CN102801699B - The system preventing server data from distorting, method and apparatus - Google Patents

Abstract

The invention provides a system, method and equipment for preventing server data tampering. The system includes a fixed host, a main server and a backup server. The fixed host is used to record login user information and modify operation information and verify user keys, and send modification instructions to the main server and backup server; the main server is used to receive the information sent by the fixed host. When receiving the information sent by the non-fixed host or the backup server, it will record the illegal access information and give an alarm; the backup server is used to receive the modification instructions sent by the fixed host and the main server. The main server is connected to a local area network, and the backup server is connected to an external network, and the main server and the backup server adopt different architectures and operating systems. The method of the invention effectively prevents the content of the server from being tampered with, and improves the security of the server.

Description

System, method and device for preventing server data tampering

technical field

The invention relates to the field of host security, in particular to a system, method and equipment for preventing server data tampering.

Background technique

With the development of the Internet age, there will be more and more computer servers, and the security of servers is becoming more and more important. Many existing servers use backup servers to ensure data integrity, and use some methods to encrypt data or monitor servers. But when the server is compromised, the integrity of the data cannot be preserved, and the server data or homepage will be tampered with.

Contents of the invention

The invention provides a system, method and device for preventing tampering of server data, which solves the problem that server data is maliciously modified and data integrity cannot be guaranteed after server data is maliciously modified.

A system for preventing tampering of server data, comprising:

Fixed host, used to record login user information and modify operation information, verify the user key before sending the user modification command, if the user key is correct, add the host verification information to the user modification command, send it to the main server and backup server, and receive Confirm the information, if the user key is wrong, an alarm signal will be generated;

The main server is used to receive user modification instructions, and judge whether the sending end is a fixed host, if so, modify according to the user modification instructions, record the modification time and operation type, and return confirmation information, otherwise it is confirmed as illegal access, and record Number of illegal visits and illegal access information;

The main server receives and records the operation status information sent by the backup server, and judges whether there are suspicious processes or wrong files, and if so, sends modification information and generates an alarm signal;

The backup server is used to receive user modification instructions and determine whether the sending end is a fixed host. If so, modify according to the user modification instructions, record the modification time and operation type, and return confirmation information, otherwise it is confirmed as illegal access and recorded Number of illegal visits and illegal access information;

The backup server is used to send the operation status information to the main server and receive the modification information sent by the main server, and judge whether the sending end is the main server, if so, modify the file according to the modification information sent by the main server, otherwise it is confirmed as illegal access , and record the number of illegal accesses and illegal access information.

In the system, the host verification information at least includes: MAC address, IP address and CPU information of the fixed host.

In the system, when the number of illegal accesses of the main server or the backup server is greater than a preset value, the main server or the backup server generates an alarm signal.

In the system, the illegal access information at least includes: host name, IP address and operation type.

In the system, the main server is connected to the local area network, and the backup server is connected to the external network, and the main server and the backup server adopt different architectures and operating systems.

A method for preventing tampering of server data, suitable for a fixed host in a system for preventing tampering of server data, the method comprising:

Record login user information and modify operation information;

Verify the user key before sending the user modification command. If the user key is correct, add the host verification information to the user modification command, send it to the main server and backup server, and receive confirmation information. If the user key is wrong, an alarm signal will be generated.

In the method, the host authentication information at least includes: MAC address, IP address and CPU information of the fixed host.

The user key can be in various forms, such as Ukey or CD key.

A fixed host device comprising:

Recording module, used to record login user information and modify operation information;

The key verification module is used to verify the user key before sending the modification command. If the user key is correct, it will enter the distribution module, otherwise it will enter the alarm module;

The distribution module is used to add the host authentication information to the user modification instruction when the authentication key is correct, send it to the main server and the backup server, and receive the confirmation information;

The alarm module is used to generate an alarm signal when the verification user key is wrong.

The device described above is characterized in that, the host authentication information at least includes: MAC address, IP address and CPU information of the fixed host.

