CN101018119A - Hardware-based server network security centralized management system without relevance to the operation system - Google Patents

Abstract

Translated fromChinese

本发明提供一种基于硬件的与操作系统无关的服务器网络安全集中管理系统，该系统是以集成有安全功能芯片的硬件网络设备为核心，通过安全集中管理平台统一制订安全策略并分发给硬件网络设备，集中收集各硬件网络设备的安全事件和信息。其特点包括：硬件网络设备中安全功能芯片只执行安全集中管理平台所分发的安全策略，它独立于服务器及其操作系统，且不占用服务器的CPU资源，不会降低服务器的性能。它增强了服务器的安全性，可靠性和高可用性，显著提高了服务器安全监控管理的效率，有效解决了安全和效率之间的矛盾。

The present invention provides a hardware-based server network security centralized management system that has nothing to do with the operating system. The system takes hardware network equipment integrated with security function chips as the core, and uniformly formulates security policies through a security centralized management platform and distributes them to the hardware network. Devices, which collect security events and information of each hardware network device in a centralized manner. Its characteristics include: the security function chip in the hardware network device only executes the security policy distributed by the security centralized management platform, it is independent of the server and its operating system, and does not occupy the CPU resources of the server, and will not reduce the performance of the server. It enhances the security, reliability and high availability of the server, significantly improves the efficiency of server security monitoring and management, and effectively resolves the contradiction between security and efficiency.

Description

Translated fromChinese

基于硬件的与操作系统无关的服务器网络安全集中管理系统Hardware-based server network security centralized management system independent of operating system

技术领域technical field

本发明涉及一种基于硬件的与操作系统无关的服务器网络安全集中管理系统，特别是以集成有安全功能芯片的硬件网络设备为核心，属于计算机信息安全领域。The invention relates to a server network security centralized management system which is based on hardware and has nothing to do with the operating system, especially takes the hardware network equipment integrated with the security function chip as the core, and belongs to the field of computer information security.

背景技术Background technique

随着国内信息化进程的迅猛发展，电子商务，电子政务等信息服务在政府，企业，商业等领域的广泛应用，网络已经成为政府办公，商业贸易的重要工具之一。而构成网络重要基础设施的服务器越来越发挥着举足轻重的作用，不仅承载着企业的宝贵数据资源，也提供着资源和数据的共享服务。正是由于服务器在网络环境及网络基础设施中的显著作用，它面临着三方面的恶意网络行为，即肆意的攻击行为，如拒绝服务攻击，网络病毒等等，这些行为旨在消耗服务器资源，影响服务器的正常运行，甚至导致服务器所在网络的瘫痪；恶意的入侵行为，这种行为更是会导致服务器敏感信息的泄漏，入侵者更是可以为所欲为，肆意破坏服务器；服务器软件本身所具有的安全漏洞，它是由于软件设计和开发不完善而造成的，从而使得各种软件具有了先天的缺陷和隐患，给恶意攻击者开启了攻击的方便之门。这些攻击和破坏给政府，企业造成了不可估量的经济损失。如何保障服务器的安全可靠运行，国家机密数据和信息不被非法窃取或篡改已是关及国家安全的重大问题。With the rapid development of domestic informatization, e-commerce, e-government and other information services are widely used in government, enterprise, business and other fields, the network has become one of the important tools for government office and business trade. The servers that constitute the important infrastructure of the network are playing an increasingly important role, not only carrying the valuable data resources of enterprises, but also providing resource and data sharing services. It is precisely because of the significant role of the server in the network environment and network infrastructure that it faces three malicious network behaviors, that is, wanton attacks, such as denial of service attacks, network viruses, etc., these behaviors are aimed at consuming server resources, Affect the normal operation of the server, and even lead to the paralysis of the network where the server is located; malicious intrusion behavior, this kind of behavior will lead to the leakage of sensitive information of the server, and the intruder can do whatever they want and destroy the server at will; the security of the server software itself Vulnerabilities, which are caused by imperfect software design and development, make various software have inherent defects and hidden dangers, and open the door for malicious attackers to attack. These attacks and damages have caused immeasurable economic losses to the government and enterprises. How to ensure the safe and reliable operation of servers, and how to prevent state secret data and information from being illegally stolen or tampered with is a major issue related to national security.

