Patent Publication Number: US-8978134-B2

Title: Security configuration verification device and method and network system employing the same

Description:
This application is a 35 USC 371 national phase filing of international application number PCT/CN2011/001929, filed Nov. 18, 2011, which claims priority to Chinese national application number 201010549861.7, filed Nov. 18, 2010, the disclosures of which are incorporated herein by reference in their entireties. 
     FIELD OF THE INVENTION 
     The invention relates to the field of network security, and in particular, to a security configuration verification device and method for verifying the security configuration of a network device as well as a network system employing the security configuration verification device. 
     BACKGROUND OF THE INVENTION 
     With the continuous development of the information technology, the network services and network applications are also ever increasing, and the servers or network devices carrying these network services and network applications also continuously hit the shelves. The security of the servers or network devices also draws more and more attention. When a network service or application is illegally intruded, a most important reason is that the configurations of the servers or network devices by their user are not secure enough, besides the vulnerabilities of these servers or network devices themselves. The deficiencies of the configurations give a hacker an opportunity that can be exploited, and also cause a major damage to a user of a server or a network device. 
     In order to prevent the loss due to the configuration faults of a server or a network device, a network administrator will generally perform a verification on the security configuration of a server or a network device within a network, and perform a security reinforcement for a server or a network device which does not meet the security configuration specification. Some security manufacturers have provided secure software for a network administrator to perform a scanning on the security configuration of a server or a network device. 
       FIG. 1  shows a schematic drawing of a procedure for performing security configuration verification on a server or a network device traditionally. As shown in  FIG. 1 , firstly, a provider of a certain server or a network device will provide a “security configuration specification”; subsequently, while a network administrator performs a security configuration on the server or the network device according to the “security configuration specification”, a security manufacturer will customize a security configuration scanning scheme for the server or the network device according to the “security configuration specification. Then, the security manufacturer performs a security configuration scanning on the server or the network device by this security scanning scheme, and notifies the scanning result to the network administrator, and thereby the security configuration of the server or the network device is normalized. Thus, the security reinforcement for the configuration of the server or the network device is accomplished. 
     However, though the security configuration verification may be performed conveniently on one server or one network device with the existing solution as shown in  FIG. 1 , the security configuration verification consumes a lot of time due to involving the work of the security manufacturer. If there is not just one server or one network device (generally there will exist more than two different servers or network devices) in the network environment, and it is desired that a security configuration verification is performed on these other devices, then the procedure as described in  FIG. 1  needs to be done repeatedly. This means that the more the kinds of servers or network devices in the network environment are, the more the steps that are repeated, and the longer the time is to be consumed. Furthermore, in a different network application scenario, the requirements for the security configuration specification of the server or the network device may also be different from each other, and thus more work of the security manufacturer is needed, which further needs to consume more time and effort. 
     It can be seen from the above that there needs a security configuration verification way in which a user of a server or a network device or a network administrator may flexibly define his/her own security configuration verification policy by himself/herself according to a different network application environment as well as a different server or network device, so as to save cost and time. 
     SUMMARY OF THE INVENTION 
     In view of the above problems, the invention is proposed to provide a security configuration verification device and method as well as a network system employing the security configuration verification device that overcome the above problems or at least in part solve the above problems. 
     According to an aspect of the invention, a security configuration verification device for performing a security configuration verification on a network device is provided, which comprises: one or more preconfigured scanning policies, each preconfigured scanning policy is corresponding to a kind of network device, wherein each scanning policy comprises one or more security check items, and each security check item is associated with the security configuration on a corresponding network device; a scanning policy generator, which selects a scanning policy from the one or more preconfigured scanning policies to generate a new scanning policy corresponding to a selected network device, a security check item in said new scanning policy being selected from the security check items in the selected preconfigured scanning policy; and a scanner, which performs a security scanning on the selected network device with the generated new scanning policy and thereby performs a security configuration verification, wherein for each security check item in said new scanning policy, it is determined whether the security configuration of the selected network device meets the security check as indicated by the security check item. 
     The security configuration verification device according to the invention may generate a new scanning policy according to a preconfigured scanning policy so as to perform the security configuration verification on the network device, thereby eliminating the intervention of a security manufacturer, which greatly saves the time for performing the security configuration verification. 
     Optionally, in said scanning policy generator, a security check item in said new scanning policy is generated by modifying a security check item in the selected scanning policy. Additionally, the selected scanning policy and said new scanning policy correspond to the same type of network device. As such, a new scanning policy adapted for a new network device and a new network application environment may be generated more quickly and accurately according to a preconfigured scanning policy, thereby further saving the time for performing the security configuration verification. 
     Optionally, the security configuration verification device according to the invention further comprises a report generator, which generates the security configuration verification result relating to the network device based on a security scanning result of the scanner, and a scanning policy memory for storing one or more preconfigured scanning policies. 
