible to the management device. Therefore, only the firewalls can be set one by one, and the firewall cannot be managed uniformly through the management device.

SUMMARY OF THE INVENTION

The present invention provides a security device management method and device, which are used to solve the defect that the security devices cannot be managed uniformly in the prior art, and realize the centralized management of the security devices.

In a first aspect, the present invention provides a security device management method, which is applied to management devices, including:

Receive device registration information from one or more security devices;

establishing a reverse proxy tunnel with each of the security devices, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol;

A configuration message is sent to each of the security devices based on the reverse proxy tunnel, the configuration message being used to configure the security device.

Optionally, the receiving device registration information sent by one or more security devices includes:

receiving a first authentication message sent by each of the security devices, where the first authentication message includes SSL certificate information of the security device;

sending a first authentication response message to each of the security devices, where the first authentication response message includes the SSL certificate information of the management device;

receiving a registration message sent by each of the security devices, where the registration message includes device information of the security device;

A listening port is determined based on the device information, and the listening port is bound to the security device corresponding to the device information one by one, so that the corresponding security device listens to the message of the management device based on the listening port.

Optionally, establishing a reverse proxy tunnel with each of the security devices includes:

sending a registration response message to each of the security devices, where the registration response message includes port information of the listening port;

receiving a tunnel establishment request message sent by each of the security devices, and establishing the reverse proxy tunnel based on the tunnel establishment request message and the listening port.

Optionally, the method further includes:

A public key sent by each security device is received, where the public key is used by the management device to encrypt and decrypt transmission data, where the transmission data is data transmitted between the security device and the management device.

Optionally, before the sending a configuration message to each of the security devices, the method further includes:

A second authentication message is sent to each of the security devices, where the second authentication message is used by the security device to perform device management authority authentication on the management device, and the management authority is pre-allocated by the security device.

Optionally, the sending of the configuration message is implemented based on the django-http-proxy open source library.

In a second aspect, the present invention also provides a security device management method, which is applied to security devices, including:

Send device registration information to the management device;

Establishing a reverse proxy tunnel with the management device, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol;

A configuration message sent by the management device is received based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

Optionally, the sending device registration information to the management device includes:

sending a first authentication message to the management device, where the first authentication message includes SSL certificate information of the security device;

receiving a first authentication response message sent by the management device, where the first authentication response message includes SSL certificate information of the management device;

A registration message is sent to the management device, the registration message including device information of the security device.

Optionally, the establishing a reverse proxy tunnel with the management device includes:

Receive a registration response message sent by the management device, where the registration response message includes port information of a listening port, the listening port is determined by the management device based on the device information, and a security device corresponding to the device information is a security device. a binding, for the corresponding security device to monitor the message of the management device based on the listening port;

Sending a tunnel establishment request message to the management device, and establishing a reverse proxy tunnel based on the tunnel establishment request message and the listening port.

Optionally, the method further includes:

Send a public key to the management device, where the public key is used by the management device to encrypt and decrypt transmission data, where the transmission data is data transmitted between the security device and the management device.

Optionally, before receiving the configuration message sent by the management device, the method further includes:

receiving a second authentication message sent by the management device;

Perform device management authority authentication on the management device based on the second authentication message, where the management authority is pre-allocated by the security device.

In a third aspect, the present invention also provides a security device management device, which is applied to management devices, including:

a first receiving module, configured to receive device registration information sent by one or more security devices;

a first tunnel establishment module, configured to establish a reverse proxy tunnel with each of the security devices, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol;

a first sending module, configured to send a configuration message to each of the security devices based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

In a fourth aspect, the present invention also provides a security device management device, which is applied to security devices, including:

a second sending module, configured to send device registration information to the management device;

a second tunnel establishment module, configured to establish a reverse proxy tunnel with the management device, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol;

The second receiving module is configured to receive, based on the reverse proxy tunnel, a configuration message sent by the management device, where the configuration message is used to configure the security device.

In a fifth aspect, the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, the processor implementing the program as described in the first aspect when the processor executes the program The steps of the security device management method, or the steps of the security device management method described in the second aspect.

In a sixth aspect, the present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the method for managing a security device according to the first aspect, or the first aspect. The second aspect includes the steps of the security device management method.