A method for preventing tampering of server data, suitable for a master server in a system for preventing tampering of server data, comprising:

Receive user modification instructions or operation status information sent by the backup server;

If it is a user modification command, judge whether the sending end is a fixed host, if so, modify it according to the user modification command, record the modification time and operation type, and return confirmation information, otherwise it is confirmed as illegal access, and record the number of illegal access and Unlawful access to information;

If it is the running status information sent by the backup server, then record the running status information of the backup server, and judge whether there is a suspicious process or an error file, and if so, send the modification information and generate an alarm signal.

In the method, when the number of illegal accesses is greater than a preset value, an alarm signal is generated.

In the method, the illegal access information at least includes: access host name, IP address and operation type.

In the described method, the operation information at least includes:

The MD5 information of the main file of the backup server and the name and number of running processes.

In the method, the modification information is file information on the main server corresponding to the suspicious file.

The method for judging the wrong file in the method can be, compare the MD5 value of the main file sent by the backup server with the MD5 value of the corresponding file in the main server, if they are the same, the file is correct, otherwise the file is wrong. If the file is correct, no information will be fed back. If the file is wrong, the file on the backup server will be changed to the file on the master server.

A master server device comprising:

The receiving module is used to receive user modification instructions or operation status information sent by the backup server;

The fixed host verification module is used to determine whether the sending end is a fixed host when receiving a user modification instruction, and if so, modify it according to the user modification instruction, otherwise it is confirmed as an illegal access;

The recording module is used to record the modification time and operation type, the number of illegal accesses and illegal access information, and the operation status information of the backup server;

The detection and modification module is used to determine whether there is a suspicious process or an error file when receiving the operation status information sent by the backup server, and if it enters the alarm module and the sending module;

An alarm module, configured to generate an alarm signal;

The sending module is used to return confirmation information to the fixed host or send modification information to the backup server.

In the device, when the number of illegal accesses is greater than a preset value, the alarm module generates an alarm signal.

The recording module can also expand the recording content according to requirements, such as recording the time and file content sent by the primary server to the backup server for modification information.

A method for preventing tampering of server data, suitable for a backup server in a system for preventing server data tampering, comprising:

Receive user modification instructions or send operating status information to the main server;

If the user modification instruction is received, it is judged whether the sending end is a fixed host, if yes, it is modified according to the user modification instruction, the modification time and operation type are recorded, and a confirmation message is returned, otherwise it is confirmed as illegal access, and the number of illegal access and the number of illegal access are recorded. Unlawful access to information;

If the operation status information is sent to the main server, it will receive the modification information sent by the main server, and judge whether the sending end is the main server, if so, modify the file according to the modification information sent by the main server, otherwise it will be confirmed as illegal access, and record Number of illegal visits and information on illegal visits.

In the method, when the number of illegal accesses is greater than a preset value, an alarm signal is generated.

In the method, the illegal access information at least includes: access host name, IP address and operation type.

In the method, the running information at least includes: the MD5 information of the main file of the backup server and the name and number of running processes.

A backup server device comprising:

The receiving module is used to receive user modification instructions and modification information sent by the main server;

The fixed host and main server verification module is used to determine whether the sending end is a fixed host or a main server when receiving user modification instructions or modification information sent by the main server. If it is a fixed host, enter the modification module. If it is the main server, Then enter the main server to modify the module, otherwise it is confirmed as illegal access;

Recording module, used to record modification time and operation type, illegal access times and illegal access information;

The modification module is used to modify according to the user modification instruction and return confirmation information;

A security reporting module, used to send operating information to the main server;

The main server modification module is configured to receive the modification information sent by the main server, and modify the file according to the modification information sent by the main server.

The device also includes an alarm module, which is used to generate an alarm signal when the number of illegal accesses is greater than a preset value.

In the present invention, the main server is not directly connected to the external network, but only exists in the local area network, and the backup server is connected to the external network and has a link with the main server. In order to ensure the security of the server, the two servers use CPUs with different architectures and install different operating systems, which greatly increases the difficulty of tampering with server data, thereby improving server security. There are also strict restrictions on the modification of server content, and only fixed machines can be used for modification. At the same time, fixed hosts will also perform external key verification when they are in use.

