WO2016026303A1 - 安全服务的审核处理方法及装置 - Google Patents

安全服务的审核处理方法及装置 Download PDF

Info

Publication number
WO2016026303A1
WO2016026303A1 PCT/CN2015/075913 CN2015075913W WO2016026303A1 WO 2016026303 A1 WO2016026303 A1 WO 2016026303A1 CN 2015075913 W CN2015075913 W CN 2015075913W WO 2016026303 A1 WO2016026303 A1 WO 2016026303A1
Authority
WO
WIPO (PCT)
Prior art keywords
security
specified
event
security event
resource
Prior art date
Application number
PCT/CN2015/075913
Other languages
English (en)
French (fr)
Inventor
叶郁文
彭亦辉
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to PCT/CN2015/086678 priority Critical patent/WO2016026403A1/zh
Publication of WO2016026303A1 publication Critical patent/WO2016026303A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks

Definitions

  • the present invention relates to the field of communications, and more particularly to an audit processing method and apparatus for security services.
  • the current cloud security process adopts the process of Figure 1, from the configuration of the security policy, the configuration of the security policy template, the release of the service level agreement (SLA) service, the execution of the security policy, and the monitoring of security events. , security policy policies and auditing of security logs.
  • the security policy template consists of security policies
  • the security services consist of security templates.
  • the present invention provides an audit processing method and apparatus for security services to at least solve the above problems.
  • a method for auditing security services including: auditing a specified security event triggered by a specified event, the specified security event including at least one of the following: a security service, a security service application Security policy; when the specified security event does not satisfy the predetermined condition, an indication or warning message is generated.
  • generating the alert or indication information includes at least one of: generating when the resource on which the specified security event depends does not satisfy the preset condition, The warning or indication information is generated when the resource condition on which the specified security event depends conflicts with resource conditions on which other security events depend.
  • the auditing the specified security event includes: detecting a pre-stored specified security event; reviewing the specified security event when the current resource occurs in one of the following conditions: the current resource change, the current resource corruption, the The current resource is working abnormally.
  • the current resource change or damage or work abnormality is determined: the device accesses the network, the physical machine is down, and the virtual machine crashes.
  • the auditing the specified security event includes: reviewing the specified security event according to a predetermined period.
  • an audit processing apparatus for a security service, comprising: an auditing module configured to audit a specified security event triggered by a specified event, the specified security event comprising at least one of the following: The security policy, the security policy applied by the security service, and the generating module, configured to generate an indication or warning information when the specified security event does not satisfy the predetermined condition.
  • the generating module includes: a first generating unit, configured to generate an indication or warning information when the resource on which the specified security event depends does not satisfy the preset condition; and the second generating unit is configured to An indication or warning message is generated when the resource condition on which the specified security event depends conflicts with the resource condition on which other security events depend.
  • the auditing module includes: a detecting unit configured to detect a specified security event stored in advance; or an auditing unit configured to review a specified security event when one of the following conditions occurs: the current The resource is changed, the current resource is damaged, and the current resource is abnormal.
  • the auditing module further includes a determining unit, configured to determine that the current resource change or damage or work abnormality in one of the following situations: the device accesses the network, the physical machine is down, the virtual machine Crash.
  • the auditing module is further configured to audit the specified security event according to a predetermined period.
  • the technical solution for triggering the mechanism for auditing the security event by using the specified event solves the problem that the technical solution for detecting the availability of the security service is not perfect, and the availability of the security service is low and the administrator is difficult to operate.
  • a comprehensive security service detection solution realizes early warning of security services, so that administrators can adjust in time, improve the availability of security services, and provide security for the security services themselves.
  • FIG. 1 is a system architecture diagram of a cloud security system in related art
  • FIG. 2 is a flowchart of an audit processing method of a security service according to an embodiment of the present invention
  • FIG. 3 is a flow chart of a static detection security policy in accordance with a preferred embodiment of the present invention.
