CN116566654A - Protection system for block chain management server - Google Patents

Abstract

The invention discloses a protection system for a blockchain management server, which comprises gateway deployment, a security agent, application deployment, a security center and a management center, wherein the gateway deployment is deployed on a protection wall and used for protecting the edge security of a virtual platform, providing DHCP, NAT, a unified firewall, being responsible for balancing, VPN and port isolation functions, and the security agent is deployed in the blockchain server. According to the invention, through the blockchain server safety protection system, comprehensive protection is realized in aspects of virus protection, patch protection, malicious software protection, intrusion detection and protection, access control and integrity monitoring, and the problems of mutual attack, inconsistent safety states, inconsistent running environments and storm safety risks occupied by resources among servers in the blockchain server are solved, so that the safety threat of the system is reduced, the capability of resisting the latest safety threat is provided, the safety of the server is improved, and the high availability of the blockchain service application is ensured.

Description

A protection system for blockchain management server

technical field

The invention relates to the technical field of protection systems, in particular to a protection system for a blockchain management server.

Background technique

With the rapid development of blockchain technology, the security of blockchain servers has attracted more and more attention. Blockchain servers are called nodes in the blockchain system, and they provide storage for the entire blockchain system. Space and computing power support.

However, the current blockchain servers do not have security protection measures in the process of operation, and the blockchain servers are prone to mutual attacks. At the same time, there are inconsistent security states, inconsistent operating environments, and The technical problem of resource occupation storm security risk has brought security risks to the use of blockchain servers.

Contents of the invention

The purpose of the present invention is to provide a protection system for a block chain management server to solve the problems raised in the above-mentioned background technology.

In order to achieve the above object, the present invention provides the following technical solutions: a protection system for a blockchain management server, the protection system includes gateway deployment, security agent, application deployment, security center and management center, the gateway is deployed on the protection wall, with To protect the edge security of the virtual platform, it provides DHCP, NAT, unified firewall, responsible for balancing, VPN, and port isolation functions. The security agent is deployed in the blockchain server to provide anti-virus engines and anti-virus databases for the entire blockchain server. Deployed in the blockchain server, it provides agentless virus killing, IDS/IPS, program protection, program control, integrity monitoring and log auditing. The security center is responsible for updating the virus database and providing trusted data access. Maintain a global cache of scanned files, save files that have been security scanned, and the management center enables administrators to manage security policies and apply security policies to servers, as well as security updates and generate reports, which can be used for management, deployment, reporting, and recording And integrate third-party security services to achieve role-based access control and separation of duties;

The protection system also includes: a virus protection module, a patch protection module, a malware protection module, a Web application protection module, an intrusion prevention module, an access control module, an intrusion detection module, an integrity detection module, an application isolation module and a stateful firewall.

Preferably, the virus protection module: aiming at the problems of inconsistency of security status and resource occupation storms existing in the blockchain server service environment, the virus protection module provides agentless virus protection, adopts heuristic scanning, and promptly checks and kills viruses;

Patch protection module: evaluate the blockchain server through patch technology, and automatically provide comprehensive vulnerability patching for each blockchain server, and provide interception against vulnerability attacks before the patch is installed;

Preferably, the malicious software protection module: integrates VMware vShield Endpoint API, which can prevent the block chain server from being infringed by viruses and Trojan horse malware, thereby providing protection for complex attack interference in the block chain server environment;

Web application protection module: prevents cross-site scripting attacks and other web application vulnerabilities, and provides automatic notifications including summary information such as attackers and attack time.

Preferably, the intrusion prevention module: by blocking SQL injection attacks, denial of service attacks, worm intrusion attacks, etc., provides high security protection for the blockchain server, checks all incoming and outgoing data packets, It is not allowed to modify the protocol, and the content that violates the security policy and causes the attack can take advantage of it;

Access control module: Provides access control functions based on state detection, realizes access control based on blockchain server network ports, realizes logical isolation between blockchain servers, and at the same time identifies and intercepts various flooding attacks, according to traffic Management protocol blocks illegal traffic and optimizes traffic distribution;

Intrusion detection module: Based on the protocol, it provides policy-based monitoring and analysis tools to more accurately monitor, analyze and access control traffic, and at the same time conduct network behavior analysis to quickly and accurately detect intrusions in an unattended environment behaviors, matching attack signatures with signature databases, recording new attack signatures, and continuously improving signature databases.