The invention provides a system, method and equipment for preventing server data tampering. The system includes a fixed host, a main server and a backup server. The fixed host is used to record login user information and modify operation information and verify user keys, and send modification instructions to the main server and backup server; the main server is used to receive the information sent by the fixed host. When receiving the information sent by the non-fixed host or the backup server, it will record the illegal access information and give an alarm; the backup server is used to receive the modification instructions sent by the fixed host and the main server. The main server is connected to a local area network, and the backup server is connected to an external network, and the main server and the backup server adopt different architectures and operating systems. The method of the invention effectively prevents the content of the server from being tampered with, and improves the security of the server.

Description of drawings

In order to more clearly illustrate the present invention or the technical solutions in the prior art, the accompanying drawings that need to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings in the following description are only the present invention. For some embodiments described in the invention, those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is a schematic diagram of a system for preventing server data tampering;

Fig. 2 is a flow chart of a method for fixing a host in a method for preventing tampering of server data;

Fig. 3 is a structural diagram of a fixed host device;

Fig. 4 is a flow chart of the main server method in a method for preventing server data tampering;

Fig. 5 is a kind of master server device structural diagram;

Fig. 6 is a flow chart of a method for backing up a server in a method for preventing tampering of server data;

FIG. 7 is a structural diagram of a backup server device.

Detailed ways

In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the technical solutions in the present invention will be further detailed below in conjunction with the accompanying drawings illustrate.

The invention provides a system, method and device for preventing tampering of server data, which solves the problem that server data is maliciously modified and data integrity cannot be guaranteed after server data is maliciously modified.

A system for preventing tampering of server data, as shown in Figure 1, includes:

Fixed host 101, used to record login user information and modify operation information, verify the user key before sending the user modification command, if the user key is correct, add the host verification information to the user modification command, send it to the main server and the backup server, and Receive confirmation information, if the user key is wrong, an alarm signal will be generated;

The main server 102 is used to receive the user modification instruction, and judge whether the sending end is a fixed host, if so, then modify according to the user modification instruction, record the modification time and operation type, and return confirmation information, otherwise it is confirmed as illegal access, and Record the number of illegal visits and illegal visit information;

The main server receives and records the operation status information sent by the backup server, and judges whether there are suspicious processes or wrong files, and if so, sends modification information and generates an alarm signal;

The backup server 103 is used to receive the user modification instruction, and judge whether the sending end is a fixed host, if so, then modify according to the user modification instruction, record the modification time and operation type, and return confirmation information, otherwise it is confirmed as illegal access, and Record the number of illegal visits and illegal visit information;

The backup server 103 sends the operation status information to the main server and receives the modification information sent by the main server, and judges whether the sending end is the main server, if so, then carries out file modification according to the modification information sent by the main server, otherwise it is confirmed as illegal access, and Record the number of illegal visits and illegal visit information.

In the system, the host verification information at least includes: MAC address, IP address and CPU information of the fixed host.

In the system, when the number of illegal accesses of the main server or the backup server is greater than a preset value, the main server or the backup server generates an alarm signal.

In the system, the illegal access information at least includes: host name, IP address and operation type.

In the system, the main server is connected to the local area network, and the backup server is connected to the external network, and the main server and the backup server adopt different architectures and operating systems. For example, the main server adopts the X86 architecture window operating system, and the backup server adopts the ARM architecture Linux operating system.

A method for preventing tampering of server data, suitable for a fixed host in a system for preventing tampering of server data, as shown in Figure 2, the method comprising:

S201: Record login user information and modify operation information;

S202: verify the user key before sending the user modification instruction, if the user key is correct, execute S203, and if the user key is wrong, execute S205;

S203: Add the host verification information to the user modification instruction, and send it to the main server and the backup server;

S204: Receive confirmation information, and end modification;

S205: Generate an alarm signal.

In the method, the host authentication information at least includes: MAC address, IP address and CPU information of the fixed host.

The user key can be in various forms, such as Ukey or CD key.