另一方面，目前服务器的管理方式主要体现在以下三个方面：即基于硬件的管理工具、网络操作系统的附加管理功能以及第三方的系统管理软件。其中，基于硬件的管理工具往往由服务器生产厂商所提供，它主要是通过服务器主板上集成的远程管理芯片实现对服务器的CPU、硬盘、内存、风扇等底层部件的监控和管理；网络操作系统所附带的管理功能如Windows Server 2003中的服务器管理向导，就是为很多服务器网络管理人员所熟知的功能。这两种管理方式局限性较大，不支持异构跨平台的管理。除此之外，还有一些第三方管理软件厂商的产品，这些专业产品具有强大的跨平台管理能力，可以完成对操作系统、应用软件、硬件平台等多种系统资源的维护和监控，并具备一些智能化管理的特性。On the other hand, the current server management methods are mainly reflected in the following three aspects: hardware-based management tools, additional management functions of the network operating system, and third-party system management software. Among them, hardware-based management tools are often provided by server manufacturers, which mainly realize the monitoring and management of underlying components such as the CPU, hard disk, memory, and fan of the server through the remote management chip integrated on the server motherboard; The accompanying management functions, such as the server management wizard in Windows Server 2003, are functions well known to many server network administrators. These two management methods have relatively large limitations and do not support heterogeneous cross-platform management. In addition, there are some products of third-party management software manufacturers. These professional products have strong cross-platform management capabilities, and can complete the maintenance and monitoring of various system resources such as operating systems, application software, and hardware platforms. Some features of intelligent management.

但是在实际的应用中，随着网络系统越来越复杂，网络技术的不断应用对服务器的可靠性、安全性管理上的要求越来越高，企业需要服务器的管理软件来简化服务器系统管理。此外，由于服务器数量的增加，地域的扩展，企业部署并使用了多个服务器管理平台对多家服务器进行管理，而这些管理平台之间的互操作性、整体拥有成本、管理人员的知识都会带来管理上的挑战。However, in practical applications, as the network system becomes more and more complex, the continuous application of network technology has higher and higher requirements for server reliability and security management. Enterprises need server management software to simplify server system management. In addition, due to the increase in the number of servers and the expansion of regions, enterprises have deployed and used multiple server management platforms to manage multiple servers, and the interoperability between these management platforms, the total cost of ownership, and the knowledge of managers will bring to manage the challenges.

因此，必须采用先进技术及管理方式解决服务器网络安全集中管理和监控的问题，以通过单一的控制台实现对系统资源全方位的监控、管理和控制，同时在不影响服务器正常运转和降低其性能的情况下，满足用户对安全、详细日志以及报警等功能的多方面需求。Therefore, it is necessary to adopt advanced technology and management methods to solve the problem of centralized management and monitoring of server network security, so as to realize all-round monitoring, management and control of system resources through a single console, without affecting the normal operation of the server and reducing its performance. In the case of the system, it meets the various needs of users for functions such as security, detailed logs, and alarms.

发明内容Contents of the invention

本发明的目的在于提供一种基于硬件的与操作系统无关的服务器网络安全集中管理系统。为实现上述目的，本发明的技术解决方案是：The purpose of the present invention is to provide a server network security centralized management system which is based on hardware and has nothing to do with the operating system. For realizing the above object, technical solution of the present invention is:

将集成有安全功能芯片的硬件网络设备部署在被监管服务器中并与安全集中管理平台相连，由安全集中管理平台统一制订安全策略并分发给硬件网络设备，同时收集各硬件网络设备所生成的安全事件和信息，实时监控服务器网络的健康程度及安全状态，具体步骤如下：Deploy hardware network devices integrated with security function chips in supervised servers and connect them to the centralized security management platform. The centralized security management platform formulates security policies and distributes them to hardware network devices, and collects security data generated by each hardware network device at the same time. Events and information, real-time monitoring of the health and security status of the server network, the specific steps are as follows:

