Content of the invention
According to the present invention provide scheme solve technical problem be identical function fundamental functional modules between system phase
There are a lot of identical redundancy of effort when mutually transplanting.
A kind of construction method of the information safety system platform being provided according to the present invention, including:
It is used for management and controlling tacticses and controlled using C/S (Client/Server, client-server) server construction
The master hosts of main frame;
C/S client computer is utilized to build for executing control strategy and reporting the compromised slave of log information;
It is used for forwarding control strategy and daily record using B/S (Browser/Server, browser/server) server construction
The managing main frame of information;
B/S browser is utilized to build the operation main frame for configuring control strategy and show log information;
Via LAN, database server and described master hosts, compromised slave, managing main frame, operation main frame are connected
It is connected into an information safety system platform, so that described operation main frame passes through this information safety system platform to described compromised slave
Carry out security control.
Preferably, described operation main frame carries out security control by this information safety system platform to described compromised slave
Including:
Described operation main frame is sent to described number via LAN and managing main frame specified compromised slave control strategy
According to storehouse server;
The control strategy reading from described database server is sent to corresponding compromised slave by described master hosts;
Each compromised slave is carried out according to the control strategy receiving from described master hosts, the operation to each business object
Security control.
Preferably, described operation main frame sends specified compromised slave control strategy via LAN and managing main frame
Include to described database server:
Described operation main frame passes through to monitor the operative configuration to each compromised slave for the user, generates bag for each compromised slave
Control strategy containing compromised slave ID;
Specified compromised slave control strategy is sent to described number via LAN and managing main frame by described operation main frame
According to storehouse server.
Preferably, the control strategy reading from described database server is sent to and is subject to accordingly by described master hosts
Control main frame includes:
Described master hosts periodically read all of control strategy from described database server;
Described master hosts, according to the compromised slave ID comprising in control strategy, all of control strategy are sent respectively to
Corresponding compromised slave.
Preferably, also include:
The log information of each compromised slave is shown by described operation main frame by this information safety system platform.
Preferably, the log information of each compromised slave is entered by described operation main frame by this information safety system platform
Row is shown and is included:
Each compromised slave is sent to described database server via LAN and master hosts log information;
The log information reading from described database server is sent to operation main frame by described managing main frame, with convenient to operate
Described log information shown by main frame.
Preferably, each described compromised slave is sent to described data via LAN and master hosts log information
Storehouse server includes:
Each compromised slave during executing received control strategy, by real-time monitoring user to each business object
Operation, generates the log information comprising compromised slave ID;
The log information being generated is sent to described database clothes via LAN and master hosts by each compromised slave
Business device.
Preferably, the log information reading from described database server is sent to operation master by described managing main frame
With convenient to operate main frame, machine, shows that described log information includes:
Described managing main frame receives the compromised slave ID needing displaying log information that operation main frame sends;
Described managing main frame reads the day of corresponding compromised slave according to described compromised slave ID from described database server
Will information;
The log information being read is sent to described operation main frame by described managing main frame, is shown described with convenient to operate main frame
The log information of compromised slave.
A kind of information safety system platform being provided according to the present invention, including:
Utilize C/S server construction for the master hosts of management and controlling tacticses and compromised slave;
C/S client computer is utilized to build for executing control strategy and reporting the compromised slave of log information;
Utilize B/S server construction for forwarding the managing main frame of control strategy and log information;
B/S browser is utilized to build the operation main frame for configuring control strategy and show log information;
Wherein, described information Secure System Platform be via LAN by database server and described master hosts,
Compromised slave, managing main frame, operation main frame connect and compose, and carry out safe control for described operation main frame to described compromised slave
System.
Preferably, it is additionally operable to described operation main frame to be shown the log information of each compromised slave.
The scheme providing according to embodiments of the present invention, can easily be managed using constructed information safety system platform
Multiple compromised slave and between control system, improve Consumer's Experience.