  • FIG. 4 is a flow chart of a dynamic detection security policy in accordance with a preferred embodiment of the present invention.
  • FIG. 5 is a flow chart of periodically detecting a security policy in accordance with a preferred embodiment of the present invention.
  • FIG. 6 is a structural block diagram of an audit process of a security service according to an embodiment of the present invention.
  • FIG. 7 is another structural block diagram of an audit process of a security service according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a method for auditing security services according to an embodiment of the present invention. As shown in FIG. 2, the method includes the following steps:
  • Step S202 Auditing a specified security event under the trigger of the specified event, where the specified security event includes: a security service, a security policy applied by the security service;
  • Step S204 When the specified security event does not satisfy the predetermined condition, an indication or warning information is generated.
  • the technical solution for triggering the mechanism for auditing the security event by using the specified event solves the problem that the technical solution for detecting the availability of the security service is not perfect, and the availability of the security service is low and the administrator is difficult to operate.
  • a perfect security service detection solution realizes early warning of security services, so that administrators can adjust in time, improve the availability of security services, and provide security for the security services themselves.
  • the foregoing step S204 may include at least one of: generating an indication or warning information when the resource on which the specified security event depends does not satisfy the preset condition; and the resource condition on which the specified security event depends and other resources depending on the security event When the conditions conflict, an indication or warning message is generated.
  • the auditing specified security event in step S202 includes: detecting a pre-stored specified security event; and reviewing the specified security event when the current resource occurs in one of the following situations: the current resource change The current resource is damaged, and the current resource is abnormal.
  • the current resource change or damage or abnormal operation is determined: the device accesses the network, the physical machine is down, and the virtual machine crashes.
  • the technical solution provided by the foregoing embodiments of the present invention can also be applied to the security service before the security service is released, and the security solution can be pre-warned by such a technical solution, so that the administrator can perform management in advance.
  • the detection process is divided into a static detection process and a dynamic detection process.
  • the static or dynamic detection security policy is taken as an example, but does not limit the invention.
  • Static security policy audit process The administrator can select an existing security policy, security template, and security service to perform correlation measurement on the resources and conditions to be executed. The administrator can also instantiate the security service (if it has been selected by a tenant) ) Take measurements. If the resource conditions on which the security policy depends are not met or conflict, the resources and conditions that do not comply with the policy may be displayed through text or graphics, and an alarm is generated to prompt the administrator to process.
  • FIG. 3 is a flow chart of a static detection security policy according to a preferred embodiment of the present invention, as shown in FIG. 3:
  • Step S302 determining whether the current security policy audit is passed, if yes, go to step S304, if not, go to step S306;
  • Step S304 After determining that the current security policy is approved, the security SLA service is released, the security policy is running, the security event is monitored, the security data is measured, and the security event is audited;
  • Step S306 After determining that the current security policy audit has not passed, generating an alarm message, and the system alarms;
  • Step S308 Notifying the administrator to perform related operations.
  • Dynamic security policy audit When resources are changed or damaged, such as network access equipment, physical machine down, virtual machine hanged, etc., the security policy dynamic audit module collects alarm events and reversely searches for the security services involved according to the resource code.
  • the security policy template and the security policy are used to perform security policy audits. For resources and conditions that do not meet the policy, an alarm is generated immediately and the administrator is prompted to process the alarm.
  • FIG. 4 is a flow chart of a dynamic detection security policy according to a preferred embodiment of the present invention, as shown in FIG. 4:
  • Step S402 detecting a resource change
  • Step S404 triggering a dynamic audit of the security policy
  • Step S406 Search for a related security policy according to the resource id;
  • Step S408 Security policy review
  • Step S410 determining whether the security policy audit is passed, if yes, go to step S416, if not, go to step S412;
  • Step S412 After determining that the current security policy audit has not passed, generating an alarm message, and the system alarms;
