TWI752813B - Inspection and correction system of server's configuration based on touch operation and method thereof - Google Patents

Abstract

An inspection and correction system of server’s configuration comprises an authorization device and a server. The authorization device comprises a storage circuit and a control circuit. The storage circuit stores a hardware internal code and a first hash value. The control circuit comprises a first and a second trigger component. The control circuit respectively generates a first or a second operating signal when the first or second trigger component receives a trigger operation. The server is configured to install a verification program, an inspection program, and a correction program. The verification program is configured to determine whether the authorization device, the inspection program and the correction program are valid. The inspection program is performed to generate an inspection report after the determination result of the verification program is valid and the first operating signal is received. The correction program is performed to fix at least one configuration of the server after the determination result of the verification program is valid and the second operating signal is received.

Description

System and method for checking and correcting server configuration based on trigger operation

The present invention relates to the configuration check and correction of the server, and more particularly, to a system and method for performing the server configuration check and correction through an authorization device.

New servers or computers purchased by financial institutions can be installed with various open operating systems such as Windows, AIX, Linux, etc. Before these servers actually operate online, information security personnel need to confirm that the security settings in each server or computer comply with internal specifications.

However, the current way of checking the server configuration consumes a lot of manpower and man-hours. To be more specific, the inspector must be familiar with the command operations of the command line interface such as PowerShell in Windows, Bash in Linux or korn shell in IBM AIX, etc. in order to perform the inspection smoothly. In addition, not only the checking is labor-intensive and time-consuming, but also the operation of correcting the server configuration with wrong parameter setting also requires a lot of time and labor cost. Furthermore, since there are many versions of open server operating systems, when the server updates the version of the operating system, the previous command used to check or correct the server configuration may also be updated accordingly, resulting in checking and programming. Developers may not be able to quickly complete related tasks using all previous instructions, increasing the difficulty of checking and correcting tasks. Another point that cannot be ignored is that the use of manual inspection is likely to affect the stability and security of the entire server system due to a small negligence of the inspector.

In view of this, the present invention proposes a system for checking and correcting server configuration and a method for checking and correcting server configuration, which saves server configuration checking and correction under the premise of meeting financial institutions' requirements for information security The human and time cost of the procedure.

A system for checking and correcting server configuration according to an embodiment of the present invention includes an authorization device and a server. The authorization device includes a storage circuit and a control circuit. The storage circuit is used for storing the hardware internal code and the first hash value. The control circuit includes a first trigger element and a second trigger element. The control circuit is used for generating a first operation signal when the first trigger element receives a trigger operation, and generates a second operation signal when the second trigger element receives another trigger operation. The server is electrically connected to the authorization device. The server is used to install verification programs, verification programs and correction programs. The verification program is used to determine whether the authorization device, the verification program and the correction program are legal. The check program is used to generate a check report after the verification program is judged to be legal and when the first operation signal is received. The modification program is used for executing to modify at least one configuration value of the server after the verification program is determined to be valid and when the second operation signal is received.

According to an embodiment of the present invention, a method for checking and revising a server configuration includes: using an authorization device to electrically connect a server on which a check program and a correction program are installed; Check whether the verification program and the correction program are legal; when the verification program determines that the authorization device, the verification program and the correction program are all legal, the authorization device outputs one of the first operation signal and the second operation signal; when the server receives the first operation signal When the signal is received, a check program is executed to generate a check report; or when the server receives the second operation signal, a correction program is executed to modify at least one configuration value of the server.

The above description of the present disclosure and the following description of the embodiments are used to demonstrate and explain the spirit and principle of the present invention, and provide further explanation of the scope of the patent application of the present invention.

The detailed features and advantages of the present invention are described in detail below in the embodiments, and the content is sufficient to enable any person skilled in the relevant art to understand the technical content of the present invention and implement it accordingly, and according to the content disclosed in this specification, the scope of the patent application and the drawings , any person skilled in the related art can easily understand the related objects and advantages of the present invention. The following examples further illustrate the viewpoints of the present invention in detail, but do not limit the scope of the present invention in any viewpoint.

FIG. 1 is a block diagram of a server configuration checking and correcting system 10 according to an embodiment of the present invention. As shown in FIG. 1 , the server configuration checking and correcting system 10 includes an authorization device 1 and a server 3 . The authorization device 1 is electrically connected to the server 3 . Specifically, the authorization device 1 is electrically connected to the server 3 based on the Human Interface Device (HID) protocol in the Universal Serial Bus (USB) standard. Compared with using the USB Mass Stroage Device Class (MSC) protocol in the Universal Serial Bus (USB) standard as an authorized device for the connection interface, using the HID protocol can reduce the risk of computer poisoning. In addition, the authorization device 1 using the HID protocol can be used for the server 3 whose USB port is disabled.