     According to another aspect of the invention, a security configuration verification method for a network device is provided, which method may generate a new scanning policy according to a preconfigured scanning policy so as to perform a security configuration verification on a network device, thereby eliminating the intervention of a security manufacturer, which greatly saves the time for performing a security configuration verification. In particular, the security configuration verification method comprises steps of: selecting a scanning policy from one or more preconfigured scanning policies to generate a new scanning policy corresponding to said network device, wherein each preconfigured scanning policy corresponds to a kind of network device and comprises one or more security check items, and each security check item is associated with the security configuration on the corresponding kind of network device, and wherein a security check item in said new scanning policy is selected from the security check items in the selected preconfigured scanning policy; and performing a security scanning on said network device with the generated new scanning policy, wherein for each security check item in said new scanning policy, it is determined whether the security configuration of said network device meets the security check as indicated by the security check item. 
     According to yet another aspect of the invention, a network system is provided, which comprises one or more network devices and a security configuration verification device according to the invention for performing the security configuration verification on these network devices. 
     Since the network system employs a security configuration verification device according to the invention, even if there are a plurality of network devices with different types in the network system, a scanning policy corresponding to these network devices may be conveniently generated to perform an appropriate security configuration verification, thereby saving the time for performing a security configuration verification. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       Various other advantages and benefits will become apparent to those of ordinary skills in the art by reading the following detailed description of the preferred embodiments. The drawings are only for the purpose of showing the preferred embodiments, and are not considered to be limiting the invention. And throughout the drawings, like reference signs are used to denote like components. In the drawings: 
         FIG. 1  shows a schematic drawing of a procedure for performing the security configuration verification on a server or a network device traditionally; 
         FIG. 2  shows a security configuration verification device according to an embodiment of the invention; 
         FIG. 3  shows a schematic drawing of generating a new scanning policy by a scanning policy generator in a security configuration verification device according to an embodiment of the invention; 
         FIG. 4  shows a security configuration verification method according to an embodiment of the invention; 
         FIG. 5  shows a network system according to an embodiment of the invention in which a security configuration verification device is employed; 
         FIG. 6  shows a network system according to another embodiment of the invention in which a security configuration verification device is employed; 
         FIG. 7  shows schematically a block diagram of a server for performing a security configuration verification method according to the invention; and 
         FIG. 8  shows schematically a storage unit for holding or carrying a program code for implementing a security configuration verification method according to the invention. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     In the following the particular embodiments of the invention will be described in connection with the drawings. 
       FIG. 2  shows a security configuration verification device  200  according to an embodiment of the invention. As shown in  FIG. 2 , the security configuration verification device  200  comprises one or more preconfigured scanning policies  210 , each scanning policy is corresponding to a kind of network device (Hereinafter, for ease of description, a server and a network device are collectively referred to as a network device). A preconfigured scanning policy is usually pre-customized by a security manufacturer according to a specification provided by a network device provider. For example, depending on the type of a network device, a scanning policy  210  may be selected from a group including the following scanning policies: a Windows scanning policy, a Solaris scanning policy, an Oracle scanning policy, a Cisco Router scanning policy, a Juniper Router scanning policy, a Huawei Router scanning policy, a NETSCREEN scanning policy, a PIX Firewall scanning policy, an Informix scanning policy, an HP Unix scanning policy, an AIX scanning policy, a Linux scanning policy, a Microsoft SQL Server scanning policy, a BIND scanning policy, an Apache scanning policy, an IIS scanning policy, a Tomcat scanning policy, an H3C Switch scanning policy, a fortigate scanning policy, and a Windows-ORACLE scanning policy. Each scanning policy  210  comprises one or more security check items, and each of the security check items is associated with the security configuration on a corresponding network device. For example, in the case of the scanning policy  210  being an HP Unix scanning policy, the corresponding network device at this point is HP Unix, where the security check item may comprise: detecting whether a default user access right conforms to a specification (detecting whether the setting of a default user access right conforms to a security specification according to the security check items), detecting whether telnet restricts a direct remote login by a user with super administrator right, detecting whether ssh restricts a direct remote login by a user with super administrator right, detecting whether the length of a password of a device employing the static password authentication technology conforms to a specification, detecting whether the lifetime of a password of a device employing the static password authentication technology meets a specification, and detecting that a device employing the static password authentication technology cannot use the passwords set within the last specified number of times, and so on. According to the type difference of the network device corresponding to a scanning policy, the scanning policy may have a different type and number of security check items. Furthermore, even for network devices of the same type, it is also possible to preconfigure a scanning policy adapted for a different network application environment. For example, for a NETSCREEN network device, a different scanning policy may be preconfigured according to whether the network device is used in a public network or in a local area network. 
