TWI715047B - Inspection and correction system of server's configuration and method of inspecting and correcting server's configuration - Google Patents

Abstract

An inspection and correction system of server’s configuration comprises an authorization device and a server. The authorization device comprises a storage circuit and a control circuit. The storage circuit stores a hardware internal code and a first hash value. The control circuit comprises a first and a second trigger component. The control circuit respectively generates a first or a second operating signal when the first or second trigger component receives a trigger operation. The server is configured to install a verification program, an inspection program, and a correction program. The verification program is configured to determine whether the authorization device, the inspection program and the correction program are valid. The inspection program is performed to generate an inspection report after the determination result of the verification program is valid and the first operating signal is received. The correction program is performed to fix at least one configuration of the server after the determination result of the verification program is valid and the second operating signal is received.

Description

Server configuration checking and correcting system and method for checking and correcting server configuration

The present invention relates to server configuration checking and modification, in particular to a system and method for server configuration checking and modification through an authorized device.

New servers or computers purchased by financial institutions can be installed with various open operating systems such as Windows, AIX, Linux, etc. Before these servers actually operate online, information security personnel need to confirm that the security settings in each server or computer comply with internal regulations.

However, the current method of checking the server configuration consumes a lot of manpower and man-hours. In detail, the inspector must be familiar with the command operation of the command line interface such as PowerShell of Windows, Bash of Linux or korn shell of IBM AIX in order to conduct the inspection smoothly. In addition, not only checking is laborious and time-consuming, but also correcting the server configuration with incorrect parameter settings also requires a lot of time and labor costs. Furthermore, due to the numerous versions of the open server operating system, when the server updates the operating system version, the previous commands used to check or modify the server configuration may also be updated, resulting in checks and programs Developers may not be able to use all previous instructions to quickly complete related operations, which increases the difficulty of checking and correcting operations. Another point that cannot be ignored is that the use of manual inspection is likely to affect the stability and security of the entire server system due to a small error by the inspector.

In view of this, the present invention proposes a server configuration verification and correction system and a method for verifying and correcting the server configuration. Under the premise of meeting the information security requirements of financial institutions, the server configuration verification and correction are saved. The labor and time cost of the procedure.

A server configuration verification and correction system according to an embodiment of the present invention includes an authorization device and a server. The authorization device includes a storage circuit and a control circuit. The storage circuit is used to store the internal hardware code and the first hash value. The control circuit includes a first trigger element and a second trigger element. The control circuit is used for generating a first operation signal when the first trigger element receives a trigger operation, and generates a second operation signal when the second trigger element receives another trigger operation. The server is electrically connected to the authorization device. The server is used to install verification programs, verification programs, and correction programs. The verification program is used to determine whether the authorized device, verification program, and correction program are legal. The verification program is used to execute after the verification program is judged to be legal and when the first operation signal is received to generate a verification report. The modification program is used to execute when the verification program is judged to be legal and the second operation signal is received to modify at least one configuration value of the server.

A method for checking and revising the configuration of a server according to an embodiment of the present invention includes: electrically connecting a server with a verification program and a correction program to an authorized device; the server executes the verification program to determine the authorized device, Whether the verification program and the correction program are legal; when the verification program determines that the authorized device, the verification program, and the correction program are all legal, the authorized device outputs one of the first operation signal and the second operation signal; among them, when the server receives the first operation When the signal is detected, the verification program is executed to generate a verification report; or when the server receives the second operation signal, a correction program is executed to modify at least one configuration value of the server.

The above description of the content of the disclosure and the description of the following embodiments are used to demonstrate and explain the spirit and principle of the present invention, and to provide a further explanation of the patent application scope of the present invention.

The detailed features and advantages of the present invention are described in detail in the following embodiments, and the content is sufficient to enable anyone familiar with the relevant art to understand the technical content of the present invention and implement it accordingly, and according to the content disclosed in this specification, the scope of patent application and the drawings Anyone who is familiar with the relevant art can easily understand the related purpose and advantages of the present invention. The following examples further illustrate the viewpoints of the present invention in detail, but do not limit the scope of the present invention by any viewpoint.

FIG. 1 is a block diagram of a server configuration verification and correction system 10 according to an embodiment of the present invention. As shown in FIG. 1, the server configuration verification and correction system 10 includes an authorization device 1 and a server 3. The authorization device 1 is electrically connected to the server 3. Specifically, the authorization device 1 is electrically connected to the server 3 based on the Human Interface Device (HID) protocol in the Universal Serial Bus (USB) standard. Compared with using the USB Mass Stroage Device Class (MSC) protocol in the Universal Serial Bus (USB) standard as the authorized device for the connection interface, the use of the HID protocol can reduce the risk of computer poisoning. In addition, the authorization device 1 using the HID protocol can be used for the server 3 whose USB port is disabled.

