WO2024108686A1 - 一种Linux下基于iptables的安全孤岛构建方法、装置及存储介质 - Google Patents

一种Linux下基于iptables的安全孤岛构建方法、装置及存储介质 Download PDF

Info

Publication number
WO2024108686A1
WO2024108686A1 PCT/CN2022/138641 CN2022138641W WO2024108686A1 WO 2024108686 A1 WO2024108686 A1 WO 2024108686A1 CN 2022138641 W CN2022138641 W CN 2022138641W WO 2024108686 A1 WO2024108686 A1 WO 2024108686A1
Authority
WO
WIPO (PCT)
Prior art keywords
island
security
information
exit
security island
Prior art date
Application number
PCT/CN2022/138641
Other languages
English (en)
French (fr)
Inventor
孟阳
彭博威
高霞
苏浩
Original Assignee
中通服创发科技有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中通服创发科技有限责任公司 filed Critical 中通服创发科技有限责任公司
Publication of WO2024108686A1 publication Critical patent/WO2024108686A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
    • H04L41/0816—Configuration setting characterised by the conditions triggering a change of settings the condition being an adaptation, e.g. in response to network events

Definitions

  • the embodiments of the present disclosure are generally designed in the field of security technology, and more specifically and flexibly, perform security island construction based on iptables.
  • the purpose of the present invention is to provide a method, device and readable storage medium for constructing a secure island based on iptables under Linux.
  • the first aspect of the present invention provides a method for constructing a secure island based on iptables under Linux, comprising:
  • the safety island is reconstructed according to the monitoring situation information and instructions.
  • the task instruction for obtaining and constructing a safe island is obtained by the following steps:
  • a security island is constructed for one or more hosts to obtain a security island
  • the security island information required to be configured includes at least one of the following: host IP information.
  • a security island is constructed for one or more hosts to obtain a security island, including:
  • the rule configuration information is distributed and made effective through the rule distribution tool.
  • the required security island exit information includes at least one of the following:
  • a secure island export is constructed for one or more hosts to obtain a secure island export, including:
  • the rule configuration information is distributed and made effective through the rule distribution tool.
  • the safety island is reconstructed according to the monitoring information and instructions, including:
  • the second aspect of the present invention provides a device.
  • the device comprises:
  • An acquisition module is used to acquire a task instruction for building a safe island and a task instruction for building a safe island exit;
  • Processing module used to build safety islands and safety island exits
  • a monitoring module is used to monitor the safety island.
  • the task instruction for obtaining and constructing a safe island is obtained by the following steps:
  • a security island is constructed for one or more hosts to obtain a security island
  • the security island information required to be configured includes at least one of the following: host IP information.
  • a security island is constructed for one or more hosts to obtain a security island, including:
  • the rule configuration information is distributed and made effective through the rule distribution tool.
  • the required security island exit information includes at least one of the following:
  • a secure island export is constructed for one or more hosts to obtain a secure island export, including:
  • the rule configuration information is distributed and made effective through the rule distribution tool.
  • the safety island is reconstructed according to the monitoring information and instructions, including:
  • an electronic device which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method described above is implemented.
  • a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the method according to the first aspect of the present disclosure is implemented.
  • the present invention discloses a method, device and readable storage medium for constructing a secure island based on iptables under Linux.
  • the method comprises: obtaining a task instruction for constructing a secure island, constructing a secure island for one or more hosts according to the task instruction for constructing a secure island, obtaining a task instruction for constructing a secure island export, constructing a secure island export for one or more hosts according to the task instruction for constructing a secure island export, monitoring the secure island to obtain monitoring situation information, and reconstructing the secure island according to the monitoring situation information and the instruction, so as to solve the problem of helping users to perform security protection on known digital assets among a large number of assets.
  • the method can quickly and accurately construct the required island type, help enterprises protect digital assets, and is suitable for large-scale applications.
  • FIG1 shows a flow chart of a method for constructing a secure island based on iptables in Linux according to an embodiment of the present disclosure
  • FIG2 shows a flow chart of security island construction according to an embodiment of the present disclosure
  • FIG3 shows a flowchart of a security island reconstruction according to an embodiment of the present disclosure
  • FIG4 shows a block diagram of a device for constructing a secure island based on iptables under Linux according to the present invention
  • FIG5 shows a schematic diagram of a secure island construction device based on iptables under Linux according to the present invention.
  • FIG1 shows a flow chart of an efficient network asset risk assessment method of the present invention.
  • the present invention discloses an efficient network asset risk assessment method, comprising:
  • S112 Reconstruct the safety island according to the monitoring situation information and instructions.
  • a safety island construction task instruction is received
  • a security island is successfully constructed.
  • the receiving of the security island construction task instruction is obtained by the following steps: constructing one or more hosts according to the security island scale required by the user to obtain the required security island. After the security island is constructed, the integrity of the security island is monitored.
  • the obtaining of the task instruction for constructing a secure island is obtained by the following steps:
  • a security island is constructed for one or more hosts to obtain a security island
  • the security island information required to be configured includes at least one of the following: host IP information.
  • a task instruction for building a security island is received; the security island is successfully built according to the instruction; according to the above aspects and any possible implementation method, an implementation method is further provided, and the receiving task instruction for building a security island is obtained through the following steps: according to the scale of security island built by the user, one or more hosts are built to obtain the required security island, wherein: receiving the task instruction for building a security island includes at least one of the following: host IP.
  • a security island is constructed for one or more hosts to obtain a security island, including:
  • any possible implementation methods further provide an implementation method, in which a security island is constructed, the host IP information is matched and deduplicated, and then converted into basic configuration information.
  • the rules are distributed and effective through a rule distribution tool, and the basic configuration information is loaded into a relational database.
  • the task instruction for obtaining and constructing a safe island exit is obtained by the following steps:
  • the required security island exit information includes at least one of the following:
  • the security island exit is successfully built according to the instruction; according to the aspects described above and any possible implementation method, an implementation method is further provided, and the receiving task instruction for building a security island exit is obtained through the following steps: according to the scale of security island exit required by the user, one or more hosts are built to obtain the required security island exit, wherein: the receiving task instruction for building a security island exit includes the following items: host IP, host port, protocol, entry and exit direction.
  • a secure island exit is constructed for one or more hosts to obtain a secure island exit, including:
  • the rule configuration information is distributed and made effective through the rule distribution tool.
  • any possible implementation methods further provide an implementation method, in which a secure island exit is constructed, the host IP information is matched and deduplicated, and then converted into basic configuration information.
