TWM644484U - Deployment system of information security equipment - Google Patents

Abstract

A deployment system for information security equipment, which includes a service provider, equipment to be set, and electronic devices; the service provider stores multiple deployment strategies, the deployment strategy has multiple setting guide information, and sets the identification string group of guide information configuration; The device to be set has identification information and multiple setting pages, and the setting pages match the identification string group; the electronic device obtains the identification information and packages it as a supply and packaging request, and the electronic device sends the supply and installation request to the service provider, and the service provider uses the identification information Select the deployment strategy and send the deployment strategy to the electronic device. The electronic device receives the page selection request and selects one of the setting pages. The electronic device searches for the corresponding setting guide information. The found setting guide information is the current guide information. Guidance information acquisition setting input.

Description

Deployment system of information security equipment

The invention relates to an installation and deployment system of electronic equipment, in particular to a deployment system of information security equipment.

Although various convenient online services are provided on the Internet, malicious programs or hackers also exist in the Internet. If the network equipment is attacked, the network service will stop at least, and even the user's own rights and interests will be affected. In order to resist cyber attacks, many users will choose to install physical information security devices or anti-virus software.

Since the setting items and parameters of the information security equipment (or anti-virus software) are too complicated, it needs to be set by experienced practitioners. For general users, users do not know each setting parameter and function of information security equipment. Furthermore, when the information security equipment detects an attack or an abnormal event occurs, the user may not be able to solve the corresponding problem. In addition, due to the wide variety of brands, machine models, or combinations of installed software of information security equipment. In addition to the fact that ordinary users cannot know the differences in the settings of various devices, this will also hinder the learning curve for novice practitioners for installation.

In view of this, in some embodiments, the deployment system of information security equipment can provide setting information or guidance prompts during software installation, so that construction personnel can follow the guidance prompts during the installation process to update the hardware or software of information security equipment. software to set. After the construction personnel complete the installation, the back-end server can also check whether the information security equipment is connected or operating normally.

In some embodiments, an information security equipment deployment system is used for setting multiple configuration pages of the equipment to be configured. The information security equipment deployment system includes a service provider and an electronic device. The service provider stores a plurality of deployment strategies, each deployment strategy has a plurality of setting guide information, each setting guide information configuration identification string group, and each setting page matches the identification string group; the identification string group electronic device The network is connected to the service provider and the device to be configured. The electronic device obtains the identification information and packages the identification information into a supply and installation request. The electronic device sends the supply and installation request to the service provider. The service provider selects a corresponding deployment strategy based on the identification information And send the deployment strategy to the electronic device. The electronic device receives the page selection request and selects one of the setting pages. The electronic device searches for the corresponding setting guide information according to the selected setting page. The found setting guide information is the current guide information. The device obtains the setting input value corresponding to the current guidance information, and fills the setting input value into the corresponding setting page, so that the device to be set stores the setting page and the corresponding setting input value.

In one embodiment, after the electronic device finishes inputting all setting pages and setting input values, the service provider records the equipment to be set into the managed list.

In one embodiment, the service provider regularly obtains a log from the device to be configured according to the managed list, and the log file records the operation status of the device to be configured.

In one embodiment, the service provider judges whether the device to be configured is abnormal according to the operating status. If the device to be configured is abnormal, the service provider generates an abnormality warning notification, and the service provider sends the abnormality warning notification to the client.

In one embodiment, the service provider generates a statistical report according to a plurality of operating states, and the client obtains the statistical report from the service provider according to the abnormal warning notification.

In some embodiments, the service provider obtains the configuration update notification, and the service provider forwards the configuration update notification to the device to be configured, so that the device to be configured is connected to the configuration server and obtains an update package, and the device to be configured uses the update package to perform renew.

The information security equipment deployment system provides real-time software and hardware installation information, so that construction personnel can directly refer to the prompt information during the installation of information security equipment or software. After the construction personnel complete the installation of the equipment to be set, the service provider can immediately manage the equipment to be set. In addition to instantly verifying the installation integrity of the device to be configured, the service provider can also provide corresponding network protection services to the device to be configured. If the service provider detects that an abnormality or event occurs in the device to be set, the service provider can send a corresponding message to the client or the specified object.