1)在管理平台下设置监管服务器S_A、S_B和S_C，通过监管服务器对外分别提供Web和邮件代理服务以及入侵检测功能，通过Web和邮件代理可以访问外部网站和邮件服务器；1) Set up supervision servers S_A , S_B and S_C under the management platform, and provide Web and mail proxy services and intrusion detection functions through the supervision servers, and can access external websites and mail servers through Web and mail proxy;

2)部署安装：将集成安全功能芯片的硬件网络设备NIC_A、NIC_B和NIC_C分别安装部署到被监管服务器S_A、S_B和S_C中，并加载其驱动程序，配置相应的网络参数。通过网络线、交换机将被监管服务器S_A、S_B和S_C与安全集中管理平台M所在机器相连；2) Deployment and installation: install and deploy the hardware network devices NIC_A , NIC_B and NIC_C with integrated security function chips to the supervised servers S_A , S_B and S_C respectively, load their drivers, and configure corresponding network parameters . Connect the supervised servers S_A , S_B and S_C to the machine where the security centralized management platform M is located through network cables and switches;

3)配置安全集中管理平台M使之能监管服务器S_A、S_B和S_C；3) configure the security centralized management platform M so that it can supervise the servers_SA , S_B and S_C ;

4)策略编制：系统管理人员通过安全集中管理平台M制订Web、邮件、入侵检测安全策略。Web安全策略以黑白名单，关键字，扩展名或应用型的形式对Web访问进行过滤，阻断对不良站点或内容的访问；邮件安全策略根据发件人、收件人、抄送、邮件主题和附件类型对邮件进行过滤；入侵检测安全策略用以实时侦测服务器网络环境中所发生的入侵攻击行为并生成报警信息；4) Policy formulation: System managers formulate security policies for Web, mail, and intrusion detection through the security centralized management platform M. Web security policies filter web access in the form of black and white lists, keywords, extensions, or applications to block access to bad sites or content; email security policies are based on sender, recipient, CC, and email subject and attachment types to filter emails; the intrusion detection security policy is used to detect intrusion attacks in the server network environment in real time and generate alarm information;

5)策略分发：分别将安全集中管理平台M所制订的Web、邮件和入侵检测安全策略分发给被监管服务器S_A、S_B和S_C的硬件网络设备NIC_A、NIC_B和NIC_C中并使这些安全策略生效；5) Policy distribution: distribute the Web, mail and intrusion detection security policies formulated by the security centralized management_platform M to the hardware network devices NIC_A , NIC_B and NIC_C of the supervised servers SA, S_B and S_C respectively and enforce these security policies;

6)硬件网络设备以独立于服务器及其操作系统的方式工作，不受服务器及其操作系统的影响，它只接收安全集中管理平台M所分发的各种安全策略并根据安全策略的动作在满足安全策略的条件下，采取相应的策略动作。网络报文的实时采集分析以及网络访问和网络流量的监控都是在硬件网络设备所集成的安全功能芯片中进行，不占用任何被监管服务器的CPU资源，更不会影响甚至降低服务器的性能；同时，安全集中管理平台M对硬件网络设备的单一控制，从一定程度上杜绝安全风险的发生，保障硬件网络设备的安全性和可靠性；6) The hardware network device works independently of the server and its operating system, and is not affected by the server and its operating system. It only receives various security policies distributed by the security centralized management platform M and acts according to the security policies to satisfy Under the condition of the security policy, take the corresponding policy action. The real-time collection and analysis of network messages and the monitoring of network access and network traffic are all carried out in the security function chip integrated in the hardware network device, which does not occupy any CPU resources of the supervised server, and will not affect or even reduce the performance of the server; At the same time, the single control of the hardware network equipment by the security centralized management platform M can prevent the occurrence of security risks to a certain extent and ensure the security and reliability of the hardware network equipment;