     The security configuration verification device  200  further comprises a scanning policy generator  220 , which generates a new scanning policy for a target network device on which the security configuration verification is to be performed. The scanning policy generator  220  selects one or more scanning policies from a preconfigured scanning policy  210  to generate a new scanning policy corresponding to the target network device. 
       FIG. 3  shows a schematic drawing of generating a new scanning policy by a scanning policy generator  220 . In the new scanning policy, the security checks item therein are obtained by selecting from the security check items in a selected preconfigured scanning policy  210 . Optionally, a security check item of the new scanning policy may be selected from one preconfigured scanning policy  210 , and may also be selected from a plurality of preconfigured scanning policies. Based on the type of the target network device and the network application environment, the scanning policy generator  220  screens out security check items suitable for the target network device from the security check items of one or more selected preconfigured scanning policies  210  to construct a new scanning policy. 
     Optionally, when the security check item of the preconfigured scanning policy  210  does not conform to the network application environment of the target network device, the scanning policy generator  220  may modify the parameter of the security check item to obtain a security check item pertaining to the new scanning policy. Since now only the parameter of the security check item is needed to be modified without creating a new security check item from scratch, a security check item may be established quickly. To give an example, for an existing security check item “detecting that a user of a device employing the static password authentication technology cannot repeatedly use the passwords used within the last eight times (including the eighth time)”, the parameter “eight times” therein may be modified according to the network application environment to construct a new security check item. 
     Of course, the scanning policy generator  220  may also newly create a security check item according to the type of the target network device. For example, in the case that the type of the target network device is a Windows operating system, a security check item may be established with respect to the content value of a certain registry entry. For other types of the network device, there are other ways to create the new security check item, all of which fall within the protection scope of the invention. 
     Further, optionally, the new scanning policy may be selected from the preconfigured scanning policies whose associated type of network devices is the same as that of the target network device. For example, when the target network device is Windows, a security check item of the new scanning policy may be selected from individual preconfigured scanning policies for Windows. As such, a new scanning policy may be constructed quickly and accurately. 
     After the scanning policy generator  220  constructs the new scanning policy, the scanner  230  in the security configuration verification device  200  performs a security scanning on the target network device  300  based on the new scanning policy so as to perform the security configuration verification. For each security check item in the new scanning policy, the scanner  230  determines whether the security configuration of the target network device  300  meets the security check content as indicated by the security check item. The scanner  230  may employ any known way in the art to perform the detection of the content as indicated by the security check item. For example, the scanner  230  may, based on the content of the security check item, generate a script to be executed on the target network device  300  after being logged in, execute the script on the target network device  300 , and determine whether the target network device  300  meets the security check item according to the execution result of the script. All these checking ways fall within the protection scope of the invention. 
     Optionally, the security configuration verification device further comprises a report generator  240 , which generates the security configuration verification result regarding target network device  300  based on the security scanning result from the scanner  230 , such that the system administrator of the target network device  300  may modify the security configuration on the target network device  300  according to the verification result, thereby improving the security of the target network device  300 . 
     In addition, the security configuration verification device  200  further comprises a scanning policy memory  250  for storing the one or more preconfigured scanning policies  210 . 
     The security configuration verification device  200  may generate a new scanning policy according to the preconfigured scanning policy  210  so as to perform the security configuration verification on a target network device  300 , thereby eliminating the intervention of a security manufacturer, which greatly saves the time for performing the security configuration verification. 
       FIG. 4  shows a security configuration verification method according to an embodiment of the invention, which method may be implemented by a security configuration verification device  200  so as to perform a security configuration verification on a network device. As shown in  FIG. 4 , the method begins at step S 410 , where a scanning policy is selected from one or more preconfigured scanning policies to generate a new scanning policy corresponding to the target network device. As described above, each preconfigured scanning policy corresponds to one kind of network device and comprises one or more security check items, and each security check item is associated with the security configuration on the corresponding kind of network device. 
     At step S 410 , based on the type of the target network device and the network application environment, the new scanning policy is generated by screening out the security check items suitable for the target network device from the security check items in the selected preconfigured scanning policy. Optionally, a security check item of the new scanning policy may be selected from one preconfigured scanning policy, and may also be selected from a plurality of preconfigured scanning policies. Further, optionally, when a security check item of a preconfigured scanning policy does not conform to the network application environment of the target network device, the parameters of the security check item may be modified to obtain a security check item pertaining to the new scanning policy. Since now only the parameters of the security check item are needed to be modified without creating a new security check item from scratch, a security check item may be established quickly. Further, optionally, the new scanning policy may be selected from the preconfigured scanning policies whose associated type of network device is the same as that of the target network device. 
     Optionally, step S 410  may be performed by the above-mentioned scanning policy generator  220 . 