In a seventh aspect, the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the security device management method described in the first aspect, or the security device management method described in the second aspect. steps of the method.

The security device management method provided by the embodiment of the present invention realizes that the management device actively sends messages to the security device through the reverse proxy tunnel, and further realizes the function of centralized management of the security device through the management device. The reverse proxy tunnel does not expose the management port of the security device, so the security is guaranteed; and the reverse proxy tunnel is established based on the SSH protocol, which can effectively prevent the problem of information leakage during the management process and improve the security. The security of device management; in addition, the device registration in the embodiment of the present invention realizes the business requirement of registering the expansion device according to the business needs of the network organization, so that the security device can not only centrally control the firewall device, but also manage the probe, Border security devices such as VPNs and sub-security devices.

Description of drawings

In order to explain the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are the For some embodiments of the invention, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without any creative effort.

1 is a schematic flowchart of a reverse proxy provided by the present invention;

2 is a schematic diagram of an application scenario provided by an embodiment of the present invention;

3 is one of the schematic flowcharts of the security device management method provided by the embodiment of the present invention;

4 is a second schematic flowchart of a method for managing a security device provided by an embodiment of the present invention;

5 is a third schematic flowchart of a method for managing a security device provided by an embodiment of the present invention;

6 is a schematic diagram of a reverse proxy of a security device management method provided by an embodiment of the present invention;

7 is one of the schematic structural diagrams of a security device management apparatus provided by an embodiment of the present invention;

8 is a second schematic structural diagram of a security device management apparatus provided by an embodiment of the present invention;

9 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention. , not all examples. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Below is an introduction to the technical terms involved in the present invention:

Reverse Proxy: refers to a proxy server that accepts connection requests on the Internet, then forwards the request to a server on the internal network, and returns the results obtained from the server to the client requesting a connection on the Internet. At this time, the proxy server appears as a server to the outside world. Fig. 1 is a schematic flow diagram of a reverse proxy provided by the present invention. As shown in Fig. 1, a proxy server (also referred to as a reverse proxy server) is used to receive users (user equipment A, user equipment B and user equipment C) The request is distributed to the proxy server (server A, server B and server C), so that different users can obtain the same service by requesting the reverse proxy server.

SSH (Secure Shell): SSH is a security protocol based on the application layer. SSH is a more reliable security protocol designed for remote login sessions and other network services.

ACL (Access Control Lists, Access Control List): It is an access control technology based on packet filtering, which can filter the data packets on the interface according to the set conditions, allowing them to pass or discard them.

FIG. 2 is a schematic diagram of an application scenario provided by an embodiment of the present invention. As shown in FIG. 2, FIG. 2 shows a common deployment method of management devices and security devices. Both security devices and management devices belong to subnets, but due to security settings (such as ACL settings of the firewall), the management port of the security device is inaccessible to the management device. The security device can discover the management device through the network. In this scenario, the conventional reverse proxy technology cannot meet the requirements of management devices for managing security devices. Therefore, embodiments of the present invention provide a security device management method to implement centralized management of security devices by management devices.

The following describes the security device management method provided by the embodiment of the present invention with reference to FIG. 3 to FIG. 6 .

FIG. 3 is one of the schematic flowcharts of the security device management method provided by the embodiment of the present invention. As shown in FIG. 3 , the security device management method provided by the embodiment of the present invention is applied to management devices, including:

Step 110, receiving device registration information sent by one or more security devices;

Specifically, a security device refers to a border device used in the security field, also called a border security protection device, such as a firewall, a probe, a VPN, or a sub-management device. Exemplarily, for a large network system, the firewall may send device registration information to the sub-management device, and the sub-management device may send the device registration information to the management device to form multi-level management. The device registration information is used to centrally manage the access of the security device to the management device.

Exemplarily, the management device establishes an underlying communication channel with the security device based on the ssl protocol. The management device receives device registration information sent by one or more security devices through the underlying communication channel.

Step 120, establishing a reverse proxy tunnel with each of the security devices, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol;

Specifically, the reverse proxy tunnel is used for communication between the management device and the security device. The reverse proxy tunnel is an SSH tunnel that is actively requested by the security device to be established. It can bind a port of the management device, and manage the binding. The device port is monitored, data sent based on the port (such as an HTTP request message) is detected, and the data is forwarded to the security device.

