WO2021115160A1

WO2021115160A1 - Acl rule management method and apparatus, computer device, and computer readable medium

Info

Publication number: WO2021115160A1
Application number: PCT/CN2020/133118
Authority: WO
Inventors: 林宁
Original assignee: 中兴通讯股份有限公司
Priority date: 2019-12-09
Filing date: 2020-12-01
Publication date: 2021-06-17
Also published as: CN113037681B; CN113037681A

Abstract

An access control list (ACL) rule management method and apparatus, a computer device, and a computer readable medium. The method comprises: determining the priority of a rule to be written, the priority of the rule to be written being determined by the priority of the rule type of the rule to be written and the sequence numbers of rules of the rule type in an ACL (S11); and writing the rule to be written into the ACL according to at least the priority of the rule to be written (S12).

Description

ACL rule management method, device, computer equipment and computer readable medium

Cross-references to related applications

This application is filed based on a Chinese patent application with application number 201911250942.4 and an application date of December 9, 2019, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated by reference into this application.

Technical field

The present disclosure relates to the field of communication technology, and in particular to an ACL rule management method, device, computer equipment, and computer readable medium.

Background technique

Access Control List (ACL) is a list of commands for router and switch interfaces, used to control data packets entering and leaving the port. In general, ACL management complies with the following basic management principles:

1. When the ACL priority is the same, the rule issued first takes effect.

2. When the priorities are not the same, the rule with the higher priority will be effective.

3. When a packet is forwarded, the rules in the ACL are matched from top to bottom, and the first rule that can be matched is matched, and then forwarded according to this rule.

Therefore, if the rules are issued, the low priority rules are first issued, and then the high priority rules are issued, which will cause the ACL rules to be moved when the hardware is issued to meet the basic management of ACL. in principle.

At present, the common processing process of device ACL issuance is as follows:

1. Issue a rule of a certain priority.

2. Compare the priority relationship between this rule and the existing rules, as well as the sequence of issuing rules with the same priority.

3. According to the basic management principles of ACL, the rules are moved to meet the priority requirements when matching packets from top to bottom.

It can be seen that if the priority of the rule issued first is lower than the priority of the rule issued later, the rule will be moved. If there are too many rules issued, in extreme cases, issuing a rule requires all the rules to be moved. The moving action will bring additional consumption to the CPU (Central Processing Unit, central processing unit) of the device. In addition, during the migration process, the original rules that have been in effect will have a short black hole period. During this black hole period, packets matching the original ACL that have been in effect cannot be forwarded normally, which affects network stability.

Summary of the invention

The present disclosure provides an ACL rule management method, device, computer equipment and computer readable medium.

In the first aspect, an embodiment of the present disclosure provides an ACL rule management method, the method includes: determining the priority of the rule to be written, the priority of the rule to be written is determined by the priority of the rule type of the rule to be written And the sequence number of the rule of the rule type in the access control list is determined; at least according to the priority of the rule to be written, the rule to be written is written into the access control list.

In a second aspect, an embodiment of the present disclosure provides an ACL rule management device, including a determining module and a writing module, the determining module is set to determine the priority of the rule to be written, and the priority of the rule to be written It is determined by the priority of the rule type to be written and the sequence number of the rule of the rule type in the access control list; the writing module is set to, at least according to the priority of the rule to be written, set the The rules to be written are written into the access control list.

In a third aspect, embodiments of the present disclosure also provide a computer device, including: one or more processors and a storage device; one or more programs are stored on the storage device. When executed by the two processors, the foregoing one or more processors implement the ACL rule management method provided in the foregoing first aspect.

In a fourth aspect, the embodiments of the present disclosure also provide a computer-readable medium on which a computer program is stored, and the computer program implements the ACL rule management method provided in the foregoing first aspect when the computer program is executed.