  • Step S414 Notifying the administrator to perform related operations
  • Step S416 End the review process.
  • the auditing security event may include: reviewing the security event according to a predetermined period.
  • Regular security policy review process It can test the task mechanism of regular review of security policies, and can schedule tasks to review the security policies when the system is idle.
  • FIG. 5 is a flow chart of periodically detecting a security policy according to a preferred embodiment of the present invention, as shown in FIG. 5:
  • Step S502 Periodic policy audit task time triggering
  • Step S504 traversing the security policy according to the task
  • Step S506 Security Policy Audit
  • Step S508 determining whether the security policy audit is passed, if yes, go to step S514, if not, go to step S510;
  • Step S510 After determining that the current security policy audit has not passed, generating an alarm message, and the system alarms;
  • Step S512 Notifying the administrator to perform related operations
  • Step S514 End the review process.
  • the embodiment of the present invention focuses on the security policy configuration of the security chain of FIG. 1 and the security service release, and proposes a new security policy audit.
  • security policies Through static and dynamic auditing of security policies, the existing security policies, security templates, and security services are alerted so that administrators can adjust in time to provide the availability of security services, and the security services themselves provide security.
  • the cloud computing system includes a security policy, a security template, a security service, a physical machine, a virtual machine, and the like. All resources have unique codes in the cloud computing system, so as to accurately retrieve and locate according to the code.
  • Security policy audit database The security policy and the security policy association instance are used as objects to store the associated resource information. When the policy is audited, the corresponding instance resource information needs to be found according to the policy convenience;
  • Security Policy Audit Management Node Administrators can configure security policy auditing through this node configuration
  • the security policy auditing service node is connected to the cloud platform's alarm system to capture resource change information and trigger dynamic security policy auditing according to the configured security audit policy.
  • FIG. 6 is a structural block diagram of an audit process of a security service according to an embodiment of the present invention. As shown in Figure 6, the device includes:
  • the auditing module 60 is configured to audit the specified security event under the trigger of the specified event, where the specified security event includes: a security service, a security policy applied by the security service;
  • the generating module 62 is connected to the auditing module 60 and configured to generate an indication or warning information when the specified security event does not satisfy the predetermined condition.
  • the generating module 62 includes: a first generating unit 620, configured to generate an indication or warning information when the resource on which the specified security event depends does not satisfy the preset condition; and the second generating unit 622 Is set to generate an indication or warning message when the resource condition on which the specified security event depends conflicts with the resource condition on which other security events depend.
  • the auditing module 60 includes: a detecting unit 600 configured to detect a specified security event stored in advance; and an auditing unit 602 configured to audit the specified when one of the following conditions occurs in the current resource Security event: The current resource change, the current resource damage, and the current resource work exception.
  • the auditing module 60 further includes a determining unit 604 configured to determine the current resource change or damage or work abnormality in one of the following situations: the physical machine is down, and the virtual machine is dead.
  • the audit module 60 is further configured to audit the specified security event according to a predetermined period.
  • the embodiments of the present invention achieve the following beneficial effects: the technical solution for detecting the availability of the security service is not perfect, and the availability of the security service is low and the administrator is difficult to operate, and the security service can be alerted. In order to adjust the administrator in time, improve the availability of security services and provide security for the security services themselves.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the above technical solution provided by the embodiment of the present invention solves the technical solution that triggers the auditing of the security event by using the specified event, and solves the technical solution that the security service is detected is not perfect, and the availability of the security service is low and the administrator
  • the problem of difficult operation provides a perfect security service detection solution, which enables early warning of security services, so that administrators can adjust in time, improve the availability of security services, and provide security for the security services themselves.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Debugging And Monitoring (AREA)

