CN116107621A - Linkage execution method and device of safety equipment and electronic equipment - Google Patents

Abstract

The invention discloses a linkage execution method and device of safety equipment and electronic equipment. Wherein the method comprises the following steps: receiving a linkage instruction issued by a client security platform; reading action parameters of linkage templates and target linkage actions configured for all linkage actions; adopting action parameters to replace parameters corresponding to parameter keywords in the linkage template; translating the replaced parameters in the linkage template and N built-in functions used in the built-in function set into code scripts; executing the code script, and issuing a linkage command to the linkage safety equipment according to script operation logic in the code script, wherein after the linkage safety equipment operates according to the linkage command, reading a linkage return value. The invention solves the technical problem that when the safety platform is linked with the safety equipment in the related technology, templates configured for each linkage action are only limited to linkage of a single action, and interaction of different linkage actions cannot be realized.

Description

Linkage execution method and device of safety equipment and electronic equipment

Technical Field

The invention relates to the field of network security, in particular to a linkage execution method and device of security equipment and electronic equipment.

Background

With the rapid development of information technology, network security gradually shows the importance of the network security, especially for large enterprises and companies, security equipment is managed by establishing an internal security platform, so that the network security event is prevented.

The security platform of the same enterprise/company has the condition that security devices of different manufacturers or different models need to be docked, because different standards exist in different manufacturers, command line sentences for executing actions/configurations of the security devices are also different, currently, in order to realize linkage of the security platform and different security devices, a mode of customizing a set of codes independently for different devices is often used for managing, the mode can greatly increase workload and is inflexible, expansibility is not provided, a set of codes need to be customized independently whenever a new security device needs to be connected to the security platform, and the codes need to be modified again when the original configuration needs to be changed in the later period.

In the related art, in order to better realize the linkage of the safety platform and the safety equipment, a linkage template is configured for each linkage action, specific attribute values of all execution keywords in the selected linkage template are filled in, all command lines in the template are extracted when the linkage action is executed, the command line execution is carried out according to the sequence number of the command line execution from small to large, the command line echo value is waited for to confirm that the command line execution is successful, and the linkage template is called and executed successfully until the execution of all command lines is finished. Although the way the linkage templates are configured avoids the problem of manually customizing codes to different security devices, it also has the following drawbacks: firstly, the command line execution is performed according to the command line execution sequence number from small to large and waiting for the return display value, and the method is not suitable for the linkage safety equipment to perform query operation, the query operation needs to extract and analyze the return display value after the query operation is performed, the related operation on the return value is not performed in the related technology, only whether the return display value is judged to confirm that the command line execution is completed, and similarly, the requirement of acquiring the return value is also met when the linkage safety equipment performs action issuing, so that the conventional scheme still needs to be developed for the second time under the condition. Also, the correctness checking is not performed on the echo value in the prior art, and after one step of error reporting, the subsequent command is still continuously issued, which may cause other problems; secondly, the existing linkage mode is not flexible enough, and the requirements of the safety equipment such as the replacement and issuing of the action command line parameters, the circular issuing of sentences and the like cannot be realized, so that the linkage mode cannot be suitable for most safety equipment; thirdly, in the related art, specific attribute values of all execution keywords in the selected linkage template are filled, that is, the execution keywords are replaced according to specific parameters of the current action, so that different standards of all manufacturers cannot be considered, for example, the starting time of a schedule is considered, and formats required by different security devices of different manufacturers at the same time are different: 2022/08/01:00, 2022-08-01 00:00:00,00:00 08/01/2022, etc.; fourth, in the related art, when the safety platform is linked with the safety device, the templates configured for each linkage action are limited to linkage of a single action, and interaction of different linkage actions cannot be realized.

In view of the above problems, no effective solution has been proposed at present.

Disclosure of Invention

The embodiment of the invention provides a linkage execution method and device of safety equipment and electronic equipment, which at least solve the technical problem that templates configured for various linkage actions are limited to linkage of a single action and interaction of different linkage actions cannot be realized when a safety platform is linked with the safety equipment in the related art.

According to an aspect of the embodiment of the present invention, there is provided a linkage execution method of a security device, including: receiving a linkage instruction issued by a client security platform, wherein the linkage instruction at least comprises: the equipment identification and target linkage action of the linkage safety equipment to be issued; reading a linkage template configured for all linkage actions and action parameters of the target linkage actions, wherein the predefined template information in the linkage template at least comprises: parameter keywords and built-in function sets; replacing parameters corresponding to the parameter keywords in the linkage template by adopting the action parameters; translating the replaced parameters in the linkage template and N built-in functions used in the built-in function set into code scripts, wherein N is a positive integer greater than or equal to 1; executing the code script, and issuing a linkage command to the linkage safety equipment according to script operation logic in the code script, wherein after the linkage safety equipment operates according to the linkage command, a linkage return value is read.

Optionally, the linkage execution method of the safety device further includes: collecting action parameters and action built-in functions of different linkage actions executed by M safety devices, wherein M is a positive integer greater than or equal to 1; constructing an initial linkage template; configuring parameter keywords, attribute sets and built-in function sets of the initial linkage template based on action parameters and action built-in functions of the different linkage actions; and determining the linkage template based on the configured parameter keywords, the attribute set and the built-in function set.

Optionally, the step of configuring the parameter keyword, the attribute set and the built-in function set of the initial linkage template based on the action parameters and the action built-in functions of the different linkage actions includes: configuring the parameter keywords in the initial linkage template based on the action parameters of the different linkage actions; configuring missing attributes and formatting attributes in the initial linkage template based on action parameters of the different linkage actions to obtain the attribute set; based on the action built-in function, configuring a command execution statement, an execution result echo acquisition statement, an ending echo display statement, a word string containing statement of a judging word string and a return function value statement in the initial linkage template, and obtaining the built-in function set.