Description of the drawings

FIG. 1 is a flowchart of an ACL rule management method provided by an embodiment of the disclosure;

2 is a flowchart of an ACL rule management method provided by another embodiment of the present disclosure;

FIG. 3 is a schematic diagram of writing a rule into an access control list according to another embodiment of the present disclosure;

FIG. 4 is another schematic diagram of writing a rule into an access control list according to another embodiment of the present disclosure;

Fig. 5 is a schematic structural diagram of an ACL rule management apparatus provided by another embodiment of the present disclosure.

Detailed ways

Hereinafter, example embodiments will be described more fully with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete, and to enable those skilled in the art to fully understand the scope of the present disclosure.

As used herein, the term "and/or" includes any and all combinations of one or more related listed rules.

The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a" and "the" are also intended to include the plural forms, unless the context clearly dictates otherwise. It will also be understood that when the terms "comprising" and/or "made of" are used in this specification, it specifies the presence of the described features, wholes, steps, operations, elements and/or components, but does not exclude the presence or Add one or more other features, wholes, steps, operations, elements, components, and/or groups thereof.

The embodiments described herein can be described with reference to plan views and/or cross-sectional views with the help of ideal schematic diagrams of the present disclosure. Therefore, the example illustrations may be modified according to manufacturing technology and/or tolerances. Therefore, the embodiment is not limited to the embodiment shown in the drawings, but includes a modification of the configuration formed based on the manufacturing process. Therefore, the regions illustrated in the drawings have schematic properties, and the shapes of the regions shown in the figures exemplify the specific shapes of the regions of the elements, but are not intended to be limiting.

Unless otherwise defined, the meanings of all terms (including technical and scientific terms) used herein are the same as those commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having meanings consistent with their meanings in the context of the related technology and the present disclosure, and will not be interpreted as having idealized or excessive formal meanings, Unless this article specifically defines it as such.

The embodiment of the present disclosure provides an ACL rule management method. As shown in FIG. 1, the ACL rule management method includes the following steps:

Step 11. Determine the priority of the rule to be written.

In this step, the priority of the rule to be written is determined by the priority of the rule type of the rule to be written and the sequence number of the rule of the rule type in the access control list. That is, the priority of the rule to be written is composed of the priority of the rule type of the rule to be written and the sequence number of the rule of the rule type in the access control list.

It should be noted that different rule types correspond to different priorities. Rule types can be classified according to binding types. The binding types can include: port, SG (Signaling Gateway), VLAN (Virtual Local Area Network, virtual local area network), and different binding types correspond to different priorities. Rule types can also be classified according to ACL types, for example, IPv4 (Internet Protocol Version 4, Internet Protocol Version 4), IPv6 (Internet Protocol Version 6, Internet Protocol Version 6), etc. Different ACL types correspond to different priorities. Of course, the rules for dividing rule types can be defined by the user.

The larger the sequence number of the rule of the rule type in the access control list, the higher the order of issuing the rules of the same rule type (that is, the later the issuing), and the higher the priority value of the corresponding rule to be written. . That is to say, the priority of the rules to be written takes into account the priority order between different ACL rule types, as well as the order in which the rules of the same rule type are issued.

Step 12: Write the rules to be written into the access control list at least according to the priority of the rules to be written.

In this step, the priority of the rule to be written determined in step 11 is used as the basis for writing the rule to be written into the access control list, that is, the rule to be written is determined according to the priority of the rule to be written The writing position in the access control list.

In the embodiment of the present disclosure, the priority of the rule to be written is determined, and the rule to be written is written into the access control list at least according to the priority of the rule to be written, wherein the priority of the rule to be written It is determined by the priority of the rule type to be written in the rule and the sequence number of the rule of the rule type in the access control list. The priority of the rules to be written takes into account the priority order between different ACL rule types, and also the order in which the rules of the same rule type are issued. In this way, the priority of the rules to be written is changed according to the priority of the rules to be written. When the entry rules are written into the access control list, the migration phenomenon can be minimized, and the CPU consumption of the network device can be reduced. Correspondingly, the black hole period is reduced, and the packet loss caused by ACL migration will also be reduced, thereby improving the performance of the network device. Reliability and stability.

