CN104468537A - System and method for achieving safety audit - Google Patents

Abstract

The present invention relates to a system for realizing security auditing, which includes several clients, several servers and security auditing equipment, and the present invention also relates to a method for security auditing, including sending a service request message from the client to the security auditing equipment ; The security audit device forwards the service request message to the server corresponding to the service request message, and mirrors and copies the service request message to obtain the corresponding image file; the security audit device parses the image file to obtain the corresponding service operation instruction; the server responds to the service request message, and send the corresponding business operation log to the security audit device; the security audit device compares and analyzes the business operation instruction and the business operation log. The system for realizing safety audit by adopting the present invention has the functions of dual-machine hot backup and cluster deployment, is easy to popularize, is stable and reliable, supports dynamic expansion, and has a wider application range.

Description

System and method for realizing safety audit

technical field

The present invention relates to the field of information security, in particular to the field of security audit of user access, and specifically refers to a system and method for realizing security audit.

Background technique

With the rapid development of information technology, Internet security issues have become increasingly prominent. Traditional network security methods such as firewalls and intrusion detection can realize the management and monitoring of abnormal network behaviors, but cannot monitor network content and authorized normal internal network access behaviors. Therefore, information leakage and network resource monitoring caused by normal network access behaviors Behavior can't be helped. Under this background, a security audit device is produced. The network topology diagram of the existing security audit device is shown in Figure 1, and the security audit device corresponds to the server one by one. However, at present, various industries rely heavily on information systems and need to provide uninterrupted services to ensure 24-hour uninterrupted operation. This also requires security audit equipment to provide continuous and reliable services. The method shown in Figure 1 is difficult to meet this requirement. Requirements: In actual applications, the number of application servers is relatively large and increasing day by day. Usually, a security audit device cannot support a large number of servers, which requires the security audit device to support dynamic expansion.

Contents of the invention

The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art, and provide a device that supports a large number of servers, and periodically performs data synchronization between devices, and performs selective alarms by comparing business operation instructions and business operation logs, and has Dual-machine hot backup and cluster deployment, easy to popularize, stable and reliable, support dynamic expansion of the security audit system and method.

In order to achieve the above object, the system and method for realizing security audit of the present invention have the following components:

The main feature of the system for realizing safety audit is that the system includes:

Several clients are used to send the service request message to the security audit device;

Several servers are used to respond to the service request message forwarded by the security audit device, and send the corresponding service operation log to the security audit device;

A security auditing device, configured to mirror copy the business request message to obtain a corresponding mirror file, and parse the mirror file to obtain a corresponding business operation instruction, and to perform a review of the business operation instruction and the business operation logs for comparative analysis.

Further, the security audit equipment includes:

A switching module, configured to forward the service request message to the server corresponding to the service request message, and mirror copy the service request message to obtain a corresponding mirror image file;

A packet capture module for encrypting the image file and obtaining a corresponding encrypted file;

a protocol parsing module, configured to parse the encrypted file to obtain the business operation instruction;

The early warning monitoring module is used to compare and analyze the business operation instruction and the business operation log.

Furthermore, the security auditing device further includes a local storage module, and the local storage module is used to store the encrypted file.

Wherein, the encrypted file is an encrypted file in pcap format, the switch module is a switch with STP protocol, each security audit device is connected through a local area network, and data synchronization is performed between each security audit device.

In addition, the present invention also relates to a method for implementing security auditing, the main feature of which is that the method includes the following steps:

(1) The client sends the service request message to the security audit device;

(2) The security auditing device forwards the service request message to the server corresponding to the service request message, and mirror copies the service request message to obtain a corresponding image file;

(3) The security audit device parses the image file to obtain the corresponding business operation instruction;

(4) The server responds to the service request message, and sends the corresponding service operation log to the security audit device;

(5) The security audit device compares and analyzes the business operation instruction and the business operation log.

Further, the security audit device includes a packet capture module and a protocol analysis module, and the security audit device parses the image file to obtain corresponding business operation instructions, including the following steps:

(3.1) the packet capture module described in the message encrypts the image file and obtains the corresponding encrypted file;

(3.2) The protocol analysis module analyzes the encrypted file to obtain the business operation instruction.