  • the rules are distributed and effective through a rule distribution tool, and the basic configuration information is loaded into a relational database.
  • reconstructing the safety island according to the monitoring situation information and the instruction includes:
  • the rule configuration information loaded in the relational database is periodically detected.
  • the number and details of the rule configuration information are counted.
  • the number and details of the match rule configuration information and the security island configuration details are matched.
  • an implementation method is further provided, when the rule does not match, it is determined that the security island is invalid, and when the rule matches, it is determined that the security island is complete.
  • a task instruction for reconstructing the security island is received; the security island is successfully reconstructed according to the instruction; according to the above aspects and any possible implementation method, an implementation method is further provided, and the receiving task instruction for reconstructing the security island is obtained by the following steps: according to the user's requirements, it is determined whether the security island needs to be reconstructed after the security island fails, and when the security island needs to be reconstructed, the method is implemented: according to the above aspects and any possible implementation method, an implementation method is further provided, and the reconstruction of the security island converts the host IP information of the destroyed island into basic configuration information, distributes and takes effect the rules through the distribution rule tool, and loads the basic configuration information into the relational database.
  • FIG4 shows a block diagram of a secure island construction device based on iptables under Linux according to the present invention.
  • the second aspect of the present invention provides a device.
  • the device comprises:
  • An acquisition module is used to acquire a task instruction for building a safe island and a task instruction for building a safe island exit;
  • Processing module used to build safety islands and safety island exits
  • a monitoring module is used to monitor the safety island.
  • a safety island construction task instruction is received
  • a security island is successfully constructed.
  • the receiving of the security island construction task instruction is obtained by the following steps: constructing one or more hosts according to the security island scale required by the user to obtain the required security island. After the security island is constructed, the integrity of the security island is monitored.
  • the obtaining of the task instruction for constructing a secure island is obtained by the following steps:
  • a security island is constructed for one or more hosts to obtain a security island
  • the security island information required to be configured includes at least one of the following: host IP information.
  • the security island is built, a task instruction for building a security island is received; the security island is successfully built according to the instruction; according to the aspects described above and any possible implementation method, an implementation method is further provided, and the receiving task instruction for building a security island is obtained through the following steps: according to the scale of security island built by the user, one or more hosts are built to obtain the required security island, wherein: the receiving task instruction for building a security island includes at least one of the following: host IP.
  • a security island is constructed for one or more hosts to obtain a security island, including:
  • the rule configuration information is distributed and made effective through the rule distribution tool.
  • any possible implementation methods further provide an implementation method, in which a security island is constructed, the host IP information is matched and deduplicated, and then converted into basic configuration information.
  • the rules are distributed and effective through a rule distribution tool, and the basic configuration information is loaded into a relational database.
  • the task instruction for obtaining and constructing a safe island exit is obtained by the following steps:
  • the required security island exit information includes at least one of the following:
  • the security island exit is successfully built according to the instruction; according to the aspects described above and any possible implementation method, an implementation method is further provided, and the receiving task instruction for building a security island exit is obtained through the following steps: according to the scale of security island exit required by the user, one or more hosts are built to obtain the required security island exit, wherein: the receiving task instruction for building a security island exit includes the following items: host IP, host port, protocol, entry and exit direction.
  • a secure island exit is constructed for one or more hosts to obtain a secure island exit, including:
  • the rule configuration information is distributed and made effective through the rule distribution tool.
  • any possible implementation methods further provide an implementation method, in which a secure island exit is constructed, the host IP information is matched and deduplicated, and then converted into basic configuration information.
  • the rules are distributed and effective through a rule distribution tool, and the basic configuration information is loaded into a relational database.
  • reconstructing the safety island according to the monitoring situation information and the instruction includes:
  • the rule configuration information loaded in the relational database is periodically detected.
  • the number and details of the rule configuration information are counted.
  • the number and details of the matching rule configuration information and the security island configuration details are matched. According to the above aspects and any possible implementation method, an implementation method is further provided, when the rule does not match, it is determined that the security island is invalid, and when the rule matches, it is determined that the security island is complete.
  • a task instruction for reconstructing the security island is received; the security island is successfully reconstructed according to the instruction; according to the above aspects and any possible implementation method, an implementation method is further provided, and the receiving task instruction for reconstructing the security island is obtained by the following steps: according to the user's requirements, it is determined whether the security island needs to be reconstructed after the security island fails, and when the security island needs to be reconstructed, the method is implemented: according to the above aspects and any possible implementation method, an implementation method is further provided, and the reconstruction of the security island converts the host IP information of the destroyed island into basic configuration information, distributes and takes effect the rules through the distribution rule tool, and loads the basic configuration information into the relational database.
  • an electronic device comprising: a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method described above is implemented.
  • a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the method according to the first aspect of the present disclosure is implemented.
  • the present invention discloses a method, device and readable storage medium for constructing a secure island based on iptables under Linux.
  • the method comprises: obtaining a task instruction for constructing a secure island, constructing a secure island for one or more hosts according to the task instruction for constructing a secure island, obtaining a task instruction for constructing a secure island export, constructing a secure island export for one or more hosts according to the task instruction for constructing a secure island export, monitoring the secure island to obtain monitoring situation information, and reconstructing the secure island according to the monitoring situation information and the instruction, so as to solve the problem of helping users to perform security protection on known digital assets among a large number of assets.
  • the method can quickly and accurately construct the required island type, help enterprises protect digital assets, and is suitable for large-scale applications.
  • the disclosed devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the units is only a logical function division.
  • the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.
  • the units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.
  • all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.
  • the computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention.
  • the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Alarm Systems (AREA)