Step 130: Send a configuration message to each of the security devices based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

Specifically, the configuration message includes configuration information (such as a security policy), and the configuration information is used to configure the security device. The configuration information may be obtained by the management device based on the user's input on the management device; or may be obtained based on a user configuration message sent by the user device to the management device, where the user configuration message is based on the user's input on the user device. generated, the user configuration message includes configuration information.

The security device management method provided by the embodiment of the present invention realizes that the management device actively sends a message to one or more registered security devices through the reverse proxy tunnel, and realizes the centralized management function of the security device by the management device. It is established by the active request of the security device. The reverse proxy tunnel does not expose the management port of the security device, so the management port of the security device is prevented from being invaded by other devices, and the security is improved; and the reverse proxy tunnel is established based on the SSH protocol. The SSH protocol can effectively prevent the problem of information leakage in the management process, and improve the security of security device management; in addition, the device registration in the embodiment of the present invention realizes the business requirements of device registration for extended devices according to network organization business needs, thereby The management device can not only centrally manage and control firewall devices, but also manage border security devices such as probes, VPNs, and sub-security devices.

In the following, possible implementation manners of the above steps in specific embodiments are further described.

Step 110: Receive device registration information sent by one or more security devices.

Optionally, the receiving device registration information sent by one or more security devices includes:

Step 111: Receive a first authentication message sent by each of the security devices, where the first authentication message includes the SSL certificate information of the security device;

Step 112: Send a first authentication response message to each of the security devices, where the first authentication response message includes the SSL certificate information of the management device;

It is understandable that the management device cannot actively send messages to the security device because it cannot know the port of the security device before establishing the reverse proxy tunnel, but the management device can open a communication port for receiving messages actively sent by the security device. In response to the message actively sent by the security device, a response message (response message) is sent to the security device, thereby implementing passive message transmission. As described in step 110, the management device establishes an underlying communication channel with the security device based on the ssl protocol. Exemplarily, the security device may learn the open port of the management device based on the user's input, so as to establish a one-way communication connection with the management device, and send a communication message to the management device.

For the SSL certificate information of the security device and the SSL certificate information of the management device, the SSL certificate is a digital certificate configured on the server, also called the SSL server certificate, which has the functions of server authentication and data transmission encryption. In this step, the SSL certificate bidirectional exchange technology is used to authenticate the identity of the security device and the management device.

Step 113: Receive a registration message sent by each of the security devices, where the registration message includes device information of the security device;

Specifically, the device information may include a device name and the like.

Optionally, the management device receives heartbeat information (which may also be referred to as a heartbeat packet or a heartbeat message, etc., and the name is not limited in this embodiment) sent by the security device and including information about the security device itself.

Step 114: Determine a listening port based on the device information, and the listening port is bound to the security device corresponding to the device information one by one, so that the corresponding security device listens to the message of the management device based on the listening port.

Specifically, the management device allocates a listening port (also referred to as a listening port) to the security device based on the device information and the port negotiation technology, and the management device allocates a listening port to the security device on the idle security port, and the listening port will Bind with security device. The listening port is used to send messages from the management device to the security device. Exemplarily, use port 8888 as the listening port to bind with the security device 001.

Step 120: Establish a reverse proxy tunnel with each of the security devices, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol.

Optionally, establishing a reverse proxy tunnel with each of the security devices includes:

Step 121: Send a registration response message to each of the security devices, where the registration response message includes port information of the listening port;

Specifically, in response to the registration message sent by the security device, a registration response message is sent to the security device, and the port information (eg, port number) of the listening port determined in step 114 is sent to the security device. Exemplarily, after receiving the registration message sent by the security device 001, a registration response message is sent to the security device 001, and the registration response message includes the port number of the listening port 8888.

Step 122: Receive a tunnel establishment request message sent by each of the security devices, and establish the reverse proxy tunnel based on the tunnel establishment request message and the listening port.