     After the new scanning policy adapted for the target network device is constructed at step S 410 , a security scanning is performed on the target network device using the generated new scanning policy at step S 420 , where for each security check item in the new scanning policy, it is determined whether the security configuration of the target network device meets the security check as indicated by the security check item. At step S 420 , any known way in the art may be employed to perform the detection of the content as indicated by the security check item. For example, a script to be executed on the target network device after being logged in may be generated based on the content of a security check item, the script may be executed on the target network device, and it may be determined whether the target network device meets the security check item according to the execution result of the script. All these checking ways fall within the protection scope of the invention. 
     Optionally, step S 420  may be performed by the above-mentioned scanner  230 . 
     After a security configuration verification is performed on the target network device at step S 420 , optionally, the method further comprises step S 430 , where the security configuration verification result regarding the target network device is generated based on the security scanning result at step S 420 , such that the system administrator of the target network device may modify the security configuration on the target network device according to the verification result, thereby improving the security of the target network device. 
       FIG. 5  shows a network system  500  according to an embodiment of the invention in which a security configuration verification device  200  is employed. As shown in  FIG. 5 , the network system  500  comprises a plurality of network devices interconnected via a local area network  540 , and these network devices comprise a server  520  and a terminal  530 , etc., besides traditional network devices  510  such as a gateway, a router. The security configuration verification device  200  is also interconnected with these network devices via the local area network  540 , so as to be able to verify the security configuration of these network devices. In this way, the system administrator may utilize one security configuration verification device  200  to perform the security configuration verification on all the network devices in the network system  500 . 
     In addition, for some large networks, because of the complex organizational structure, numerous distribution points and relatively dispersed data, etc., a distributed deployment of a plurality of security configuration verification devices  200  may be utilized to achieve the security configuration verification for network devices in the whole network system.  FIG. 6  shows such an instance. As shown in  FIG. 6 , a distributed deployment is made to the security configuration verification devices  200  and it supports the data sharing and aggregation among the individual verification devices, thereby facilitating a centralized management of a distributed network by a user. In the network system  600  in  FIG. 6 , there are a plurality of network devices grouped according to the network topology, each group of network devices are verified by the corresponding security configuration verification device, and the verified data may be shared or aggregated among individual verification devices, which makes it possible for the security configuration verification device  200  according to the invention to be applied in a large network. 
     Since in the invention a security configuration scanning scheme may be customized flexibly and such customization absolutely depends on the demand of a user, the user may perform a security scanning more flexibly on the configuration of a server or a network device, and a large amount of time and cost may be saved. 
     It is to be noted that, in individual components of the security configuration verification device according to the invention, the components therein are divided logically according to the functions to be realized by them, however, the invention is not limited thereto, and individual components may be re-divided or combined as desired, for example, some components may be combined into a single component, or some components may be further divided into more sub-components. 
     Embodiments of the individual components of the invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. It will be appreciated by those skilled in the art that, in practice, some or all of the functions of some or all of the components in the security configuration verification device according to embodiments of the invention may be implemented by using a microprocessor or a digital signal processor (DSP). The invention may also be implemented as a device or a means program (e.g., a computer program or a computer program product) for carrying out a part or all of the method described herein. Such a program implementing the invention may be stored on a computer readable medium. 
     For example,  FIG. 7  shows a server which may carry out the security configuration verification method according to the invention, e.g., an application server. The server traditionally comprises a processor  710  and a computer program product or a computer readable medium in the form of a memory  720 . The memory  720  may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk or a ROM. The memory  720  has a memory space  730  for program codes  731  used for carrying out any method steps of the method as described above. For example, the memory space  730  for the program codes may comprise individual program codes  731  for carrying out individual steps in the above method, respectively. These program codes may be read from or written to one or more computer program products. These computer program products comprise such a program code carrier as a hard disk, a compact disk (CD), a memory card or a floppy disk. Such a computer program product is generally a portable or stationary storage unit as described with reference to  FIG. 8 . The storage unit may have a memory segment, a memory space, etc. arranged similarly to the memory  720  in the server of  FIG. 7 . The program codes may for example be compressed in an appropriate form. In general, the storage unit comprises computer readable codes  731 ′, i.e. the codes that may be read by for example a processor such as  710 , and when run by a server, these codes cause the server to carry out individual steps in the method described above. 
     It is to be noted that the above embodiments illustrate rather than limit the invention, and those skilled in the art may design alternative embodiments without departing the scope of the appended claims. In the claims, any reference sign placed between the parentheses shall not be construed as the limitation to a claim. The word “comprise” does not exclude the presence of an element or a step not listed in the claims. The word “a” or “an” preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of a hardware comprising several distinct elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of the means may be embodied by one and the same hardware item. The use of the words first, second, and third, etc. does not mean any ordering. Such words may be construed as naming.