WO2016180088A1 - 一种配置信息的合规检测方法和装置 - Google Patents

一种配置信息的合规检测方法和装置 Download PDF

Info

Publication number
WO2016180088A1
WO2016180088A1 PCT/CN2016/077019 CN2016077019W WO2016180088A1 WO 2016180088 A1 WO2016180088 A1 WO 2016180088A1 CN 2016077019 W CN2016077019 W CN 2016077019W WO 2016180088 A1 WO2016180088 A1 WO 2016180088A1
Authority
WO
WIPO (PCT)
Prior art keywords
configuration information
result
configuration
content
verification
Prior art date
Application number
PCT/CN2016/077019
Other languages
English (en)
French (fr)
Inventor
滕志猛
蒋璐峥
沈岷
周娜
霍玉臻
严为
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016180088A1 publication Critical patent/WO2016180088A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • This document relates to, but is not limited to, the field of communications, and relates to a method and apparatus for compliance detection of configuration information.
  • the Skybox Security survey found that 58% of enterprises deployed more than 100 rules on their NGFW (Next Generation Firewall), while 35% of companies performed more than 100 changes per month. Frequent changes are likely to cause configuration errors. . According to Gartner, 99% of firewall security incidents are caused by firewall configuration errors. Enterprises need a way to automatically detect security device configuration policy compliance, combine technology and management organically, and manage and control network security in a unified manner to improve overall security.
  • NGFW Next Generation Firewall
  • Configuration change management is disorderly and disorderly.
  • the embodiment of the invention provides a method and device for detecting compliance of configuration information, which solves the problem that the configuration change management is disorderly and disorderly.
  • a method for compliance detection of configuration information including:
  • the first configuration information and the second configuration information obtained by modifying the first configuration information are all detected by using the same verification policy, and respectively obtaining a first verification result and a second verification result;
  • the evaluation result is output.
  • the output evaluation result includes:
  • the evaluation result is output.
  • the outputting the evaluation result includes:
  • the method further includes:
  • the suggestion information for selecting the change content is determined according to the evaluation result corresponding to each change content, wherein the suggestion information is determined according to the compliance degree obtained after checking the change content and the verification policy.
  • the method further includes:
  • the notification completes the configuration operation using the final used configuration information.
  • the method further includes:
  • the notification modifies the content of the change in the recommendation information whose compliance degree is lower than the threshold.
  • a compliance detection device for configuration information comprising:
  • a detecting module configured to change the first configuration information and the first configuration information
  • the second configuration information obtained is detected by the same verification strategy, and the first verification result and the second verification result are respectively obtained;
  • a comparison module configured to compare the first verification result and the second verification result to obtain a comparison result
  • the processing module is configured to output an evaluation result according to the comparison result.
  • the processing module includes:
  • the evaluation unit is configured to perform risk assessment on the changed content according to the changed content, and obtain an evaluation result
  • An output unit configured to output the evaluation result.
  • the output unit is configured to output an evaluation result corresponding to each changed content when the number of the changed contents is at least two;
  • the processing module further includes:
  • the processing unit is configured to: receive a selection result of the changed content; and determine configuration information to be finally used according to the selection result of the changed content; or output the pair selection according to the evaluation result corresponding to each changed content
  • the suggestion information of the change content wherein the suggestion information is determined according to the compliance obtained after checking the change content and the verification strategy.
  • the device further includes:
  • the first notification module is configured to notify, after determining the configuration information finally used, that the configuration operation is completed by using the finally used configuration information.
  • the device further includes:
  • the second notification module is configured to, after outputting the suggestion information for selecting the changed content, notify the modification content of the recommendation information that the compliance degree is lower than the threshold.
  • the embodiment of the present invention provides a computer readable storage medium, where the computer readable storage medium stores computer executable instructions, and the computer executable instructions are executed to implement the compliance detection method of the configuration information.
  • the original first configuration information and the second configuration information obtained after the change are detected by using the same verification policy, and the first verification result and the second result are respectively obtained.
  • the verification result after comparing the two verification results, outputs the comparison result, realizes the compliance detection of the configuration information, and solves the problem that the configuration change management is disorderly and disorderly.
  • FIG. 1 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 1 of the present invention
  • FIG. 2 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 2 of the present invention
  • FIG. 3 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 3 of the present invention.
  • FIG. 4 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 4 of the present invention.
  • FIG. 5 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 5 of the present invention.
  • FIG. 6 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 6 of the present invention.
  • FIG. 7 is a structural diagram of a compliance detecting apparatus for configuration information according to Embodiment 7 of the present invention.
  • FIG. 8 is another structural diagram of a compliance detecting apparatus for configuration information according to Embodiment 7 of the present invention.
  • FIG. 1 is a flowchart of a method for detecting compliance of configuration information according to an embodiment of the present invention.
  • the method shown in Figure 1 includes:
  • Step 101 The first configuration information and the second configuration information obtained by modifying the first configuration information are all detected by using the same verification policy, and respectively obtaining a first verification result and a second verification result;
  • Step 102 Compare the first verification result with the second verification result to obtain a comparison result
  • Step 103 Output an evaluation result according to the comparison result.
  • the method for detecting compliance of the configuration information detects the original first configuration information and the second configuration information obtained after the change using the same verification policy, and obtains the first After verifying the results of the verification and the second verification result, after comparing the two verification results, the comparison result is output, and the comparison result is analyzed to check the difference in the comparison result.
  • the result of the evaluation is to judge the difference. For the content that is not in compliance with the difference, or the content that brings more risks, an alarm or suggestion is not given.
  • the knowledge base can be used to verify the configuration information.
  • the knowledge base includes various rich configuration check libraries (the configuration check library can be composed of multiple configuration check items), such as various risk pools and compliance libraries. , baseline libraries, etc., these checklists and checklists can provide verification of different requirements for devices, devices or systems from different dimensions.
  • the configuration information may include various configurations related to the device, device or system, such as configuration information before and after the change on the device, device or system, or configuration information selected and set by the user for different configurations defined by the device, device or system. Wait.
  • any configuration check library in the knowledge base for the first configuration information for example, checking the configuration information in the first configuration according to the configuration check item in the configuration check library, and detecting the compliance degree of the first configuration information according to the configuration check item , generating the first verification result.
  • the same configuration check library as the first configuration information is also selected, the configuration check is performed, and the compliance degree of the second configuration information is detected according to the configuration check entry, and the configuration check result is generated. If multiple configurations are included, the same configuration check library can be selected accordingly, and configuration verification can be performed for different configurations to generate a second verification result.
  • Compare the first verification result with the second verification result For example, comparing the configuration of different configuration choices or settings of the same configuration item on the device, device, or system to verify the compliance degree, and providing the user with configuration suggestion options, for example, suggesting that the user select a configuration with higher compliance. Similarly, you can compare the configuration check results for multiple configurations to select the most compliant configuration choice or setting for a device, device, or system configuration item.
