TWI746361B - Inspection and correction system of server's configuration based on hash algorithm and method thereof - Google Patents

Abstract

An inspection and correction system of server’s configuration comprises an authorization device and a server. The authorization device comprises a storage circuit and a control circuit. The storage circuit stores a hardware internal code and a first hash value. The control circuit comprises a first and a second trigger component. The control circuit respectively generates a first or a second operating signal when the first or second trigger component receives a trigger operation. The server is configured to install a verification program, an inspection program, and a correction program. The verification program is configured to determine whether the authorization device, the inspection program and the correction program are valid. The inspection program is performed to generate an inspection report after the determination result of the verification program is valid and the first operating signal is received. The correction program is performed to fix at least one configuration of the server after the determination result of the verification program is valid and the second operating signal is received.

Description

Server configuration checking and correcting system and method based on hash algorithm

The present invention relates to server configuration checking and modification, in particular to a system and method for server configuration checking and modification through an authorized device.

New servers or computers purchased by financial institutions can be installed with various open operating systems such as Windows, AIX, Linux, etc. Before these servers actually operate online, information security personnel need to confirm that the security settings in each server or computer comply with internal regulations.

However, the current method of checking the server configuration consumes a lot of manpower and man-hours. In detail, the inspector must be familiar with the command operation of the command line interface such as PowerShell of Windows, Bash of Linux, or korn shell of IBM AIX in order to conduct the inspection smoothly. In addition, not only checking is laborious and time-consuming, but also correcting a server configuration with incorrect parameter settings also requires a lot of time and labor costs. Furthermore, due to the numerous versions of the open server operating system, when the server updates the version of the operating system, the previous commands used to check or modify the server configuration may also be updated, resulting in checks and programs Developers may not be able to use all previous instructions to quickly complete related operations, which increases the difficulty of checking and correcting operations. Another point that cannot be ignored is that the use of manual inspection is likely to affect the stability and security of the entire server system due to a small error by the inspector.

In view of this, the present invention proposes a server configuration verification and correction system and a method for verifying and correcting the server configuration. Under the premise of meeting the information security requirements of financial institutions, the server configuration verification and correction are saved. The labor and time cost of the procedure.

A server configuration verification and correction system according to an embodiment of the present invention includes an authorization device and a server. The authorization device includes a storage circuit and a control circuit. The storage circuit is used to store the internal hardware code and the first hash value. The control circuit includes a first trigger element and a second trigger element. The control circuit is used for generating a first operation signal when the first trigger element receives a trigger operation, and generates a second operation signal when the second trigger element receives another trigger operation. The server is electrically connected to the authorization device. The server is used to install verification programs, verification programs, and correction programs. The verification program is used to determine whether the authorized device, the verification program, and the correction program are legal. The verification program is used to execute after the verification program is judged to be legal and when the first operation signal is received to generate a verification report. The correction program is used to execute after the verification program is judged to be legal and when the second operation signal is received to correct at least one configuration value of the server.

A method for checking and correcting server configuration according to an embodiment of the present invention includes: electrically connecting a server with a verification program and a correction program to an authorized device; the server executes the verification program to determine the authorized device, Whether the verification program and the correction program are legal; when the verification program determines that the authorized device, the verification program and the correction program are all legal, the authorized device outputs one of the first operation signal and the second operation signal; among them, when the server receives the first operation When the signal is detected, the verification program is executed to generate a verification report; or when the server receives the second operation signal, the correction program is executed to modify at least one configuration value of the server.

The above description of the disclosure and the following description of the embodiments are used to demonstrate and explain the spirit and principle of the present invention, and to provide a further explanation of the scope of the patent application of the present invention.

The detailed features and advantages of the present invention will be described in detail in the following embodiments. The content is sufficient to enable anyone familiar with the relevant art to understand the technical content of the present invention and implement it accordingly, and according to the content disclosed in this specification, the scope of patent application and the drawings. Anyone who is familiar with relevant skills can easily understand the purpose and advantages of the present invention. The following examples further illustrate the viewpoints of the present invention in detail, but do not limit the scope of the present invention by any viewpoint.

FIG. 1 is a block diagram of a server configuration checking and correcting system 10 according to an embodiment of the present invention. As shown in FIG. 1, the server configuration verification and correction system 10 includes an authorization device 1 and a server 3. The authorization device 1 is electrically connected to the server 3. Specifically, the authorization device 1 is electrically connected to the server 3 based on the Human Interface Device (HID) protocol in the Universal Serial Bus (USB) standard. Compared with the use of the USB Mass Stroage Device Class (MSC) protocol in the Universal Serial Bus (USB) standard as the authorized device for the connection interface, the use of the HID protocol can reduce the risk of computer poisoning. In addition, the authorization device 1 using the HID protocol can be used for the server 3 whose USB port is disabled.