Optionally, after configuring the missing attribute and the formatted attribute in the initial linkage template based on the action parameters of the different linkage actions to obtain the attribute set, the method further includes: receiving firewall equipment information which is issued by the client security platform and is associated with a first type of appointed clients; based on the firewall equipment information, configuring a threat information list and a safety response strategy to be returned by the self-defined firewall equipment in the linkage template, and configuring a return display value judgment statement of the safety equipment in the linkage template.

Optionally, after constructing the initial linkage template, the method further comprises: collecting cyclic commands of different linkage actions executed by M safety devices; and configuring a circulation statement keyword in the linkage template based on the circulation command.

Optionally, after constructing the initial linkage template, the method further comprises: collecting judgment commands of different linkage actions executed by M safety devices; and configuring judgment statement keywords in the linkage template based on the judgment command.

Optionally, after constructing the initial linkage template, the method further comprises: receiving a custom action which is issued by the client security platform and is associated with a second class of appointed clients; and configuring a custom function in the linkage template based on the custom action.

Optionally, the step of replacing the parameter corresponding to the parameter keyword in the linkage template with the action parameter includes: analyzing the parameter identification of the parameter keywords related to the linkage template, and replacing the parameters corresponding to the parameter keywords in the linkage template by adopting the action parameters; or extracting attribute information associated with the parameters corresponding to the parameter keywords in the linkage template; when the attribute information indicates that the attribute of the parameter corresponding to the parameter key is a missing attribute and the parameter value of the action parameter is null, replacing the parameter corresponding to the parameter key in the linkage template by adopting a designated missing attribute value; and when the attribute information indicates that the attribute of the parameter corresponding to the parameter key is a formatting attribute, replacing the parameter corresponding to the parameter key in the linkage template by adopting the appointed formatting attribute.

According to another aspect of the embodiment of the present invention, there is also provided a linkage execution apparatus of a safety device, including: the receiving unit is used for receiving linkage instructions issued by the client security platform, wherein the linkage instructions at least comprise: the equipment identification and target linkage action of the linkage safety equipment to be issued; the reading unit is used for reading linkage templates configured for all linkage actions and action parameters of the target linkage actions, wherein the predefined template information in the linkage templates at least comprises: parameter keywords and built-in function sets; the replacing unit is used for replacing parameters corresponding to the parameter keywords in the linkage template by adopting the action parameters; the translation unit is used for translating the replaced parameters in the linkage template and N built-in functions used in the built-in function set into code scripts, wherein N is a positive integer greater than or equal to 1; and the execution unit executes the code script, and issues a linkage command to the linkage safety equipment according to script operation logic in the code script, wherein after the linkage safety equipment operates according to the linkage command, a linkage return value is read.

Optionally, the linkage actuating device of the safety device further includes: the first acquisition module is used for acquiring action parameters and action built-in functions of different linkage actions executed by M safety devices, wherein M is a positive integer greater than or equal to 1; the first construction module is used for constructing an initial linkage template; the first configuration module is used for configuring parameter keywords, attribute sets and built-in function sets of the initial linkage template based on action parameters and action built-in functions of the different linkage actions; the first determining module is used for determining the linkage template based on the configured parameter keywords, the attribute set and the built-in function set.

Optionally, the first configuration module includes: the first configuration submodule is used for configuring the parameter keywords in the initial linkage template based on the action parameters of the different linkage actions; the second configuration submodule is used for configuring missing attributes and formatting attributes in the initial linkage template based on action parameters of the different linkage actions to obtain the attribute set; and the third configuration submodule is used for configuring a command execution statement, an execution result echo acquisition statement, an ending echo display statement, a word string containing statement of a judgment character string and an echo function value statement in the initial linkage template based on the action built-in function to obtain the built-in function set.

Optionally, the first configuration module further includes: the first receiving sub-module is used for receiving firewall equipment information which is associated with a first type of appointed clients and issued by the client security platform; and the fourth configuration submodule is used for configuring a threat information list and a safety response strategy to be returned by the self-defined firewall equipment in the linkage template based on the firewall equipment information, and configuring a return display value judgment statement of the safety equipment in the linkage template.

Optionally, the first building module includes: the first acquisition sub-module is used for acquiring the cyclic commands of different linkage actions executed by the M safety devices; and a fifth configuration sub-module, configured to configure the loop sentence keywords in the linkage template based on the loop command.

Optionally, the first building module further includes: the second acquisition sub-module is used for acquiring judgment commands of different linkage actions executed by the M safety devices; and a sixth configuration sub-module, configured to configure the judgment statement keywords in the linkage template based on the judgment command.

Optionally, the first building module further includes: the second receiving sub-module is used for receiving the custom action which is associated with the second class of appointed clients and issued by the client security platform; and a seventh configuration sub-module, configured to configure the custom function in the linkage template based on the custom action.

Optionally, the replacing unit includes: the first analysis module is used for analyzing the parameter identification of the parameter keywords related to the linkage template and replacing the parameters corresponding to the parameter keywords in the linkage template by adopting the action parameters; or, the first extraction module is used for extracting attribute information of parameter association corresponding to the parameter keyword in the linkage template; the first replacing module is used for replacing the parameter corresponding to the parameter key word in the linkage template by adopting a designated missing attribute value when the attribute information indicates that the attribute of the parameter corresponding to the parameter key word is a missing attribute and the parameter value of the action parameter is null; and the second replacing module is used for replacing the parameter corresponding to the parameter key word in the linkage template by adopting the appointed formatting attribute when the attribute information indicates that the attribute of the parameter corresponding to the parameter key word is the formatting attribute.

According to another aspect of the embodiment of the present invention, there is also provided an electronic device, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform a coordinated execution method of any of the security devices via execution of the executable instructions.

According to another aspect of the embodiment of the present invention, there is further provided a computer readable storage medium, where the computer readable storage medium includes a stored computer program, and when the computer program runs, the device where the computer readable storage medium is controlled to execute the linkage execution method of any one of the security devices.