A fixed host device, as shown in Figure 3, includes:

A recording module 301, configured to record login user information and modify operation information;

The key verification module 302 is used to verify the user key before sending the modification instruction, if the user key is correct, then enter the distribution module, otherwise enter the alarm module;

The distribution module 303 is used to add the host verification information to the user modification instruction when the verification key is correct, send it to the main server and the backup server, and receive confirmation information;

The alarm module 304 is configured to generate an alarm signal when the verification user key is wrong.

The device described above is characterized in that, the host authentication information at least includes: MAC address, IP address and CPU information of the fixed host.

A method for preventing tampering of server data, suitable for a master server in a system for preventing tampering of server data, as shown in Figure 4, comprising:

S401: Receive the user modification instruction or the operation status information sent by the backup server; if it is the user modification instruction, execute S402, and if it is the operation status information sent by the backup server, execute S405;

S402: Determine whether the sending end is a fixed host, if so, execute S403, otherwise confirm that it is an illegal access, execute S404;

S403: Modify according to the user modification instruction, record the modification time and operation type, and return confirmation information;

S404: Record the number of illegal visits and illegal visit information, but do not return any information;

S405: Recording information about the operation status of the backup server;

S406: judging whether there is a suspicious process or an error file, if there is, then execute S407, if not, then do not make any response;

S407: Send modification information and generate an alarm signal.

In the method, when the number of illegal accesses is greater than a preset value, an alarm signal is generated.

In the method, the illegal access information at least includes: access host name, IP address and operation type.

In the described method, the operation information at least includes:

The MD5 information of the main file of the backup server and the name and number of running processes.

In the method, the modification information is file information on the main server corresponding to the suspicious file.

The method for judging the wrong file in the method can be, compare the MD5 value of the main file sent by the backup server with the MD5 value of the corresponding file in the main server, if they are the same, the file is correct, otherwise the file is wrong. If the file is correct, no information will be fed back. If the file is wrong, the file on the backup server will be changed to the file on the master server.

A main server device, as shown in Figure 5, includes:

The receiving module 501 is used to receive the user modification instruction or the operation status information sent by the backup server;

The fixed host authentication module 502 is used to determine whether the sending end is a fixed host when receiving a user modification instruction, and if so, modify it according to the user modification instruction, otherwise it is confirmed as an illegal access;

Recording module 503, for recording modification time and operation type, illegal access times and illegal access information and backup server operation information;

The detection and modification module 504 is used to determine whether there is a suspicious process or an error file when receiving the operation status information sent by the backup server, and if so, enter the alarm module and the sending module;

An alarm module 505, configured to generate an alarm signal;

The sending module 506 is configured to return confirmation information to the fixed host or send modification information to the backup server.

In the device, when the number of illegal accesses is greater than a preset value, the alarm module generates an alarm signal.

The recording module can also expand the recording content according to requirements, such as recording the time and file content sent by the primary server to the backup server for modification information.

A method for preventing tampering of server data is suitable for a backup server in a system for preventing tampering of server data, as shown in Figure 6, comprising:

S601: Receive the user modification instruction or send the operation status information to the main server; if the user modification instruction is received, execute S602, and if send the operation status information to the main server, execute S605;

S602: Determine whether the sending end is a fixed host, if so, execute S603, otherwise confirm that it is an illegal access, and execute S604;

S603: Modify according to the user modification instruction, record the modification time and operation type, and return confirmation information;

S604: Record the number of illegal visits and illegal visit information, but do not return any information;

S605: Receive modification information sent by the main server;

S606: Determine whether the sending end is the main server, if so, execute S607, otherwise confirm that it is illegal access, and execute S608;

S607: Modify the file according to the modification information sent by the master server;

S608: Record the number of illegal access times and illegal access information, but not return any information.

In the method, when the number of illegal accesses is greater than a preset value, an alarm signal is generated.

In the method, the illegal access information at least includes: access host name, IP address and operation type.

In the method, the running information at least includes: the MD5 information of the main file of the backup server and the name and number of running processes.