Preferably, the integrity detection module: supports baseline-based key file monitoring functions such as files, directories, and registry records. If these key locations are maliciously tampered with or infected with viruses, the system will automatically send an alarm to the administrator and record the problem;

Application isolation module: supports separation of virtual applications, thereby avoiding mutual infection between blockchain server applications, and uses signature-based intrusion prevention functions to protect HTTP and FTP services;

Stateful firewall: carry out fine-grained filtering, design policies for the network and location-aware functions based on IP protocols, reduce the attack range of servers, centrally manage server firewall policies, prevent denial of service attacks and detect reconnaissance scans.

Preferably, the integrity detection module also includes suspicious file analysis, specifically: select parameters, analyze the selected customer service end system parameters, and use the disassembly technology of the instruction sequence in the analysis to obtain the information of interest. data to get the final result.

Preferably, the management center also includes establishing DNS communication with the blockchain couple.

Preferably, the Web application protection module also includes: setting IP access restrictions, screening users, checking whether the client has legal access rights, setting this function in the web server filtering module, and matching the IP address in the HTTP request with the With the IP address method in the blacklist, when a user requests a page and runs a JSP program, the Web server will read the access control file, and will obtain access control information from this process, and at the same time require the client to provide a user name and password, and then the browser will The user name and password are passed to the server, and after verification, the server will satisfy the content requested by the user, such as sending back the requested page or executing a JSP program.

Technical effects and advantages of the present invention: Through the blockchain server security protection system, comprehensive protection is realized in virus protection, patch protection, malware protection, intrusion detection and protection, access control, and integrity monitoring, and solves the problem of blockchain security. In the server, the servers attack each other, the security status is inconsistent, the operating environment is inconsistent, and the security risk of resource occupation storm reduces the security threat of the system, has the ability to resist the latest security threat, improves the security of the server, and thus guarantees High availability of blockchain business applications.

Description of drawings

Fig. 1 is a system block diagram of a protection system for a block chain management server of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The invention provides a protection system for a blockchain management server. The protection system includes gateway deployment, security agent, application deployment, security center and management center. The gateway is deployed on the protection wall to protect the edge security of the virtual platform, providing DHCP, NAT, unified firewall, responsible for balancing, VPN, and port isolation functions, security agents are deployed in the blockchain server, providing anti-virus engines and anti-virus databases for the entire blockchain server, applications are deployed in the blockchain server, Provide agentless virus killing, IDS/IPS, program protection, program control, integrity monitoring, and log auditing. The security center is responsible for uniformly updating the virus database and providing trusted data access. By establishing and maintaining a global cache of scanned files, Save the files that have been security scanned, and the management center enables administrators to manage security policies and apply security policies to servers, as well as security updates and generate reports, which can be used to manage, deploy, report, record and integrate third-party security services to achieve Role-based access control and separation of duties;

The risks of the blockchain management server specifically include: mutual attacks between blockchain services, inconsistent security status, inconsistent operating environment, resource occupation storms, tool vulnerability risks, data security risks, and system replication risks.

The protection system also includes: a virus protection module, a patch protection module, a malware protection module, a Web application protection module, an intrusion prevention module, an access control module, an intrusion detection module, an integrity detection module, an application isolation module and a stateful firewall.

Virus protection module: Aiming at the problems of inconsistent security status and resource occupation storms in the blockchain server service environment, the virus protection module provides agentless virus protection, and uses heuristic scanning to detect and kill viruses in a timely manner;

Patch protection module: evaluate the blockchain server through patch technology, and automatically provide comprehensive vulnerability patching for each blockchain server, and provide interception against vulnerability attacks before the patch is installed;

Malware protection module: integrates VMware vShield Endpoint API, which can prevent the blockchain server from being attacked by viruses and Trojan malware, thereby providing protection for complex attacks in the blockchain server environment and interfering with security;

Web application protection module: prevents cross-site scripting attacks and other web application vulnerabilities, and provides automatic notifications including summary information such as attackers and attack time.