In the present disclosure, the following steps are employed: firstly, receiving a linkage instruction issued by a client security platform, wherein the linkage instruction at least comprises: reading the equipment identifier and the target linkage action of the linkage safety equipment to be issued, and reading action parameters of a linkage template and the target linkage action configured for all linkage actions, wherein the predefined template information in the linkage template at least comprises: and then adopting action parameters to replace parameters corresponding to the parameter keywords in the linkage template, translating the replaced parameters in the linkage template and N built-in functions used in the built-in function set into code scripts, wherein N is a positive integer greater than or equal to 1, finally executing the code scripts, and issuing a linkage command to the linkage safety equipment according to script operation logic in the code scripts, wherein after the linkage safety equipment operates according to the linkage command, reading a linkage return value.

In the method, when the safety platform is linked with the safety equipment, the linkage template is introduced, so that a set of codes is not required to be customized for each equipment, linkage workload is reduced, expansibility and universality are enhanced, secondary development is avoided, the action parameters are adopted to replace original parameters in the linkage template, the linkage template is not limited to linkage of a single action, interaction of different linkage actions is supported, and the technical problem that the template configured for each linkage action is limited to linkage of the single action and interaction of different linkage actions cannot be realized when the safety platform is linked with the safety equipment in the related art is solved.

In the method, related logic can be filled in by a user according to own business requirements when the user configures the template through the custom template language, and the requirement logic of the user is automatically translated into codes executable by scripts during linkage, so that the functions of linkage of safety equipment and execution of actions are achieved.

In the method, the function of linking different safety devices and inquiring is realized, the return display value of the current safety device is obtained through the built-in function, and the function of inquiring can be realized through analyzing the return display value.

Drawings

The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiments of the invention and together with the description serve to explain the invention and do not constitute a limitation on the invention. In the drawings:

FIG. 1 is a flow chart of an alternative linkage execution method of a security device in accordance with an embodiment of the present invention;

FIG. 2 is a flow chart of an alternative construction of a ganged template according to an embodiment of the present invention;

FIG. 3 is a schematic illustration of an alternate linkage actuator of a safety device, according to an embodiment of the present invention;

fig. 4 is a block diagram of a hardware structure of an electronic device (or mobile device) of a method for performing linkage of a security device according to an embodiment of the present invention.

Detailed Description

In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.

It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

It should be noted that, related information (including, but not limited to, user equipment information, user personal information, etc.) and data (including, but not limited to, data for presentation, analyzed data, etc.) related to the present disclosure are information and data authorized by a user or sufficiently authorized by each party. For example, an interface is provided between the system and the relevant user or institution, before acquiring the relevant information, the system needs to send an acquisition request to the user or institution through the interface, and acquire the relevant information after receiving the consent information fed back by the user or institution.

The invention can be applied to linkage execution systems/devices/products of various safety equipment, provides a universal template language suitable for linkage of different actions of different safety equipment, can fill logic required to be processed in linkage in a template through grammar (such as for/while circulation, if/else statement, custom function and the like) of the template language, automatically analyzes and translates keywords or related logic in the template into a format which can be executed by a script in linkage, and then executes the script to realize linkage of actions, thereby avoiding writing various processing logic in codes directly, reducing coupling and enhancing linkage generality and expandability.

According to the invention, only one set of codes is required to be developed, so that different linkage actions of safety equipment of different manufacturers can be linked, the types of the linkage actions include, but are not limited to, execution actions, inquiry actions, modification actions and the like, and whenever new equipment or new linkage actions need to be supported, only one set of templates is required to be newly added, and execution logic of the linkage actions based on template language is written in the templates; when the original linkage action execution logic needs to be modified, the response logic only needs to be modified/added in the template.

The invention can customize the exclusive business logic according to the user demand, realize the interaction of a plurality of linkage actions through one template, or add special processing logic in a certain action to meet the business logic demand of the user.

The present invention will be described in detail with reference to the following examples.

Example 1

In accordance with an embodiment of the present invention, there is provided a method embodiment of the coordinated execution of a security device, it being noted that the steps illustrated in the flowchart of the figures may be performed in a computer system, such as a set of computer-executable instructions, and, although a logical sequence is illustrated in the flowchart, in some cases, the steps illustrated or described may be performed in a different order than that illustrated herein.

FIG. 1 is a flow chart of an alternative linkage execution method of a security device according to an embodiment of the present invention, as shown in FIG. 1, the method comprising the steps of:

step S102, a linkage instruction issued by a client security platform is received, wherein the linkage instruction at least comprises: the equipment identification and target linkage action of the linkage safety equipment to be issued;

step S104, reading action parameters of linkage templates and target linkage actions configured for all linkage actions, wherein the predefined template information in the linkage templates at least comprises: parameter keywords and built-in function sets;

step S106, replacing parameters corresponding to the parameter keywords in the linkage template by action parameters;

step S108, translating the replaced parameters in the linkage template and N built-in functions used in the built-in function set into a code script, wherein N is a positive integer greater than or equal to 1;

step S110, executing the code script, and issuing a linkage command to the linkage safety equipment according to script operation logic in the code script, wherein after the linkage safety equipment operates according to the linkage command, reading a linkage return value.

Through the steps, the linkage instruction issued by the client security platform is received, wherein the linkage instruction at least comprises: and then reading action parameters of linkage templates and target linkage actions configured for all linkage actions, wherein the predefined template information in the linkage templates at least comprises: and the parameter keywords and the built-in function sets are adopted to replace parameters corresponding to the parameter keywords in the linkage template by action parameters, the replaced parameters in the linkage template and N built-in functions used in the built-in function sets are translated into code scripts, wherein N is a positive integer greater than or equal to 1, the code scripts are executed finally, and linkage commands are issued to the linkage safety equipment according to script operation logic in the code scripts, wherein linkage return values are read after the linkage safety equipment operates according to the linkage commands. In the embodiment, when the safety platform is linked with the safety equipment, the linkage template is introduced, so that a set of codes is not required to be customized for each equipment, linkage workload is reduced, expansibility and universality are enhanced, secondary development is avoided, the action parameters are adopted to replace original parameters in the linkage template, the linkage template is not limited to linkage of a single action, interaction of different linkage actions is supported, and the technical problem that when the safety platform is linked with the safety equipment in the related art, templates configured for all linkage actions are limited to linkage of the single action only, and interaction of different linkage actions cannot be realized is solved.