  • the following describes the compliance detection method of the configuration information provided by the embodiment of the present invention.
  • the user has a configuration change request, but it is not clear whether the change will affect the existing environment.
  • the policy management device provides a verification method for the configuration change.
  • the policy control device is a A hardware device that can manage policies on a network device.
  • the configuration information compliance detection method provided in this embodiment includes, in addition to the technical solution in the first embodiment, in the compliance detection method of the configuration information in the implementation,
  • the evaluation result is output, including:
  • the evaluation result is output.
  • FIG. 2 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 2 of the present invention. As shown in FIG. 2, the method includes:
  • Step 21 configuring a verification process
  • This embodiment can perform verification check on the configuration before and after the change.
  • the configuration before the change may be the original configuration information or option that has been validated on the device, device, or system.
  • the configuration after the change may be the device that the user plans to perform or adds, modify, or delete after the original configuration.
  • the acquisition of the configuration information can be obtained by actively acquiring the device, the device or the system, or by uploading the device, the device or the system.
  • any template library in the knowledge base may be selected for the original configuration information, and the original configuration information is checked according to the configuration check item in the template library, and the compliance degree of the original configuration information is detected according to the configuration check item. , generate configuration check results.
  • the same template library is also selected, the configuration check is performed, and the configuration verification result is generated by detecting the compliance degree of the changed configuration information according to the configuration check entry.
  • Step 22 automatically comparing the two configuration verification results
  • the specific content of the change can be obtained by comparing the configuration file before and after the change or the configuration check result before and after the change; analyzing the scope of the changed content and evaluating the risk, for example, determining whether the change content is involved To areas such as access control, security auditing, structural security, intrusion prevention, border integrity, malicious code prevention, network device protection, etc. It is necessary to judge whether the changed content will bring higher risks or loopholes.
  • Step 23 the comparison results are displayed.
  • the above analysis results can be displayed to the user through a visual interface, and the user can decide whether to perform the change operation according to the automated analysis result.
  • the original first configuration information and the second configuration information obtained after the change are detected by using the same verification policy, and the first verification result and the second result are respectively obtained.
  • the verification result after comparing the two verification results, outputs the comparison result to achieve compliance detection of the configuration information.
  • the user can accurately analyze the risk caused by the configuration change, and provide a basis for the user to select the configuration information.
  • the following describes the compliance detection method of the configuration information provided by the embodiment of the present invention.
  • the policy management device provides a plurality of configuration verification methods.
  • the outputting the evaluation result includes:
  • the method further includes:
  • the selection result of the changed content is received, and the configuration information finally used is determined based on the selection result of the changed content.
  • FIG. 3 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 3 of the present invention. As shown in FIG. 3, the method includes:
  • Step 31 configuring a verification process
  • the first configuration information is a configuration file scheme
  • the second configuration information is another configuration file scheme different from the first configuration information
  • the two configuration information may be partially different or completely different.
  • any template library in the knowledge base for the first configuration information checking the first configuration information according to the configuration check item in the template library, detecting the compliance degree of the first configuration information according to the configuration check item, and generating a configuration check result.
  • the same template library is also selected for the second configuration information, the configuration check is performed, and the compliance degree of the second configuration information is detected according to the configuration check item, and the configuration check result is generated.
  • Step 32 Automate the comparison of the results of the configuration check
  • the specific content of the variation configuration difference can be obtained by comparing the configuration files of the two or the verification results of the two; analyzing the range of possible differences of the specific content of the difference and evaluating the risk thereof For example, to determine whether the difference content involves such scope as access control, security audit, structural security, intrusion prevention, border integrity, malicious code prevention, network device protection, etc., to determine whether the difference content will bring higher risks or loopholes, etc. .
  • Step 33 the comparison results are displayed.
  • the above analysis results can be displayed to the user through a visual interface, and the user can decide which set of configuration files to use based on the automated analysis results.
  • the original first configuration information and the second configuration information obtained after the change are detected by using the same verification policy, and the first verification result and the second result are respectively obtained.
  • the verification result after comparing the two verification results, outputs the comparison result to achieve compliance detection of the configuration information.
  • the user can accurately analyze the risk caused by the configuration change, and provide a basis for the user to select the configuration information; and when the change content is multiple, By outputting the evaluation result of each change content and receiving the configuration information determined by the user according to the evaluation result, the optimal selection of the configuration information is realized through human-computer interaction, and the processing efficiency is improved.
  • the following describes the compliance detection method of the configuration information provided by the embodiment of the present invention.
  • the user wants to get a suggestion based on the configuration analysis to decide which Configuration, policy management device configuration comparison analysis results support recommendations.
  • the outputting the evaluation result includes:
  • the method further includes:
  • suggestion information for selecting the change content is determined, wherein the suggestion information is determined based on the compliance obtained by checking the change content and the verification policy.
  • FIG. 4 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 4 of the present invention. As shown in FIG. 4, the method includes:
  • Step 41 Configuring a verification process
  • any template library in the knowledge base for the first configuration information checking the first configuration information according to the configuration verification item in the template library, and detecting the compliance degree of the first configuration information according to the configuration verification item, and generating a configuration verification result.
  • the same template library is also selected, the configuration check is performed, and the compliance degree of the second configuration information is detected according to the configuration check item, and the configuration check result is generated.
  • Step 42 Automate the comparison of the results of the configuration check
  • the specific content of the variation configuration difference can be obtained by comparing the configuration files of the two or the verification results of the two; analyzing the range of possible differences of the specific content of the difference and evaluating the risk thereof For example, to determine whether the difference content involves such scope as access control, security audit, structural security, intrusion prevention, border integrity, malicious code prevention, network device protection, etc., to determine whether the difference content will bring higher risks or loopholes, etc. .
  • Step 43 the comparison result is displayed
  • the above analysis results can be displayed to the user through a visual interface, and the user can decide which set of configuration files to use based on the automated analysis results.
  • the embodiment further includes:
  • Step 44 Provide a configuration suggestion selection for the user.
  • a profile with less risk and more compliance can suggest that the user choose to comply with the configuration.
  • the original first configuration information and the second configuration information obtained after the change are detected by using the same verification policy, and the first verification result and the second result are respectively obtained.
  • the verification result after comparing the two verification results, outputs the comparison result to achieve compliance detection of the configuration information.
  • the user can accurately help analyze the risk caused by the configuration change, and provide a basis for the user to select the configuration information; by providing the user with the suggestion information, further The user provides the basis for the selection of configuration information.