Abstract

本发明提供了一种安全服务的审核处理方法及装置，其中，所述审核处理方法包括：在指定事件的触发下，审核指定安全事件，该指定安全事件包括：安全服务、安全服务所应用的安全策略；当检测到所述指定安全事件不满足预定条件时，产生指示或警示信息。采用本发明提供的上述技术方案，解决了在检测安全服务的可用性的技术方案不够完善而导致的安全服务的可用性低以及管理员操作难度大的问题，能够实现对安全服务进行预警，以便管理员及时调整，提高了安全服务的可用性，并对安全服务本身提供安全保障。

Description

安全服务的审核处理方法及装置 技术领域
本发明涉及通信领域，更具体地说，涉及安全服务的审核处理方法及装置。
背景技术
随着云计算市场的快速发展和产业链的建立，云安全日益重要。相关的安全研究也逐渐深入。目前的云安全环节采用了图1的过程，从安全策略的配置、安全策略模板的配置、安全服务等级协议(Service Level Agreement，简称为SLA)服务的发布、安全策略的执行、安全事件的监控、安全事件的策略和安全日志的审计。安全策略模板由安全策略组成，安全服务由安全模板组成。
针对相关技术中在检测安全服务的可用性的技术方案还不够完善而导致的安全服务的可用性低以及管理员操作难度大的问题，目前尚未提出有效的解决方案。
发明内容
本发明提供了一种安全服务的审核处理方法及装置，以至少解决上述问题。
根据本发明的一个实施例，提供了一种安全服务的审核处理方法，包括：在指定事件的触发下，审核指定安全事件，该指定安全事件包括以下至少之一：安全服务、安全服务所应用的安全策略；所述指定安全事件不满足预定条件时，产生指示或警示信息。
在本发明实施例中，当检测到所述指定安全事件不满足预定条件时，产生警示或指示信息包括至少以下之一：当所述指定安全事件所依赖的资源不满足预设条件时，产生所述警示或指示信息；当所述指定安全事件所依赖的资源条件与其他安全事件所依赖的资源条件冲突时，产生所述警示或指示信息。
在本发明实施例中，审核指定安全事件包括：检测预先存储的指定安全事件；在当前资源出现以下之一情况时，审核指定安全事件：所述当前资源变更、所述当前资源损坏、所述当前资源工作异常。
在本发明实施例中，在以下之一情况时，确定所述当前资源变更或损坏或工作异常：设备接入网络、物理机宕机、虚拟机死机。
在本发明实施例中，审核指定安全事件，包括：按照预定周期审核指定安全事件。
根据本发明的另一个实施例，还提供了一种安全服务的审核处理装置，包括：审核模块，设置为在指定事件的触发下，审核指定安全事件，该指定安全事件包括以下至少之一：安全服务、安全服务所应用的安全策略；产生模块，设置为当所述指定安全事件不满足预定条件时，产生指示或警示信息。
在本发明实施例中，所述产生模块包括：第一产生单元，设置为当所述指定安全事件所依赖的资源不满足预设条件时，产生指示或警示信息；第二产生单元，设置为当所述指定安全事件所依赖的资源条件与其他安全事件所依赖的资源条件冲突时，产生指示或警示信息。
在本发明实施例中，所述审核模块包括：检测单元，设置为检测预先存储的指定安全事件；或审核单元，设置为在当前资源出现以下之一情况时，审核指定安全事件：所述当前资源变更、所述当前资源损坏、所述当前资源工作异常。
在本发明实施例中，所述审核模块，还包括确定单元，设置为在以下之一情况时，确定所述当前资源变更或损坏或工作异常：设备接入网络、物理机宕机、虚拟机死机。
在本发明实施例中，所述审核模块还设置为按照预定周期审核指定安全事件。
通过本发明，采用指定事件触发审核安全事件的机制的技术方案，解决了检测安全服务的可用性的技术方案还不够完善而导致的安全服务的可用性低以及管理员操作难度大的问题，提供了一种完善的安全服务的检测方案，实现了对安全服务进行预警，以便管理员及时调整，提高了安全服务的可用性，并对安全服务本身提供安全保障。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为相关技术中云安全系统的系统架构图；
图2为根据本发明实施例的安全服务的审核处理方法的流程图；
图3为根据本发明优选实施例的静态检测安全策略的流程图；
图4为根据本发明优选实施例的动态检测安全策略的流程图；