The following will describe the steps in detail.

According to the embodiment of the invention, the universal linkage template is constructed, so that the safety platform can be linked with safety equipment of different types, different actions are executed for linkage, logic required to be processed in linkage is filled in the template through grammar of the template language, keywords or related logic in the template are automatically analyzed and translated into a format which can be executed by a script in linkage, and then the script is executed to realize linkage of actions, so that various processing logic is prevented from being written in codes, coupling is reduced, and universality and expandability are enhanced.

It should be noted that, before the action linkage of the safety platform and the safety device is performed, a linkage template needs to be constructed, and fig. 2 is a flowchart of an alternative construction of the linkage template according to an embodiment of the present invention, and as shown in fig. 2, the steps of constructing the linkage template include:

step S202, collecting action parameters and action built-in functions of different linkage actions executed by M safety devices, wherein M is a positive integer greater than or equal to 1.

It should be noted that, the security device in the embodiment of the present invention includes, but is not limited to, an IP protocol crypto-engine, a security router, a line crypto-engine, and a firewall device, where the security device maintains the security of a platform or a device by means of encryption or virus killing. And each enterprise or company performs unified management on each safety device through the safety platform. Types of linkage actions of the security device include, but are not limited to: query action, modify action, issue action, delete action.

It should be noted that, in the embodiment of the present invention, parameters are identified by custom symbols, for example, # { }, # (), +[ ], etc. may be used as identification symbols, and the embodiment of the present invention is schematically illustrated by # { }.

Step S204, constructing an initial linkage template.

It should be noted that, the initial linkage template can implement basic action execution function and custom action function, parameters and grammar in the linkage template can be custom and replaced, and a user can modify and update the initial linkage template according to own requirements, so as to implement execution of different linkage actions.

In the embodiment of the invention, after the initial linkage template is constructed, the method further comprises the following steps: collecting cyclic commands of different linkage actions executed by M safety devices; based on the loop command, loop sentence keywords in the linkage template are configured.

It should be noted that, in the embodiment of the present invention, the function of issuing the cyclic command line is implemented by a for/while keyword, for example:

for#{source-address}:

set source address#{source-address-ip}；

if N ips (1.1.1.1/24-1.1.1.1.N/24) are configured in the source address book, the # source-address loop is traversed to issue set source address.1.1.1.X/24, X is E [1, N ] command lines, while is the same as above.

In the embodiment of the invention, after the initial linkage template is constructed, the method further comprises the following steps: collecting judgment commands of different linkage actions executed by M safety devices; based on the judgment command, a judgment statement keyword in the linkage template is configured.

It should be noted that, in the embodiment of the present invention, the judgment logic in the issuing command line is implemented by the if/else keyword, for example:

if#{schedule-type}＝＝"onetime":

set schedule onetime

else:

set schedule periodic

the logic function realizes the following functions: if the currently issued schedule type is onetime, then set schedule onetime is executed, otherwise set schedule periodic is executed.

In the embodiment of the invention, after the initial linkage template is constructed, the method further comprises the following steps: receiving a custom action which is issued by a client security platform and is associated with a second class of appointed clients; based on the custom action, a custom function in the linkage template is configured.

It should be noted that the initial linkage template also supports customizing the business requirements via custom functions, e.g.,

def is_success(message):

for error in errors:

if find(message,error):

return false

return true

and (3) the following steps:

if is_success(message):

if the message is the echo value of the firewall after the current command line is executed, whether the current command line is executed successfully or not can be judged.

Step S206, based on action parameters and action built-in functions of different linkage actions, configuring parameter keywords, attribute sets and built-in function sets of the initial linkage template.

In the embodiment of the present invention, step S206 includes: configuring parameter keywords in an initial linkage template based on action parameters of different linkage actions; configuring missing attributes and formatting attributes in an initial linkage template based on action parameters of different linkage actions to obtain an attribute set; based on the action built-in function, configuring a command execution statement, an execution result echo acquisition statement, an ending echo display statement, a word string containing statement of a judging word string and a return function value statement in an initial linkage template to obtain a built-in function set.

It should be noted that, the initial linkage template parameter supports configuration format formatting property, and the property value is formatted by the parameter to support different formats of different devices of different manufacturers, for example, set start time# { start-time, format=% m/% d/% Y }, and the parameter can format the initial configuration time into a specified format. The initial linkage template parameters also support configuration default value attributes, which can be replaced with default corresponding values when missing values exist, and meanwhile, the method also supports the expansion of other parameter related attributes, and has good expandability.

It should be noted that, the template further includes an internal grammar, and the internal function can directly call the internal grammar to implement a corresponding function, where the internal grammar includes: send (cmd) (corresponding to the command execution statement described above), can be implemented to execute the current cmd command line on the linked security device; the receiving () (corresponding to the execution result echo obtaining statement) can obtain the echo value of the security device after the current cmd is executed; ctrl_c () (corresponding to the above-mentioned end playback display statement), realizing that if the return information is longer after a certain command line is executed, the situation of-more-and the like occurs, the function of issuing ctrl+c to the security device to end the last playback content can be realized through ctrl_c (); find (arg 1, arg 2) (a string inclusion statement corresponding to the above-described judgment string), it is possible to judge whether an arg2 substring is included in the arg1 string, and if so, return true, and if not, return false; return (corresponding to the return function value statement described above) may effect the return of the function value.

In the embodiment of the invention, after configuring the missing attribute and the formatted attribute in the initial linkage template based on the action parameters of different linkage actions to obtain the attribute set, the method further comprises the following steps: receiving firewall equipment information which is issued by a client security platform and is associated with a first type of appointed clients; based on firewall equipment information, configuring a threat information list and a safety response strategy to be returned by the user-defined firewall equipment in the linkage template, and configuring a return display value judgment statement of the safety equipment in the linkage template.