Specifically, a tunnel establishment request message sent by the security device is received, where the tunnel establishment request message is actively sent to the management device by the security device after receiving the port information of the listening port. Exemplarily, the tunnel establishment request message may include the following information: device information of the security device; port number of the corresponding listening port; management device information. The security device will allocate a management port for reverse proxy tunnel establishment and communication with the management device, but to improve security, the management port of the security device is not exposed. After the reverse proxy tunnel is established, the data sent based on the listening port will be sent to the security device through the reverse proxy tunnel. Exemplarily, the security device 001 can perform port listening on port 8888 based on the reverse proxy tunnel, and obtain data sent by the management device based on port 8888.

Optionally, the method further includes:

A public key sent by each security device is received, where the public key is used by the management device to encrypt and decrypt transmission data, where the transmission data is data transmitted between the security device and the management device.

Specifically, the public key and the private key are in one-to-one correspondence, and the public key and the private key are generated by the security device. The management device manages the public key of the security device, which can realize login based on the public key, that is, the security device does not need to enter a password to log in to the management device (that is, establish an SSH connection).

Step 130: Send a configuration message to each of the security devices based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

Optionally, before the sending a configuration message to each of the security devices, the method further includes:

Step 1301: Send a second authentication message to each of the security devices, where the second authentication message is used by the security device to perform device management authority authentication on the management device, and the management authority is pre-allocated by the security device. of.

Specifically, the security device assigns an account with management authority to the management device. When establishing an HTTP connection with the security device, the management device needs to perform identity authentication through the account assigned by the security device, thereby achieving the purpose of managing the security device. It is understood that HTTP requests are used to configure the security device, and HTTP requests can be tunneled through a reverse proxy.

The security device management method provided by the embodiment of the present invention adopts a role authority authentication mechanism to prevent servers other than the management device from entering the management port of the security device, thereby improving the security of security device management.

Optionally, the sending of the configuration message is implemented based on the django-http-proxy open source library.

The django-http-proxy open source library can proxy requests from Django servers to other servers. Based on the request forwarding function of the django-http-proxy open source library, it realizes the forwarding and response of HTTP requests in the reverse proxy tunnel. Exemplarily, the management device sends configuration information to the security device through an HTTP request, and based on the django-http-proxy open source library, the HTTP request is forwarded from the management device to the security device, and the security device returns a response message to the HTTP request.

Optionally, the method further includes: the management device receives a disconnection message sent by the security device.

FIG. 4 is a second schematic flowchart of a method for managing a security device provided by an embodiment of the present invention. As shown in FIG. 4 , the method for managing a security device provided by an embodiment of the present invention, applied to a security device, includes:

Step 210, sending device registration information to the management device;

Step 220, establishing a reverse proxy tunnel with the management device, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol;

Step 230: Receive a configuration message sent by the management device based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

For the introduction of the security device, the management device and the reverse proxy tunnel, refer to the introduction in FIG. 3 , and details are not repeated here.

In the security device management method provided by the embodiment of the present invention, the security device actively requests the management device to establish a reverse proxy tunnel, thereby realizing the centralized management function of the security device by the management device. Since the reverse proxy tunnel is actively requested by the security device to establish, The reverse proxy tunnel does not expose the management port of the security device, so the management port of the security device is prevented from being invaded by other devices, and the security is improved; and the reverse proxy tunnel is established based on the SSH protocol, which can effectively prevent the management process. The problem of information leakage improves the security of security device management; in addition, the device registration in the embodiment of the present invention realizes the business requirement of registering the extended device according to the business needs of the network organization, so that the firewall, probe, VPN and Border security devices such as child security devices can initiate device registration with the management device to implement centralized management.

In the following, possible implementation manners of the above steps in specific embodiments are further described.

Step 210: Send device registration information to the management device.

Optionally, the sending device registration information to the management device includes:

sending a first authentication message to the management device, where the first authentication message includes SSL certificate information of the security device;

receiving a first authentication response message sent by the management device, where the first authentication response message includes SSL certificate information of the management device;

A registration message is sent to the management device, the registration message including device information of the security device.

For the introduction of the SSL certificate and the registration message, refer to the introduction in FIG. 3 , which will not be repeated here.

Step 220: Establish a reverse proxy tunnel with the management device, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol.