Please refer to Figure 1. The authorization device 1 includes a storage circuit 12 and a control circuit 14. The storage circuit 12 can store the internal hardware code and the first hash value, wherein the internal hardware code and the first hash value are written into the storage circuit 12 in advance. The internal hardware code is used to prove that the authorization device 1 is a trusted device. The first hash value is used for comparison by the server 3 to confirm whether the installed program has not been tampered with. The application method of the internal code and the first hash value will be described in detail later.

The control circuit 14 includes a first trigger element 16 and a second trigger element 18. Please refer to FIG. 2, which is a schematic diagram of the connection between the authorization device 1 and the server 3 shown in the server configuration verification and correction system 10 according to an embodiment of the present invention. In practice, the authorization device 1 is presented in the appearance of a USB flash drive, for example, and is electrically connected to the server 3 through the connector 11. The first trigger element 16 and the second trigger element 18 are presented in the form of buttons or toggle switches, for example. The outside of the second trigger element 18 may further include a protective shell 19 to prevent accidental touch. It should be noted that the above-mentioned appearance types are only examples and not intended to limit the present invention.

Please refer to Figure 1. When the first trigger element 16 receives a trigger operation, the control circuit 14 generates a first operation signal. When the second trigger element 18 receives another trigger operation, the control circuit 14 generates a second operation signal. The triggering operation is, for example, pressing a button or flipping a switch, and the present invention does not limit the way of triggering operation.

Please refer to FIG. 1 and FIG. 3 together. FIG. 3 shows a flowchart of a method for checking and correcting a server configuration according to an embodiment of the present invention. The server 3 includes an arithmetic circuit 32 and a storage circuit 34. The arithmetic circuit 32 is electrically connected to the storage circuit 34. The storage circuit 34 can be pre-installed with a verification program, a verification program and a correction program, as shown in step S0 of FIG. 3.

Please refer to Step S1: Electrically connect the authorization device 1 to the server 3. After step S1 is completed, the server 3 will use the arithmetic circuit 32 to execute a verification program to determine whether the device connected to itself is a legitimate device, and then determine whether the verification program and correction program installed by itself are legal based on the legal authorization device 1, so The "legal" mentioned means that the verification program and the correction program are not infected by computer viruses or damaged due to some reason.

In detail, as shown in step S2, the verification program first obtains the internal hardware code and the current system time. In practice, the computing circuit 32 of the server 3 can send appropriate electronic signals to obtain the internal hardware code of the authorization device 1. The authorization device 1 can also actively send its own hardware to the server 3 after it is electrically connected to the server 3. In vivo code, the present invention does not limit the way to obtain the hardware in vivo code.

After obtaining the internal hardware code, the verification program then determines whether the internal hardware code is legal, as shown in step S3. For example, a list is stored in the verification program, and this list includes a plurality of sub-lists. Each sublist includes a plurality of legal hardware codes and a legal time segment. These legal hardware codes are pre-written into the list by the information security unit, for example. The legal time segment represents the effective use time of the internal hardware code in the sublist. Therefore, the verification program finds the sublist whose current time falls within the legal time zone, and compares the obtained hardware code with the legal hardware code in the sublist one by one; if a match is found, it represents the authorized device 1 is a legally authorized device; if no match is found, the computing unit 32 sends a notification signal to inform the user that the authorized device 1 is an illegally authorized device, and returns to step S2 to obtain the hardware code again.

After confirming that the authorization device 1 is legal, the verification program continues to obtain the first hash value stored in the storage circuit 12 of the authorization device 1, as shown in step S4. The verification program executes a hash algorithm according to the verification program and the correction program to generate a second hash value, as shown in step S5. The hash algorithm is, for example, the third-generation Secure Hash Algorithm 3 (SHA-3), but the present invention is not limited to this. Please refer to step S6 to verify whether the program compares the first hash value and the second hash value to the same, so as to confirm whether the verification program and the correction program installed on the server 3 are still the original installed version. If the first hash value is the same as the second hash value, it means that the contents of the check program and the correction program have not been changed. Therefore, the verification program generates a legal signal to indicate legality. The legal signal, for example, instructs the arithmetic circuit 32 to send another notification signal, thereby informing the user that the verification or modification of the server 3 configuration can be started.

Please refer to step S7. After confirming that the verification program and the correction program are legal, the user can trigger the first trigger element 16 on the authorization device 1 to choose to execute the verification program on the server 3 or trigger the first trigger on the authorization device 1. The two trigger elements 18 can be selected on the server 3 or modified programs.