Please refer to Figure 1. The authorization device 1 includes a storage circuit 12 and a control circuit 14 . The storage circuit 12 can store the hardware internal code and the first hash value, wherein the hardware internal code and the first hash value are written into the storage circuit 12 in advance. The hardware internal code is used to prove that the authorized device 1 is a trusted device. The first hash value is used for comparison by the server 3 to confirm whether the program installed by itself has not been tampered with. The application of the hardware inner code and the first hash value will be described in detail later.

The control circuit 14 includes a first trigger element 16 and a second trigger element 18 . Please refer to FIG. 2 . FIG. 2 is a schematic diagram illustrating the connection between the authorization device 1 and the server 3 according to the server configuration checking and correcting system 10 according to an embodiment of the present invention. In practice, the authorization device 1 is presented in the form of a USB flash drive, for example, and is electrically connected to the server 3 through the connector 11 . The first trigger element 16 and the second trigger element 18 are presented in the form of buttons or toggle switches, for example. The outside of the second trigger element 18 may further include a protective shell 19 to prevent accidental touch. It should be noted that the above-mentioned appearance patterns are only used as examples and are not used to limit the present invention.

Please refer to Figure 1. When the first trigger element 16 receives a trigger operation, the control circuit 14 generates a first operation signal. When the second trigger element 18 receives another trigger operation, the control circuit 14 generates a second operation signal. The triggering operation is, for example, pressing a button or flipping a switch, and the present invention does not limit the manner of the triggering operation.

Please refer to FIG. 1 and FIG. 3 together. FIG. 3 is a flowchart illustrating a method for checking and correcting server configuration according to an embodiment of the present invention. The server 3 includes an arithmetic circuit 32 and a storage circuit 34 . The arithmetic circuit 32 is electrically connected to the storage circuit 34 . The storage circuit 34 can be pre-installed with a verification program, a check program and a correction program, as shown in step S0 in FIG. 3 .

Please refer to step S1 : electrically connecting the authorization device 1 to the server 3 . After step S1 is completed, the server 3 will execute the verification program with the arithmetic circuit 32 to determine whether the device connected to itself is a legal device, and then determine whether the verification program and the correction program installed by itself are legal according to the legal authorization device 1. The "legitimate" mentioned here means that the checking programs and correction programs have not been infected by computer viruses or damaged for any reason.

Specifically, as shown in step S2, the verification program first obtains the hardware internal code and the current system time. In practice, the hardware internal code of the authorization device 1 can be obtained by sending an appropriate electronic signal from the computing circuit 32 of the server 3; In vivo code, the present invention does not limit the manner of obtaining the hardware inner code.

After obtaining the internal code of the hardware, the verification program determines whether the internal code of the hardware is legal, as shown in step S3. For example, the verification program stores a list that includes a plurality of sub-lists. Each sub-list includes a plurality of valid hardware internal codes and a valid time period. These legal hardware internal codes are pre-written into the list by the information security unit, for example. The legal time segment represents the valid usage time of the hardware inner code in the sub-list. Therefore, the verification program finds a sub-list whose current time falls within the legal time zone, and then compares the obtained hardware internal code with the legal hardware internal code in the sub-list one by one; if a match is found, it represents the authorized device 1 is a legitimate authorized device; if no match is found, the computing unit 32 sends a notification signal to inform the user that the authorized device 1 is an illegal authorized device, and returns to step S2 to obtain the hardware internal code again.

After confirming that the authorization device 1 is legal, the verification program continues to obtain the first hash value stored in the storage circuit 12 of the authorization device 1, as shown in step S4. The verification program executes a hash algorithm to generate a second hash value according to the check program and the correction program, as shown in step S5. The hash algorithm is, for example, the third generation secure hash algorithm (Secure Hash Algorithm 3, SHA-3), but the present invention is not limited to this. Referring to step S6, the verification program compares whether the first hash value and the second hash value are the same, thereby confirming whether the check program and the correction program installed on the server 3 are still the original versions. If the first hash value is the same as the second hash value, it means that the contents of the checking program and the correction program have not been changed. Therefore, the verification program generates a legal signal to indicate legal. The legal signal, for example, instructs the arithmetic circuit 32 to send another notification signal, thereby informing the user that the check or correction of the configuration of the server 3 can be started.

Please refer to step S7. After confirming that the verification program and the correction program are valid, the user can trigger the first trigger element 16 on the authorization device 1 to choose to execute the verification program on the server 3, or trigger the first trigger element 16 on the authorization device 1 to execute the verification program. Two trigger elements 18 to select on the server 3 or to modify the program.