Intrusion prevention module: By blocking SQL injection attacks, denial of service attacks, worm intrusion attacks, etc., it provides high security protection for blockchain servers, checks all incoming and outgoing data packets, and does not allow protocol modification, Content that violates security policies and leads to attacks has opportunities;

Access control module: Provides access control functions based on state detection, realizes access control based on blockchain server network ports, realizes logical isolation between blockchain servers, and at the same time identifies and intercepts various flooding attacks, according to traffic Management protocol blocks illegal traffic and optimizes traffic distribution;

Intrusion detection module: Based on the protocol, it provides policy-based monitoring and analysis tools to more accurately monitor, analyze and access control traffic, and at the same time conduct network behavior analysis to quickly and accurately detect intrusions in an unattended environment behaviors, matching attack signatures with signature databases, recording new attack signatures, and continuously improving signature databases.

Integrity detection module: supports baseline-based monitoring of key files such as files, directories, and registry. If these key locations are maliciously tampered with or infected with viruses, the system will automatically send an alarm to the administrator and record the problem;

Application isolation module: supports separation of virtual applications, thereby avoiding mutual infection between blockchain server applications, and uses signature-based intrusion prevention functions to protect HTTP and FTP services;

Stateful firewall: carry out fine-grained filtering, design policies for the network and location-aware functions based on IP protocols, reduce the attack range of servers, centrally manage server firewall policies, prevent denial of service attacks and detect reconnaissance scans.

The integrity detection module also includes suspicious file analysis, specifically: select parameters, analyze the selected customer service system parameters, use the disassembly technology of the command sequence in the analysis to obtain the data of interest, and obtain the final result.

The management center also includes establishing DNS communication with the blockchain couple, which specifically includes the following steps:

Step S1: The client sends a city name query request to the server and proposes specific query content. When the query content of the client belongs to the host name within the domain name of the server, the DNS server will directly answer the client and inform the IP address , when the content inquired by the client belongs to other domain names, it will first query the server's own cache content to see if there is any relevant information. If found, it will reply to the client and inform the IP address;

Step S2: If no relevant information is found in the server's own cache content, the server will turn to the root server for query. After receiving the server's query information, the root server will notify the location of the authorized server at the next layer under the city name, that is, the IP address The server may contain multiple lower-level authorization server addresses. The local server will then query one of the authorization servers and store the list of lower-level authorization server addresses in the cache. Later, when the client requests similar content, it can Reply directly to the client;

Step S3: The remote authorization server responds to the query of the local server. If the response from the remote authorization server is not the answer of the last layer, the query continues until the result required by the client is obtained. The local server responds to the client with the query result, and At the same time, the query results are stored in the cache of the server. If the same query from the client is received before the storage time of the local server has expired, the data stored in the cache of the server will be used as a response.

The web application protection module also includes: setting IP access restrictions, screening users, checking whether customers have legal access rights, setting this function in the web server filtering module, and matching the IP address in the HTTP request with the IP in the blacklist Address mode, when a user requests a page and runs a JSP program, the Web server will read the access control file, and will obtain access control information from this process, and at the same time ask the client to provide a user name and password, and then the browser will pass the user name and password to The server, after verification, the server will satisfy the content requested by the user, such as sending back the requested page or executing the JSP program.

The content not described in detail in this specification belongs to the prior art known to those skilled in the art. The specific embodiments described herein are merely illustrative of the spirit of the invention. Those skilled in the art to which the present invention belongs can make various modifications or supplements to the described specific embodiments or adopt similar methods to replace them, but they will not deviate from the spirit of the present invention or go beyond the definition of the appended claims range.