It should be noted that, the linkage template may also be configured with a list of error information that may be returned by the firewall, for example: and (3) judging whether the current command line is successfully executed by checking whether the template contains character string logic in the error.

Step S208, determining a linkage template based on the configured parameter keywords, the attribute set and the built-in function set.

And when the parameter keywords, the missing attribute, the formatting attribute and the built-in function set are acquired, a corresponding linkage template can be constructed.

After at least one linkage template is constructed, the linkage template is brought into a template library, and a certain linkage template is called along with a linkage instruction issued by a safety platform in the subsequent use process, so that linkage actions are completed. The present embodiment will be described in detail with reference to specific embodiments.

Step S102, a linkage instruction issued by a client security platform is received, wherein the linkage instruction at least comprises: and the equipment identification and target linkage action of the linkage safety equipment to be issued.

Step S104, reading action parameters of linkage templates and target linkage actions configured for all linkage actions, wherein the predefined template information in the linkage templates at least comprises: parameter keywords and a set of built-in functions.

And S106, replacing parameters corresponding to the parameter keywords in the linkage template by using the action parameters.

In the embodiment of the present invention, step S106 includes: analyzing the parameter identification of the associated parameter keywords in the linkage template, and replacing the parameters corresponding to the parameter keywords in the linkage template by adopting action parameters; or extracting attribute information associated with parameters corresponding to the parameter keywords in the linkage template; when the attribute information indicates that the attribute of the parameter corresponding to the parameter key is a missing attribute and the parameter value of the action parameter is null, replacing the parameter corresponding to the parameter key in the linkage template by adopting the appointed missing attribute value; and when the attribute information indicates that the attribute of the parameter corresponding to the parameter key is a formatting attribute, replacing the parameter corresponding to the parameter key in the linkage template by adopting the appointed formatting attribute.

It should be noted that when different security devices are managed, a linkage template is directly called to replace parameters in the template, unified management of different devices can be achieved, in the linkage template, customizable data of the devices are marked in the form of keywords, when a security operator executes a certain linkage action, specific parameters of the current action can be used to replace parameter keywords in the template, for example, for set policy name { policy-name }, when in background translation, the name of a currently issued policy is used to replace { policy-name } parameters, for example, the name of the current policy is abc, and a command issued to the security device is set policy name abc; in addition, parameters such as the current time, the equipment identifier and the like can be formatted through format formatting attribute parameters and converted into a uniform format, for example: the current time is denoted 2022-04-04, and by calling set start time # 2022-02-01, format =% m/% d/% Y, time may be replaced with 04/01/2022 format.

Step S108, translating the replaced parameters in the linkage template and N built-in functions used in the built-in function set into a code script, wherein N is a positive integer greater than or equal to 1.

It should be noted that, when in linkage, the client's demand logic is automatically translated into the code that can be executed by the script, so as to achieve the functions of linkage safety equipment and executing various linkage actions.

Step S110, executing the code script, and issuing a linkage command to the linkage safety equipment according to script operation logic in the code script, wherein after the linkage safety equipment operates according to the linkage command, reading a linkage return value. In the embodiment, when the safety platform is linked with the safety equipment, the original code is required to be modified when the linkage function is required to be independently developed and expanded for the safety equipment of different types of different manufacturers, the expansibility and the universality are enhanced, and secondary development is avoided.

The embodiment supports different linkage actions and special processing logic, and when a user configures a template through a custom template language, relevant logic can be filled in according to own business requirements, and when linkage is carried out, the requirement logic of the user is automatically translated into codes which can be executed by scripts, so that the functions of linkage safety equipment and execution of various linkage actions are achieved. In the related art, the execution sequence of a certain action is written in the code, compared with a strategy of issuing, a schedule is firstly created, then an address book … is created, and finally the strategy is created, although the support of different security devices can be realized through a template, all actions cannot be supported, if a new linkage action is needed or special processing logic needs to be added, the new code needs to be developed, and the support of different security devices, different actions, various special processing logic and the like can be realized under the condition of not carrying out secondary development through the custom processing logic, so that the method has good expansibility. The user self-defined business logic is not limited to realizing the linkage of a certain action, and interaction among a plurality of linkage actions can be realized through one template.

In this embodiment, a function of linking different security devices and querying is implemented, a return display value of the current security device is obtained through a built-in receive () function, and the function of querying can be implemented through analysis of the return display value.

The following describes a specific method of using the linked template by way of a specific example.

When a certain security operator executes a certain linkage action, the template language analysis process is as follows:

step one, reading a linkage template configured by the linkage action;

reading a linkage template configured by the linkage action and specific parameters of the current linkage action, replacing all parameters marked by a custom symbol (schematically shown by # { } in the embodiment) in the template by using the specific parameters of the current linkage action, traversing each parameter marked by # { } and analyzing the parameters marked by # { } and replacing by using the specific parameters of the current linkage action; if the parameter has the relevant attribute, the step two is entered, and if the parameter does not have the attribute, the step two is continued to be traversed;

step two, default judgment (corresponding to the judgment of the missing attribute);

determining whether the parameter has default attribute and the specific parameter of the current linkage action is null, if so, replacing the value of the parameter by using the default attribute value, and ending the current traversal;

Step three, format formatting (corresponding to the formatting attribute);

determining whether the parameters have format attributes, and if so, formatting by using format values;

step four, after all the parameters of the # { } identifier are obtained and replaced, analyzing the for/while circulation keywords, and translating the for/while circulation keywords into codes executable by the script;

step five, after obtaining and replacing all for/while circulation keywords, analyzing if/else keywords, and translating into codes executable by scripts;

step six, after all if/else keywords are translated, loading all def function declarations and function uses, and translating the declarations into codes which can be executed by the script;

step seven, obtaining and replacing other built-in functions;

and step eight, executing the script after translation is completed, and realizing the linkage safety equipment to execute actions.