Please refer to FIG. 1 and FIG. 2 , which are schematic diagrams of the system architecture and components of some embodiments, respectively. The deployment system of information security equipment (hereinafter referred to as the deployment system 100 ) includes an electronic device 110 and a service provider 130 . The electronic device 110 includes an input unit 111 , a display unit 112 , a first network unit 113 , a first storage unit 114 and a first processing unit 115 . The first processing unit 115 is electrically connected to the display unit 112 , the input unit 111 , the first network unit 113 and the first storage unit 114 . For the convenience of description, the device 120 to be configured is drawn in FIG. 1 , so that the related processing of the electronic device 110 and the service provider 130 on the device 120 to be configured will be described later.

In addition to playing the screen of the operating system of the electronic device 110 , the display unit 112 can also play the operation interface and setting guide information 135 of the installation program 116 . The input unit 111 is used for inputting a page selection request, identification information 121 , set values or parameters, and the like. The input unit 111 can be an image capture device (for example: complementary metal oxide semiconductor (Complementary Metal Oxide Semiconductor, CMOS), to obtain the identification information 121 by image capture. In addition, the input unit 111 can also be a physical keyboard or a virtual key. Combination, etc. The first network unit 113 is connected to the device 120 to be set and the service provider 130. The first network unit 113 sends the supply and installation request 211 to the service provider 130, or receives the setting guide information of the service provider 130 135. The electronic device 110 may be, but not limited to, a mobile phone, a tablet, a notebook, a wearable device, or a personal computer.

The first processing unit 115 executes the installation program 116 stored in the first storage unit 114 . When the installation program 116 is executed, the first processing unit 115 drives the display unit 112 to play the user interface of the installation program 116 or the screen of setting guide information 135 . The installation program 116 also prompts the user to obtain the identification information 121 of the device 120 to be configured through the input unit 111 . The first processing unit 115 encapsulates the identification information 121 into a supply request 211 , and the first processing unit 115 drives the first network unit 113 to send the supply request 211 to the service provider 130 . The first network unit 113 can adopt IEEE802.X series Ethernet or wireless network communication protocols, and is connected to the device 120 to be configured or the service provider 130 through the network. The installation program 116 can be an independent application program, or can be executed through a browser or plug-in. The electronic device 110 performs parameter setting to the device to be set 120 .

The device to be configured 120 includes identification information 121 , a second network unit 122 , a second storage unit 123 and a second processing unit 124 . The type of the device 120 to be set can be a router, a gateway, a switch, a wireless access point, a personal computer, a notebook computer, a tablet computer or an Internet of Things device ( Internet of Things, IoT). The second processing unit 124 is electrically connected to the second network unit 122 and the second storage unit 123 . The second network unit 122 is network-connected to the electronic device 110 and the service provider 130 . The second processing unit 124 loads a plurality of setting pages 125 of the second storage unit 123 . Each setting page 125 corresponds to setting content of different aspects of the device 120 to be set, and each setting page 125 has a different number of input fields (no labels). The input field can be filled in or selected to set the corresponding input value 212 . The setting page 125 can be implemented as a webpage, or as an independent application program.

In addition, different setting pages 125 each match an identification string group, and each identification string group is a unique value, character, number, hash code or a combination thereof. For example, the identification string group may be a combination of a device number and a value (or character code) of the device 120 to be configured. The identification string group is determined according to the deployment strategy 134 and/or the setting guide information 135, which will be described later. The second processing unit 124 sequentially loads the setting page 125 according to the sequence of the identification string group, so that the electronic device 110 can set the corresponding setting page 125 . The second network unit 122 receives the set input value 212 of the electronic device 110 . Identification information 121 includes media access control code (Media Access Control, MAC), customer ID number, customer number, device identification code, universally unique identifier (Universally Unique Identifier), firmware version number, software name, software version number . The identification information 121 can be recorded on the physical sticker in the form of a two-dimensional barcode or text, or the identification information 121 can be stored in the second storage unit 123 .