Abstract

本发明公开了一种Linux下基于iptables的安全孤岛构建方法、装置及存储介质。所述方法包括：获取构建安全孤岛任务指令，根据所述构建安全孤岛任务指令对一个或多个主机构建安全孤岛，获取构建安全孤岛出口任务指令，根据所述构建安全孤岛出口任务指令对一个或多个主机构建安全孤岛出口，对所述安全孤岛进行监测得到监测情况信息，根据所述监测情况信息和指令对安全孤岛进行重构，通过该方法能快速准确的构建所需要的孤岛类型，帮助企业保护数字资产，可适用于大规模应用。

Description

一种Linux下基于iptables的安全孤岛构建方法、装置及存储介质 技术领域
本公开的实施例一般设计安全技术领域，并且更具体的，灵活的，进行基于iptables的安全孤岛构建。
背景技术
目前，在进行iptables配置的过程中，由于需要确定目标信息，然后对所需要的主机进行iptables配置，当拥有大量主机时，会在目标的信息和配置过程中耗费大量时间，并且在后续过程中有变动时，无法进行监控，用户体验感查，不适合大规模应用。所以，如何高效，快速，准确并能检查iptables配置成为一个难题。
因此现有技术存在缺陷，急需改进。
发明内容
鉴于上述问题，本发明的目的是提供一种Linux下基于iptables的安全孤岛构建方法、装置和可读存储介质。
本发明第一方面提供了一种Linux下基于iptables的安全孤岛构建方法，包括：
获取构建安全孤岛任务指令；
根据所述构建安全孤岛任务指令对一个或多个主机构建安全孤岛；
获取构建安全孤岛出口任务指令；
根据所述构建安全孤岛出口任务指令对一个或多个主机构建安全孤岛出口；
对所述安全孤岛进行监测得到监测情况信息；
根据所述监测情况信息和指令对安全孤岛进行重构。
本方案中，所述获取构建安全孤岛任务指令通过以下步骤获得：
获取所需配置的安全孤岛信息；
根据所述所需配置的安全孤岛信息，对一个或多个主机进行安全孤岛构建，得到安全孤岛；
其中，所述所需配置的安全孤岛信息至少包括以下至少一项：主机IP信息。
本方案中，对一个或多个主机进行安全孤岛构建，得到安全孤岛，包括：
获取所需配置的安全孤岛信息；
对所述所需配置的安全孤岛信息进行预处理，得到规则配置信息；
根据所述一个或多个主机确认分发规则工具；
通过所述分发规则工具，将规则配置信息分发并生效。
本方案中，所述获取构建安全孤岛出口任务指令通过以下步骤获得：
获取所需配置的安全孤岛出口信息；
根据所述所需配置的安全孤岛出口信息，对一个或多个主机进行安全孤岛出口构建，得到安全孤岛出口；
其中，所述所需配置的安全孤岛出口信息至少包括以下至少一项：
主机IP信息、端口。
本方案中，对一个或多个主机进行安全孤岛出口构建，得到安全孤岛出口，包括：
获取所需配置的安全孤岛出口信息；
对所述所需配置的安全孤岛出口信息进行预处理，得到规则配置信息；
根据所述一个或多个主机确认分发规则工具；
通过所述分发规则工具，将规则配置信息分发并生效。
本方案中，根据所述监测情况信息和指令对安全孤岛进行重构，包括：
获取规则配置信息数量和详情；
对所述规则配置信息数量和详情进行分析，判断与安全孤岛配置详情是否匹配；
若是，则不做处理，若否，则得到安全孤岛重构指令。
本发明第二方面提供了一种装置。该装置包括：
获取模块，用于获取构建安全孤岛任务指令、构建安全孤岛出口任务指令；
处理模块，用于构建安全孤岛、安全孤岛出口；
监测模块，用于对所述安全孤岛进行监测。
本方案中，所述获取构建安全孤岛任务指令通过以下步骤获得：
获取所需配置的安全孤岛信息；
根据所述所需配置的安全孤岛信息，对一个或多个主机进行安全孤岛构建，得到安全孤岛；
其中，所述所需配置的安全孤岛信息至少包括以下至少一项：主机IP信息。
本方案中，对一个或多个主机进行安全孤岛构建，得到安全孤岛，包括：
获取所需配置的安全孤岛信息；
对所述所需配置的安全孤岛信息进行预处理，得到规则配置信息；
根据所述一个或多个主机确认分发规则工具；
通过所述分发规则工具，将规则配置信息分发并生效。
本方案中，所述获取构建安全孤岛出口任务指令通过以下步骤获得：
获取所需配置的安全孤岛出口信息；
根据所述所需配置的安全孤岛出口信息，对一个或多个主机进行安全孤岛出口构建，得到安全孤岛出口；
其中，所述所需配置的安全孤岛出口信息至少包括以下至少一项：
主机IP信息、端口。
本方案中，对一个或多个主机进行安全孤岛出口构建，得到安全孤岛出口，包括：
获取所需配置的安全孤岛出口信息；
对所述所需配置的安全孤岛出口信息进行预处理，得到规则配置信息；
根据所述一个或多个主机确认分发规则工具；
通过所述分发规则工具，将规则配置信息分发并生效。
本方案中，根据所述监测情况信息和指令对安全孤岛进行重构，包括：
获取规则配置信息数量和详情；
对所述规则配置信息数量和详情进行分析，判断与安全孤岛配置详情是否匹配；
若是，则不做处理，若否，则得到安全孤岛重构指令。