7)被监管服务器S_A、S_B和S_C中的硬件网络设备NIC_A、NIC_B、和NIC_C实时监控通过硬件网络设备进入被监管服务器的网络报文和网络访问，对于满足安全策略的任何Web访问，入侵攻击行为或者邮件发送或接收，都会触发相应的安全策略，根据安全策略所规定的动作采取对应的处理，即阻断或通过，并记录日志；7) The hardware network devices NIC_A , NIC_B , and NIC_C in the supervised servers SA, S_B and S_C monitor in real time the network packets and network accesses_entering the supervised server through the hardware network devices. Any web access, intrusion attack behavior, or email sending or receiving will trigger the corresponding security policy, and take corresponding processing according to the action specified in the security policy, that is, block or pass, and record the log;

8)安全集中管理平台M实时监控Web、邮件和入侵检测安全策略所产生的安全事件日志。根据安全事件的级别及数量，系统管理人员可以通过安全集中管理平台M适当调整硬件网络设备NIC_A、NIC_B和NIC_C所加载的Web，入侵检测和邮件安全策略的内容，使这些安全策略更能准确地检测网络报文和网络访问，进而能提高服务器网络环境的整体安全性；8) The security centralized management platform M monitors in real time the security event logs generated by the security policies of Web, email and intrusion detection. According to the level and quantity of security events, system administrators can properly adjust the content of Web, intrusion detection and email security policies loaded by the hardware network devices NIC_A , NIC_B and NIC_C through the security centralized management platform M to make these security policies more secure. It can accurately detect network packets and network access, thereby improving the overall security of the server network environment;

本发明的基于硬件的与操作系统无关的服务器网络安全集中管理系统，它包括安全集中管理平台，被监管服务器和集成有安全功能芯片的以标准全长全高千兆线速网卡形式体现的硬件网络设备。The hardware-based, operating system-independent server network security centralized management system of the present invention includes a security centralized management platform, a supervised server and a hardware network embodied in the form of a standard full-length full-height gigabit wire-speed network card integrated with a security function chip equipment.

本发明的优点和积极效果是，硬件网络设备所集成的安全功能芯片，根据安全集中管理平台制订并分发的安全策略，实时监控进入服务器的网络报文及网络资源访问，避免了服务器遭受外部黑客、病毒的攻击。本发明将集成有安全功能芯片的硬件网络设备安装部署到局域网的所有被监管服务器中，而硬件网络设备以独立于服务器及其操作系统的方式运行，支持跨平台，不受服务器操作系统的控制，只接收安全集中管理平台所制订分发的安全策略。本发明在不影响服务器和降低服务器性能的条件下，从物理上保障了服务器安全可靠的运行，增强了服务器的高可用性和稳定性，突破了传统服务器单一的管理模式及其局限，有效解决了安全和管理效率之间的矛盾，在低成本、易安装、性能、稳定性、功能等方面都有很大的提高。The advantages and positive effects of the present invention are that the security function chip integrated in the hardware network device can monitor the network message and network resource access entering the server in real time according to the security policy formulated and distributed by the security centralized management platform, and avoid the server from being subjected to external hackers , Virus attack. The present invention installs and deploys the hardware network device integrated with the security function chip to all supervised servers in the local area network, and the hardware network device operates independently of the server and its operating system, supports cross-platform, and is not controlled by the server operating system , only receive the security policies formulated and distributed by the security centralized management platform. Under the condition of not affecting the server and reducing the performance of the server, the present invention physically guarantees the safe and reliable operation of the server, enhances the high availability and stability of the server, breaks through the single management mode and limitations of the traditional server, and effectively solves the problem of The contradiction between safety and management efficiency has been greatly improved in terms of low cost, easy installation, performance, stability, and functions.

附图说明Description of drawings

图1是本发明的安全管理系统结构示意图。Fig. 1 is a schematic structural diagram of the safety management system of the present invention.

具体实施方式Detailed ways

下面结合附图和具体实施例对本发明作进一步的说明。The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

如图1所示，本发明提供一种基于硬件的与操作系统无关的服务器网络安全集中管理系统，它包括安全集中管理平台M，被监管服务器S_A、S_B和S_C以及集成有安全功能芯片的硬件网络设备NIC_A、NIC_B和NIC_C。As_shown in Fig_. 1, the present invention provides a kind_of hardware-based server network security centralized management system that has nothing to do with the operating system. The chip's hardware network devices NIC_A , NIC_B and NIC_C .