Specific embodiment
Below in conjunction with accompanying drawing to a preferred embodiment of the present invention will be described in detail it will be appreciated that described below is excellent
Select embodiment to be merely to illustrate and explain the present invention, be not intended to limit the present invention.
Fig. 1 is a kind of flow chart of the construction method of information safety system platform provided in an embodiment of the present invention, including:
Step S101:Utilize C/S server construction for the master hosts of management and controlling tacticses and compromised slave;
Step S102:C/S client computer is utilized to build for executing control strategy and reporting the compromised slave of log information;
Step S103:Utilize B/S server construction for forwarding the managing main frame of control strategy and log information;
Step S104:B/S browser is utilized to build the operation main frame for configuring control strategy and show log information;
Step S105:Via LAN by database server and described master hosts, compromised slave, managing main frame,
Operation main frame connects into an information safety system platform, so that described operation main frame passes through this information safety system platform to institute
State compromised slave and carry out security control.
Wherein, described operation main frame carries out security control bag by this information safety system platform to described compromised slave
Include:Described operation main frame is sent to described database clothes via LAN and managing main frame specified compromised slave control strategy
Business device;The control strategy reading from described database server is sent to corresponding compromised slave by described master hosts;Each
Compromised slave carries out security control according to the control strategy receiving from described master hosts, the operation to each business object.
Wherein, described operation main frame is sent to specified compromised slave control strategy via LAN and managing main frame
Described database server includes:Described operation main frame passes through to monitor the operative configuration to each compromised slave for the user, for each
Compromised slave generates the control strategy comprising compromised slave ID;Described operation main frame will be specified via LAN and managing main frame
Compromised slave control strategy is sent to described database server.
Wherein, described master hosts the control strategy reading from described database server is sent to controlled accordingly
Main frame includes:Described master hosts periodically read all of control strategy from described database server;Described master control master
Machine, according to the compromised slave ID comprising in control strategy, all of control strategy is sent respectively to corresponding compromised slave.
The embodiment of the present invention also includes:Described operation main frame passes through this information safety system platform by each compromised slave
Log information is shown.
Wherein, the log information of each compromised slave is carried out by described operation main frame by this information safety system platform
Show and include:Each compromised slave is sent to described database server via LAN and master hosts log information;Institute
State managing main frame and the log information reading from described database server is sent to operation main frame, institute is shown with convenient to operate main frame
State log information.
Wherein, each described compromised slave is sent to described database via LAN and master hosts log information
Server includes:Each compromised slave during executing received control strategy, by real-time monitoring user to each business pair
The operation of elephant, generates the log information comprising compromised slave ID;Each compromised slave will be given birth to via LAN and master hosts
The log information becoming is sent to described database server.
Wherein, the log information reading from described database server is sent to operation main frame by described managing main frame,
Show that described log information includes with convenient to operate main frame:The displaying daily record that needs that described managing main frame receives operation main frame transmission is believed
The compromised slave ID of breath;Described managing main frame reads accordingly controlled master according to described compromised slave ID from described database server
The log information of machine;The log information being read is sent to described operation main frame by described managing main frame, with convenient to operate main frame exhibition
Show the log information of described compromised slave.
A kind of information safety system platform of the embodiment of the present invention also offer, including:C/S server construction is utilized to be used for managing
Reason control strategy and the master hosts of compromised slave;C/S client computer is utilized to build for executing control strategy and reporting daily record to believe
The compromised slave of breath;Utilize B/S server construction for forwarding the managing main frame of control strategy and log information;Clear using B/S
Device of looking at builds the operation main frame for configuring control strategy and show log information;Wherein, described information Secure System Platform is
Via LAN, database server and described master hosts, compromised slave, managing main frame, operation main frame are connected and composed
, for described operation main frame, security control is carried out to described compromised slave.
Wherein, described information Secure System Platform be additionally operable to described operation main frame the log information of each compromised slave is entered
Row is shown.