Further, the security auditing device establishes connections with the several servers through the switching module with the STP protocol, before the step (1), it also includes the following steps:

(0) The switching module runs the STP protocol to discover the loop network structure in the network established by the security audit device and the several servers, and prunes the loop network structure to be loop-free Tree network structure.

Further, between the steps (1) and (2), the following steps are also included:

(1.1) said switching module judges whether the communication lines between said security audit equipment and said several servers are normal by STP protocol, if yes, then continue step (2), otherwise continue step (1.2);

(1.2) The switch module switches the communication lines between the security audit device and the several servers.

Further, each security auditing device is connected through a local area network, and after the step (5), the following steps are also included:

(6) each safety audit equipment described judges whether to reach timing synchronous time, if yes, then continue step (7), otherwise continue to wait;

(7) Data synchronization is performed among the security audit devices described above.

Adopting the system and method for realizing safety audit of the present invention has the following positive benefits:

1. Comprehensiveness of audit data: This security audit device collects all messages generated by user operations and business logs generated by web services in response to user requests;

2. Convenient dynamic expansion: when it is necessary to add a web server, you can connect to the newly added web server through multiple groups of ports of this security audit device. If the ports of the security audit device are used up, just add a new security audit device in the cluster environment Just connect the web server to be added to the security audit device through the switch, and it is very convenient to expand the web server;

3. High stability and high reliability: This security audit device supports dual-machine hot backup. When the main security audit device fails, the backup security audit device is automatically activated to ensure continuous, uninterrupted, stable and reliable services for users.

Description of drawings

FIG. 1 is a network topology diagram of an existing security auditing device.

FIG. 2 is a network topology diagram of the system for implementing security auditing in the present invention.

Fig. 3 is a flow chart of the method for implementing security auditing in the present invention.

FIG. 4 is a network topology diagram of the cluster deployment of the security auditing system of the present invention.

FIG. 5 is a network topology diagram of the hot backup of the system for implementing security auditing in the present invention.

Fig. 6 is a flow chart of the method for implementing security audit based on the hot backup environment of the present invention.

Detailed ways

In order to describe the technical content of the present invention more clearly, further description will be given below in conjunction with specific embodiments.

The system for implementing security audit involved in the present invention has functions such as capturing business request messages, analyzing messages, analyzing business operation instructions, and fault warnings. The security audit equipment is actually a security audit product. The network topology of the system The picture is shown in Figure 2.

Through multiple groups of ports of the security audit device, the security audit device can be connected in series between multiple client users and multiple servers providing web services. The security audit device receives the service request message sent by the client to the server and the service operation log generated after the server responds to the user request; all http messages (ie service request messages) for the user to access the web service must pass through the security audit device, Most switches (that is, switching modules) support the mirror (mirror) strategy. The mirror strategy can copy the packets that meet the specified rules on one port to one or more ports, which is convenient to use and has a good effect. Therefore, this security audit device is used in switching The mirror strategy is set on the board assembly, in conjunction with the method shown in Figure 3, a specific embodiment of the present invention is as follows:

When a user accesses the server, the security audit device copies the packets whose protocol is HTTP, whose destination address is in the whitelist of the web server, and whose destination port is 8080 to the main control board of the security audit device. The package module encrypts the image file and stores it in the local disk (ie, the local storage module), and the protocol analysis module of the main control board performs protocol analysis on the http message to obtain business operation instructions, and stores the business operation instructions in the security audit device; The server responds to the business request initiated by the user to generate a business operation log, and reports the business operation log to the security audit device. The early warning monitoring module of the security audit device regularly compares and analyzes the business operation instruction and the reported user operation log. The rules generate corresponding early warning information such as network disconnection, disconnection, and no traffic.