  • the following describes the compliance detection method of the configuration information provided by the embodiment of the present invention.
  • the policy management device supports the delivery of the recommended configuration.
  • the method further includes:
  • the notification completes the configuration operation using the final used configuration information.
  • FIG. 5 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 5 of the present invention. As shown in FIG. 5, the method includes:
  • Step 51 configuring a verification process
  • Step 52 automatically compare the results of the configuration check
  • the specific content of the variation configuration may be obtained by comparing the configuration files of the two or the verification results of the two; analyzing the range of the specific content of the difference and evaluating the risk. For example, to determine whether the content of the difference involves such areas as access control, security audit, structural security, intrusion prevention, border integrity, malicious code prevention, network device protection, etc., to determine whether the difference content will bring higher risks or loopholes.
  • Step 53 shows the comparison results.
  • the above analysis results can be displayed to the user through a visual interface, and the user can decide which set of configuration files to use based on the automated analysis results.
  • the embodiment further includes:
  • Step 54 Provide a configuration suggestion selection for the user
  • a profile with less risk and more compliance can suggest that the user choose to comply with the configuration.
  • the implementation further includes:
  • Step 55 Deliver the configuration.
  • the configuration file can be locally sent to the device, the device, or the system, or the configuration command can be sent to the remote device, device, or system to change the configuration information of the check entry.
  • the original first configuration information and the second configuration information obtained after the change are detected by using the same verification policy, and the first verification result and the second result are respectively obtained.
  • the verification result after comparing the two verification results, outputs the comparison result to achieve compliance detection of the configuration information.
  • the user can accurately analyze the risk caused by the configuration change, and provide a basis for the user to select the configuration information; and when the change content is multiple,
  • the optimal selection of the configuration information is realized through human-computer interaction, and the processing efficiency is improved; in addition, by issuing the configuration information, Improves the configuration completion of configuration information and improves the efficiency of configuration operations.
  • the following describes the compliance detection method of the configuration information provided by the embodiment of the present invention.
  • the policy management device supports the modification of the configuration.
  • the compliance detection method of the configuration information of the implementation includes:
  • the notification changes the change content in the suggestion information whose compliance degree is lower than the threshold.
  • FIG. 6 is a flowchart of a method for detecting compliance of configuration information according to Embodiment 6 of the present invention. As shown in FIG. 6, the method includes:
  • Step 61 configuring a verification process
  • any template library in the knowledge base for the first configuration information in the configuration checking the first configuration information according to the configuration check item in the template library, detecting the compliance degree of the first configuration information according to the configuration check item, and generating a configuration check result.
  • the same template library is also selected, the configuration check is performed, and the compliance degree of the second configuration information is detected according to the configuration check item, and the configuration check result is generated.
  • Step 62 Automate the comparison of the results of the configuration check
  • the specific content of the variation configuration difference can be obtained by comparing the configuration files of the two or the verification results of the two; analyzing the range of possible differences of the specific content of the difference and evaluating the risk thereof For example, to determine whether the difference content involves such scope as access control, security audit, structural security, intrusion prevention, border integrity, malicious code prevention, network device protection, etc., to determine whether the difference content will bring higher risks or loopholes, etc. .
  • Step 63 the comparison results are displayed.
  • the above analysis results can be displayed to the user through a visual interface, and the user can decide which set of configuration files to use based on the automated analysis results.
  • the method in this embodiment further includes:
  • Step 64 Provide a configuration suggestion selection for the user
  • a profile with less risk and more compliance can suggest that the user choose to comply with the configuration.
  • the method in this embodiment further includes:
  • Step 65 change the configuration.
  • the policy management device can locally send the changed configuration file to the device, device, or system, or directly send the change to the remote device, device, or system.
  • Configuration commands that enable the configuration to conform to the verification specification.
  • the original first configuration information and the second configuration information obtained after the change are detected by using the same verification policy, and the first verification result and the second result are respectively obtained.
  • the verification result after comparing the two verification results, outputs the comparison result to achieve compliance detection of the configuration information.
  • the user can accurately help analyze the risk caused by the configuration change, and provide a basis for the user to select the configuration information; by providing the user with the suggestion information, further The user provides the basis for the selection of configuration information.
  • the management efficiency of the configuration information is provided, which facilitates the optimization of the configuration information.
  • FIG. 7 is a structural diagram of a compliance detecting apparatus for configuration information according to an embodiment of the present invention.
  • the structure shown in Figure 7 includes:
  • the detecting module 701 is configured to detect the first configuration information and the second configuration information obtained by modifying the first configuration information by using the same verification policy, and respectively obtain the first verification result and the second verification result;
  • the comparison module 702 is configured to compare the first verification result and the second verification result to obtain a comparison result
  • the processing module 703 is configured to output an evaluation result according to the comparison result.
  • the processing module 703 includes:
  • the obtaining unit 7031 is configured to obtain the changed content according to the comparison result
  • the evaluation unit 7032 is configured to perform risk assessment on the changed content according to the changed content, and obtain an evaluation result
  • the output unit 7033 is configured to output the evaluation result.
  • the output unit 7033 is configured to output an evaluation result of each changed content when the changed content is at least two;
  • the processing module 703 further includes:
  • the processing unit 7034 is configured to: receive a selection result of the changed content; and determine configuration information to be finally used according to the selection result of the changed content; or output the pair selection according to the evaluation result of each changed content
  • the suggestion information of the change content wherein the suggestion information is determined according to the compliance obtained after checking the change content and the verification strategy.
  • the device further includes:
  • the first notification module 704 is configured to notify the completion of the configuration operation using the finally used configuration information after determining the final used configuration information.
  • the device further includes:
  • the second notification module 705 is configured to, after outputting the suggestion information for selecting the changed content, notify the modification content of the recommendation information that the compliance degree is lower than the threshold.
  • the original first configuration information and the second configuration information obtained after the change are detected by using the same verification policy, and the first verification result and the first verification result are respectively obtained.
  • the verification results after comparing the two verification results, output the comparison results to achieve compliance detection of the configuration information.
  • the embodiment of the present invention provides a computer readable storage medium, where the computer readable storage medium stores computer executable instructions, and the computer executable instructions are executed to implement the compliance detection method of the configuration information.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the application is not limited to any particular combination of hardware and software.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • each device/function module/functional unit in the above embodiment When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the above technical solution provides the compliance detection of the configuration information, and solves the problem that the configuration change management is disorderly and disorderly.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Storage Device Security (AREA)