Fig. 2 is a kind of deployment schematic diagram of information safety system platform provided in an embodiment of the present invention, as shown in Fig. 2 institute
State information safety system platform to be become by C/S, B/S and database server group.C/S is by C/S server and C/S group of clients
Become, both are separately mounted in master hosts and compromised slave corresponding program;B/S is by B/S browser and B/S server end group
Become, the former is deployed on operation main frame, and the latter is deployed in managing main frame, and via LAN by database server and institute
State master hosts, compromised slave, managing main frame, operate main frame to couple together.
Wherein, described C/S client computer:Refer mainly to monitored main frame, this main frame accepts the management strategy of management server, and
This content host, behavior etc. are monitored and report daily record to arrive management server, and can strategically require to specific industry
Business warning information carries out playing the operation such as frame, auditory tone cues, Email.Described C/S server:For managing user, management strategy,
Focus on all business host informations.Described database server:For data storage, mainly storage user profile, daily record
Information, strategy etc..Described B/S server:User accepts WEB storage.Described B/S browser:The i.e. calculating of the browser of B/S
Machine, as long as be provided with browser on this computer, you can accessed by network address.Using web browser, management server is carried out
Access, realize human-computer interaction interface, major function is tactful configuration, log analysis, administrator role configure, system is arranged, portion
Door management etc..
Specifically, related log information is sent to C/S server by C/S client computer, and C/S server is by log information
Write into Databasce server, and B/S server reads and writes this log information from database server, and be pushed to B/S browser and enter
Row is shown.The configuration of some strategies can be carried out in B/S browser, the strategy having configured is via B/S server storage to data
In the server of storehouse, C/S server reads strategy from database server, is issued to corresponding C/S client computer, thus realizing to visitor
The control function of family machine.
For example utilize information safety system platform in the host monitor and auditing system of exploitation, complete to C/S client
The monitoring of file operation behavior of machine and audit:When in C/S client computer, user carries out replicating what operation was prohibited from, newly-built operation is
Record, deletion action is intended to warning information.Now, keeper needs (to formulate plan in B/S browser end configuration strategy
Slightly:Replication actions are for forbidding, newly-built action is daily record, deletion action is alarm, and specifies the C/S client computer of this instruction sensing),
The strategy specified in B/S browser end is submitted to B/S server, and this strategy is written to database server by B/S server, then
C/S server is had to read strategy from database server, and by policy distribution to corresponding in C/S client computer, so that corresponding
C/S client computer executes this strategy.When C/S client computer first-class user execution replicates operation, the failure of this action executing;Execution is new
Build and can be normally carried out during operation, during execution deletion action, alarm can be ejected;Duplication used, newly-built, deletion action information are equal
Finally can show in B/S browser end through C/S server, database server, B/S server.
Fig. 3 is the configuration diagram of C/S client computer provided in an embodiment of the present invention, as shown in figure 3, including:Internet:Main
Network connection to be responsible for, network data is received and dispatched;Protocol layer:Mainly it is responsible for procotol framing, solution frame;General service logical layer:
Mainly it is responsible for management, renewal, inspection and the communication and process tray between of strategy;Business module management level:Mainly it is responsible for pipe
Manage each business module, and call related service module to carry out the process of related service;Each business module:Mainly it is responsible for realizing business
Function, monitors business object, produces log information;Scheduling message layer:Mainly be responsible for integrated scheduling, include each module scheduling with
The scheduling of data flow.
The flow process of described C/S client computer specifically includes:
1) example of business module, policy management module, protocol layer and Internet is generated by scheduling message layer.
2) call the init of business module, policy management module, protocol layer and Internet.
3) call the Start of business module, policy management module, protocol layer and Internet, start each module.
4), after business module is called Start, instantiates each business module, call the Init of each business module.
5), after business module all starts each business module, send business main frame log on command to service end.
6) after receiving the log on command of server end, to server request distributing policy.
7) after receiving the strategy that server issues, put the policy in policy management module, circulation obtains each module policy,
Each module policy is handed down to each business module respectively.