Optionally, the establishing a reverse proxy tunnel with the management device includes:

Step 221: Receive a registration response message sent by the management device, where the registration response message includes port information of a listening port, and the listening port is determined by the management device based on the device information and corresponds to the device information. The security devices are bound one by one, for the corresponding security device to monitor the message of the management device based on the listening port;

Step 222: Send a tunnel establishment request message to the management device, and establish a reverse proxy tunnel based on the tunnel establishment request message and the listening port.

Exemplarily, receiving the registration response message sent by the management device, the registration response message includes the port number 8888 of the listening port assigned by the management device to the security device 001, and the management port number of the security device 001 is 3000 (it can be understood that, Management port 3000, unknown to devices other than security device 001) is used to communicate with management devices. At this time, the management port 3000 of the security device 001 initiates a tunnel establishment request to the management device. SSH binds the listening port 8888 on the management device and binds the request message sending port (ie the management port 3000) on the security device. Monitor the data on port 8888 to the proxy tunnel, and forward the data sent based on port 8888 to the security device. At this time, by monitoring the request message sending port for forwarding data to the security device, there is no need for the management device to send messages to the security device according to the command format of "local address; local port; target address; target port". In the case of the management port, a reverse proxy tunnel is established to realize the communication between the security device and the management device.

Optionally, the method further includes:

Send a public key to the management device, where the public key is used by the management device to encrypt and decrypt transmission data, where the transmission data is data transmitted between the security device and the management device.

Specifically, the security device generates its own public and private keys through SSH-keygen. The public key is public and can be sent to the outside world. There is a one-to-one correspondence between public keys and private keys, and each private key has one and only one corresponding public key, and vice versa. Exemplarily, the security device sends the public key to the management device through the one-way communication connection described in step 112 . Based on the public key of the management device to manage the security device, public key login can be implemented. The security device requests to connect to the management device based on SSH, and the management device sends a random string to the security device; the security device encrypts the random string according to its own private key and sends it to the management device; after the management device receives the encrypted string Decrypt with the public key and let the security device log in if correct, otherwise reject. Public key login can solve the problem of entering a password every time you log in to the management device (ie, establish an SSH connection), improve the convenience of security device management, and improve the security of security device management through asymmetric encryption of public and private keys .

Step 230: Receive a configuration message sent by the management device based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

Optionally, before receiving the configuration message sent by the management device, the method further includes:

receiving a second authentication message sent by the management device;

Perform device management authority authentication on the management device based on the second authentication message, where the management authority is pre-allocated by the security device.

For the introduction of device management authority authentication, refer to the introduction in FIG. 3 , which will not be repeated here.

The security device management method provided by the embodiment of the present invention adopts a role authority authentication mechanism to prevent servers other than the management device from entering the management port of the security device, thereby improving the security of security device management.

Optionally, an underlying communication channel is established between the security device and the management device based on the ssl protocol. The security device sends device registration information to the management device through the underlying communication channel.

Optionally, the method further includes: the security device sends heartbeat information (which may also be referred to as a heartbeat packet or a heartbeat message, etc., and the name is not limited in this embodiment) including the information of the security device itself to the management device, so the The heartbeat information is sent by the security device based on the underlying communication channel.

Optionally, the method further includes: the security device sends a disconnection message to the management device, where the disconnection message is used to instruct the management device to disconnect.

In the security device management method provided by the embodiment of the present invention, the security device sends a disconnection message to the management device, so that the security device can actively send a disconnection message to the management device when the security device detects that the current connection is unstable or the connection is unsafe. messages to further improve the security of secure device management.

FIG. 5 is the third schematic flowchart of the security device management method provided by the embodiment of the present invention. As shown in FIG. 5 , the security device management method provided by the embodiment of the present invention includes: device registration, tunnel establishment, and reverse proxy.

Specifically, considering the security of the reverse proxy tunnel, the SSL certificate exchange technology is used to authenticate the identity of the management device and the security device during device registration. The management device will randomly assign a listening port to the security device on the free security port, and the port will be bound to the security device.

During the tunnel establishment process, considering the unique deployment scenarios of the security device and the management device, the public key of the security device is managed on the management device, and the listening port negotiated in the previous step is sent to the security device, and the security device actively Establish a reverse proxy tunnel to the management device. This step ensures the autonomy and security of the security device and avoids the risk of port exposure.