图5为根据本发明优选实施例的定期检测安全策略的流程图；
图6为根据本发明实施例的安全服务的审核处理的结构框图；
图7为根据本发明实施例的安全服务的审核处理的另一结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
本发明的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本发明而了解。本发明的目的和其他优点可通过在所写的说明书、权利要求书、以及附图中所特别指出的结构来实现和获得。
本发明实施例提供了一种安全服务的审核处理方法，图2为根据本发明实施例的安全服务的审核处理方法的流程图，如图2所示，该方法包括如下步骤：
步骤S202：在指定事件的触发下，审核指定安全事件，该指定安全事件包括：安全服务、安全服务所应用的安全策略；
步骤S204：当上述指定安全事件不满足预定条件时，产生指示或警示信息。
通过上述各个步骤，采用指定事件触发审核安全事件的机制的技术方案，解决了检测安全服务的可用性的技术方案还不够完善而导致的安全服务的可用性低以及管理员操作难度大的问题，提供了一种完善的安全服务的检测方案，实现了对安全服务进行预警，以便管理员及时调整，提高了安全服务的可用性，并对安全服务本身提供安全保障。
上述步骤S204可以包括至少以下之一：当上述指定安全事件所依赖的资源不满足预设条件时，产生指示或警示信息；当上述指定安全事件所依赖的资源条件与其他安全事件所依赖的资源条件冲突时，产生指示或警示信息。
在本发明实施例的一个可选实施例中，步骤S202中的审核指定安全事件包括：检测预先存储的指定安全事件；在当前资源出现以下之一情况时，审核指定安全事件：上述当前资源变更、上述当前资源损坏、上述当前资源工作异常，可选地，在以下之一情况时，确定上述当前资源变更或损坏或工作异常：设备接入网络、物理机宕机、虚拟机死机。
需要说明的是，本发明实施例上述提供的技术方案还可以应用于安全服务发布之前，采用这样的技术方案可以对安全事件等进行提前预警，进而管理员能够提前进行管理。
为了更好的理解上述检测安全事件的过程，以下结合优选实施例进行说明，实际上，在本发明实施例中，是将检测过程分为了静态检测过程和动态检测过程，本发明优选实施例以静态或动态检测安全策略为例，但并不限定本发明。
静态安全策略审核过程：管理员可以选择已有的安全策略、安全模板、安全服务，对被执行的资源、条件进行关联测量；管理员亦可已实例化的安全服务(如已被某租户选用)进行测量。如安全策略所依赖的资源条件不具备或冲突，并可通过文本或图形显示不符合策略的资源和条件，并产生告警，提示管理员进行处理。
图3为根据本发明优选实施例的静态检测安全策略的流程图，如图3所示：
步骤S302：判断当前安全策略审核是否通过，如果通过，则转到步骤S304，如果不通过，则转到步骤S306；
步骤S304：在确定当前安全策略审核通过后，安全SLA服务发布，安全策略运行，安全事件监控，安全数据测量，安全事件审计；
步骤S306：在确定当前安全策略审核没有通过后，产生报警信息，系统报警；
步骤S308：通知管理员进行相关操作。
动态安全策略审核：当资源变更或损坏时，如网络接入设备，物理机宕机，虚机吊死等，安全策略动态审核模块通过采集告警事件，根据资源代码反向搜索所涉及的安全服务、安全策略模板和安全策略，进行安全策略审核,对于不符合策略的资源和条件，即时产生告警，并提示管理员进行处理。
图4为根据本发明优选实施例的动态检测安全策略的流程图，如图4所示：
步骤S402：检测到资源变更；
步骤S404：安全策略动态审核触发；
步骤S406：根据资源id寻找相关安全策略；
步骤S408：安全策略审核；
步骤S410：判断安全策略审核是否通过，如果通过，则转到步骤S416，如果没通过，则转到步骤S412；
步骤S412：在确定当前安全策略审核没有通过后，产生报警信息，系统报警；
步骤S414：通知管理员进行相关操作；
步骤S416：结束审核流程。
其中，审核安全事件可以包括：按照预定周期对上述安全事件进行审核。
为了更好的理解上述定期检测安全事件的过程，以下结合另一个优选实施例进行说明。