The service provider 130 has a third network unit 131 , a third storage unit 132 and a third processing unit 133 . The third processing unit 133 is electrically connected to the third network unit 131 and the third storage unit 132 . The third network unit 131 is network-connected to the electronic device 110 and the device 120 to be configured. The third network unit 131 transmits the configuration guide information 135 to the electronic device 110 , and receives the supply and installation request 211 of the electronic device 110 or the confirmation notification of the device 120 to be configured.

The third storage unit 132 stores multiple sets of deployment strategies 134 , and each deployment strategy 134 further includes at least one setting guide information 135 . Each setting guide information 135 sets a corresponding identification string group, and each identification string group is unique and not repeated. For multiple setting pages 125 of the same device 120 to be set, different identification string groups of setting guidance information 135 will be matched respectively. The third processing unit 133 selects the corresponding deployment strategy 134 according to the provisioning requirement 211 , and drives the third network unit 131 to transmit the deployment strategy 134 and its setting guide information 135 to the electronic device 110 . The content of the setting guidance information 135 is matched with the device 120 to be set and the related setting page 125 . Since the deployment policy 134 corresponds to the device 120 to be configured. Therefore, each deployment strategy 134 can correspond to the device 120 to be configured and its software from different manufacturers.

In order to further describe the operation process of the deployment system 100 , please also refer to FIG. 3 . FIG. 3 is a schematic diagram of the operation flow of the deployment system 100 . The operation process of the deployment system 100 includes the following steps: Step S310: Connect the electronic device to the service provider and the device to be configured. The device to be configured has identification information and multiple configuration pages; Step S320: The electronic device acquires identification information of the device to be configured, and generates a supply and installation request for the corresponding identification information; Step S330: The electronic device sends a supply and installation request to the service provider, so that the service provider provides a corresponding deployment strategy; Step S340: The electronic device receives a page selection request, the electronic device selects one of the setting pages, and the electronic device searches for corresponding setting guide information according to the selected setting page, and the found setting guide information is the current guide information; Step S350: the electronic device fills the received setting input value into the corresponding setting page; and Step S360: The device to be set stores the setting page and the associated setting input value.

Before the electronic device 110 is connected to the service provider 130 , the service provider 130 stores multiple sets of deployment strategies 134 . Different deployment strategies 134 correspond to the devices 120 to be configured. And different devices 120 to be configured may respectively correspond to different manufacturers. The electronic device 110 enables the installation program 116 to connect the installation program 116 to the service provider 130 . The electronic device 110 can be connected to the service provider 130 through a wireless network or a wired network (corresponding to step S310). The installation program 116 can have a built-in default uniform resource locator (Uniform Resource Locator, URL or website address) or network address (Internet Protocol Address, referred to as IP), or the website address of the service provider 130 can be entered by the user (or IP address). After the installer 116 is connected to the service provider 130 , the installer 116 sends the identification information 121 to the service provider 130 .

Next, the electronic device 110 is connected to the device 120 to be configured via a network (corresponding to step S310). The electronic device 110 can obtain the identification information 121 by taking a picture or input the identification information 121 with a keyboard, so that the installation program 116 can generate the supply and installation request 211 according to the identification information 121 (corresponding to step S320). After the electronic device 110 acquires the identification information 121 of the device 120 to be configured, the installation program 116 transmits a supply and installation request 211 to the service provider 130 . The service provider 130 can obtain the corresponding deployment strategy 134 according to the identification information 121 (corresponding to step S330). The service provider 130 transmits the deployment policy 134 to the electronic device 110 and the installation program 116 . After the electronic device 110 receives the deployment strategy 134 , the installation program 116 drives the display unit 112 and prepares to play the deployment strategy 134 .

The electronic device 110 receives a page selection request. The user can select the setting page 125 through the input unit 111 and operation. The installation program 116 displays the selected setting page 125 on the display unit 112 . The installation program 116 selects the corresponding setting guide information 135 according to the currently loaded setting page 125 and the matching identification string group (corresponding to step S340 ). The selected setting guide information 135 is called current guide information. The installation program 116 simultaneously plays the setting page 125 and the current guidance information on the display unit 112 . The installation program 116 can present the setting page 125 and the setting guidance information 135 in a split screen or sub-window, or display the setting guidance information 135 in a pop-up window. The user can view the setting guide information 135 from the display unit 112 . The user then inputs the value of the current guidance information into the corresponding field of the setting page 125 according to the content prompted by the setting guidance information 135, and the input value is the setting input value 212 (corresponding to step S350).