Secondly, the security audit equipment involved in the present invention supports cluster deployment, and its network topology diagram is shown in Figure 4: the server is connected to different security audit equipment through a switch, and each security audit equipment in the cluster is connected through a local area network. Each security audit device in the cluster provides the same service, and the generated data is stored in its own local disk; data synchronization is performed on all security audit devices in the cluster through scheduled tasks to ensure data consistency of each security audit device in the cluster When the number of servers increases and the existing security audit equipment cannot support the new servers, it is only necessary to add a new security audit equipment in the cluster deployment environment shown in Figure 3 and connect it with the existing security audit equipment The same local area network is enough.

In addition, the present invention is based on the STP (Spanning Tree Protocol, Spanning Tree Protocol) protocol to realize dual-machine hot backup, select a switch that supports the STP protocol, open the switch to set the STP protocol, and build a dual-machine hot backup environment as shown in Figure 5. The STP protocol has the function of logically disconnecting the loop to prevent the generation of broadcast storms on the Layer 2 network, and the disconnected interface is activated to restore communication when the line fails. The effect is as follows:

(1) Path selection: when the user accesses the server, the STP protocol will select the best access path for it;

(2) Automatic path switching: when the current access line fails, the STP protocol automatically switches to the backup line;

(3) Fault warning: when the security audit equipment in Fig. 4 breaks down, the background alarm program of the security audit equipment will prompt alarm information;

(4) Data synchronization: This security audit device uses memory synchronization instead of shared memory for data synchronization, and regularly synchronizes the data of two security audit devices through the timing synchronization task of the security audit device to maintain data consistency.

In combination with the above-mentioned hot backup environment and FIG. 6, another specific embodiment of the present invention is as follows:

Build a hot backup working environment according to the network topology diagram shown in Figure 5, connect the switch and set the STP protocol, the switches running the STP protocol discover loops in the network by exchanging information with each other, and selectively block some ports, and finally Prune the loop network structure into a loop-free tree network structure, so as to prevent the continuous proliferation and infinite loop of packets in the loop network, and set the mirror policy on the switch board component of the security audit device.

The user accesses the web service through the client, and the switch selects the best access line (main line) for the user through the STP protocol. The request initiated by the user is transmitted to the server through this line. At the same time, the STP protocol continuously detects the main line. When the line fails Automatically enable the disconnected backup line to restore communication, and at the same time, the alarm monitoring program on the main line prompts the alarm information and prompts the maintenance personnel to repair the fault, thus providing users with a stable and reliable communication environment.

Uplink communication packets (that is, business request packets) that users access to web server services must pass through the security audit device. In practical applications, users will access web services in large numbers and The real-time analysis of the text requires high performance of the security audit equipment. When the CPU usage of the security audit equipment is high, packet loss will occur. Therefore, the security audit equipment encrypts the message and stores it in the security audit equipment as a pcap file. The local hard disk deferred processing method reduces the cost of the product while ensuring the quality of the product.

In practical applications, the protocol analysis module of the security audit equipment of the present invention decrypts pcap files regularly, and the security audit equipment can support web services provided by multiple manufacturers, and each service provider provides its own data packet analysis program, and the security audit equipment According to the destination address of the message, the corresponding unpacking program is called to analyze the protocol of the message, so as to obtain the business operation instruction. Encrypted pcap files and different services use different unpacking programs to ensure the security of communication messages.

The early warning detection device (that is, the early warning monitoring module) regularly compares and analyzes the business operation instructions and the reported user operation logs. If the security audit device does not receive the task information of the web service for 12 consecutive hours, it will generate a disconnection warning; Under the premise of offline connection, if the number of business operation instructions and reported user business operation logs is zero for 12 consecutive hours, a no-flow alarm will be generated; If the number of logs is larger than the number of logs, an exception will be generated for submitting logs.

In the present invention, the audit information collected by the main security audit equipment and the standby security audit equipment is stored in their respective local hard disks, and data synchronization is carried out by using memory synchronization instead of shared storage. Synchronize audit information data with one security audit device.