定期安全策略审核过程：可测试安全策略定期审核的任务机制，在系统闲时可调度任务来对安全策略进行回溯时审核。
图5为根据本发明优选实施例的定期检测安全策略的流程图，如图5所示：
步骤S502：定期策略审核任务时间触发
步骤S504：根据任务对安全策略进行遍历
步骤S506：安全策略审核
步骤S508：判断安全策略审核是否通过，如果通过，则转到步骤S514，如果没通过，则转到步骤S510；
步骤S510：在确定当前安全策略审核没有通过后，产生报警信息，系统报警；
步骤S512：通知管理员进行相关操作；
步骤S514：结束审核流程。
综上所述，本发明实施例侧重点在于在图1安全链条的安全策略配置到安全服务发布之间，提出了新增安全策略审核的环节。通过对安全策略的静态和动态审核，对现有的安全策略、安全模板、安全服务进行预警，以便管理员及时调整，提供安全服务的可用性，并安全服务本身提供安全保障。
在本发明实施例中，上述云计算系统包括安全策略、安全模板、安全服务、物理机、虚机等，所有资源在云计算系统中都有唯一的代码，以便根据代码进行准确检索定位。
在本发明实施例中还涉及的网元设备功能如下：
安全策略审核数据库：以安全策略和安全策略关联实例为对象存储所关联的资源信息，策略审核时，需根据策略便利找出对应的实例资源信息；
安全策略审核管理节点：管理员可通过该节点配置对安全策略审核进行配置；
安全策略审核业务节点：与云平台的告警系统相连，可捕捉资源变动信息，并根据配置安全审核策略触发动态安全策略的审核。
在本实施例中还提供了一种安全服务的审核处理装置，用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述，下面对该装置中涉及到的模块进行说明。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。图6为根据本发明实施例的安全服务的审核处理的结构框图。如图6所示，该装置包括：
审核模块60，设置为在指定事件的触发下，审核指定安全事件，该指定安全事件包括：安全服务、安全服务所应用的安全策略；
产生模块62，与审核模块60相连，设置为当上述指定安全事件不满足预定条件时，产生指示或警示信息。
通过上述各个模块的综合作用，采用指定事件触发审核安全事件的机制的技术方案，解决了检测安全服务的可用性的技术方案还不够完善而导致的安全服务的可用性低以及管理员操作难度大的问题，提供了一种完善的安全服务的检测方案，实现了对安全服务进行预警，以便管理员及时调整，提高了安全服务的可用性，并对安全服务本身提供安全保障。
可选地，如图7所示，产生模块62包括：第一产生单元620，设置为当上述指定安全事件所依赖的资源不满足预设条件时，产生指示或警示信息；第二产生单元622，设置为当上述指定安全事件所依赖的资源条件与其他安全事件所依赖的资源条件冲突时，产生指示或警示信息。
本发明实施例对上述技术方案的进一步改进在于，审核模块60包括：检测单元600，设置为检测预先存储的指定安全事件；审核单元602，设置为在当前资源出现以下之一情况时，审核指定安全事件：上述当前资源变更、上述当前资源损坏、上述当前资源工作异常。
可选地，审核模块60，还包括确定单元604，设置为在以下之一情况时，确定上述当前资源变更或损坏或工作异常：物理机宕机、虚拟机死机。
在具体实施过程中，审核模块60还设置为按照预定周期对上述指定安全事件进行审核。
综上所述，本发明实施例实现了以下有益效果：检测安全服务的可用性的技术方案还不够完善而导致的安全服务的可用性低以及管理员操作难度大的问题，能够实现对安全服务进行预警，以便管理员及时调整，提高了安全服务的可用性，并对安全服务本身提供安全保障。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
基于本发明的实施例提供的上述技术方案，通过采用指定事件触发审核安全事件的机制的技术方案，解决了检测安全服务的可用性的技术方案还不够完善而导致的安全服务的可用性低以及管理员操作难度大的问题，提供了一种完善的安全服务的检测方案，实现了对安全服务进行预警，以便管理员及时调整，提高了安全服务的可用性，并对安全服务本身提供安全保障。