Please refer to FIG. 4 , FIG. 5 , and FIG. 6 , which are schematic diagrams of three different setting pages 125 and corresponding setting guide information 135 of the installation program 116 . The installation program 116 in Fig. 4, Fig. 5, and Fig. 6 has n setting pages 125, and for convenience, the page label of each setting page 125 is set above the electronic device 110 in Fig. 4, Fig. 5, and Fig. 6 (tab pages) are also listed. But in fact, not all page tabs may necessarily appear at the same time, and one setting page 125 may be displayed on the display unit 112 at a time. And in the installation program 116, the black thick line frame is used as the active setting page 125 . And the display interface of the installation program 116 is divided into upper and lower two screens, displaying the setting guide information 135 (that is, the current guide information) and the content of the setting page 125 respectively.

Taking the page label of "page 1" as an example, the installation program 116 loads the setting guide information 135 according to the identification string group of the setting page 125 (corresponding to page 1). And assume that "page 1" is the system login page of the device 120 to be configured. The upper sub-screen of the setting guide information 135 in FIG. 4 displays the device model, user default account and default password, and the lower sub-screen of the setting page 125 displays the user's login account and password. If the device 120 to be set is set for the first time, the user can enter the default account and password into the setting page 125 and corresponding fields through the setting guide information 135 . The installation program 116 acquires a setting input value 212 according to the aforementioned fields, and sends the setting input value 212 to the device 120 to be set. In the example of FIG. 4 , after the installation program 116 sends the setting input value 212 to the device 120 to be configured, the installation program 116 can log in the system setting page of the device 120 to be configured.

After logging into the setting page, the installation program 116 further loads the setting page 125 of "page 2". At the same time, the installation program 116 loads the corresponding setting guide information 135 according to the identification string group of "page 2", as shown in FIG. 5 . Assume that "page 2" is a page for setting the network address of the device 120 to be set. The related content of "network address", "DNS address" and "MAC address" is displayed in the setting guide information 135 in FIG. 5 . The user can input the corresponding setting input value 212 to the corresponding field of the setting page 125 according to the setting guide information 135 . The installation program 116 then sends the input setting input value 212 (that is, the aforementioned network address) to the device 120 to be configured, so as to complete the network configuration of the device 120 to be configured (corresponding to step S360).

The setting page 125 in "page 3" is the various pass (or prohibition) rules of the firewall. The installation program 116 obtains the corresponding setting guide information 135 according to the setting page 125 of "page 3". The user can set the input value 21 for the corresponding field of the setting page 125 according to the content of the setting guide information 135 . The installation program 116 sends the obtained setting input value 21 to the device to be set 120 to complete the setting page 125 of the firewall rule.

In addition to the aforementioned setting of the hardware environment of the device to be set 120 , it can also be applied to the setting of the software of the device to be set 120 . The second processing unit 124 executes the application program stored in the second storage unit 123 and makes the application program generate identification information 121 . The second processing unit 124 can play the identification information 121 through the display device, or the installation program 116 obtains the identification information 121 from the device 120 to be configured through the network.

For example, the second processing unit 124 can convert the identification information 121 into a two-dimensional barcode (QR code), and display it on the display device of the device 120 to be configured, so that the electronic device 110 can obtain the identification information 121 . Alternatively, the second processing unit 124 may drive the second network unit 122 to search for electronic devices 110 with the installed program 116 in the network in the form of network broadcast. After the electronic device 110 receives the notification, the installation program 116 can perform corresponding setting operations on the software of the device 120 to be set according to the aforementioned method.

In some embodiments, after the electronic device 110 completes all the operations of setting the page 125 and setting the input value 212 , the electronic device 110 sends an operation completion notification to the service provider 130 . The service provider 130 records the corresponding to-be-configured device 120 into the managed list according to the operation completion notification. The operation completion notification includes the identification information 121 and the setting input values 212 for the service provider 130 to record the operation history of the device 120 to be set.