在本公开的第三方面，提供了一种电子设备。该电子设备包括：存储器和处理器，所述存储器上存储有计算机程序，所述处理器执行所述程序时实现如以上所述的方法。
在本公开的第四方面，提供了一种计算机可读存储介质，其上存储有计算机程序，所述程序被处理器执行时实现如根据本公开的第一方面的方法。
本发明公开的了一种Linux下基于iptables的安全孤岛构建方法、装置和可读存储介质。所述方法包括：获取构建安全孤岛任务指令，根据所述构建安全孤岛任务指令对一个或多个主机构建安全孤岛，获取构建安全孤岛出口任务指令，根据所述构建安全孤岛出口任务指令对一个或多个主机构建安全孤岛出口，对所述安全孤岛进行监测得到监测情况信息，根据所述监测情况信息和指令对安全孤岛进行重构，以此方式，解决在大量资产中帮助用户对已知数字资产进行安全防护。通过该方法能快速准确的构建 所需要的孤岛类型，帮助企业保护数字资产，可适用于大规模应用。
应当理解，发明内容部分中所描述的内容并非旨在限定本公开的实施例的关键或重要特征，亦非用于限制本公开的范围。本公开的其它特征将通过以下的描述变得容易理解。
附图说明
结合附图并参考以下详细说明，本公开各实施例的上述和其他特征、优点及方面将变得更加明显。附图用于更好地理解本方案，不构成对本公开的限定在附图中，相同或相似的附图标记表示相同或相似的元素，其中：
图1示出了根据本公开的实施例的一种Linux下基于iptables的安全孤岛构建方法的流程图；
图2示出了根据本公开的实施例的安全孤岛构建的流程图；
图3示出了根据本公开的实施例的安全孤岛重构流程图；
图4示出了本发明一种Linux下基于iptables的安全孤岛构建装置的框图；
图5示出了本发明一种Linux下基于iptables的安全孤岛构建装置的方案图。
具体实施方式
为了能够更清楚地理解本发明的上述目的、特征和优点，下面结合附图和具体实施方式对本发明进行进一步的详细描述。需要说明的是，在不冲突的情况下，本申请的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多具体细节以便于充分理解本发明，但是，本发明还可以采用其他不同于在此描述的其他方式来实施，因此，本发明的保护范围并不受下面公开的具体实施例的限制。
图1示出了本发明一种高效的网络资产风险评估方法的流程图。
如图1所示，本发明公开了一种高效的网络资产风险评估方法，包括：
S102，获取构建安全孤岛任务指令；
S104，根据所述构建安全孤岛任务指令对一个或多个主机构建安全孤岛；
S106，获取构建安全孤岛出口任务指令；
S108，根据所述构建安全孤岛出口任务指令对一个或多个主机构建安全孤岛出口；
S110，对所述安全孤岛进行监测得到监测情况信息；
S112，根据所述监测情况信息和指令对安全孤岛进行重构。
根据本发明实施例，安全孤岛构建前接收构建安全孤岛任务指令；
根据指令成功构建安全孤岛，如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述接收构建安全孤岛任务指令通过以下步骤获得：根据用户所需要构建安全孤岛规模，对一个或多个主机进行构建，以获得所需安全孤岛。构建安全孤岛后对安全孤岛完整性进行监测。
根据本发明实施例，所述获取构建安全孤岛任务指令通过以下步骤获得：
获取所需配置的安全孤岛信息；
根据所述所需配置的安全孤岛信息，对一个或多个主机进行安全孤岛构建，得到安全孤岛；
其中，所述所需配置的安全孤岛信息至少包括以下至少一项：主机IP信息。
需要说明的是，安全孤岛构建前接收构建安全孤岛任务指令；根据指令成功构建安全孤岛；如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述接收构建安全孤岛任务指令通过以下步骤获得：根据用户所需要构建安全孤岛规模，对一个或多个主机进行构建，以获得所需安全孤岛，其中：接收构建安全孤岛任务指令包括以下至少一项：主机 IP。
根据本发明实施例，对一个或多个主机进行安全孤岛构建，得到安全孤岛，包括：
S202，获取所需配置的安全孤岛信息；
S204，对所述所需配置的安全孤岛信息进行预处理，得到规则配置信息；
S206，根据所述一个或多个主机确认分发规则工具；
S208，通过所述分发规则工具，将规则配置信息分发并生效。
需要说明的是，如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述构建安全孤岛，将主机IP信息进行匹配去重后，转换成基础配置信息，通过分发规则工具，将规则分发并生效，并将基础配置信息加载到关系型数据库中。
根据本发明实施例，所述获取构建安全孤岛出口任务指令通过以下步骤获得：
获取所需配置的安全孤岛出口信息；
根据所述所需配置的安全孤岛出口信息，对一个或多个主机进行安全孤岛出口构建，得到安全孤岛出口；
其中，所述所需配置的安全孤岛出口信息至少包括以下至少一项：
主机IP信息、端口。