Claims (10)

  1. 一种安全服务的审核处理方法，包括：
    在指定事件的触发下，审核指定安全事件，该指定安全事件包括以下至少之一：安全服务、安全服务所应用的安全策略；
    所述指定安全事件不满足预定条件时，产生指示或警示信息。
  2. 根据权利要求1所述的方法，其中，当检测到所述指定安全事件不满足预定条件时，产生警示或指示信息包括至少以下之一：
    当所述指定安全事件所依赖的资源不满足预设条件时，产生所述警示或指示信息；
    当所述指定安全事件所依赖的资源条件与其他安全事件所依赖的资源条件冲突时，产生所述警示或指示信息。
  3. 根据权利要求1所述的方法，其中，审核指定安全事件包括：
    检测预先存储的指定安全事件；或
    在当前资源出现以下至少之一情况时，审核所述指定安全事件：所述当前资源变更、所述当前资源损坏、所述当前资源工作异常。
  4. 根据权利要求3所述的方法，其中，在以下之一情况时，确定所述当前资源变更或损坏或工作异常：
    设备接入网络、物理机宕机、虚拟机死机。
  5. 根据权利要求1-4任一项所述的方法，其中，审核相关的安全事件，包括：按照预定周期审核相关的安全事件。
  6. 一种安全服务的审核处理装置，包括：
    审核模块，设置为在指定事件的触发下，审核指定安全事件，该安全事件包括以下至少之一：安全服务、安全服务所应用的安全策略；
    产生模块，设置为当所述指定安全事件不满足预定条件时，产生指示或警示信息。
  7. 根据权利要求6所述的装置，其中，所述产生模块包括：
    第一产生单元，设置为当所述指定安全事件所依赖的资源不满足预设条件时，产生指示或警示信息；
    第二产生单元，设置为当所述指定安全事件所依赖的资源条件与其他安全事件所依赖的资源条件冲突时，产生指示或警示信息。
  8. 根据权利要求6所述的装置，其中，所述审核模块包括：
    检测单元，设置为检测预先存储的指定安全事件；或
    审核单元，设置为在当前资源出现以下之一情况时，审核指定安全事件：所述当前资源变更、所述当前资源损坏、所述当前资源工作异常。
  9. 根据权利要求8所述的装置，其中，所述审核模块，还包括确定单元，设置为在以下之一情况时，确定所述当前资源变更或损坏或工作异常：设备接入网络、物理机宕机、虚拟机死机。
  10. 根据权利要求6-9任一项所述的装置，其中，所述审核模块还设置为按照预定周期审核指定安全事件。
PCT/CN2015/075913 2014-08-21 2015-04-03 安全服务的审核处理方法及装置 WO2016026303A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/086678 WO2016026403A1 (zh) 2014-08-21 2015-08-11 安全服务的审核处理方法及装置

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410416187.3A CN105357170A (zh) 2014-08-21 2014-08-21 安全服务的审核处理方法及装置
CN201410416187.3 2014-08-21

Publications (1)

Publication Number Publication Date
WO2016026303A1 true WO2016026303A1 (zh) 2016-02-25

Family

ID=55333036

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/CN2015/075913 WO2016026303A1 (zh) 2014-08-21 2015-04-03 安全服务的审核处理方法及装置
PCT/CN2015/086678 WO2016026403A1 (zh) 2014-08-21 2015-08-11 安全服务的审核处理方法及装置

Family Applications After (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/086678 WO2016026403A1 (zh) 2014-08-21 2015-08-11 安全服务的审核处理方法及装置

Country Status (2)