Abstract

一种配置信息的合规检测方法和装置。所述方法，包括：对第一配置信息和对所述第一配置信息进行变更后得到的第二配置信息均采用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果；对比所述第一核查结果和所述第二核查结果，得到对比结果；根据所述对比结果，输出评估结果。

Description

一种配置信息的合规检测方法和装置 技术领域
本文涉及但不限于通信领域，涉及一种配置信息的合规检测方法和装置。
背景技术
随着网络的开放性、互联性及共享程度的扩大，企业越来越依赖信息和网络技术。随着网络安全威胁越来越大，而单一的安全技术或安全设备无法满足网络对安全的要求，企业对网络安全的部署变得日趋复杂，而安全设备产品种类繁多，搭建环境具有多样性，而设备上的策略配置愈趋繁琐，这对技术人员的水平要求很高，往往很多企业的技术人员没有足够的安全领域相关知识，导致在安全设备上进行的配置存在诸多隐患。
Skybox Security调查发现，58％的企业在他们的NGFW(Next generation firewall，下一代防火墙)上部署了100条以上的规则，而35％的公司每月执行100次以上变更，频繁变更易导致配置错误。据Gartner统计，99％的防火墙安全事件均是由防火墙的配置错误而引起。企业需要一种自动检测安全设备配置策略合规性的方法，将技术和管理有机的结合起来，对网络安全进行统一管理和控制，提高整体安全水平。
信息安全策略是否合规是通过配置核查来进行评估。相关的核查技术只有利用核查库条目进行已有配置的逐项核查，但针对配置的变更或配置文件的选择并没有好的方法，因此，亟需提出一种改进的策略合规检测方法来解决配置变更管理混乱无序的问题。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供一种配置信息的合规检测方法和装置，解决了配置变更管理混乱无序的问题。
本发明实施例提供了如下技术方案：
一种配置信息的合规检测方法，包括：
对第一配置信息和对所述第一配置信息进行变更后得到的第二配置信息均采用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果；
对比所述第一核查结果和所述第二核查结果，得到对比结果；
根据所述对比结果，输出评估结果。
可选地，所述根据所述对比结果，输出评估结果包括：
根据所述对比结果，得到变更内容；
对所述变更内容进行风险评估，得到评估结果；
输出所述评估结果。
可选地，
所述输出所述评估结果，包括：
当所述变更内容的个数为至少两个时，输出每个变更内容对应的评估结果；
在所述输出所述评估结果之后，所述方法还包括：
接收对所述变更内容的选择结果，并根据所述变更内容的选择结果，确定最终使用的配置信息；或者，
根据每个变更内容对应的评估结果，输出对选择所述变更内容的建议信息，其中，所述建议信息是根据变更内容与核查策略进行核查后得到的遵从度确定的。
可选地，所述确定最终使用的配置信息之后，所述方法还包括：
通知利用所述最终使用的配置信息完成配置操作。
可选地，所述输出对选择所述变更内容的建议信息之后，所述方法还包括：
通知对所述建议信息中遵从度低于阈值的变更内容进行修改。
一种配置信息的合规检测装置，包括：
检测模块，设置为对第一配置信息和对所述第一配置信息进行变更后得 到的第二配置信息均采用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果；
对比模块，设置为对比所述第一核查结果和所述第二核查结果，得到对比结果；
处理模块，设置为根据所述对比结果，输出评估结果。
可选地，所述处理模块包括：
获取单元，设置为根据所述对比结果，得到变更内容；
评估单元，设置为根据所述变更内容，对所述变更内容进行风险的评估，得到评估结果；
输出单元，设置为输出所述评估结果。
可选地，
所述输出单元是设置为当所述变更内容的个数为至少两个时，输出每个变更内容对应的评估结果；
所述处理模块还包括：
处理单元，设置为：接收对所述变更内容的选择结果；并根据所述变更内容的选择结果，确定最终使用的配置信息；或者，根据每个变更内容对应的评估结果，输出对选择所述变更内容的建议信息，其中所述建议信息是根据变更内容与核查策略进行核查后得到的遵从度确定的。
可选地，所述装置还包括：
第一通知模块，设置为在确定最终使用的配置信息之后，通知利用所述最终使用的配置信息完成配置操作。
可选地，所述装置还包括：
第二通知模块，设置为在输出对选择所述变更内容的建议信息之后，通知对所述建议信息中遵从度低于阈值的变更内容进行修改。
本发明实施例提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述配置信息的合规检测方法。
本发明实施例提供的技术方案，在配置信息发生变更后，将原有的第一配置信息和变更后得到的第二配置信息利用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果，在对比两个核查结果后，输出对比结果，实现对配置信息的合规性检测，解决了配置变更管理混乱无序的问题。
在阅读并理解了附图和详细描述后，可以明白其它方面。
附图说明
图1为本发明实施例一提供的配置信息的合规检测方法的流程图；
图2为本发明实施例二提供的配置信息的合规检测方法的流程图；
图3为本发明实施例三提供的配置信息的合规检测方法的流程图；
图4为本发明实施例四提供的配置信息的合规检测方法的流程图；
图5为本发明实施例五提供的配置信息的合规检测方法的流程图；
图6为本发明实施例六提供的配置信息的合规检测方法的流程图；
图7为本发明实施例七提供的配置信息的合规检测装置的结构图；
图8为本发明实施例七提供的配置信息的合规检测装置的另一结构图。
具体实施方式
下面将结合附图及具体实施例对本发明实施例的技术方案作进一步的详细描述。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
实施例一
图1为本发明实施例提供的配置信息的合规检测方法的流程图。图1所示方法包括：
步骤101、对第一配置信息和对所述第一配置信息进行变更后得到的第二配置信息均采用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果；
步骤102、对比所述第一核查结果和所述第二核查结果，得到对比结果；
步骤103、根据所述对比结果，输出评估结果。
本发明实施例提供的配置信息的合规检测方法，在配置信息发生变更后，将原有的第一配置信息和变更后得到的第二配置信息利用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果，在对比两个核查结果后，输出对比结果，对该对比结果进行分析，核查该对比结果存在的差异。评估结果是对差异之处给出判断，对于差异之处为不合规的内容，或者带来更大风险的内容，可以给出告警或者建议不进行变更。通过上述技术方案可以实现对配置信息的合规性检测。
在实际应用中，可以利用知识库实现对配置信息的核查，其中，知识库包括各种丰富配置核查库(配置核查库可以由多条配置核查条目组成)，例如各种风险库、合规库、基线库等，这些核查库和核查条目可以从不同维度为设备、装置或系统提供不同需求的核查。
配置信息可以包含与设备、装置或系统相关的多种配置，例如设备、装置或系统上变更前和变更后的配置信息、或用户为设备、装置或系统定义的不同配置选择和设置的配置信息等。
为第一配置信息选择知识库中的任一配置核查库，例如，根据配置核查库中的配置核查条目对第一配置中的配置信息进行核查，依据配置核查条目检测第一配置信息的遵从程度，生成第一核查结果。同样，对第二配置信息，也选择与第一配置信息同样的配置核查库，进行配置核查，依据配置核查条目检测第二配置信息的遵从程度，生成配置核查结果。如果包含多种配置，则可以依此选择同样的配置核查库，对不同配置进行配置核查，生成第二核查结果。