需要说明的是，安全孤岛出口构建前接收构建安全孤岛出口任务指令；根据指令成功构建安全孤岛出口；如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述接收构建安全孤岛出口任务指令通过以下步骤获得：根据用户所需要构建安全孤岛出口规模，对一个或多个主机进行构建，以获得所需安全孤岛出口，其中：接收构建安全孤岛出口任务指令包括以下项：主机IP，主机端口，协议，出入方向。
根据本发明实施例，对一个或多个主机进行安全孤岛出口构建，得到 安全孤岛出口，包括：
获取所需配置的安全孤岛出口信息；
对所述所需配置的安全孤岛出口信息进行预处理，得到规则配置信息；
根据所述一个或多个主机确认分发规则工具；
通过所述分发规则工具，将规则配置信息分发并生效。
需要说明的是，如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述构建安全孤岛出口，将主机IP信息进行匹配去重后，转换成基础配置信息，通过分发规则工具，将规则分发并生效，并将基础配置信息加载到关系型数据库中。
根据本发明实施例，根据所述监测情况信息和指令对安全孤岛进行重构，包括：
S302，获取规则配置信息数量和详情；
S304，对所述规则配置信息数量和详情进行分析，判断与安全孤岛配置详情是否匹配；
S306，若是，则不做处理，若否，则得到安全孤岛重构指令。
需要说明的是，定时检测关系型数据库中加载的规则配置信息。统计规则配置信息数量和详情。匹配规则配置信息数量和详情和安全孤岛配置详情。如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述规则不匹配时，判定为安全孤岛失效，所述规则匹配时，判定为安全孤岛完整。安全孤岛重构前接收重构安全孤岛任务指令；根据指令成功重构安全孤岛；如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述接收重构安全孤岛任务指令通过以下步骤获得：根据用户所需求，判断当安全孤岛失效后，是否需要重构安全孤岛，当需要重构安全孤岛时，实现该方法：如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述重构安全孤岛，将已破坏孤岛的主机IP信息，转换成基础配置信息，通过分发规则工具，将规则分发并生效，并将基础配置 信息加载到关系型数据库中。
图4示出了本发明一种Linux下基于iptables的安全孤岛构建装置的框图。
如图4所示，本发明第二方面提供了一种装置。该装置包括：
获取模块，用于获取构建安全孤岛任务指令、构建安全孤岛出口任务指令；
处理模块，用于构建安全孤岛、安全孤岛出口；
监测模块，用于对所述安全孤岛进行监测。
根据本发明实施例，安全孤岛构建前接收构建安全孤岛任务指令；
根据指令成功构建安全孤岛，如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述接收构建安全孤岛任务指令通过以下步骤获得：根据用户所需要构建安全孤岛规模，对一个或多个主机进行构建，以获得所需安全孤岛。构建安全孤岛后对安全孤岛完整性进行监测。
根据本发明实施例，所述获取构建安全孤岛任务指令通过以下步骤获得：
获取所需配置的安全孤岛信息；
根据所述所需配置的安全孤岛信息，对一个或多个主机进行安全孤岛构建，得到安全孤岛；
其中，所述所需配置的安全孤岛信息至少包括以下至少一项：主机IP信息。
需要说明的是，安全孤岛构建前接收构建安全孤岛任务指令；根据指令成功构建安全孤岛；如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述接收构建安全孤岛任务指令通过以下步骤获得：根据用户所需要构建安全孤岛规模，对一个或多个主机进行构建，以获得所需安全孤岛，其中：接收构建安全孤岛任务指令包括以下至少一项：主机IP。
根据本发明实施例，对一个或多个主机进行安全孤岛构建，得到安全孤岛，包括：
获取所需配置的安全孤岛信息；
对所述所需配置的安全孤岛信息进行预处理，得到规则配置信息；
根据所述一个或多个主机确认分发规则工具；
通过所述分发规则工具，将规则配置信息分发并生效。
需要说明的是，如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述构建安全孤岛，将主机IP信息进行匹配去重后，转换成基础配置信息，通过分发规则工具，将规则分发并生效，并将基础配置信息加载到关系型数据库中。
根据本发明实施例，所述获取构建安全孤岛出口任务指令通过以下步骤获得：
获取所需配置的安全孤岛出口信息；
根据所述所需配置的安全孤岛出口信息，对一个或多个主机进行安全孤岛出口构建，得到安全孤岛出口；
其中，所述所需配置的安全孤岛出口信息至少包括以下至少一项：
主机IP信息、端口。