Country Link
CN (1) CN105357170A (zh)
WO (2) WO2016026303A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113064948A (zh) * 2021-04-29 2021-07-02 济南慧天云海信息技术有限公司 一种高效安全的数据服务发布方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113505367B (zh) * 2021-06-29 2024-05-28 杭州华橙软件技术有限公司 安全审计方法、装置、系统、电子装置和可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101605065A (zh) * 2009-04-22 2009-12-16 网经科技（苏州）有限公司 安全中心系统中安全事件监控的实现方法
CN101820360A (zh) * 2010-04-02 2010-09-01 中兴通讯股份有限公司 一种告警平台及其实现告警的方法
CN102291253A (zh) * 2011-07-05 2011-12-21 苏州阔地网络科技有限公司 一种网络通信中消息安全的预警方法及装置
US20120084857A1 (en) * 2010-09-30 2012-04-05 Verizon Patent And Licensing Inc. Device security system
CN103441896A (zh) * 2013-08-26 2013-12-11 苏州市吴江区人民政府国有资产监督管理办公室 一种业务数据监测预警平台及预警方法

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8091114B2 (en) * 2006-09-15 2012-01-03 Bombardier Transportation Gmbh Integrated security event management system
CN101800773A (zh) * 2010-02-20 2010-08-11 北京城际高科信息技术有限公司 一种车载信息服务系统和方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101605065A (zh) * 2009-04-22 2009-12-16 网经科技（苏州）有限公司 安全中心系统中安全事件监控的实现方法
CN101820360A (zh) * 2010-04-02 2010-09-01 中兴通讯股份有限公司 一种告警平台及其实现告警的方法
US20120084857A1 (en) * 2010-09-30 2012-04-05 Verizon Patent And Licensing Inc. Device security system
CN102291253A (zh) * 2011-07-05 2011-12-21 苏州阔地网络科技有限公司 一种网络通信中消息安全的预警方法及装置
CN103441896A (zh) * 2013-08-26 2013-12-11 苏州市吴江区人民政府国有资产监督管理办公室 一种业务数据监测预警平台及预警方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113064948A (zh) * 2021-04-29 2021-07-02 济南慧天云海信息技术有限公司 一种高效安全的数据服务发布方法
CN113064948B (zh) * 2021-04-29 2022-10-04 济南慧天云海信息技术有限公司 一种高效安全的数据服务发布方法

Also Published As

Publication number Publication date
WO2016026403A1 (zh) 2016-02-25
CN105357170A (zh) 2016-02-24

Similar Documents

Publication Publication Date Title
CN109726072B (zh) WebLogic服务器的监控告警方法、装置、系统及计算机存储介质
CN105631026B (zh) 一种安全数据分析系统
US10558544B2 (en) Multiple modeling paradigm for predictive analytics
US8224942B1 (en) Network failure detection
US9836952B2 (en) Alarm causality templates for network function virtualization
WO2015154455A1 (zh) 告警处理方法、装置、nms、oss及ems
CN108833522B (zh) 一种确定节点可信的系统及方法
JP2018518762A5 (zh)
GB2434670B (en) Monitoring and management of distributed information systems
WO2017114152A1 (zh) 一种业务拨测方法、装置以及系统
WO2016188100A1 (zh) 信息系统故障场景信息收集方法及系统
JP2011175639A5 (zh)
CN106776243B (zh) 一种针对监控软件的监控方法及装置
CN111124830B (zh) 一种微服务的监控方法及装置
US11196613B2 (en) Techniques for correlating service events in computer network diagnostics
JP2024521357A (ja) Ｍｌモデルを用いて準リアルタイムデータ／オフラインデータでデータセンタの大規模な故障の検出
US10999180B2 (en) System for defining and implementing performance monitoring requirements for applications and hosted computing environment infrastructure
US10664335B2 (en) System and method for maintaining the health of a machine
CN108073499B (zh) 应用程序的测试方法及装置
CN105184156A (zh) 一种安全威胁管理方法和系统
WO2016026303A1 (zh) 安全服务的审核处理方法及装置
CN113342608B (zh) 流式计算引擎任务的监控方法及装置
US11251976B2 (en) Data security processing method and terminal thereof, and server
US20160050101A1 (en) Real-Time Network Monitoring and Alerting
US20180060987A1 (en) Identification of abnormal behavior in human activity based on internet of things collected data

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15834481

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15834481

Country of ref document: EP

Kind code of ref document: A1