将第一核查结果与第二核查结果进行对比。例如，比较设备、装置或系统上相同配置项的不同配置选择或设置的配置核查遵从程度，为用户提供配置建议选择，例如建议用户选择遵从度更高的配置。同样，可以比较多种配置的配置核查结果，为设备、装置或系统的配置项选择遵从度最高的配置选择或设置。
实施例二
下面对本发明实施例提供的配置信息的合规检测方法作进一步说明。
在本实施例中，在用户有配置变更需求，但不清楚变更后是否会给现有环境造成影响，策略管控设备提供了配置变更的核查方法，在本发明实施例中，策略管控设备是一个能够管理网络设备上的策略的硬件设备。
本实施例提供的配置信息合规检测方法除了包括实施例一中的技术方案外，在本实施的配置信息的合规检测方法中，
根据所述对比结果，输出评估结果，包括：
根据所述对比结果，得到变更内容；
根据所述变更内容，对所述变更内容进行风险的评估，得到评估结果；
输出所述评估结果。
图2为本发明实施例二提供的配置信息的合规检测方法的流程图。如图2所示，所述方法包括：
步骤21、配置核查过程；
本实施例可以针对变更前后的配置进行的核查检验。例如，变更前配置可以是设备、装置或系统上原有的，已经生效的配置信息或选项；变更后配置可以是用户在原有配置上计划要进行或者进行了增加、修改或删除等操作后设备、装置或系统上的配置信息。配置信息的获取可以通过主动去设备、装置或系统上采集获得，也可以由设备、装置或系统上传而得。
在本实施例中，可以为原有配置信息选择知识库中的任一模版库，根据模版库中的配置核查条目对原有配置信息进行核查，依据配置核查条目检测原有配置信息的遵从程度，生成配置核查结果。同样，对变更后配置信息，也选择同样的模版库，进行配置核查，依据配置核查条目检测变更后的配置信息的遵从程度，生成配置核查结果。
步骤22、将上述两个配置核查结果进行自动化对比；
例如，识别变更内容，可以通过变更前后的配置文件或者变更前后的配置核查结果对比得到变更的具体内容；分析变更的内容可能影响的范围并对其进行风险的评估，例如，判断变更内容是否涉及到诸如访问控制、安全审计、结构安全、入侵防范、边界完整性、恶意代码防范、网络设备防护等范 围，判断变更的内容是否会带来更高的风险或者漏洞等。
步骤23、对比结果展示。
例如，可以将上述的分析结果以可视化界面展示给用户查阅，用户可以根据自动化分析结果来决策是否进行变更操作。
本发明实施例二提供的方法，在配置信息发生变更后，将原有的第一配置信息和变更后得到的第二配置信息利用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果，在对比两个核查结果后，输出对比结果，实现对配置信息的合规性检测。
另外，通过获取变更内容，再对变更内容进行评估，可以准确地帮助用户分析得到配置的更改所带来的风险，为用户做配置信息的选择提供了依据。
实施例三
下面对本发明实施例提供的配置信息的合规检测方法作进一步说明。
此实施例中，用户有多种配置需求，但不清楚哪种配置更优、更不会给现有环境造成影响，对此策略管控设备提供了多种配置的核查方法。
除了包括实施例一中的技术方案外，在本实施的配置信息的合规检测方法中：
所述输出所述评估结果，包括：
当所述变更内容的数量为至少两个时，输出每个变更内容对应的评估结果；
在所述输出所述评估结果之后，所述方法还包括：
接收对所述变更内容的选择结果，并根据所述变更内容的选择结果，确定最终使用的配置信息。
图3为本发明实施例三提供的配置信息的合规检测方法的流程图。如图3所示，所述方法包括：
步骤31、配置核查过程；
第一配置信息是一种配置文件方案，第二配置信息是与第一配置信息不同的另一种配置文件方案，两种配置信息可能有部分不同也可能完全不同。 这些配置信息既可以是从设备、装置或系统上获取的，也可以是能下发到设备、装置或系统上的配置文件。
例如，为第一配置信息选择知识库中的任一模版库，根据模版库中的配置核查条目对第一配置信息进行核查，依据配置核查条目检测第一配置信息的遵从程度，生成配置核查结果。同样，对第二配置信息也选择同样的模版库，进行配置核查，依据配置核查条目检测第二配置信息的遵从程度，生成配置核查结果。
步骤32、将配置核查的结果进行自动化对比；
例如，识别上述两种配置信息内容的差别，可以通过两者的配置文件或者两者的核查结果对比得到变配置差异的具体内容；分析差异的具体内容可能影响的范围并对其进行风险的评估，例如，判断差异内容是否涉及到诸如访问控制、安全审计、结构安全、入侵防范、边界完整性、恶意代码防范、网络设备防护等范围，判断差异内容是否会带来更高的风险或者漏洞等。
步骤33、对比结果展示。
例如，可以将上述的分析结果以可视化界面展示给用户查阅，用户可以根据自动化分析结果来决策采用哪一套配置文件。
本发明实施例三提供的方法，在配置信息发生变更后，将原有的第一配置信息和变更后得到的第二配置信息利用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果，在对比两个核查结果后，输出对比结果，实现对配置信息的合规性检测。
另外，通过获取变更内容，再对变更内容进行评估，可以准确地帮助用户分析得到配置的更改所带来的风险，为用户做配置信息的选择提供了依据；且在变更内容为多个时，通过输出每个变更内容的评估结果，并接收用户根据评估结果确定的配置信息，通过人机交互，实现了配置信息的最优选择，提高了处理效率。
实施例四
下面对本发明实施例提供的配置信息的合规检测方法作进一步说明。
此实施例中，用户希望得到根据配置分析给出的建议，来决定采用哪种 配置，策略管控设备配置对比分析结果支持提供建议。
除了包括实施例一中的技术方案外，在本实施的配置信息的合规检测方法中：
所述输出所述评估结果，包括：
当所述变更内容为至少两个时，输出每个变更内容的评估结果；
在所述输出所述评估结果之后，所述方法还包括：
根据每个变更内容的评估结果，输出对选择所述变更内容的建议信息，其中，所述建议信息是根据变更内容与核查策略进行核查后得到的遵从度确定的。
图4为本发明实施例四提供的配置信息的合规检测方法的流程图。如图4所示，所述方法包括：
步骤41、配置核查过程；
为第一配置信息选择知识库中的任一模版库，根据模版库中的配置核查条目对第一配置信息进行核查，依据配置核查条目检测第一配置信息的遵从程度，生成配置核查结果。同样，对第二配置信息，也选择同样的模版库，进行配置核查，依据配置核查条目检测第二配置信息的遵从程度，生成配置核查结果。
步骤42、将配置核查的结果进行自动化对比；
例如，识别上述两种配置信息内容的差别，可以通过两者的配置文件或者两者的核查结果对比得到变配置差异的具体内容；分析差异的具体内容可能影响的范围并对其进行风险的评估，例如，判断差异内容是否涉及到诸如访问控制、安全审计、结构安全、入侵防范、边界完整性、恶意代码防范、网络设备防护等范围，判断差异内容是否会带来更高的风险或者漏洞等。
步骤43、对比结果展示；
例如，可以将上述的分析结果以可视化界面展示给用户查阅，用户可以根据自动化分析结果来决策采用哪一套配置文件。
可选地，本实施例还包括：
步骤44、为用户提供配置建议选择。
例如，根据自动化分析结果中，风险少、合规项多的配置文件可以建议用户选择遵从该配置。同样，也可以比较多种配置的自动化分析结果，为设备、装置或系统的配置项选择遵从度最高的配置选择或设置。
本发明实施例四提供的方法，在配置信息发生变更后，将原有的第一配置信息和变更后得到的第二配置信息利用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果，在对比两个核查结果后，输出对比结果，实现对配置信息的合规性检测。
另外，通过获取变更内容，再对变更内容进行评估，可以准确地帮助用户分析得到配置的更改所带来的风险，为用户做配置信息的选择提供了依据；通过为用户提供建议信息，进一步为用户做配置信息的选择提供了依据。