需要说明的是，安全孤岛出口构建前接收构建安全孤岛出口任务指令；根据指令成功构建安全孤岛出口；如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述接收构建安全孤岛出口任务指令通过以下步骤获得：根据用户所需要构建安全孤岛出口规模，对一个或多个主机进行构建，以获得所需安全孤岛出口，其中：接收构建安全孤岛出口任务指令包括以下项：主机IP，主机端口，协议，出入方向。
根据本发明实施例，对一个或多个主机进行安全孤岛出口构建，得到安全孤岛出口，包括：
获取所需配置的安全孤岛出口信息；
对所述所需配置的安全孤岛出口信息进行预处理，得到规则配置信息；
根据所述一个或多个主机确认分发规则工具；
通过所述分发规则工具，将规则配置信息分发并生效。
需要说明的是，如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述构建安全孤岛出口，将主机IP信息进行匹配去重后，转换成基础配置信息，通过分发规则工具，将规则分发并生效，并将基础配置信息加载到关系型数据库中。
根据本发明实施例，根据所述监测情况信息和指令对安全孤岛进行重构，包括：
获取规则配置信息数量和详情；
对所述规则配置信息数量和详情进行分析，判断与安全孤岛配置详情是否匹配；
若是，则不做处理，若否，则得到安全孤岛重构指令。
需要说明的是，定时检测关系型数据库中加载的规则配置信息。统计规则配置信息数量和详情。匹配规则配置信息数量和详情和安全孤岛配置详情。如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述规则不匹配时，判定为安全孤岛失效，所述规则匹配时，判定为安全孤岛完整。安全孤岛重构前接收重构安全孤岛任务指令；根据指令成功重构安全孤岛；如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述接收重构安全孤岛任务指令通过以下步骤获得：根据用户所需求，判断当安全孤岛失效后，是否需要重构安全孤岛，当需要重构安全孤岛时，实现该方法：如上所述的方面和任一可能的实现方式，进一步提供一种实现方式，所述重构安全孤岛，将已破坏孤岛的主机IP信息，转换成基础配置信息，通过分发规则工具，将规则分发并生效，并将基础配置信息加载到关系型数据库中。
在本公开的第三方面，提供了一种电子设备。该电子设备包括：存储 器和处理器，所述存储器上存储有计算机程序，所述处理器执行所述程序时实现如以上所述的方法。
在本公开的第四方面，提供了一种计算机可读存储介质，其上存储有计算机程序，所述程序被处理器执行时实现如根据本公开的第一方面的方法。
本发明公开的了一种Linux下基于iptables的安全孤岛构建方法、装置和可读存储介质。所述方法包括：获取构建安全孤岛任务指令，根据所述构建安全孤岛任务指令对一个或多个主机构建安全孤岛，获取构建安全孤岛出口任务指令，根据所述构建安全孤岛出口任务指令对一个或多个主机构建安全孤岛出口，对所述安全孤岛进行监测得到监测情况信息，根据所述监测情况信息和指令对安全孤岛进行重构，以此方式，解决在大量资产中帮助用户对已知数字资产进行安全防护。通过该方法能快速准确的构建所需要的孤岛类型，帮助企业保护数字资产，可适用于大规模应用。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备和方法，可以通过其它的方式实现。以上所描述的设备实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，如：多个单元或组件可以结合，或可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的各组成部分相互之间的耦合、或直接耦合、或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性的、机械的或其它形式的。
上述作为分离部件说明的单元可以是、或也可以不是物理上分开的，作为单元显示的部件可以是、或也可以不是物理单元；既可以位于一个地方，也可以分布到多个网络单元上；可以根据实际的需要选择其中的部分或全部单元来实现本实施例方案的目的。
另外，在本发明各实施例中的各功能单元可以全部集成在一个处理单元中，也可以是各单元分别单独作为一个单元，也可以两个或两个以上单 元集成在一个单元中；上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：移动存储设备、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
或者，本发明上述集成的单元如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、服务器、或者网络设备等)执行本发明各个实施例所述方法的全部或部分。而前述的存储介质包括：移动存储设备、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (9)