When the first operation signal generated by the first trigger element 16 is received (equivalent to the user pressing the check button), step S8 is executed: the arithmetic unit 32 executes the check program to generate a check report. In detail, the verification program detects the operating system type of server 3 and executes multiple verification commands corresponding to the operating system type. The verification instructions are used to obtain multiple configuration settings of server 3 value. The verification program can compare the obtained configuration setting values according to a standard setting value list (for example, a specification table defined by the financial institution), and output the comparison result to the verification report. The user can check according to The report knows the configuration settings of server 3.

The configuration value is, for example, the password length setting value of the server 3, or the protection stack function of the operating system is turned on to prevent IP transmission or host spoofing. In practice, the verification instructions in the verification program can be defined by oneself according to the internal regulations of financial institutions.

When the second operation signal generated by the second trigger element 18 is received (equivalent to the user pressing the correction button), step S9 is executed: the arithmetic unit 32 executes a correction program to correct at least one configuration value of the server 3. In detail, the correction program detects the operating system type of the server 3 and executes a plurality of correction commands corresponding to the operating system type. The correction command is used to replace the plurality of configuration setting values of the server 3 according to the plurality of setting values of the standard setting value list.

In another embodiment of the present invention, before step S8 or step S9 is executed, a password verification program may be further included. The user must enter the designated password on the interface provided by the server 3 before continuing to execute the verification program in step S8 or the correction program in step S9. The above method can enhance the safety of the inspection or correction operation.

In practice, the verification programs and correction programs are written in the Java language and developed with the Java Development Kit. Therefore, the verification program and the correction program can run in a variety of operating system environments, and call the verification command or correction command corresponding to the current operating system. As a cross-platform programming language is used to develop verification and correction programs, it can reduce the cost of subsequent program maintenance and also reduce the cost of education and training. In addition, for the subsequent update of the operating system of the server 3, it can be easily applied to the server 3 running different operating systems only by corresponding to the verification command in the adjustment verification program or the correction command in the correction program.

In summary, the server configuration verification and correction system and the method for verifying and correcting the server configuration disclosed in the present invention only need to connect the authorization device to the server and then press the verification or correction button on the authorization device , The server itself can check or modify its configuration settings in batch operation, so it can greatly shorten the operation time and increase the operation efficiency. Secondly, the authorization device proposed by the present invention uses the USB Human Interface Device protocol instead of the USB Mass Storage Device protocol adopted by the traditional USB flash drive. Therefore, the risk of server system poisoning caused by the flash drive can be avoided, and the HID protocol can also be used to perform server verification and correction operations on servers that restrict the use of USB devices. Furthermore, before the execution of the correction and verification program, it is necessary to confirm whether the hardware code of the authorized device is legal, so as to avoid unauthorized operations. Therefore, the present invention can realize the authenticity and accountability in the principle of information security. In addition, the verification and correction program disclosed in the present invention adopts the SHA-3 algorithm to perform secure hash calculation in advance, and puts the hash value into the authorization device. Before executing the verification and correction program, it is necessary to mutually verify the hash value with the authorized device, and the execution can be continued after the verification program is passed. Therefore, it is possible to prevent the check program and the correction program from being tampered with by a virus, so that the integrity of the information security policy can be achieved. When the hash value verification fails, it can also alert the user that the server may have been infected by a virus. In addition, the verification and correction programs described in the present invention are developed using JDK, so the same programs can be executed on different platforms. Therefore, it is possible to reduce the cost of education, training and use of the operators of the inspection and correction operations, and to improve the portability of the inspection and correction programs. The present invention can also update the commands of the operating system by updating the checking and correcting programs, thereby solving the problem of interruption of checking or correcting operations due to different commands among operating systems.

Although the present invention is disclosed in the foregoing embodiments, it is not intended to limit the present invention. All changes and modifications made without departing from the spirit and scope of the present invention fall within the scope of patent protection of the present invention. For the scope of protection defined by the present invention, please refer to the attached patent scope.

10 Server configuration verification and correction system 1 Authorized device 11 Connector 12 Storage circuit 14 Control circuit 16 The first trigger element 18 The second trigger element 19 Protective cover 3 Server 32 Operation circuit 34 Storage circuit

FIG. 1 is a block diagram of a system for checking and correcting a server configuration according to an embodiment of the present invention. 2 is a schematic diagram of the connection between the authorization device and the server shown in the server configuration verification and correction system according to an embodiment of the present invention. FIG. 3 is a flowchart of a method for checking and modifying a server configuration according to an embodiment of the present invention.