In some embodiments, the service provider 130 obtains the log file 712 (log) from the registered device 120 to be configured according to the managed list. The service provider 130 can regularly obtain the record file 712 from the device 120 to be configured in a fixed period. The record file 712 records the operation state of the device 120 to be configured. For example, the service provider 130 may request the record file 712 from the device 120 to be configured every 24 hours. The service provider 130 generates the record files 712 sequentially according to time.

In some embodiments, the service provider 130 determines whether the to-be-configured device 120 is abnormal according to the operating status. The service provider 130 can analyze and process the abnormality of the record file 712 obtained per unit time. If the device 120 to be configured is abnormal, the service provider 130 generates an abnormality warning notification 713 . The service provider 130 sends an abnormal warning notification 713 to the client 711 , please refer to FIG. 7 . For example, the service provider 130 can use the network traffic of the record file 712 for each hour within 12 hours as whether it has encountered a denial of service attack. The service provider 130 sends an abnormal warning notification 713 of a network attack to a designated client 711 .

In some embodiments, the service provider 130 generates a corresponding statistical report 714 according to the operation status. As mentioned in the previous example, the service provider 130 can be based on the network traffic, the number of packets and bytes of the session (session), the start timestamp and end timestamp of the session, the source IP and the destination IP, the source and the destination TCP (Transmission Control Protocol), UDP (User Datagram Protocol) connection port or ICMP type and code, processor overload (loading) or memory overload and other operating states, obtain the statistical report 714 of the specified time length. After the client 711 receives the abnormal warning notification 713 , the client 711 can send a report request request to the service provider 130 to obtain the statistical report 714 of the specified operation status and time.

In some embodiments, the service provider 130 obtains the configuration update notification 715 . The service provider 130 updates the content of the corresponding deployment strategy 134 and configuration guide information 135 according to the configuration update notification 715 . The configuration update notification 715 may be provided by the manufacturer or software provider of the device 120 to be configured. The content of configuration update can be but not limited to device firmware or software update. After the service provider 130 receives the configuration update notification 715, the service provider 130 can forward the configuration update notification 715 to the corresponding device 120 to be configured according to the managed list, so as to prompt the user to update the configuration of the device 120 to be configured .

In some embodiments, the electronic device 110 and the device 120 to be configured may belong to the same local area network. In the same local area network, the electronic device 110 can be connected to the device 120 to be configured through a wireless access point, a hub, or a switch of the local area network.

In some embodiments, the step of the electronic device 110 transmitting the supply request 211 to the service provider 130 in step S330 further includes the following steps, and please refer to FIG. 8 : Step S331: The service provider searches for a complete device list according to the identification information; Step S332: the service provider determines whether the device to be set is recorded in the complete device list; Step S333: If there is a device to be configured in the complete device list, the service provider provides a corresponding deployment strategy to the electronic device; and Step S334: If there is no device to be configured in the complete device list, the service provider generates a warning notification to the electronic device.

After the electronic device 110 sends the supply and installation request 211 to the service provider 130 , the service provider 130 provides a complete equipment list to the electronic device 110 . The complete equipment list records the installed or uninstalled equipment 120 to be set in the area. The service provider 130 determines whether the current device 120 to be configured belongs to the device 120 to be configured in the complete device list. If the device 120 to be configured exists in the complete device list, the service provider 130 sends a confirmation notification to the electronic device 110, and the service provider 130 provides the corresponding deployment policy 134 to the electronic device 110 (continuing to step S340). On the contrary, the service provider 130 sends a warning notification to the electronic device 110 to prompt the electronic device 110 to acquire the wrong device 120 to be configured.

The information security equipment deployment system 100 provides real-time software and hardware installation information, so that construction personnel can directly refer to the prompt information during installation of information security equipment or software. Moreover, during the installation process, the electronic device 110 can obtain the devices 120 to be configured and the deployment strategies 134 of each brand through the installation program 116 . The construction personnel do not need to go to each original factory platform one by one to download the corresponding software, or execute the software one by one to set the device 120 to be set. After the construction personnel complete the installation of the equipment 120 to be configured, the service provider 130 can take over the equipment 120 to be configured immediately. The service provider 130 can not only immediately verify the installation integrity of the device to be configured 120 , but also provide corresponding network protection services to the device to be configured 120 . If the service provider 130 detects that an abnormality or event occurs in the device 120 to be configured, the service provider 130 can send a corresponding message to the client 711 or the specified object.