According to the embodiment, when the user configures the template, relevant logic can be filled in according to own functional requirements, the required logic of the user is automatically translated into a format which can be executed by the script during linkage, so that the function of linkage safety equipment is achieved, meanwhile, the control right of business logic is completely given to the user for self-definition through the self-definition template language, interaction of a plurality of linkage actions can be realized on one template, the interaction is not limited to linkage of single action, such as query strategy, modification strategy, issuing strategy and deletion strategy interaction, and user self-definition in the true sense is realized.

The invention is described below in connection with alternative embodiments.

Example two

The present embodiment provides a linkage execution device of a safety device, where each implementation unit included in the linkage execution device of the safety device corresponds to each implementation step in the first embodiment.

FIG. 3 is a schematic view of an alternative linkage actuator of a safety device, as shown in FIG. 3, according to an embodiment of the present invention, the linkage actuator of the safety device comprising: a receiving unit 30, a reading unit 32, a replacing unit 34, a translating unit 36, an executing unit 38, wherein,

the receiving unit 30 is configured to receive a linkage instruction issued by the client security platform, where the linkage instruction at least includes: the equipment identification and target linkage action of the linkage safety equipment to be issued;

the reading unit 32 is configured to read action parameters of the linkage template and the target linkage action configured for all linkage actions, where template information predefined in the linkage template at least includes: parameter keywords and built-in function sets;

a replacing unit 34, configured to replace a parameter corresponding to the parameter keyword in the linkage template with the action parameter;

a translation unit 36, configured to translate the parameters replaced in the linkage template and N built-in functions used in the built-in function set into a code script, where N is a positive integer greater than or equal to 1;

The execution unit 38 executes the code script and issues a linkage command to the linkage safety device according to script operation logic in the code script, wherein the linkage return value is read after the linkage safety device operates according to the linkage command.

The linkage execution device of the safety equipment receives the linkage instruction issued by the client safety platform through the receiving unit 30, wherein the linkage instruction at least comprises: the equipment identification and target linkage action of the linkage safety equipment to be issued; the reading unit 32 reads action parameters of the linkage templates and the target linkage actions configured for all linkage actions, wherein the predefined template information in the linkage templates at least comprises: parameter keywords and built-in function sets; replacing parameters corresponding to the parameter keywords in the linkage template by using the action parameters through a replacing unit 34; translating, by the translating unit 36, the replaced parameter in the linkage template and N built-in functions used in the built-in function set into a code script, where N is a positive integer greater than or equal to 1; the code script is executed by the execution unit 38, and a linkage command is issued to the linkage safety device according to script operation logic in the code script, wherein the linkage return value is read after the linkage safety device operates according to the linkage command.

In the embodiment, when the safety platform is linked with the safety equipment, the linkage template is introduced, so that a set of codes is not required to be customized for each equipment, linkage workload is reduced, expansibility and universality are enhanced, secondary development is avoided, the action parameters are adopted to replace original parameters in the linkage template, the linkage template is not limited to linkage of a single action, interaction of different linkage actions is supported, and the technical problem that when the safety platform is linked with the safety equipment in the related art, templates configured for all linkage actions are limited to linkage of the single action only, and interaction of different linkage actions cannot be realized is solved.

According to the embodiment of the invention, the universal linkage template is constructed, so that the safety platform can be linked with safety equipment of different types, different actions are executed for linkage, logic required to be processed in linkage is filled in the template through grammar of the template language, keywords or related logic in the template are automatically analyzed and translated into a format which can be executed by a script in linkage, and then the script is executed to realize linkage of actions, so that various processing logic is prevented from being written in codes, coupling is reduced, and universality and expandability are enhanced.

Before the action linkage of the safety platform and the safety equipment is carried out, an initial linkage template is required to be constructed, the initial linkage template can realize a basic action execution function and a self-defining action function, parameters and grammar in the linkage template can be self-defined and replaced, and a user can modify and update the initial linkage template according to own requirements, so that execution of different linkage actions is realized.

Optionally, the linkage actuating device of the safety device further includes: the first acquisition module is used for acquiring action parameters and action built-in functions of different linkage actions executed by M safety devices, wherein M is a positive integer greater than or equal to 1; the first construction module is used for constructing an initial linkage template; the first configuration module is used for configuring parameter keywords, attribute sets and built-in function sets of the initial linkage template based on action parameters and action built-in functions of different linkage actions; the first determining module is used for determining the linkage template based on the configured parameter keywords, the attribute set and the built-in function set.

Optionally, the first configuration module includes: the first configuration submodule is used for configuring parameter keywords in the initial linkage template based on action parameters of different linkage actions; the second configuration submodule is used for configuring missing attributes and formatting attributes in the initial linkage template based on action parameters of different linkage actions to obtain an attribute set; the third configuration submodule is used for configuring a command execution statement, an execution result echo acquisition statement, an ending echo display statement, a word string containing statement of a judging character string and a return function value statement in the initial linkage template based on the action built-in function to obtain a built-in function set.

It should be noted that, the initial linkage template parameter supports configuration format formatting property, and the property value is formatted by the parameter to support different formats of different devices of different manufacturers, for example, set start time# { start-time, format=% m/% d/% Y }, and the parameter can format the initial configuration time into a specified format. The initial linkage template parameters also support configuration default value attributes, which can be replaced with default corresponding values when missing values exist, and meanwhile, the method also supports the expansion of other parameter related attributes, and has good expandability.

It should be noted that, the linkage template further includes a built-in grammar, and the built-in function may directly call the built-in grammar to implement a corresponding function, for example: send (cmd) (corresponding to the command execution statement described above), can be implemented to execute the current cmd command line on the linked security device; the receiving () (corresponding to the execution result echo obtaining statement) can obtain the echo value of the security device after the current cmd is executed; ctrl_c () (corresponding to the above-mentioned end playback display statement), realizing that if the return information is longer after a certain command line is executed, the situation of-more-and the like occurs, the function of issuing ctrl+c to the security device to end the last playback content can be realized through ctrl_c (); find (arg 1, arg 2) (a string inclusion statement corresponding to the above-described judgment string), it is possible to judge whether an arg2 substring is included in the arg1 string, and if so, return true, and if not, return false; return (corresponding to the return function value statement described above) may implement the return of the function value.