A backup server device, as shown in Figure 7, includes:

A receiving module 701, configured to receive user modification instructions and modification information sent by the main server;

The fixed host and main server verification module 702 is used to determine whether the sending end is a fixed host or a main server when receiving a modification instruction from a user or a main server. If it is a fixed host, it enters the modification module 704. server, then enter the main server modification module 406, otherwise it is confirmed as illegal access;

A recording module 703, configured to record modification time, operation type, illegal access times and illegal access information;

A modification module 704, configured to modify according to the user modification instruction, and return confirmation information;

A safety reporting module 705, configured to send operation information to the main server;

The main server modification module 706 is configured to receive the modification information sent by the main server, and modify the file according to the modification information sent by the main server.

The device further includes an alarm module 707, configured to generate an alarm signal when the number of illegal accesses is greater than a preset value.

In the present invention, the main server is not directly connected to the external network, but only exists in the local area network, and the backup server is connected to the external network and has a link with the main server. In order to ensure the security of the server, the two servers use CPUs with different architectures and install different operating systems, which greatly increases the difficulty of tampering with server data, thereby improving server security. There are also strict restrictions on the modification of server content, and only fixed machines can be used for modification. At the same time, fixed hosts will also perform external key verification when they are in use.

The invention provides a system, method and equipment for preventing server data tampering. The system includes a fixed host, a main server and a backup server. The fixed host is used to record login user information and modify operation information and verify user keys, and send modification instructions to the main server and backup server; the main server is used to receive the information sent by the fixed host. When receiving the information sent by the non-fixed host or the backup server, it will record the illegal access information and give an alarm; the backup server is used to receive the modification instructions sent by the fixed host and the main server. The main server is connected to a local area network, and the backup server is connected to an external network, and the main server and the backup server adopt different architectures and operating systems. The method of the invention effectively prevents the content of the server from being tampered with, and improves the security of the server.

While the invention has been described by way of example, those skilled in the art will appreciate that there are many variations and changes to the invention without departing from the spirit of the invention, and it is intended that the appended claims cover such variations and changes without departing from the spirit of the invention.

Claims (21)