Please refer to Figure 1. The authorization device 1 includes a storage circuit 12 and a control circuit 14. The storage circuit 12 can store the internal hardware code and the first hash value, wherein the internal hardware code and the first hash value are written into the storage circuit 12 in advance. The internal hardware code is used to prove that the authorized device 1 is a trusted device. The first hash value is used for comparison by the server 3 to confirm whether the installed program has not been tampered with. The application method of the internal code and the first hash value will be described in detail later.

The control circuit 14 includes a first trigger element 16 and a second trigger element 18. Please refer to FIG. 2, which is a schematic diagram of the connection between the authorization device 1 and the server 3 shown in the server configuration verification and correction system 10 according to an embodiment of the present invention. In practice, the authorization device 1 is presented in the appearance of a USB flash drive, for example, and is electrically connected to the server 3 through the connector 11. The first trigger element 16 and the second trigger element 18 are presented in the form of buttons or toggle switches, for example. The outside of the second trigger element 18 may further include a protective shell 19 to prevent accidental touch. It should be noted that the above-mentioned appearance types are only examples and not intended to limit the present invention.

Please refer to Figure 1. When the first trigger element 16 receives a trigger operation, the control circuit 14 generates a first operation signal. When the second trigger element 18 receives another trigger operation, the control circuit 14 generates a second operation signal. The triggering operation is, for example, pressing a button or flipping a switch, and the present invention does not limit the way of triggering operation.

Please refer to FIG. 1 and FIG. 3 together. FIG. 3 shows a flowchart of a method for checking and correcting a server configuration according to an embodiment of the present invention. The server 3 includes an arithmetic circuit 32 and a storage circuit 34. The arithmetic circuit 32 is electrically connected to the storage circuit 34. The storage circuit 34 can be pre-installed with a verification program, a verification program, and a correction program, as shown in step S0 of FIG. 3.

Please refer to Step S1: Electrically connect the authorization device 1 to the server 3. After the completion of step S1, the server 3 will use the arithmetic circuit 32 to execute a verification program to determine whether the device connected to itself is a legal device, and then determine whether the verification program and correction program installed by itself are legal based on the legal authorization device 1, so The "legal" mentioned means that the verification program and the correction program are not infected by computer viruses or damaged due to any reason.

In detail, as shown in step S2, the verification program first obtains the internal hardware code and the current system time. In practice, the arithmetic circuit 32 of the server 3 can send appropriate electronic signals to obtain the internal hardware code of the authorization device 1; the authorization device 1 can also actively send its own hardware to the server 3 after being electrically connected to the server 3 In-body code, the present invention does not limit the way to obtain the hardware-in-body code.

After obtaining the internal hardware code, the verification program then determines whether the internal hardware code is legal, as shown in step S3. For example, a list is stored in the verification program, and this list includes a plurality of sub-lists. Each sublist includes a plurality of legal hardware codes and a legal time segment. These legal hardware codes are pre-written into the list by the information security unit, for example. The legal time segment represents the effective use time of the internal hardware code in the sublist. Therefore, the verification program finds the sublist whose current time falls within the legal time zone, and then compares the obtained hardware code with the legal hardware code in the sublist one by one; if a match is found, it represents the authorized device 1 is a legally authorized device; if no match is found, the arithmetic unit 32 sends a notification signal to inform the user that the authorized device 1 is an illegally authorized device, and returns to step S2 to obtain the internal hardware code again.

After confirming that the authorization device 1 is legal, the verification program continues to obtain the first hash value stored in the storage circuit 12 of the authorization device 1, as shown in step S4. The verification program executes a hash algorithm according to the verification program and the correction program to generate a second hash value, as shown in step S5. The hash algorithm is, for example, the third-generation Secure Hash Algorithm 3 (SHA-3), but the present invention is not limited to this. Please refer to step S6 to verify whether the program compares the first hash value and the second hash value to the same, so as to confirm whether the verification program and the correction program installed on the server 3 are still the original installed version. If the first hash value is the same as the second hash value, it means that the content of the check program and the correction program has not been changed. Therefore, the verification program generates a legal signal to indicate legality. The legal signal, for example, instructs the arithmetic circuit 32 to send another notification signal, thereby informing the user that the verification or modification of the configuration of the server 3 can be started.