8) each business module is strategically monitored to each module monitors content.
9) after producing daily record and alarm, log information and warning information are put into message queue, is carried by scheduling message layer
Take the message in message queue and be distributed to corresponding module and processed.
10) when system exits, scheduling message layer calls the Stop of each module.
Fig. 4 is the configuration diagram of C/S server provided in an embodiment of the present invention, as shown in figure 4, including:Internet:Main
Network connection to be responsible for, network data is received and dispatched;Protocol layer:Mainly it is responsible for procotol framing, solution frame;General service logical layer:
Mainly it is responsible for client management to interact with database server, by various log information write into Databasce servers, or from
Database server reads various log informations;Business module management level:Mainly it is responsible for benchmark service module and third party's business
The carrying of module;Scheduling message layer:Mainly it is responsible for total system scheduling, including the scheduling of the scheduling data stream of each module.
The flow process of described C/S server specifically includes:
1) business module, client management module, data memory module, protocol layer and network are generated by message scheduling module
The example of layer.
2) business module, client management module, the init of data memory module, protocol layer and Internet are called.
3) call the Start of data memory module, log-on data memory module, taken from database using data memory module
Business device reads log information, policy information etc..
4) scheduling message layer obtains log information and policy information from data memory module, and places this information in client
Management module, sets up fictitious host computer according to log information and policy information.
5) accept C/S client network to connect, after receiving C/S client logon agreement, in modification client manager module
The state of fictitious host computer.
6), after receiving C/S client requests policy protocol, provide strategy by each fictitious host computer, and send it to each C/S
Client computer.
7) after receiving the log protocol that C/S client computer reports, log protocol is put into data memory module, deposited by data
Storage module write into Databasce server.
Fig. 5 is the configuration diagram of B/S server provided in an embodiment of the present invention, as shown in figure 5, using main flow
Spring MVC (Model View Controller, model, view represent, controller) is a kind of service logic, data, boundary
Face shows detached method tissue code, service logic is gathered inside components, is improving and personalized customization interface
And it is not necessary to again write service logic while user mutual.It includes:View represent layer:View be user see and with
Interaction interface.For web application, view is exactly by Adobe Flash with as XHTML (eXtensible
Hyper Text Markup Language, expansible Hypertext Markup Language), XML (eXtensible Markup
Language, extendible identifiable language)/XSL (eXtensible Stylesheet Language, expansible pattern predicative
Speech), some identifiable languages and the Web services group such as WML (Wireless Markup Language, WML)
The interface becoming;Key-course:Controller accepts the input of user and calling model and view go to complete the demand of user, so when single
Hit the hyperlink in Web page and send HTML (HyperText Markup Language, HTML) list
When, controller itself does not export anything and does any process.It is that reception is asked and determined called which model component
Go to process request, then determine the data which view to show return with again;Business model layer:Model representation business data and
Business rule.In three parts of MVC, model has most process tasks.For example it may with as EJBs and
The such component object of ColdFusion Components carrys out processing data storehouse server, and the data being returned by model is neutral
, that is model is unrelated with data form, and such a model can provide data for multiple views.Data Persistence Layer and number
According to cache layer.
Add-on system
Existed with dll form under Windows, existed with so form under LINUX.
Interface is realized being realized according to the interface of framework definition.
Whether XML file decision module loads, loading sequence, the example number of loading.Such as loading configuration under LINUX
File is as follows.
Add-on system only needs to three steps 1, realizes interface;2nd, generate dynamic base;3rd, add in configuration file.
The scheme providing according to embodiments of the present invention, using constructed information safety system platform it is achieved that once opening
Send out repeated application such that it is able to reduce workload, Improving The Quality of Products.
Although being described in detail to the present invention above, the invention is not restricted to this, those skilled in the art of the present technique
Various modifications can be carried out according to the principle of the present invention.Therefore, all modifications made according to the principle of the invention, all should be understood to
Fall into protection scope of the present invention.