Optionally, the first configuration module further comprises: the first receiving sub-module is used for receiving firewall equipment information which is associated with the first type of appointed clients and issued by the client security platform; and the fourth configuration submodule is used for configuring a threat information list and a safety response strategy to be returned by the self-defined firewall equipment in the linkage template based on the firewall equipment information and configuring a return display value judgment statement of the safety equipment in the linkage template.

It should be noted that, the linkage template may also be configured with a list of error information that may be returned by the firewall, for example: and (3) judging whether the current command line is successfully executed by checking whether the template contains character string logic in the error.

Optionally, the first building module includes: the first acquisition sub-module is used for acquiring the cyclic commands of different linkage actions executed by the M safety devices; and a fifth configuration sub-module for configuring the loop sentence keywords in the linkage template based on the loop command.

It should be noted that, in the embodiment of the present invention, the function of circularly issuing the command line is implemented by a for/while keyword, for example:

for#{source-address}:

set source address#{source-address-ip}；

If N ips (1.1.1.1/24-1.1.1.1.N/24) are configured in the source address book, the # source-address loop is traversed to issue set source address.1.1.1.X/24, X is E [1, N ] command lines, while is the same as above.

Optionally, the first building module further comprises: the second acquisition sub-module is used for acquiring judgment commands of different linkage actions executed by the M safety devices; and a sixth configuration sub-module, configured to configure the judgment statement keywords in the linkage template based on the judgment command.

It should be noted that, in the embodiment of the present invention, the judgment logic in the issuing command line is implemented by the if/else keyword, for example:

if#{schedule-type}＝＝"onetime":

set schedule onetime

else:

set schedule periodic

the logic function realizes the following functions: if the currently issued schedule type is onetime, then set schedule onetime is executed, otherwise set schedule periodic is executed.

Optionally, the first building module further comprises: the second receiving sub-module is used for receiving the custom action which is issued by the client security platform and is associated with the second class of appointed clients; and the seventh configuration sub-module is used for configuring the custom function in the linkage template based on the custom action.

It should be noted that the initial linkage template also supports customizing the business requirements via custom functions, e.g.,

def is_success(message):

for error in errors:

if find(message,error):

return false

return true

And (3) the following steps:

if is_success(message):

if the message is the echo value of the firewall after the current command line is executed, whether the current command line is executed successfully or not can be judged.

Optionally, the replacing unit includes: the first analysis module is used for analyzing the parameter identification of the associated parameter keywords in the linkage template and replacing the parameters corresponding to the parameter keywords in the linkage template by adopting the action parameters; or the first extraction module is used for extracting attribute information associated with the parameters corresponding to the parameter keywords in the linkage template; the first replacing module is used for replacing the parameter corresponding to the parameter key word in the linkage template by adopting the appointed missing attribute value under the condition that the attribute information indicates that the attribute of the parameter corresponding to the parameter key word is the missing attribute and the parameter value of the action parameter is null; and the second replacing module is used for replacing the parameter corresponding to the parameter key word in the linkage template by adopting the appointed formatting attribute when the attribute information indicates that the attribute of the parameter corresponding to the parameter key word is the formatting attribute.

It should be noted that, when managing different security devices, the linkage template is directly called, and parameters in the template are replaced, so that unified management of different devices can be realized, for example, parameters such as current time, date and the like can be formatted through format formatting attribute parameters, and are converted into a unified format, for example: the current time is denoted 2022-04-04, and by calling set start time # 2022-02-01, format =% m/% d/% Y, time may be replaced with 04/01/2022 format.

The linkage execution device of the safety device may further include a processor and a memory, where the receiving unit 30, the reading unit 32, the replacing unit 34, the translating unit 36, the executing unit 38, and the like are stored as program units in the memory, and the processor executes the program units stored in the memory to implement corresponding functions.

The processor includes a kernel, and the kernel fetches a corresponding program unit from the memory. The kernel can be provided with one or more than one, and the linkage execution operation of the safety device is realized by adjusting the kernel parameters.

The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM), which includes at least one memory chip.

According to another aspect of the embodiment of the present invention, there is also provided an electronic device, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the coordinated execution method of the security device of any one of the items via execution of the executable instructions.

According to another aspect of the embodiment of the present invention, there is also provided a computer readable storage medium, where the computer readable storage medium includes a stored computer program, and when the computer program runs, the linkage execution method for controlling the device in which the computer readable storage medium is located to execute any one of the security devices is provided.

The present application also provides a computer program product adapted to perform, when executed on a data processing device, a program initialized with the method steps of: receiving a linkage instruction issued by a client security platform; reading action parameters of linkage templates and target linkage actions configured for all linkage actions; adopting action parameters to replace parameters corresponding to parameter keywords in the linkage template; translating the replaced parameters in the linkage template and N built-in functions used in the built-in function set into code scripts; executing the code script, and issuing a linkage command to the linkage safety equipment according to script operation logic in the code script, wherein after the linkage safety equipment operates according to the linkage command, reading a linkage return value.

Fig. 4 is a block diagram of a hardware structure of an electronic device (or mobile device) of a method for performing linkage of a security device according to an embodiment of the present invention. As shown in fig. 4, the electronic device may include one or more (shown as 402a, 402b, … …,402 n) processors 402 (the processors 402 may include, but are not limited to, a processing means such as a microprocessor MCU or a programmable logic device FPGA), a memory 404 for storing data. In addition, the method may further include: a display, an input/output interface (I/O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of the I/O interface), a network interface, a keyboard, a power supply, and/or a camera. It will be appreciated by those of ordinary skill in the art that the configuration shown in fig. 4 is merely illustrative and is not intended to limit the configuration of the electronic device described above. For example, the electronic device may also include more or fewer components than shown in FIG. 4, or have a different configuration than shown in FIG. 4.