  1. 一种Linux下基于iptables的安全孤岛构建方法，其特征在于，包括：
    获取构建安全孤岛任务指令；
    根据所述构建安全孤岛任务指令对一个或多个主机构建安全孤岛；
    获取构建安全孤岛出口任务指令；
    根据所述构建安全孤岛出口任务指令对一个或多个主机构建安全孤岛出口；
    对所述安全孤岛进行监测得到监测情况信息；
    根据所述监测情况信息和指令对安全孤岛进行重构。
  2. 根据权利要求1所述的方法，其特征在于，所述获取构建安全孤岛任务指令通过以下步骤获得：
    获取所需配置的安全孤岛信息；
    根据所述所需配置的安全孤岛信息，对一个或多个主机进行安全孤岛构建，得到安全孤岛；
    其中，所述所需配置的安全孤岛信息至少包括以下至少一项：主机IP信息。
  3. 根据权利要求2所述方法，其特征在于，对一个或多个主机进行安全孤岛构建，得到安全孤岛，包括：
    获取所需配置的安全孤岛信息；
    对所述所需配置的安全孤岛信息进行预处理，得到规则配置信息；
    根据所述一个或多个主机确认分发规则工具；
    通过所述分发规则工具，将规则配置信息分发并生效。
  4. 根据权利要求1所述的方法，其特征在于，所述获取构建安全孤岛出口任务指令通过以下步骤获得：
    获取所需配置的安全孤岛出口信息；
    根据所述所需配置的安全孤岛出口信息，对一个或多个主机进行安全 孤岛出口构建，得到安全孤岛出口；
    其中，所述所需配置的安全孤岛出口信息至少包括以下至少一项：
    主机IP信息、端口。
  5. 根据权利要求4所述的方法，其特征在于，对一个或多个主机进行安全孤岛出口构建，得到安全孤岛出口，包括：
    获取所需配置的安全孤岛出口信息；
    对所述所需配置的安全孤岛出口信息进行预处理，得到规则配置信息；
    根据所述一个或多个主机确认分发规则工具；
    通过所述分发规则工具，将规则配置信息分发并生效。
  6. 根据权利要求1所述的方法，其特征在于，根据所述监测情况信息和指令对安全孤岛进行重构，包括：
    获取规则配置信息数量和详情；
    对所述规则配置信息数量和详情进行分析，判断与安全孤岛配置详情是否匹配；
    若是，则不做处理，若否，则得到安全孤岛重构指令。
  7. 一种Linux下基于iptables的安全孤岛构建装置，其特征在于，包括：
    获取模块，用于获取构建安全孤岛任务指令、构建安全孤岛出口任务指令；
    处理模块，用于构建安全孤岛、安全孤岛出口；
    监测模块，用于对所述安全孤岛进行监测。
  8. 一种电子设备，其特征在于，包括：
    至少一个处理器；
    以及与所述至少一个处理器通信连接的存储器；
    其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行权利 要求1-6中任一项所述的方法。
  9. 一种存储有计算机指令的非瞬时计算机可读存储介质，其特征在于，所述计算机指令用于使所述计算机执行根据权利要求1-6中任一项所述的方法。
PCT/CN2022/138641 2022-11-22 2022-12-13 一种Linux下基于iptables的安全孤岛构建方法、装置及存储介质 WO2024108686A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211469114.1 2022-11-22
CN202211469114.1A CN115883355A (zh) 2022-11-22 2022-11-22 一种Linux下基于iptables的安全孤岛构建方法、装置及存储介质