Claims (8)

1. A protection system for a block chain management server, characterized in that the protection system includes gateway deployment, security agent, application deployment, security center and management center, and the gateway deployment is deployed on the protective wall to protect the edge security of the virtual platform , providing DHCP, NAT, unified firewall, responsible for balancing, VPN, port isolation functions, security agents are deployed in the blockchain server, providing anti-virus engines and anti-virus databases for the entire blockchain server, and applications are deployed in the blockchain server Among them, agentless virus killing, IDS/IPS, program protection, program control, integrity monitoring and log auditing are provided. The security center is responsible for uniformly updating the virus database and providing credible data access. By establishing and maintaining a global database of scanned files Cache, save files that have been security scanned, and the management center enables administrators to perform security policy management and apply security policies to servers, as well as security updates and generate reports, which can be used to manage, deploy, report, record and integrate third-party security services , to achieve role-based access control and separation of duties; The protection system also includes: a virus protection module, a patch protection module, a malware protection module, a Web application protection module, an intrusion prevention module, an access control module, an intrusion detection module, an integrity detection module, an application isolation module and a stateful firewall. 2. The protection system for a block chain management server according to claim 1, wherein the virus protection module: for the inconsistency of the security state and the resource occupation storm problem existing in the block chain server service environment, Provide agent-free virus protection by implementing the virus protection module, and use heuristic scanning to detect and kill viruses in time; Patch protection module: Evaluate the blockchain server through patch technology, and automatically provide comprehensive vulnerability patching for each blockchain server, and provide interception against vulnerability attacks before the patch is installed. 3. The protection system for a block chain management server according to claim 1, wherein the malware protection module: integrates VMware vShield Endpoint API, which can prevent the block chain server from being subjected to viruses, Trojan horses and malware Infringement, thus providing protection for complex attacks in the blockchain server environment to interfere with security; Web application protection module: prevents cross-site scripting attacks and other web application vulnerabilities, and provides automatic notifications including summary information such as attackers and attack time. 4. The protection system for a block chain management server according to claim 1, wherein the intrusion protection module: by blocking SQL injection attacks, denial of service attacks, worm intrusion attacks, etc., for The blockchain server provides a high degree of security protection, checks all incoming and outgoing data packets, does not allow protocol modifications, and violates security policies to cause attacks; Access control module: Provides access control functions based on state detection, realizes access control based on blockchain server network ports, realizes logical isolation between blockchain servers, and at the same time identifies and intercepts various flooding attacks, according to traffic Management protocol blocks illegal traffic and optimizes traffic distribution; Intrusion detection module: Based on the protocol, it provides policy-based monitoring and analysis tools to more accurately monitor, analyze and access control traffic, and at the same time conduct network behavior analysis to quickly and accurately detect intrusions in an unattended environment behaviors, matching attack signatures with signature databases, recording new attack signatures, and continuously improving signature databases. 5. The protection system for a block chain management server according to claim 1, wherein the integrity detection module: supports key file monitoring functions such as baseline-based files, directories, and registration tables, and these key If the location is maliciously tampered with or infected with viruses, the system will automatically send an alert to the administrator and record the problem; Application isolation module: supports separation of virtual applications, thereby avoiding mutual infection between blockchain server applications, and uses signature-based intrusion prevention functions to protect HTTP and FTP services; Stateful firewall: carry out fine-grained filtering, design policies for the network and location-aware functions based on IP protocols, reduce the attack range of servers, centrally manage server firewall policies, prevent denial of service attacks and detect reconnaissance scans. 6. The protection system for a block chain management server according to claim 1, wherein the integrity detection module also includes suspicious file analysis, specifically: selected parameters, for the selected customer service Analyze the parameters of the end system, and use the disassembly technology of the instruction sequence in the analysis to obtain the data of interest and get the final result. 7. The protection system for a blockchain management server according to claim 1, wherein the management center further includes establishing DNS communication with the blockchain couple. 8. The protection system for a block chain management server according to claim 1, wherein the Web application protection module also includes: setting IP access restrictions, screening users, and checking whether customers have legal Access rights, set this function in the web server filtering module, by matching the IP address in the HTTP request and the IP address in the blacklist, when the user requests a page and runs a JSP program, the web server will read the access control file, and Access control information will be obtained from this process, and the client will be required to provide a user name and password, and then the browser will pass the user name and password to the server. After verification, the server will satisfy the content requested by the user, such as sending back the requested page or executing JSP program.