The foregoing embodiment numbers of the present invention are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments.

In the foregoing embodiments of the present invention, the descriptions of the embodiments are emphasized, and for a portion of this disclosure that is not described in detail in this embodiment, reference is made to the related descriptions of other embodiments.

In the several embodiments provided in the present application, it should be understood that the disclosed technology content may be implemented in other manners. The above-described embodiments of the apparatus are merely exemplary, and the division of units may be a logic function division, and there may be another division manner in actual implementation, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be through some interfaces, units or modules, or may be in electrical or other forms.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied essentially or in part or all of the technical solution or in part in the form of a software product stored in a storage medium, including instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a removable hard disk, a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The foregoing is merely a preferred embodiment of the present invention and it should be noted that modifications and adaptations to those skilled in the art may be made without departing from the principles of the present invention, which are intended to be comprehended within the scope of the present invention.

Claims (10)

1. A linkage execution method of a safety device, comprising:

receiving a linkage instruction issued by a client security platform, wherein the linkage instruction at least comprises: the equipment identification and target linkage action of the linkage safety equipment to be issued;

reading a linkage template configured for all linkage actions and action parameters of the target linkage actions, wherein the predefined template information in the linkage template at least comprises: parameter keywords and built-in function sets;

replacing parameters corresponding to the parameter keywords in the linkage template by adopting the action parameters;

translating the replaced parameters in the linkage template and N built-in functions used in the built-in function set into code scripts, wherein N is a positive integer greater than or equal to 1;

executing the code script, and issuing a linkage command to the linkage safety equipment according to script operation logic in the code script, wherein after the linkage safety equipment operates according to the linkage command, a linkage return value is read.

2. The linkage execution method according to claim 1, further comprising:

collecting action parameters and action built-in functions of different linkage actions executed by M safety devices, wherein M is a positive integer greater than or equal to 1;

constructing an initial linkage template;

configuring parameter keywords, attribute sets and built-in function sets of the initial linkage template based on action parameters and action built-in functions of the different linkage actions;

and determining the linkage template based on the configured parameter keywords, the attribute set and the built-in function set.

3. The linkage execution method according to claim 2, wherein the step of configuring the parameter key word, the attribute set, and the built-in function set of the initial linkage template based on the action parameters and the action built-in functions of the different linkage actions includes:

configuring the parameter keywords in the initial linkage template based on the action parameters of the different linkage actions;

configuring missing attributes and formatting attributes in the initial linkage template based on action parameters of the different linkage actions to obtain the attribute set;

based on the action built-in function, configuring a command execution statement, an execution result echo acquisition statement, an ending echo display statement, a word string containing statement of a judging word string and a return function value statement in the initial linkage template, and obtaining the built-in function set.

4. The linkage execution method according to claim 3, wherein after configuring the missing attribute and the formatted attribute in the initial linkage template based on the action parameters of the different linkage actions, the method further comprises:

receiving firewall equipment information which is issued by the client security platform and is associated with a first type of appointed clients;

based on the firewall equipment information, configuring a threat information list and a safety response strategy to be returned by the self-defined firewall equipment in the linkage template, and configuring a return display value judgment statement of the safety equipment in the linkage template.

5. The linkage execution method according to claim 2, further comprising, after constructing the initial linkage template:

collecting cyclic commands of different linkage actions executed by M safety devices;

and configuring a circulation statement keyword in the linkage template based on the circulation command.

6. The linkage execution method according to claim 2, further comprising, after constructing the initial linkage template:

collecting judgment commands of different linkage actions executed by M safety devices;

and configuring judgment statement keywords in the linkage template based on the judgment command.

7. The linkage execution method according to claim 2, further comprising, after constructing the initial linkage template:

receiving a custom action which is issued by the client security platform and is associated with a second class of appointed clients;

and configuring a custom function in the linkage template based on the custom action.

8. The linkage execution method according to claim 2, wherein the step of replacing the parameter corresponding to the parameter keyword in the linkage template with the action parameter includes:

analyzing the parameter identification of the parameter keywords related to the linkage template, and replacing the parameters corresponding to the parameter keywords in the linkage template by adopting the action parameters; or alternatively, the process may be performed,

extracting attribute information associated with parameters corresponding to the parameter keywords in the linkage template;

when the attribute information indicates that the attribute of the parameter corresponding to the parameter key is a missing attribute and the parameter value of the action parameter is null, replacing the parameter corresponding to the parameter key in the linkage template by adopting a designated missing attribute value;

and when the attribute information indicates that the attribute of the parameter corresponding to the parameter key is a formatting attribute, replacing the parameter corresponding to the parameter key in the linkage template by adopting the appointed formatting attribute.

9. A linkage actuator for a safety device, comprising:

the receiving unit is used for receiving linkage instructions issued by the client security platform, wherein the linkage instructions at least comprise: the equipment identification and target linkage action of the linkage safety equipment to be issued;

the reading unit is used for reading linkage templates configured for all linkage actions and action parameters of the target linkage actions, wherein the predefined template information in the linkage templates at least comprises: parameter keywords and built-in function sets;

the replacing unit is used for replacing parameters corresponding to the parameter keywords in the linkage template by adopting the action parameters;

the translation unit is used for translating the replaced parameters in the linkage template and N built-in functions used in the built-in function set into code scripts, wherein N is a positive integer greater than or equal to 1;

and the execution unit executes the code script, and issues a linkage command to the linkage safety equipment according to script operation logic in the code script, wherein after the linkage safety equipment operates according to the linkage command, a linkage return value is read.

10. An electronic device, comprising:

A processor; and

a memory for storing executable instructions of the processor;

wherein the processor is configured to perform the coordinated execution method of the security device of any of claims 1 to 8 via execution of the executable instructions.

Images