Adopting the system and method for realizing safety audit of the present invention has the following positive benefits:

1. Comprehensiveness of audit data: This security audit device collects all messages generated by user operations and business logs generated by web services in response to user requests;

2. Convenient dynamic expansion: when it is necessary to add a web server, you can connect to the newly added web server through multiple groups of ports of this security audit device. If the ports of the security audit device are used up, just add a new security audit device in the cluster environment Just connect the web server to be added to the security audit device through the switch, and it is very convenient to expand the web server;

3. High stability and high reliability: This security audit device supports dual-machine hot backup. When the main security audit device fails, the backup security audit device is automatically activated to ensure continuous, uninterrupted, stable and reliable services for users.

In this specification, the invention has been described with reference to specific embodiments thereof. However, it is obvious that various modifications and changes can be made without departing from the spirit and scope of the invention. Accordingly, the specification and drawings are to be regarded as illustrative rather than restrictive.

Claims (11)

1. A system that realizes safety audit, is characterized in that, described system comprises: Several clients are used to send the service request message to the security audit device; Several servers are used to respond to the service request message forwarded by the security audit device, and send the corresponding service operation log to the security audit device; A security auditing device, configured to mirror copy the business request message to obtain a corresponding mirror file, and parse the mirror file to obtain a corresponding business operation instruction, and to perform a review of the business operation instruction and the business operation logs for comparative analysis. 2. The system for realizing security auditing according to claim 1, wherein said security auditing equipment comprises: A switching module, configured to forward the service request message to the server corresponding to the service request message, and mirror copy the service request message to obtain a corresponding mirror image file; A packet capture module for encrypting the image file and obtaining a corresponding encrypted file; a protocol parsing module, configured to parse the encrypted file to obtain the business operation instruction; The early warning monitoring module is used to compare and analyze the business operation instruction and the business operation log. 3. The system for implementing security auditing according to claim 2, wherein the security auditing device further comprises a local storage module, and the local storage module is used to store the encrypted file. 4. The system for realizing security audit according to claim 3, characterized in that, the encrypted file is an encrypted file in pcap format. 5. The system for implementing security audit according to any one of claims 1 to 4, characterized in that, the switching module is a switch with STP protocol. 6. The system for implementing security auditing according to any one of claims 1 to 4, characterized in that each security auditing device is connected through a local area network, and data synchronization is performed between each security auditing device. 7. A method for realizing security audit based on the system according to any one of claims 1 to 4, characterized in that, said method comprises the following steps: (1) The client sends the service request message to the security audit device; (2) The security auditing device forwards the service request message to the server corresponding to the service request message, and mirror copies the service request message to obtain a corresponding image file; (3) The security audit device parses the image file to obtain the corresponding business operation instruction; (4) The server responds to the service request message, and sends the corresponding service operation log to the security audit device; (5) The security audit device compares and analyzes the business operation instruction and the business operation log. 8. The method for realizing security audit according to claim 7, characterized in that, said security audit device includes a packet capture module and a protocol analysis module, and said security audit device parses said image file to obtain a corresponding business operation instructions, including the following steps: (3.1) the packet capture module described in the message encrypts the image file and obtains the corresponding encrypted file; (3.2) The protocol analysis module analyzes the encrypted file to obtain the business operation instruction. 9. the method for realizing safety audit according to claim 7, is characterized in that, described safety audit equipment establishes connection with described several servers by the switching module with STP agreement, before described step (1) , also includes the following steps: (0) The switching module runs the STP protocol to discover the loop network structure in the network established by the security audit device and the several servers, and prunes the loop network structure to be loop-free Tree network structure. 10. The method for realizing security audit according to claim 7, characterized in that, between described steps (1) and (2), further comprising the following steps: (1.1) said switching module judges whether the communication lines between said security audit equipment and said several servers are normal by STP protocol, if yes, then continue step (2), otherwise continue step (1.2); (1.2) The switch module switches the communication lines between the security audit device and the several servers. 11. the method for realizing safety audit according to claim 7, is characterized in that, between each safety audit equipment, connect by local area network, after described step (5), also comprise the following steps: (6) each safety audit equipment described judges whether to reach timing synchronous time, if yes, then continue step (7), otherwise continue to wait; (7) Data synchronization is performed among the security audit devices described above.