实施例五
下面对本发明实施例提供的配置信息的合规检测方法作进一步说明。
在本实施例中，策略管控设备支持对建议配置的下发。
除了包括实施例一中的技术方案外，在本实施的配置信息的合规检测方法中：
所述确定最终使用的配置信息之后，所述方法还包括：
通知利用所述最终使用的配置信息完成配置操作。
图5为本发明实施例五提供的配置信息的合规检测方法的流程图。如图5所示，所述方法包括：
步骤51、配置核查过程；
为配置中的第一配置选择知识库中的任一模版库，根据模版库中的配置核查条目对第一配置中的配置信息进行核查，依据配置核查条目检测第一配置信息的遵从程度，生成配置核查结果。同样，对第二配置，也选择同样的模版库，进行配置核查，依据配置核查条目检测第二配置信息的遵从程度，生成配置核查结果。
步骤52、将配置核查的结果进行自动化对比；
例如，识别上述两种配置内容的差别，可以通过两者的配置文件或者两者的核查结果对比得到变配置差异的具体内容；分析差异的具体内容可能影响的范围并对其进行风险的评估，例如，判断差异内容是否涉及到诸如访问控制、安全审计、结构安全、入侵防范、边界完整性、恶意代码防范、网络设备防护等范围，判断差异内容是否会带来更高的风险或者漏洞等。
步骤53、对比结果展示。例如，可以将上述的分析结果以可视化界面展示给用户查阅，用户可以根据自动化分析结果来决策采用哪一套配置文件。
可选地，本实施例还包括：
步骤54、为用户提供配置建议选择；
例如，根据自动化分析结果中，风险少、合规项多的配置文件可以建议用户选择遵从该配置。同样，也可以比较多种配置的配自动化分析结果，为设备、装置或系统的配置项选择遵从度最高的配置选择或设置。
可选地，本实施还包括：
步骤55、下发配置。
例如可以本地构建配置文件下发到设备、装置或系统上，也可以直接远程设备、装置或系统，下发配置命令，使其变更为符合核查条目的配置信息。
本发明实施例五提供的方法，在配置信息发生变更后，将原有的第一配置信息和变更后得到的第二配置信息利用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果，在对比两个核查结果后，输出对比结果，实现对配置信息的合规性检测。
另外，通过获取变更内容，再对变更内容进行评估，可以准确地帮助用户分析得到配置的更改所带来的风险，为用户做配置信息的选择提供了依据；且在变更内容为多个时，通过输出每个变更内容的评估结果，并接收用户根据评估结果确定的配置信息，通过人机交互，实现了配置信息的最优选择，提高了处理效率；另外，通过对配置信息的下发，提高了配置信息的配置完成的速度，提高了配置操作的效率。
实施例六
下面对本发明实施例提供的配置信息的合规检测方法作进一步说明。
此实施例中，策略管控设备支持对配置的修改，除了包括实施例一中的技术方案外，本实施的配置信息的合规检测方法还包括：
在所述输出对选择所述变更内容的建议信息之后，通知对所述建议信息中遵从度低于阈值的变更内容进行修改。
图6为本发明实施例六提供的配置信息的合规检测方法的流程图。如图6所示，所述方法包括：
步骤61、配置核查过程；
为配置中的第一配置信息选择知识库中的任一模版库，根据模版库中的配置核查条目对第一配置信息进行核查，依据配置核查条目检测第一配置信息的遵从程度，生成配置核查结果。同样，对第二配置信息，也选择同样的模版库，进行配置核查，依据配置核查条目检测第二配置信息的遵从程度，生成配置核查结果。
步骤62、将配置核查的结果进行自动化对比；
例如，识别上述两种配置信息内容的差别，可以通过两者的配置文件或者两者的核查结果对比得到变配置差异的具体内容；分析差异的具体内容可能影响的范围并对其进行风险的评估，例如，判断差异内容是否涉及到诸如访问控制、安全审计、结构安全、入侵防范、边界完整性、恶意代码防范、网络设备防护等范围，判断差异内容是否会带来更高的风险或者漏洞等。
步骤63、对比结果展示。例如，可以将上述的分析结果以可视化界面展示给用户查阅，用户可以根据自动化分析结果来决策采用哪一套配置文件。
可选地，本实施例的方法还包括：
步骤64、为用户提供配置建议选择；
例如，根据自动化分析结果中，风险少、合规项多的配置文件可以建议用户选择遵从该配置。同样，也可以比较多种配置的配自动化分析结果，为设备、装置或系统的配置项选择遵从度最高的配置选择或设置。
可选地，本实施例的方法还包括：
步骤65、变更配置。
例如，对于上述建议中遵从度较低的配置选择或设置，策略管控设备可以本地构建变更后的配置文件下发到设备、装置或系统上，也可以直接远程设备、装置或系统，下发变更的配置命令，使配置能够符合核查规范。
本发明实施例六提供的方法，在配置信息发生变更后，将原有的第一配置信息和变更后得到的第二配置信息利用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果，在对比两个核查结果后，输出对比结果，实现对配置信息的合规性检测。
另外，通过获取变更内容，再对变更内容进行评估，可以准确地帮助用户分析得到配置的更改所带来的风险，为用户做配置信息的选择提供了依据；通过为用户提供建议信息，进一步为用户做配置信息的选择提供了依据；另外，通过对遵从度差的变更内容进行更改，提供了配置信息的管理效率，对优化配置信息提供了方便。
实施例七
图7为本发明实施例提供的配置信息的合规检测装置的结构图。图7所示结构包括：
检测模块701，设置为对第一配置信息和对所述第一配置信息进行变更后得到的第二配置信息均采用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果；
对比模块702，设置为对比所述第一核查结果和所述第二核查结果，得到对比结果；
处理模块703，设置为根据所述对比结果，输出评估结果。
可选地，如图8所示，所述处理模块703包括：
获取单元7031，设置为根据所述对比结果，得到变更内容；
评估单元7032，设置为根据所述变更内容，对所述变更内容进行风险的评估，得到评估结果；
输出单元7033，设置为输出所述评估结果。
可选地，
所述输出单元7033是设置为当所述变更内容为至少两个时，输出每个变更内容的评估结果；
所述处理模块703还包括：
处理单元7034，设置为：接收对所述变更内容的选择结果；并根据所述变更内容的选择结果，确定最终使用的配置信息；或者，根据每个变更内容的评估结果，输出对选择所述变更内容的建议信息，其中，所述建议信息是根据变更内容与核查策略进行核查后得到的遵从度确定的。
可选地，所述装置还包括：
第一通知模块704，设置为在确定最终使用的配置信息之后，通知利用所述最终使用的配置信息完成配置操作。
可选地，所述装置还包括：
第二通知模块705，设置为在输出对选择所述变更内容的建议信息之后，通知对所述建议信息中遵从度低于阈值的变更内容进行修改。
本发明实施例提供的装置实施例，在配置信息发生变更后，将原有的第一配置信息和变更后得到的第二配置信息利用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果，在对比两个核查结果后，输出对比结果，实现对配置信息的合规性检测。
本发明实施例提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述配置信息的合规检测方法。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本申请不限制于任何特定的硬件和软件结合。
上述实施例中的各装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的各装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求所述的保护范围为准。
工业实用性
上述技术方案提供了配置信息的合规性检测，解决了配置变更管理混乱无序的问题。