本发明的工作原理是：The working principle of the present invention is:

1.被监管服务器S_A、S_B和S_C对外分别提供Web和邮件代理服务和入侵检测功能，通过Web和邮件代理可以访问外部网站和邮件服务器。1. The supervised servers S_A , S_B and S_C respectively provide web and mail proxy services and intrusion detection functions, and can access external websites and mail servers through the web and mail proxy.

2.部署安装：将集成安全功能芯片的硬件网络设备NIC_A、NIC_B和NIC_C分别安装部署到被监管服务器S_A、S_B和S_C中，并加载其驱动程序，配置相应的网络参数。通过网络线、交换机将被监管服务器S_A、S_B和S_C与安全集中管理平台M所在机器相连。2. Deployment and installation: Install and deploy the hardware network devices NIC_A , NIC_B , and NIC_C with integrated security function chips to the supervised servers S_A , S_B , and S_C respectively, load their drivers, and configure corresponding network parameters . The supervised servers S_A , S_B and S_C are connected to the machine where the security centralized management platform M is located through network cables and switches.

3.配置安全集中管理平台M使之能监管服务器S_A、S_B和S_C。3. Configure the security centralized management platform M so that it can supervise the servers S_A , S_B and S_C .

4.策略编制：系统管理人员通过安全集中管理平台M制订Web、邮件和入侵检测安全策略。Web安全策略以黑白名单，关键字，扩展名或应用型的形式对Web访问进行过滤，阻断对不良站点或内容的访问；邮件安全策略根据发件人、收件人、抄送、邮件主题和附件类型对邮件进行过滤；入侵检测安全策略用以实时侦测服务器网络环境中所发生的入侵攻击行为并生成报警信息。4. Policy formulation: System managers formulate security policies for Web, mail and intrusion detection through the centralized security management platform M. Web security policies filter web access in the form of black and white lists, keywords, extensions, or applications to block access to bad sites or content; email security policies are based on sender, recipient, CC, and email subject Emails are filtered according to the attachment type; the intrusion detection security policy is used to detect the intrusion attacks in the server network environment in real time and generate alarm information.

5.策略分发：分别将安全集中管理平台M所制订的Web、邮件和入侵检测安全策略分发给被监管服务器S_A、S_B和S_C的硬件网络设备NIC_A、NIC_B和NIC_C中并使这些安全策略生效。5. Policy distribution: distribute the Web, mail and intrusion detection security policies formulated by the security centralized management platform M to the hardware network devices NIC_A , NIC_B and NIC_C of the supervised servers SA, S_B and S_C respectively_and Make these security policies effective.

6.硬件网络设备以独立于服务器及其操作系统的方式工作，不受服务器及其操作系统的影响。它只接收安全集中管理平台M所分发的各种安全策略并根据安全策略的动作在满足安全策略的条件下，采取相应的策略动作。网络报文的实时采集分析以及网络访问和网络流量的监控都是在硬件网络设备所集成的安全功能芯片中进行，不占用任何被监管服务器的CPU资源，更不会影响甚至降低服务器的性能。同时，安全集中管理平台M对硬件网络设备的单一控制，从一定程度上杜绝了安全风险的发生，保障了硬件网络设备的安全性和可靠性。6. The hardware network device works independently of the server and its operating system, and is not affected by the server and its operating system. It only receives various security policies distributed by the security centralized management platform M, and takes corresponding policy actions according to the security policy actions under the condition of satisfying the security policies. The real-time collection and analysis of network packets and the monitoring of network access and network traffic are all carried out in the security function chip integrated in the hardware network device, which does not occupy any CPU resources of the supervised server, and will not affect or even reduce the performance of the server. At the same time, the single control of the hardware network equipment by the security centralized management platform M prevents the occurrence of security risks to a certain extent and ensures the security and reliability of the hardware network equipment.