1. A system for preventing tampering of server data, characterized in that it comprises: Fixed host, used to record login user information and modify operation information, verify the user key before sending the user modification command, if the user key is correct, add the host verification information to the user modification command, send it to the main server and backup server, and receive Confirm the information, if the user key is wrong, an alarm signal will be generated; The main server is used to receive user modification instructions, and judge whether the sending end is a fixed host, if so, modify according to the user modification instructions, record the modification time and operation type, and return confirmation information, otherwise it is confirmed as illegal access, and record Number of illegal visits and illegal access information; The main server receives and records the operation status information sent by the backup server, and judges whether there are suspicious processes or wrong files, and if so, sends modification information and generates an alarm signal; The backup server is used to receive user modification instructions and determine whether the sending end is a fixed host. If so, modify according to the user modification instructions, record the modification time and operation type, and return confirmation information, otherwise it is confirmed as illegal access and recorded Number of illegal visits and illegal access information; It is used to send the operation status information to the main server and receive the modification information sent by the main server, and judge whether the sending end is the main server. If so, modify the file according to the modification information sent by the main server. Otherwise, it is confirmed as illegal access and recorded Number of illegal visits and illegal access information; The main server is connected to the local area network, and the backup server is connected to the external network, and the main server and the backup server adopt different architectures and operating systems. 2. The system according to claim 1, wherein the host authentication information at least includes: MAC address, IP address and CPU information of the fixed host. 3. The system according to claim 1, wherein when the number of illegal accesses of the primary server or the backup server is greater than a preset value, the primary server or the backup server generates an alarm signal. 4. The system according to claim 1, wherein the illegal access information at least includes: host name, IP address and operation type. 5. A method for preventing tampering of server data, characterized in that it is applicable to the fixed host in the system according to claim 1, said method comprising: Record login user information and modify operation information; Verify the user key before sending the user modification command. If the user key is correct, add the host verification information to the user modification command, send it to the main server and backup server, and receive confirmation information. If the user key is wrong, an alarm signal will be generated. 6. The method according to claim 5, wherein the host verification information at least includes: MAC address, IP address and CPU information of the fixed host. 7. A fixed host device, suitable for the system according to claim 1, characterized in that it comprises: Recording module, used to record login user information and modify operation information; The key verification module is used to verify the user key before sending the modification command. If the user key is correct, it will enter the distribution module, otherwise it will enter the alarm module; The distribution module is used to add the host authentication information to the user modification instruction when the authentication key is correct, send it to the main server and the backup server, and receive the confirmation information; The alarm module is used to generate an alarm signal when the verification user key is wrong. 8. The device according to claim 7, wherein the host authentication information at least includes: MAC address, IP address and CPU information of the fixed host. 9. A method for preventing tampering of server data, characterized in that it is applicable to the master server in the system according to claim 1, said method comprising: Receive user modification instructions or operation status information sent by the backup server; If it is a user modification command, judge whether the sending end is a fixed host, if so, modify it according to the user modification command, record the modification time and operation type, and return confirmation information, otherwise it is confirmed as illegal access, and record the number of illegal access and Unlawful access to information; If it is the running status information sent by the backup server, then record the running status information of the backup server, and judge whether there is a suspicious process or an error file, and if so, send the modification information and generate an alarm signal. 10. The method according to claim 9, wherein an alarm signal is generated when the number of illegal accesses is greater than a preset value. 11. The method according to claim 9, wherein the illegal access information at least includes: access host name, IP address and operation type. 12. The method according to claim 9, characterized in that, the operation information at least includes: The MD5 information of the main file of the backup server and the name and number of running processes. 13. The method according to claim 9, wherein the modification information is file information on the main server corresponding to the suspicious file. 14. A master server device, which is suitable for the system according to claim 1, said device comprising: The receiving module is used to receive user modification instructions or operation status information sent by the backup server; The fixed host verification module is used to determine whether the sending end is a fixed host when receiving a user modification instruction, and if so, modify it according to the user modification instruction, otherwise it is confirmed as an illegal access; The recording module is used to record the modification time and operation type, the number of illegal accesses and illegal access information, and the operation status information of the backup server; The detection and modification module is used to determine whether there is a suspicious process or an error file when receiving the operation status information sent by the backup server, and if it enters the alarm module and the sending module; An alarm module, configured to generate an alarm signal; The sending module is used to return confirmation information to the fixed host or send modification information to the backup server. 15. The device according to claim 14, wherein the alarm module generates an alarm signal when the number of illegal accesses is greater than a preset value. 16. A method for preventing tampering of server data, characterized in that it is applicable to the backup server in the system according to claim 1, said method comprising: Receive user modification instructions or send operating status information to the main server; If the user modification instruction is received, it is judged whether the sending end is a fixed host, if yes, it is modified according to the user modification instruction, the modification time and operation type are recorded, and a confirmation message is returned, otherwise it is confirmed as illegal access, and the number of illegal access and the number of illegal access are recorded. Unlawful access to information; If the operation status information is sent to the main server, it will receive the modification information sent by the main server, and judge whether the sending end is the main server, if so, modify the file according to the modification information sent by the main server, otherwise it will be confirmed as illegal access, and record Number of illegal visits and information on illegal visits. 17. The method according to claim 16, wherein an alarm signal is generated when the number of illegal accesses is greater than a preset value. 18. The method according to claim 16, wherein the illegal access information at least includes: access host name, IP address and operation type. 19. The method according to claim 16, characterized in that, the operation information at least includes: The MD5 information of the main file of the backup server and the name and number of running processes. 20. A backup server device, characterized in that it is suitable for the system according to claim 1, said device comprising: The receiving module is used to receive user modification instructions and modification information sent by the main server; The fixed host and main server verification module is used to determine whether the sending end is a fixed host or a main server when receiving user modification instructions or modification information sent by the main server. If it is a fixed host, enter the modification module. If it is the main server, Then enter the main server to modify the module, otherwise it is confirmed as illegal access; Recording module, used to record modification time and operation type, illegal access times and illegal access information; The modification module is used to modify according to the user modification instruction and return confirmation information; A security reporting module, used to send operating information to the main server; The main server modification module is configured to receive the modification information sent by the main server, and modify the file according to the modification information sent by the main server. 21. The device according to claim 20, further comprising an alarm module, configured to generate an alarm signal when the number of times of illegal access is greater than a preset value.