Claims (10)

  1. 一种配置信息的合规检测方法，包括：
    对第一配置信息和对所述第一配置信息进行变更后得到的第二配置信息均采用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果；
    对比所述第一核查结果和所述第二核查结果，得到对比结果；
    根据所述对比结果，输出评估结果。
  2. 根据权利要求1所述的方法，其中，所述根据所述对比结果，输出评估结果包括：
    根据所述对比结果，得到变更内容；
    对所述变更内容进行风险评估，得到评估结果；
    输出所述评估结果。
  3. 根据权利要求2所述的方法，其中：
    所述输出所述评估结果，包括：
    当所述变更内容的个数为至少两个时，输出每个变更内容对应的评估结果；
    在所述输出所述评估结果之后，所述方法还包括：
    接收对所述变更内容的选择结果，并根据所述变更内容的选择结果，确定最终使用的配置信息；或者，
    根据每个变更内容对应的评估结果，输出对选择所述变更内容的建议信息，其中，所述建议信息是根据变更内容与核查策略进行核查后得到的遵从度确定的。
  4. 根据权利要求3所述的方法，所述确定最终使用的配置信息之后，所述方法还包括：
    通知利用所述最终使用的配置信息完成配置操作。
  5. 根据权利要求3所述的方法，所述输出对选择所述变更内容的建议信息之后，所述方法还包括：
    通知对所述建议信息中遵从度低于阈值的变更内容进行修改。
  6. 一种配置信息的合规检测装置，包括：
    检测模块，设置为对第一配置信息和对所述第一配置信息进行变更后得到的第二配置信息均采用相同的核查策略进行检测，分别得到第一核查结果和第二核查结果；
    对比模块，设置为对比所述第一核查结果和所述第二核查结果，得到对比结果；
    处理模块，设置为根据所述对比结果，输出评估结果。
  7. 根据权利要求6所述的装置，其中，所述处理模块包括：
    获取单元，设置为根据所述对比结果，得到变更内容；
    评估单元，设置为根据所述变更内容，对所述变更内容进行风险评估，得到评估结果；
    输出单元，设置为输出所述评估结果。
  8. 根据权利要求7所述的装置，其中，
    所述输出单元是设置为当所述变更内容的个数为至少两个时，输出每个变更内容对应的评估结果；
    所述处理模块还包括：
    处理单元，设置为：接收对所述变更内容的选择结果；并根据所述变更内容的选择结果，确定最终使用的配置信息；或者，根据每个变更内容对应的评估结果，输出对选择所述变更内容的建议信息，其中，所述建议信息是根据变更内容与核查策略进行核查后得到的遵从度确定的。
  9. 根据权利要求8所述的装置，所述装置还包括：
    第一通知模块，设置为在确定最终使用的配置信息之后，通知利用所述最终使用的配置信息完成配置操作。
  10. 根据权利要求8所述的装置，所述装置还包括：
    第二通知模块，设置为在输出对选择所述变更内容的建议信息之后，通知对所述建议信息中遵从度低于阈值的变更内容进行修改。
PCT/CN2016/077019 2015-05-11 2016-03-22 一种配置信息的合规检测方法和装置 WO2016180088A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510238060.1A CN106301817A (zh) 2015-05-11 2015-05-11 一种配置信息的合规检测方法和装置
CN201510238060.1 2015-05-11