When the first operation signal generated by the first trigger element 16 is received (equivalent to the user pressing the check button), step S8 is executed: the operation unit 32 executes the check program to generate a check report. Specifically, the check program detects the operating system type of the server 3 and executes a plurality of check commands corresponding to the operating system type, and the check commands are used to obtain a plurality of configuration settings of the server 3 value. The checking program can compare the obtained configuration setting values against a standard setting value list (such as a specification sheet defined by the financial institution), and output the comparison result to the checking report. The report shows the configuration settings of server 3.

The configuration value is, for example, the password length setting value of the server 3, or enabling the protection stack function of the operating system to prevent IP transmission or host spoofing. In practice, the verification instructions in the verification program can be defined by themselves according to the internal regulations of the financial institution.

When the second operation signal generated by the second trigger element 18 is received (equivalent to the user pressing the correction button), step S9 is executed: the arithmetic unit 32 executes a correction program to correct at least one configuration value of the server 3 . Specifically, the correction program detects the operating system type of the server 3 and executes a plurality of correction commands corresponding to the operating system type. The modification command is used to replace the plurality of configuration setting values of the server 3 respectively according to the plurality of setting values of the standard setting value list.

In another embodiment of the present invention, before step S8 or step S9 is executed, a password verification program may be further included. The user must input the designated password on the interface provided by the server 3 before continuing to execute the checking procedure of step S8 or the correction procedure of step S9. The above approach can enhance the security of checking or correcting operations.

In practice, the check program and the correction program are written in the Java language, for example, and developed with the Java Development Kit. Therefore, the check program and the correction program can run in the environment of various operating systems, and call the check command or the correction command corresponding to the current operating system. Because of the use of cross-platform programming language to develop inspection and correction programs, the cost of subsequent program maintenance can be reduced, and the cost of education and training can also be reduced. In addition, for the subsequent update of the operating system of the server 3, it is only necessary to correspondingly adjust the check command in the check program or the correction command in the correction program, which can be easily applied to the server 3 running different operating systems.

To sum up the above, the system for checking and correcting the server configuration and the method for checking and correcting the server configuration disclosed in the present invention only need to connect the authorization device to the server and then press the check or correction button on the authorization device , the server itself can check or correct its own configuration settings by batch operation, so it can greatly shorten the operation time and increase the operation efficiency. Secondly, the authorization device proposed by the present invention uses the USB Human Interface Device protocol instead of the USB Mass Storage Device protocol adopted by the conventional USB flash drives. Therefore, the risk of server system poisoning caused by the flash drive can be avoided, and the HID protocol can also be used to perform server check and correction operations on the server that restricts the use of USB devices. Furthermore, before the modification and verification program is executed, it is necessary to confirm whether the hardware internal code of the authorized device is legal, thereby avoiding unauthorized operations. Therefore, the present invention can realize the authentication (Authenticity) and the accountability (Accountability) in the information security principle. In addition, the verification and correction program disclosed in the present invention uses the SHA-3 algorithm to perform secure hash calculation in advance, and puts the hash value into the authorization device. Before the verification and correction procedures are executed, hash value verification must be carried out with the authorization device, and the execution can be continued after the verification procedure is passed. Therefore, the checking program and the correction program can be prevented from being tampered with by viruses, so the integrity in the information security principle can be achieved. When the hash value verification fails, it can also alert the user that the server may be infected by a virus. In addition, the checking and correcting programs of the present invention are developed with JDK, so the same programs can be executed on different platforms. Therefore, it is possible to reduce the cost of education, training and use of the inspection and correction operators, and to improve the portability of the inspection and correction programs. The present invention can also update the instructions of the operating system by updating the checking and correcting programs, thereby solving the problem that the checking or correcting operation is interrupted due to different instructions among the operating systems.

Although the present invention is disclosed in the foregoing embodiments, it is not intended to limit the present invention. Changes and modifications made without departing from the spirit and scope of the present invention belong to the scope of patent protection of the present invention. For the protection scope defined by the present invention, please refer to the attached patent application scope.

10: Server configuration check and correction system 1: Authorization device 11: Connector 12: Storage circuit 14: Control circuit 16: The first trigger element 18: Second trigger element 19: Protective cover 3: Server 32: Operational circuit 34: Storage circuit

FIG. 1 is a block diagram illustrating a system for checking and correcting server configuration according to an embodiment of the present invention. FIG. 2 is a schematic diagram showing the connection between the authorization device and the server according to the server configuration checking and correction system according to an embodiment of the present invention. FIG. 3 is a flowchart illustrating a method for checking and correcting server configuration according to an embodiment of the present invention.