The last step is the reverse proxy process. In order to prevent services other than the management device from entering the management port of the security device, a role authorization authentication mechanism is adopted. The security device assigns an account with management rights to the management device, and establishes HTTP with the security device When connecting, the management device needs to authenticate through the account assigned by the account security device, so as to achieve the purpose of managing the security device. In addition, the forwarding and response of http requests in the reverse proxy tunnel are implemented based on the django-http-proxy open source library. , based on the django-http-proxy open source library, which can proxy requests from Django services to other servers, send HTTP requests from the management device to the security device, and maintain the session for each management device to log in to the security device. )information.

The security device management method provided by the embodiment of the present invention realizes the reverse proxy from the management device to the management port of the security device under the restriction of the security rules in the intranet scenario, thereby realizing more convenient centralized management of border security devices such as firewalls Requirements; the embodiment of the present invention adopts the SSH technology to realize a reverse proxy framework that is safe, reliable and highly scalable. In terms of security, the tunnel encryption technology of SSH technology is adopted, combined with the means of device registration, port negotiation and management authority authentication, to realize the security management technology from management device to security device. In addition, based on the SSH reverse proxy technology, technologies such as device authentication and data transmission are added, which makes the reverse proxy have powerful scalability.

FIG. 6 is a schematic diagram of a reverse proxy of the security device management method provided by the embodiment of the present invention. As shown in FIG. 6 , in the security device management method provided by the embodiment of the present invention, the user equipment sends a security device configuration message to the management device, and the management device sends a security device configuration message to the management device. The security device forwards the configuration message, thereby realizing the effect of centralized management of the security device by the user equipment.

In the security device management method provided by the embodiment of the present invention, firstly, the reverse proxy technology is used to perform unified and centralized management of security devices deployed in different areas through a management device, which greatly improves the convenience for users to deploy firewalls. Second, for security devices such as firewalls, devices in different subnets will be restricted by ACL (Access Control List) rules. The SSH reverse proxy can provide powerful intranet penetration capabilities on the basis of ensuring security; third, to improve security, the data tunnel established by the SSH reverse proxy is an encrypted tunnel. SSH will automatically encrypt and decrypt all network data between the SSH client and the server. Fourth, it increases the scalability: based on the reverse proxy framework, it can be extended according to the business requirements of the network's respective business, such as device authentication. Therefore, the management device can not only centrally manage and control firewall devices, but also manage probes, VPNs, and similar border security devices such as the management device itself.

The security device management apparatus provided by the present invention is described below, and the security device management device described below and the security device management method described above can be referred to each other correspondingly.

FIG. 7 is a schematic structural diagram of a security device management device provided by an embodiment of the present invention. As shown in FIG. 7 , an embodiment of the present invention provides a security device management device, which is applied to management devices and includes: a first receiving module 710, a first a tunnel establishment module 720 and a first sending module 730;

a first receiving module 710, configured to receive device registration information sent by one or more security devices;

Optionally, the first receiving module 710 can maintain a long connection between the security device and the management device. Exemplarily, the first receiving module maintains an underlying communication channel between the security device and the management device based on the ssl connection. The first receiving module 710 is configured to receive device registration information sent by one or more security devices. The first receiving module 710 is further configured to receive the device information sent by the security device. Exemplarily, the management device receives, through the first receiving module 710, the heartbeat information (also referred to as a heartbeat packet) that contains the information of the security device itself and is sent by the management device. or heartbeat message, etc., the name is not limited in this embodiment); the first receiving module 710 is also used to receive a message that the security device is disconnected; optionally, the first receiving module 710 is also used to manage the registered Session channel between the security device and the management device. Optionally, the first receiving module 710 is also used for establishing, maintaining and cleaning up the communication connection between the security device and the management device.

a first tunnel establishment module 720, configured to establish a reverse proxy tunnel with each of the security devices, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol;

The first sending module 730 is configured to send a configuration message to each of the security devices based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

It should be noted here that the above-mentioned device provided by the embodiment of the present invention can realize all the method steps realized by the above-mentioned method embodiment, and can achieve the same technical effect, and the same as the method embodiment in this embodiment is not repeated here. The parts and beneficial effects will be described in detail.