Publications (1)

Publication Number Publication Date
WO2016180088A1 true WO2016180088A1 (zh) 2016-11-17

Family

ID=57248726

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/077019 WO2016180088A1 (zh) 2015-05-11 2016-03-22 一种配置信息的合规检测方法和装置

Country Status (2)

Country Link
CN (1) CN106301817A (zh)
WO (1) WO2016180088A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109409780A (zh) * 2018-11-21 2019-03-01 平安科技（深圳）有限公司 变更处理方法、装置、计算机设备和存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107480536A (zh) * 2017-08-24 2017-12-15 杭州安恒信息技术有限公司 快速基线核查方法、装置及系统
CN109995550A (zh) * 2017-12-29 2019-07-09 上海华为技术有限公司 一种风险分析方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101562610A (zh) * 2009-05-27 2009-10-21 上海交通大学 检查项可定制的网络访问控制方法
CN101610264A (zh) * 2009-07-24 2009-12-23 深圳市永达电子股份有限公司 一种防火墙系统、安全服务平台及防火墙系统的管理方法
CN101931604A (zh) * 2009-06-18 2010-12-29 原少甫 根据网络安全报警自动调整安全策略的计算机防火墙
CN104092676A (zh) * 2014-06-30 2014-10-08 复旦大学 面向云数据中心环境防火墙即服务的并行防火墙规则异常检测的方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2819346B1 (en) * 2013-06-28 2018-06-20 Kaspersky Lab, ZAO System and method for automatically configuring application control rules

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101562610A (zh) * 2009-05-27 2009-10-21 上海交通大学 检查项可定制的网络访问控制方法
CN101931604A (zh) * 2009-06-18 2010-12-29 原少甫 根据网络安全报警自动调整安全策略的计算机防火墙
CN101610264A (zh) * 2009-07-24 2009-12-23 深圳市永达电子股份有限公司 一种防火墙系统、安全服务平台及防火墙系统的管理方法
CN104092676A (zh) * 2014-06-30 2014-10-08 复旦大学 面向云数据中心环境防火墙即服务的并行防火墙规则异常检测的方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109409780A (zh) * 2018-11-21 2019-03-01 平安科技（深圳）有限公司 变更处理方法、装置、计算机设备和存储介质
CN109409780B (zh) * 2018-11-21 2024-04-09 平安科技（深圳）有限公司 变更处理方法、装置、计算机设备和存储介质

Also Published As

Publication number Publication date
CN106301817A (zh) 2017-01-04

Similar Documents

Publication Publication Date Title
US10872029B1 (en) System, apparatus and method for deploying infrastructure to the cloud
US9712551B2 (en) Methods and systems for architecture-centric threat modeling, analysis and visualization
US10785128B1 (en) System, apparatus and method for deploying infrastructure to the cloud
US20210021644A1 (en) Advanced cybersecurity threat mitigation using software supply chain analysis
US9992230B1 (en) Assessing security control quality and state in an information technology infrastructure
CN109376078B (zh) 移动应用的测试方法、终端设备及介质
CN108153670A (zh) 一种接口测试方法、装置及电子设备
US10990370B1 (en) System, apparatus and method for deploying infrastructure to the cloud
US10379984B2 (en) Compliance testing through sandbox environments
US9276991B2 (en) Method and apparatus for providing a dynamic tool menu based upon a document
EP3065077B1 (en) Gap analysis of security requirements against deployed security capabilities
CN105915657B (zh) 数据的同步方法、装置及客户端
US11640470B1 (en) System and methods for reducing an organization's cybersecurity risk by determining the function and seniority of employees
US20140337077A1 (en) Task assignment and verification system and method
WO2016180088A1 (zh) 一种配置信息的合规检测方法和装置
CN105556533A (zh) 自动生成证书文档
US20140157383A1 (en) Access management system and method
US11416494B1 (en) Providing triggers based on one-to-many or many-to-one relationships in a system of record
CA3168223A1 (en) Method of managing and controlling security vulnerability, device, equipment, and computer-readable medium
CN103139136A (zh) 一种密码的管理方法和设备
WO2016180134A1 (zh) 管理信息安全规范库的方法和装置
KR101536812B1 (ko) Sap erp 시스템에서 보안 점검을 실행하는 방법 및 시스템
Housh et al. Multiobjective calibration of event-detection systems
US20150186446A1 (en) Identifying changes to query results system and method
KR102088388B1 (ko) 원자력 발전소 디지털자산의 사이버보안 개발 지원 시스템 및 그 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16791938

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16791938

Country of ref document: EP

Kind code of ref document: A1