1 Authorized device 3 Server 11 Connector 16 The first trigger element 18 The second trigger element 19 Protective cover

Claims (8)

A server configuration verification and correction system includes: an authorization device, including a storage circuit and a control circuit, the storage circuit is electrically connected to the control circuit and used to store a hardware code and a first hash value; the The control circuit includes a first trigger element and a second trigger element. The control circuit is used to generate a first operation signal when the first trigger element receives a trigger operation, and when the second trigger element receives another trigger operation A second operation signal is generated at the time; and a server is electrically connected to the authorization device. The server is used to install a verification program, a verification program and a correction program, wherein the verification program is used to determine the authorization device, Whether the verification program and the correction program are legal; the verification program is used to generate a verification report after the verification program is judged to be legitimate and when the first operation signal is received; the correction program is used for the verification After the program is judged to be legal and when the second operation signal is received, it is executed to modify at least one configuration value of the server; wherein the authorization device is electrically connected to the server based on a human interface device protocol. For example, the server configuration verification and correction system described in claim 1, wherein the verification program is further used to obtain the internal hardware code of the authorized device, determine whether the internal hardware code is legal to determine whether the authorized device is legal; The verification program is further used to obtain the first hash value of the authorized device, execute a hash algorithm according to the verification program and the correction program to generate a second hash value, and compare the first hash value and the second hash value. The hash value and optionally generates a legal signal to indicate whether the check program and the correction program are legal; wherein, the hash algorithm is a third-generation secure hash algorithm (SHA-3). For example, the server configuration verification and correction system described in claim 2, wherein the verification program is further used to store a list, the list includes a plurality of sub-lists, each of the sub-lists includes a plurality of legal hardware codes, the Each of the sublists has a legal time zone; the verification procedure is further used to compare the legal time zone of the sublists and one of the sublists based on a current time and the hardware code of the authorized device The legal hardware codes, wherein the current time falls within the legal time zone of one of the sublists. The server configuration verification and correction system described in claim 1, wherein the verification program and the correction program are developed with the Java Development Kit; the verification program is used to detect an operating system and Execute a plurality of check commands corresponding to the operating system, the check commands are used to obtain a plurality of configuration settings of the server, compare the configuration settings according to a standard setting list, and output a The check report and the correction program are used to detect the operating system of the server and execute a plurality of correction commands corresponding to the operating system, and the correction commands are used according to the multiple setting values of the standard setting value list Respectively replace the configuration settings of the server. A method for checking and correcting server configuration includes: electrically connecting a server with an authorization device, wherein the server is installed with a verification program and a correction program. The authorization device is based on a human interface device (Human Interface). Device) Agreement to electrically connect to the server; run a verification program with the server to determine whether the authorized device, the verification program, and the correction program are legal; When the verification program determines that the authorization device, the verification program, and the correction program are all legal, the authorization device outputs one of a first operation signal and a second operation signal; wherein when the server receives the first operation signal When operating the signal, execute a verification program to generate a verification report; or when the server receives the second operation signal, execute a correction program to modify at least one configuration value of the server. The method for checking and modifying the server configuration according to claim 5, wherein the verification program includes: obtaining a hardware internal code of the authorized device and determining whether the hardware internal code is legal; when the hardware internal code is legal, Obtain a first hash value of the authorized device; after obtaining the first hash value, execute a hash algorithm according to the verification program and the correction program to generate a second hash value; and compare the first hash value And the second hash value, and when the first hash value and the second hash value are equal, a legal signal is output to indicate that the authorization device is legal; wherein the hash algorithm is a third-generation secure hash algorithm ( Secure Hash Algorithm 3, SHA-3). The method for checking and modifying the server configuration as described in claim 6, wherein determining whether the hardware code is legal or not further includes: reading a list of the verification program with the server, and the list includes a plurality of sub-lists, each -The sub-list includes a plurality of legal hardware codes, and each of the sub-lists has a legal time zone; Use the server to compare a current time and the legal time range of the sublists to obtain one of the sublists whose current time falls in the legal time range; obtain the sublists from the server After one of the lists, the server compares the legal internal codes of the sublist with the internal hardware codes of the authorized device; and when the internal hardware codes of the authorized device are among the legal internal codes When one of them matches, the server will only obtain the first hash value of the authorized device. The method for checking and modifying the server configuration as described in claim 5, wherein the checking program and the modification program are developed by the Java Development Kit, and the execution of the checking program or the modification program further includes: Test an operating system of the server; and execute a plurality of check commands or correction commands corresponding to the operating system.

Images