100:Deploy the system 110: Electronic device 111: input unit 112: display unit 113: The first network unit 114: the first storage unit 115: The first processing unit 116: Install program 120: Equipment to be set 121: Identification information 122: Second network unit 123: Second storage unit 124: Second processing unit 125: Set pagination 130: service provider 131: The third network unit 132: The third storage unit 133: The third processing unit 134: Deployment strategy 135: Set guide information 211: Supply and installation requirements 212: set input value 711: client 712: Record file 713: Abnormal warning notification 714: Statistical report 715: Configuration update notification S310~S360, S331~S334: steps

Fig. 1 is a schematic diagram of the system architecture of some embodiments. FIG. 2 is a schematic diagram of elements of some embodiments. FIG. 3 is a schematic diagram of the operation flow of the deployment system of some embodiments. FIG. 4 is a schematic diagram of setting pages and setting guide information in some embodiments. FIG. 5 is a schematic diagram of another setting page and setting guide information of some embodiments. FIG. 6 is a schematic diagram of setting page and setting guide information in some embodiments. FIG. 7 is a schematic diagram of abnormal warning notification in some embodiments. FIG. 8 is a schematic diagram of the operation flow of step S330 in some embodiments.

100:Deploy the system

110: Electronic device

116: Install program

120: Equipment to be set

121: Identification information

125: Set pagination

130: service provider

134: Deployment strategy

135: Set guide information

211: Supply and installation requirements

Claims (8)

A deployment system for information security equipment is used to set multiple setting pages of a device to be set. The deployment system for information security equipment includes: A service provider, storing multiple deployment strategies, each deployment strategy has multiple setting guide information, each setting guide information configures an identification string group, and each setting page matches the identification string group ;as well as An electronic device, the electronic device is connected to the service provider and the device to be configured, the electronic device obtains identification information, and packages the identification information into a supply and installation request, and the electronic device sends the supply and installation request to The service provider, the service provider selects the corresponding deployment strategy according to the identification information and sends the deployment strategy to the electronic device, the electronic device receives a page selection request and selects one of the setting pages, the electronic device The device searches for the corresponding setting guidance information according to the selected setting page, the found setting guidance information is current guidance information, the electronic device obtains a setting input value corresponding to the current guidance information, and inputs the setting The value is filled in the corresponding setting page, so that the device to be set stores the setting page and the associated setting input value. The deployment system of information security equipment according to claim 1, wherein the equipment to be configured is a router, a gateway, a switch, a wireless network base station, a personal computer, a notebook computer or a tablet computer. The deployment system of information security equipment as described in Claim 1, wherein the identification information includes media access control code, customer ID number, customer number, equipment identification code, universally unique identification code, firmware version number, software name or Software version number. The deployment system of information security equipment as described in Claim 1, wherein after the electronic device completes the input of all the setting pages and the setting input values, the service provider records the equipment to be set into a managed list. The deployment system for information security equipment as described in Claim 4, wherein the service provider regularly obtains a record file from the device to be configured according to the managed list, and the log file records an operation status of the device to be configured. The deployment system for information security equipment as described in claim 5, wherein the service provider judges whether the device to be configured is abnormal according to the operating status, and if the device to be configured is abnormal, the service provider generates an abnormality warning notification, the service provider sends the abnormal warning notification to a client. The deployment system of information security equipment as described in claim 6, wherein the service provider generates a statistical report according to a plurality of the operating states, and the client obtains the statistical report from the service provider according to the abnormal warning notification. The deployment system for information security equipment as described in claim 1, wherein the service provider obtains a configuration update notification, and the service provider forwards the configuration update notification to the device to be configured, so that the device to be configured is connected to a The configuration server obtains an update package, and the device to be configured is updated with the update package.

Images