Publications (1)

Publication Number Publication Date
WO2024108686A1 true WO2024108686A1 (zh) 2024-05-30

Family

ID=85760572

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/138641 WO2024108686A1 (zh) 2022-11-22 2022-12-13 一种Linux下基于iptables的安全孤岛构建方法、装置及存储介质

Country Status (2)

Country Link
CN (1) CN115883355A (zh)
WO (1) WO2024108686A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200351286A1 (en) * 2019-05-03 2020-11-05 ShieldX Networks, Inc. Configuring an island virtual switch for provisioning of network security services
CN114565058A (zh) * 2022-03-16 2022-05-31 广东电网有限责任公司 一种孤岛检测模型训练方法、装置、设备和介质
CN114705947A (zh) * 2022-03-16 2022-07-05 广东电网有限责任公司 一种孤岛检测模型训练方法、装置、设备和介质
CN115276078A (zh) * 2022-05-20 2022-11-01 华电电力科学研究院有限公司 孤岛运行控制电路和控制方法
CN115297027A (zh) * 2022-08-02 2022-11-04 上海海得控制系统股份有限公司 孤岛网络设备间链路识别方法、系统、存储介质、网管服务器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200351286A1 (en) * 2019-05-03 2020-11-05 ShieldX Networks, Inc. Configuring an island virtual switch for provisioning of network security services
CN114565058A (zh) * 2022-03-16 2022-05-31 广东电网有限责任公司 一种孤岛检测模型训练方法、装置、设备和介质
CN114705947A (zh) * 2022-03-16 2022-07-05 广东电网有限责任公司 一种孤岛检测模型训练方法、装置、设备和介质
CN115276078A (zh) * 2022-05-20 2022-11-01 华电电力科学研究院有限公司 孤岛运行控制电路和控制方法
CN115297027A (zh) * 2022-08-02 2022-11-04 上海海得控制系统股份有限公司 孤岛网络设备间链路识别方法、系统、存储介质、网管服务器

Also Published As

Publication number Publication date
CN115883355A (zh) 2023-03-31

Similar Documents

Publication Publication Date Title
WO2020259629A1 (zh) 一种基于区块链的数据检验方法及装置
CN108073821B (zh) 数据安全处理方法及装置
US20200192885A1 (en) Utilizing Independently Stored Validation Keys to Enable Auditing of Instrument Measurement Data Maintained in a Blockchain
TWI226984B (en) Communication log processing method and communication log processing system
CN110866265A (zh) 一种基于区块链的数据存储方法、设备及存储介质
WO2021056731A1 (zh) 基于日志数据分析的行为检测方法、装置、设备及介质
CN115329177A (zh) 数据处理方法、设备、存储介质及程序产品
CN112100239A (zh) 车辆检测设备画像生成方法、装置、服务器及可读存储介质
CN116167085A (zh) 一种数据脱敏方法和装置
WO2024108686A1 (zh) 一种Linux下基于iptables的安全孤岛构建方法、装置及存储介质
CN115879164A (zh) 数据校验方法、装置、设备及存储介质
EP3472779A1 (en) Digital asset platform
CN111222181B (zh) Ai模型的监管方法、系统、服务器及存储介质
KR102541888B1 (ko) 이미지 기반 악성코드 탐지 방법 및 장치와 이를 이용하는 인공지능 기반 엔드포인트 위협탐지 및 대응 시스템
CN113190200B (zh) 展会数据安全的防护方法及装置
CN115756255A (zh) 停车场设备的设备参数处理方法、装置、设备和存储介质
US20230009460A1 (en) Trail recording system and data verification method
CN114629690A (zh) 设备安全基线合规检测方法、装置和计算机设备
CN114564358A (zh) 变更操作的合规性审查方法、装置、设备、介质和产品
CN114884696A (zh) 一种诈骗预警方法、装置、设备及存储介质
CN113360575A (zh) 联盟链中交易数据的监管方法、装置、设备及存储介质
CN113360568A (zh) 一种联盟链数据屏蔽方法、系统及计算机可读存储介质
CN103971065A (zh) 用于防止篡改数据的方法和设备
CN117610924A (zh) 一种数据访问方法、装置、电子设备和可读存储介质
US12032554B2 (en) Utilizing independently stored validation keys to enable auditing of instrument measurement data maintained in a blockchain