FIG. 8 is a schematic structural diagram of a security device management apparatus provided by an embodiment of the present invention. As shown in FIG. 8 , an embodiment of the present invention provides a security device management apparatus, which is applied to a security device and includes: a second sending module 810, a second a tunnel establishing module 820 and a second receiving module 830;

The second sending module 810 is configured to send the device registration information to the management device;

A second tunnel establishment module 820, configured to establish a reverse proxy tunnel with the management device, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol;

The second receiving module 830 is configured to receive, based on the reverse proxy tunnel, a configuration message sent by the management device, where the configuration message is used to configure the security device.

It should be noted here that the above-mentioned device provided by the embodiment of the present invention can realize all the method steps realized by the above-mentioned method embodiment, and can achieve the same technical effect, and the same as the method embodiment in this embodiment is not repeated here. The parts and beneficial effects will be described in detail.

FIG. 9 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG. 9 , the electronic device may include: a processor (processor) 910, a communication interface (Communications Interface) 920, a memory (memory) 930, and a communication bus 940, The processor 910 , the communication interface 920 , and the memory 930 communicate with each other through the communication bus 940 . The processor 910 may invoke logic instructions in the memory 930 to execute a method for managing a security device, the method being applied to managing devices, comprising: receiving device registration information sent by one or more security devices; communicating with each of the security devices Establish a reverse proxy tunnel, the reverse proxy tunnel is actively requested by the security device based on the SSH protocol; send a configuration message to each of the security devices based on the reverse proxy tunnel, and the configuration message is used for Configure the security device.

In addition, the above-mentioned logic instructions in the memory 930 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

FIG. 10 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG. 10 , the electronic device may include: a processor (processor) 1010, a communication interface (Communications Interface) 1020, a memory (memory) 1030, and a communication bus 1040, The processor 1010 , the communication interface 1020 , and the memory 1030 communicate with each other through the communication bus 1040 . The processor 1010 can invoke the logic instructions in the memory 1030 to execute a security device management method. The method is applied to the security device, including: sending device registration information to the management device; establishing a reverse proxy tunnel with the management device, so that the The reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol; a configuration message sent by the management device is received based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

In addition, the above-mentioned logic instructions in the memory 1030 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

In another aspect, the present invention also provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can Execute a security device management method provided by the above methods, the method is applied to management devices, and includes: receiving device registration information sent by one or more security devices; establishing a reverse proxy tunnel with each of the security devices, so The reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol; a configuration message is sent to each of the security devices based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

The present invention also provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the above methods. Provided is a security device management method, which is applied to a security device and includes: sending device registration information to a management device; establishing a reverse proxy tunnel with the management device, where the reverse proxy tunnel is used by the security device Actively request establishment based on the SSH protocol; and receive a configuration message sent by the management device based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

In yet another aspect, the present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored, and the computer program is implemented when executed by a processor to execute a security device management method provided by the above methods, the The method is applied to a management device, comprising: receiving device registration information sent by one or more security devices; establishing a reverse proxy tunnel with each of the security devices, and the reverse proxy tunnel is initiated by the security device based on the SSH protocol. requesting establishment; sending a configuration message to each of the security devices based on the reverse proxy tunnel, where the configuration message is used to configure the security device.

The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored, the computer program is implemented by a processor to execute a security device management method provided by the above methods, and the method is applied to security The device includes: sending device registration information to a management device; establishing a reverse proxy tunnel with the management device, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol; based on the reverse proxy tunnel A configuration message sent by the management device is received, where the configuration message is used to configure the security device.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still be The technical solutions described in the foregoing embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (16)