Please refer to step S7. After confirming that the verification program and the correction program are legal, the user can trigger the first trigger element 16 on the authorization device 1 to choose to execute the verification program on the server 3 or trigger the first trigger on the authorization device 1. The two trigger elements 18 can be selected on the server 3 or modified programs.

When the first operation signal generated by the first trigger element 16 is received (equivalent to the user pressing the check button), step S8 is executed: the arithmetic unit 32 executes the check program to generate a check report. In detail, the verification program detects the operating system type of server 3 and executes multiple verification commands corresponding to the operating system type. The verification commands are used to obtain multiple configuration settings of server 3 value. The verification program can compare the obtained configuration setting values according to a standard setting value list (for example, a specification table defined by the financial institution itself), and output the comparison result to the verification report. The user can check according to The report knows the configuration settings of server 3.

The configuration value is, for example, the password length setting value of the server 3, or the protection stack function of the operating system is turned on to prevent IP transmission or host spoofing. In practice, the verification instructions in the verification program can be defined by oneself in accordance with the internal regulations of the financial institution.

When the second operation signal generated by the second trigger element 18 is received (equivalent to the user pressing the correction button), step S9 is executed: the arithmetic unit 32 executes a correction program to correct at least one configuration value of the server 3. In detail, the correction program detects the operating system type of the server 3 and executes a plurality of correction commands corresponding to the operating system type. The correction command is used to replace the plurality of configuration setting values of the server 3 according to the plurality of setting values of the standard setting value list.

In another embodiment of the present invention, before step S8 or step S9 is executed, a password verification program may be further included. The user must enter the designated password on the interface provided by the server 3 before continuing to execute the verification program of step S8 or the correction program of step S9. The above method can strengthen the safety of the inspection or correction operation.

In practice, the verification programs and correction programs are written in the Java language, and developed with the Java Development Kit, for example. Therefore, the verification program and the correction program can run in a variety of operating system environments, and call the verification command or correction command corresponding to the current operating system. As a cross-platform programming language is used to develop verification and correction programs, the cost of subsequent program maintenance can be reduced, and the cost of education and training can also be reduced. In addition, for the subsequent update of the operating system of the server 3, it can be easily applied to the server 3 running different operating systems only by corresponding to the verification command in the adjustment verification program or the correction command in the correction program.

In summary, the server configuration verification and correction system and the method for verifying and correcting the server configuration disclosed in the present invention only need to connect the authorization device to the server and then press the verification or correction button on the authorization device , The server itself can adopt batch operation to check or modify its configuration settings, so it can greatly shorten the operation time and increase the operation efficiency. Secondly, the authorization device proposed by the present invention uses the USB Human Interface Device protocol instead of the USB Mass Storage Device protocol used by traditional USB flash drives. Therefore, the risk of server system poisoning caused by the flash drive can be avoided, and the HID protocol can also be used to perform server verification and correction operations on the server that restricts the use of USB devices. Furthermore, before the execution of the correction and verification program, it is necessary to confirm whether the hardware internal code of the authorized device is legal, so as to avoid unauthorized operations. Therefore, the present invention can realize the authenticity and accountability in the principle of information security. In addition, the verification and correction program disclosed in the present invention uses the SHA-3 algorithm to perform secure hash calculation in advance, and puts the hash value into the authorization device. Before executing the verification and correction program, it is necessary to mutually verify the hash value with the authorized device, and the execution can only be continued after the verification program is passed. Therefore, it is possible to prevent the check program and the correction program from being tampered with by the virus, so that the integrity of the information security policy can be achieved. When the hash value verification fails, it can also alert the user that the server may have been infected by a virus. In addition, the verification and correction programs of the present invention are developed using JDK, so the same programs can be executed on different platforms. Therefore, it is possible to reduce the cost of education, training and use of the operators of the inspection and correction operations, and to improve the portability of the inspection and correction programs. The present invention can also update the commands of the operating system by updating the checking and correcting programs, thereby solving the problem of interruption of checking or correcting operations due to different commands among various operating systems.

Although the present invention is disclosed in the foregoing embodiments, it is not intended to limit the present invention. All changes and modifications made without departing from the spirit and scope of the present invention fall within the scope of the patent protection of the present invention. For the scope of protection defined by the present invention, please refer to the attached scope of patent application.

10 Server configuration verification and correction system 1 Authorized device 11 Connector 12 Storage circuit 14 Control circuit 16 The first trigger element 18 Second trigger element 19 Protective cover 3 Server 32 Operational circuit 34 Storage circuit

FIG. 1 is a block diagram of a system for checking and correcting a server configuration according to an embodiment of the present invention. 2 is a schematic diagram of the connection between the authorization device and the server shown in the server configuration verification and correction system according to an embodiment of the present invention. FIG. 3 is a flowchart of a method for checking and correcting a server configuration according to an embodiment of the present invention.