1: Authorization device

3: Server

11: Connector

16: The first trigger element

18: Second trigger element

19: Protective cover

Claims (8)

A system for checking and correcting server configuration based on trigger operation, comprising: an authorization device, including a storage circuit and a control circuit, the storage circuit is electrically connected to the control circuit and used to store a hardware internal code and a first Hash value; the control circuit includes a first trigger element and a second trigger element, the control circuit is used to generate a first operation signal when the first trigger element receives a trigger operation, and the second trigger element receives Another trigger operation generates a second operation signal; and a server is electrically connected to the authorization device, the server is used to install a verification program, a verification program and a correction program, wherein the verification program is used to determine Whether the authorization device, the verification program and the correction program are legal; the verification program is used to generate a verification report after the verification program is judged to be legal and when the first operation signal is received; the correction program uses to modify at least one configuration value of the server after the verification program is judged to be valid and when the second operation signal is received; wherein the authorization device is electrically connected to the server based on a human interface device (Human Interface Device) protocol a server, and the first trigger element and the second trigger element are buttons or switches. The trigger operation-based server configuration checking and correction system as claimed in claim 1, wherein the verification program is further used to obtain the hardware internal code of the authorized device and determine whether the hardware internal code is legal to determine the authorized device Whether it is legal; the verification program is further used to obtain the first hash value of the authorized device, execute a hash algorithm according to the check program and the correction program to generate a second hash value, and compare the first hash value and the second hash value and selectively generate a legal signal to indicate whether the checking program and the correcting program are legal; wherein, the hash algorithm is a third-generation secure hash algorithm (Secure Hash Algorithm 3, SHA- 3). The trigger-based server configuration check and correction system as claimed in claim 2, wherein the verification program is further configured to store a list, the list includes a plurality of sub-lists, each of the sub-lists includes a plurality of legal hardware each of the sub-lists has a valid time zone; the verification procedure is further used to compare the valid time zone and the sub-lists of the sub-lists according to a current time and the hardware internal code of the authorization device The legal hardware internal codes of one of them, wherein the current time falls within the legal time zone of one of the sub-lists. The trigger operation-based server configuration checking and correction system as claimed in claim 1, wherein the checking program and the correction program are developed with a Java Development Kit; the checking program is further used to detect the server an operating system and executing a plurality of check commands corresponding to the operating system, the check commands are used to obtain a plurality of configuration setting values of the server, and compare the configuration setting values according to a standard setting value list , and output a check report, and the correction program is further used to detect the operating system of the server and execute a plurality of correction commands corresponding to the operating system, and the correction commands are used to set the value list according to the standard. The plurality of setting values respectively replace the configuration setting values of the server. A method for checking and correcting server configuration based on trigger operation, comprising: electrically connecting a server with an authorization device, wherein the server is installed with a check program and a correction program, and the authorization device is based on a user-friendly interface The device (Human Interface Device) agreement is electrically connected to the server; a verification program is executed by the server to determine whether the authorization device, the verification program and the correction program are legal; when the verification program determines the authorization device, the verification program When both the kernel program and the correction program are legal, use the authorization device to output one of a first operation signal and a second operation signal; wherein the authorization device includes a control circuit, and the control circuit includes a first trigger element and a a second trigger element, the control circuit is used for generating a first operation signal when the first trigger element receives a trigger operation, and generates a second operation signal when the second trigger element receives another trigger operation, and the The first trigger element and the second trigger element are buttons or switches; when the server receives the first operation signal, a check program is executed to generate a check report; or when the server receives the second operation When the signal is received, a correction program is executed to correct at least one configuration value of the server. The method for checking and correcting server configuration based on a trigger operation as claimed in claim 5, wherein the verification procedure comprises: obtaining a hardware internal code of the authorized device and judging whether the hardware internal code is legal; When the code is valid, obtain a first hash value of the authorization device; after obtaining the first hash value, execute a hash algorithm according to the checking program and the correction program to generate a second hash value; and compare the the first hash value and the second hash value, and when the first hash value and the second hash value are equal, output a legal signal to indicate that the authorization device is legal; wherein, the hash algorithm is a third-generation security Hash algorithm (Secure Hash Algorithm 3, SHA-3). The method for checking and correcting server configuration based on a trigger operation as described in claim 6, wherein determining whether the hardware internal code is legal further comprises: reading a list of the verification program with the server, the list including a plurality of sub-lists, each sub-list includes a plurality of valid hardware internal codes, each of the sub-lists has a valid time zone; the server compares a current time with the valid time zone of the sub-lists to obtain Obtaining one of the sub-lists whose current time falls within the legal time zone; after the server obtains one of the sub-lists, using the server according to the hardware internal code of the authorized device to compare the the legal hardware internal codes of the sub-list; and when the hardware internal code of the authorized device matches one of the legal hardware internal codes, the first hash value of the authorized device is obtained from the server. The method for checking and correcting server configuration based on a trigger operation as claimed in claim 5, wherein the checking program and the correcting program are developed with a Java Development Kit, and when the checking program or the correcting program is executed It further includes: detecting an operating system of the server; and executing a plurality of checking commands or correction commands corresponding to the operating system.

Images