被监管服务器S_A、S_B和S_C中的硬件网络设备NIC_A、NIC_B、和NIC_C实时监控通过硬件网络设备进入被监管服务器的网络报文和网络访问。对于满足安全策略的任何Web访问，入侵攻击行为或者邮件发送或接收，都会触发相应的安全策略，根据安全策略所规定的动作采取对应的处理，即阻断或通过，并记录日志。The hardware network devices NIC_A , NIC_B , and NIC_C in the supervised servers_SA , S_B , and_SC monitor in real time the network packets and network accesses entering the supervised servers through the hardware network devices. For any web access, intrusion attack behavior, or email sending or receiving that meets the security policy, the corresponding security policy will be triggered, and corresponding processing will be taken according to the action specified in the security policy, that is, blocking or passing, and the log will be recorded.

7.安全集中管理平台M实时监控Web、邮件和入侵检测安全策略所产生的安全事件日志。根据安全事件的级别及数量，系统管理人员可以通过安全集中管理平台M适当调整硬件网络设备NIC_A、NIC_B和NIC_C所加载的Web，入侵检测和邮件安全策略的内容，使这些安全策略更能准确地检测网络报文和网络访问，进而能提高服务器网络环境的整体安全性。7. The security centralized management platform M monitors the security event logs generated by the security policy of Web, email and intrusion detection in real time. According to the level and quantity of security events, system administrators can properly adjust the content of Web, intrusion detection and email security policies loaded by the hardware network devices NIC_A , NIC_B and NIC_C through the security centralized management platform M to make these security policies more secure. It can accurately detect network packets and network access, thereby improving the overall security of the server network environment.

Claims (2)