1 Authorized device 3 Server 11 Connector 16 The first trigger element 18 Second trigger element 19 Protective cover

Claims (4)

A server configuration verification and correction system based on a hash algorithm includes: an authorization device, including a storage circuit and a control circuit, the storage circuit is electrically connected to the control circuit and used to store a hardware internal code and a first A hash value; the control circuit includes a first trigger element and a second trigger element, the control circuit is used to generate a first operation signal when the first trigger element receives a trigger operation, and the second trigger element When receiving another trigger operation, a second operation signal is generated; and a server is electrically connected to the authorization device. The server is used to install a verification program, a verification program and a correction program, wherein the verification program is used for Determine whether the authorization device, the verification program, and the correction program are legal; the verification program is used to generate a verification report after the verification program is judged to be legal and when the first operation signal is received; the correction program Used to modify at least one configuration value of the server after the verification program is judged to be legal and when the second operation signal is received; wherein the authorization device is electrically connected based on the Human Interface Device protocol The server; wherein the verification program is used to obtain the internal hardware code of the authorized device, determine whether the internal hardware code is legal to determine whether the authorized device is legal; the verification program is further used to obtain the first authorization device Hash value, execute a hash algorithm based on the check program and the correction program to generate a second hash value, compare the first hash value and the second hash value, and selectively generate a legal signal to indicate the Check whether the program and the modified program are legal; among them, the hash algorithm is a third-generation Secure Hash Algorithm 3 (SHA-3); The verification program and the correction program are developed with the Java Development Kit; the verification program is used to detect an operating system of the server and execute a plurality of verification commands corresponding to the operating system. The command is used to obtain a plurality of configuration settings of the server, compare the configuration settings according to a list of standard settings, and output a check report, and the correction program is used to detect the server’s The operating system executes a plurality of correction commands corresponding to the operating system, and the correction commands are used to replace the configuration setting values of the server according to the plurality of setting values of the standard setting value list. The server configuration verification and correction system based on the hash algorithm as described in claim 1, wherein the verification program is further used to store a list, the list includes a plurality of sub-lists, and each of the sub-lists includes a plurality of legal hardware In-body code, each of the sub-lists has a legal time section; the verification procedure is further used to compare the legal time section and the sub-lists of the sub-lists based on a current time and the hardware in-body code of the authorized device The legal hardware code of one of the lists, wherein the current time falls within the legal time zone of one of the sublists. A method for checking and modifying server configuration based on a hash algorithm includes: electrically connecting a server with an authorization device, wherein the server is installed with a verification program and a correction program, and the authorization device is based on humanization An interface device (Human Interface Device) protocol is electrically connected to the server; a verification program is executed with the server to determine whether the authorized device, the verification program, and the correction program are legal; when the verification program determines that the authorized device, the When the verification program and the correction program are both legal, use the authorized device to output one of a first operation signal and a second operation signal; When the server receives the first operation signal, it executes a verification program to generate a verification report; or when the server receives the second operation signal, it executes a correction program to modify at least one set of the server The verification program includes: obtaining a hardware internal code of the authorized device and determining whether the hardware internal code is legal; when the hardware internal code is legal, obtaining a first hash value of the authorized device; After a hash value, a hash algorithm is executed according to the check program and the correction program to generate a second hash value; and the first hash value and the second hash value are compared, and when the first hash value and When the second hash value is equal, a legal signal is output to indicate that the authorized device is legal; wherein the hash algorithm is a third-generation secure hash algorithm (Secure Hash Algorithm 3, SHA-3); and the check program And the correction program is developed by the Java Development Kit, and when the check program or the correction program is executed, it further includes: detecting an operating system of the server; and executing a plurality of check commands corresponding to the operating system or Correction instructions. The method for checking and modifying server configuration based on the hash algorithm as described in claim 3, wherein determining whether the hardware code is legal or not further includes: reading a list of the verification program with the server, the list including A plurality of sub-lists, each of the sub-lists includes a plurality of legal hardware codes, and each of the sub-lists has a legal time zone; Use the server to compare a current time and the legal time range of the sublists to obtain one of the sublists whose current time falls within the legal time range; obtain the sublists from the server After one of the lists, the server compares the legal internal codes of the sublist with the internal hardware codes of the authorized device; and when the internal hardware codes of the authorized device are among the legal internal codes When one of them matches, the server will start to obtain the first hash value of the authorized device.

Images