1. a security device management method, is characterized in that, is applied to management device, comprises: Receive device registration information from one or more security devices; establishing a reverse proxy tunnel with each of the security devices, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol; A configuration message is sent to each of the security devices based on the reverse proxy tunnel, the configuration message being used to configure the security device. 2. The security device management method according to claim 1, wherein the receiving device registration information sent by one or more security devices comprises: receiving a first authentication message sent by each of the security devices, where the first authentication message includes SSL certificate information of the security device; sending a first authentication response message to each of the security devices, where the first authentication response message includes the SSL certificate information of the management device; receiving a registration message sent by each of the security devices, where the registration message includes device information of the security device; A listening port is determined based on the device information, and the listening port is bound to the security device corresponding to the device information one by one, so that the corresponding security device listens to the message of the management device based on the listening port. 3. The security device management method according to claim 2, wherein the establishing a reverse proxy tunnel with each of the security devices comprises: sending a registration response message to each of the security devices, where the registration response message includes port information of the listening port; receiving a tunnel establishment request message sent by each of the security devices, and establishing the reverse proxy tunnel based on the tunnel establishment request message and the listening port. 4. The security device management method according to claim 3, wherein the method further comprises: A public key sent by each security device is received, where the public key is used by the management device to encrypt and decrypt transmission data, where the transmission data is data transmitted between the security device and the management device. 5. The security device management method according to claim 1, wherein before the sending a configuration message to each of the security devices, the method further comprises: A second authentication message is sent to each of the security devices, where the second authentication message is used by the security device to perform device management authority authentication on the management device, and the management authority is pre-allocated by the security device. 6 . The security device management method according to claim 1 , wherein the sending of the configuration message is implemented based on the django-http-proxy open source library. 7 . 7. A security device management method, characterized in that, applied to security devices, comprising: Send device registration information to the management device; Establishing a reverse proxy tunnel with the management device, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol; A configuration message sent by the management device is received based on the reverse proxy tunnel, where the configuration message is used to configure the security device. 8. The security device management method according to claim 7, wherein the sending device registration information to the management device comprises: sending a first authentication message to the management device, where the first authentication message includes SSL certificate information of the security device; receiving a first authentication response message sent by the management device, where the first authentication response message includes SSL certificate information of the management device; A registration message is sent to the management device, the registration message including device information of the security device. 9. The security device management method according to claim 8, wherein the establishing a reverse proxy tunnel with the management device comprises: Receive a registration response message sent by the management device, where the registration response message includes port information of a listening port, the listening port is determined by the management device based on the device information, and a security device corresponding to the device information is a security device. a binding, for the corresponding security device to monitor the message of the management device based on the listening port; Sending a tunnel establishment request message to the management device, and establishing a reverse proxy tunnel based on the tunnel establishment request message and the listening port. 10. The security device management method according to claim 9, wherein the method further comprises: Send a public key to the management device, where the public key is used by the management device to encrypt and decrypt transmission data, where the transmission data is data transmitted between the security device and the management device. 11. The security device management method according to claim 7, wherein before receiving the configuration message sent by the management device, the method further comprises: receiving a second authentication message sent by the management device; Perform device management authority authentication on the management device based on the second authentication message, where the management authority is pre-allocated by the security device. 12. A security device management device, characterized in that, applied to management devices, comprising: a first receiving module, configured to receive device registration information sent by one or more security devices; a first tunnel establishment module, configured to establish a reverse proxy tunnel with each of the security devices, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol; a first sending module, configured to send a configuration message to each of the security devices based on the reverse proxy tunnel, where the configuration message is used to configure the security device. 13. A safety equipment management device, characterized in that, applied to safety equipment, comprising: a second sending module, configured to send device registration information to the management device; a second tunnel establishment module, configured to establish a reverse proxy tunnel with the management device, where the reverse proxy tunnel is actively requested to be established by the security device based on the SSH protocol; The second receiving module is configured to receive, based on the reverse proxy tunnel, a configuration message sent by the management device, where the configuration message is used to configure the security device. 14. An electronic device comprising a memory, a processor and a computer program stored on the memory and running on the processor, wherein the processor implements the program as claimed in claim 1 when the processor executes the program The steps of the security device management method described in any one of to 6, or the steps of the security device management method of any one of claims 7 to 11. 15. A non-transitory computer-readable storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the security device management method according to any one of claims 1 to 6 is implemented. steps, or steps of the security device management method according to any one of claims 7 to 11. 16. A computer program product, comprising a computer program, characterized in that, when the computer program is executed by a processor, the steps of the security device management method according to any one of claims 1 to 6 are implemented, or the steps of claims 7 to 11 Any one of the steps of the security device management method.

Images