Translated fromChinese

1、一种基于硬件的与操作系统无关的服务器网络安全集中管理系统，其特征在于将集成有安全功能芯片的硬件网络设备与安全集中管理平台相连，由安全集中管理平台统一制订安全策略并分发给硬件网络设备，同时收集各硬件网络设备所生成的安全事件和信息，实时监控服务器网络的健康程度及安全状态，具体步骤如下：1. A hardware-based, operating system-independent server network security centralized management system, which is characterized in that the hardware network device integrated with a security function chip is connected to the security centralized management platform, and the security centralized management platform uniformly formulates and distributes security policies. For hardware network devices, collect security events and information generated by each hardware network device at the same time, and monitor the health and security status of the server network in real time. The specific steps are as follows:1)在管理平台下设置监管服务器S_A、S_B和S_C，通过监管服务器对外分别提供Web和邮件代理服务以及入侵检测功能，通过Web和邮件代理可以访问外部网站和邮件服务器；1) Set up supervision servers S_A , S_B and S_C under the management platform, and provide Web and mail proxy services and intrusion detection functions through the supervision servers, and can access external websites and mail servers through Web and mail proxy;2)部署安装：将集成安全功能芯片的硬件网络设备NIC_A、NIC_B和NIC_C分别安装部署到监管服务器S_A、S_B和S_C中，并加载其驱动程序，配置相应的网络参数。通过网络线、交换机将被监管服务器S_A、S_B和S_C与安全集中管理平台M所在机器相连；2) Deployment and installation: install and deploy the hardware network devices NIC_A , NIC_B and NIC_C integrating security function chips to the supervisory servers S_A , S_B and S_C respectively, load their drivers, and configure corresponding network parameters. Connect the supervised servers S_A , S_B and S_C to the machine where the security centralized management platform M is located through network cables and switches;3)配置安全集中管理平台M使之能监管服务器S_A、S_B和S_C；3) configure the security centralized management platform M so that it can supervise the servers_SA , S_B and S_C ;4)策略编制：系统管理人员通过安全集中管理平台M制订Web、邮件、入侵检测安全策略。Web安全策略以黑白名单，关键字，扩展名或应用型的形式对Web访问进行过滤，阻断对不良站点或内容的访问；邮件安全策略根据发件人、收件人、抄送、邮件主题和附件类型对邮件进行过滤；入侵检测安全策略用以实时侦测服务器网络环境中所发生的入侵攻击行为并生成报警信息；4) Policy formulation: System managers formulate security policies for Web, mail, and intrusion detection through the security centralized management platform M. Web security policies filter web access in the form of black and white lists, keywords, extensions, or applications to block access to bad sites or content; email security policies are based on sender, recipient, CC, and email subject and attachment types to filter emails; the intrusion detection security policy is used to detect intrusion attacks in the server network environment in real time and generate alarm information;5)策略分发：分别将安全集中管理平台M所制订的Web、邮件和入侵检测安全策略分发给被监管服务器S_A、S_B和S_C的硬件网络设备NIC_A、NIC_B和NIC_C中并使这些安全策略生效；5) Policy distribution: distribute the Web, mail and intrusion detection security policies formulated by the security centralized management_platform M to the hardware network devices NIC_A , NIC_B and NIC_C of the supervised servers SA, S_B and S_C respectively and enforce these security policies;6)硬件网络设备以独立于服务器及其操作系统的方式工作，不受服务器及其操作系统的影响，它只接收安全集中管理平台M所分发的各种安全策略并根据安全策略的动作在满足安全策略的条件下，采取相应的策略动作。网络报文的实时采集分析以及网络访问和网络流量的监控都是在硬件网络设备所集成的安全功能芯片中进行，不占用任何被监管服务器的CPU资源，更不会影响甚至降低服务器的性能；同时，安全集中管理平台M对硬件网络设备的单一控制，从一定程度上杜绝安全风险的发生，保障硬件网络设备的安全性和可靠性；6) The hardware network device works independently of the server and its operating system, and is not affected by the server and its operating system. It only receives various security policies distributed by the security centralized management platform M and acts according to the security policies to satisfy Under the condition of the security policy, take the corresponding policy action. The real-time collection and analysis of network messages and the monitoring of network access and network traffic are all carried out in the security function chip integrated in the hardware network device, which does not occupy any CPU resources of the supervised server, and will not affect or even reduce the performance of the server; At the same time, the single control of the hardware network equipment by the security centralized management platform M can prevent the occurrence of security risks to a certain extent and ensure the security and reliability of the hardware network equipment;7)被监管服务器S_A、S_B和S_C中的硬件网络设备NIC_A、NIC_B、和NIC_C实时监控通过硬件网络设备进入被监管服务器的网络报文和网络访问，对于满足安全策略的任何Web访问，入侵攻击行为或者邮件发送或接收，都会触发相应的安全策略，根据安全策略所规定的动作采取对应的处理，即阻断或通过，并记录日志；7) The hardware network devices NIC_A , NIC_B , and NIC_C in the supervised servers SA, S_B and S_C monitor in real time the network packets and network accesses_entering the supervised server through the hardware network devices. Any web access, intrusion attack behavior, or email sending or receiving will trigger the corresponding security policy, and take corresponding processing according to the action specified in the security policy, that is, block or pass, and record the log;8)安全集中管理平台M实时监控Web、邮件和入侵检测安全策略所产生的安全事件日志。根据安全事件的级别及数量，系统管理人员可以通过安全集中管理平台M适当调整硬件网络设备NIC_A、NIC_B和NIC_C所加载的Web，入侵检测和邮件安全策略的内容，使这些安全策略更能准确地检测网络报文和网络访问，进而能提高服务器网络环境的整体安全性；8) The security centralized management platform M monitors in real time the security event logs generated by the security policies of Web, email and intrusion detection. According to the level and quantity of security events, system administrators can properly adjust the content of Web, intrusion detection and email security policies loaded by the hardware network devices NIC_A , NIC_B and NIC_C through the security centralized management platform M to make these security policies more secure. It can accurately detect network packets and network access, thereby improving the overall security of the server network environment;2、根据权利要求1所述的管理系统，其特征在于：此系统包括安全集中管理平台，被监管服务器和集成有安全功能芯片的以标准全长全高千兆线速网卡形式体现的硬件网络设备。2. The management system according to claim 1, characterized in that the system includes a secure centralized management platform, a supervised server and a hardware network device integrated with a security function chip in the form of a standard full-length full-height gigabit wire-speed network card .

Images