In some embodiments, the priority of the rule to be written includes a first field and a second field, the value of the first field is the priority of the rule type of the rule to be written, and the second field The value is the sequence number of the rule of the rule type in the access control list. The ACL rule management device defines the priority of the rules to be written to be written into the access control list in segments. The priority includes a first field and a second field. The value of the first field is the priority of the rule type to be written in the rule, and the value of the second field is the sequence number of the rule of the rule type in the access control list. The first field is a high-order field, and the second field is a low-order field. That is, the priority of the rule to be written includes the value of the high-order field and the value of the low-order field.

As shown in Figure 2, the determining the priority of the rule to be written (ie step 11) includes the following steps:

Step 111: Determine the total number of digits of the priority of the rule to be written.

It should be noted that, in the embodiment of the present disclosure, the total digits of the priority of the rule to be written, the digits of the first field and the digits of the second field are all illustrated in hexadecimal.

Step 112: Determine the value of the first field according to the rule type to be written in the rule and the preset mapping relationship between the rule type and the priority of the rule type.

In this step, a mapping relationship is established in advance between the rule type and the priority of the rule type. The higher the priority of the rule type, the smaller the value of the first field. For example, when the rule type is the binding type, because the basic order of effect of the rule is port>VLAN>SG, the priority order is also port>VLAN>SG, then the value of the first field of the port type rule is <VLAN The value of the first field of the rule of the type <the value of the first field of the rule of the SG type. The mapping relationship between the rule type and the priority of the rule type is: the priority of the port is 0x1, the priority of the VLAN is 0x2, and the priority of the SG is 0x3. According to the foregoing mapping relationship and the rule type of the rule to be written, the value of the first field can be determined. For example, if the rule type of the rule to be written is a port, the value of the first field is 0x1 (representing 1 in hexadecimal notation).

Step 113: Determine the number of bits in the second field according to the total number of bits and the preset number of bits in the first field.

In this step, the number of digits in the first field is the preset number of digits. After the total number of digits is determined, the remaining bytes are all counted as the second field, that is, the low-order field. The calculated total number of digits is subtracted from the preset number. The number of digits in the first field is the number of digits in the second field. For example, if the total number of digits is 4 and the first field is 1 digit, it can be determined that the number of digits in the second field is 3 digits.

Step 114: Determine the value of the second field according to the number of digits in the second field and the number of rules of the rule type in the access control list.

In some embodiments, the number is used as the value of the second field, and the number of bits in the second field is used to represent the value of the second field.

In this step, the sequence number of the rule of the rule type in the access control list is equal to the number of the rule of the rule type in the access control list, the number is taken as the value of the second field, and the number of digits in the second field Represents the value of the second field, that is, the value of the second field increases by 1 in order as the number of rules of the rule type in the access control list increases. For example, when the number of digits in the second field is three digits, there are 0 rules for the port type in the access control list, and the second field is 000. When the number of digits in the second field is three digits, the port in the access control list There is one type of rule, and the second field is 001, indicating that the rule to be written is the second port type rule. By analogy, every time the rule of the same first field is written, the value written later must be larger than the value written first, thereby reducing the movement of the rules.

Step 115: Concatenate the value of the first field and the value of the second field to generate the priority of the rule to be written.

In this step, the value of the first field is placed in the high order, and the value of the second field is placed in the low order, and the priority of the rule to be written is generated by splicing. For example, if the value of the first field is 0x1 and the value of the second field is 000, the priority of the rule to be written is 0x1000.

In some embodiments, the determining the total number of digits of the priority of the rule to be written (ie step 111) includes: determining the total digit of the priority of the rule to be written according to the maximum number of rules that can be accommodated in the access control list number. In other words, the value range of the total number of digits of the priority of the rules to be written is determined by the maximum number of rules that the access control list can accommodate. The greater the maximum number of rules that the access control list can accommodate, the priority of the rules to be written The total number of digits is also larger. For example, when the access control list can accommodate the maximum number of rules, the total number of digits in the priority of the rules to be written can be determined to be 4, and when the access control list can accommodate the maximum number of rules, the total number of digits to be written can be determined The total number of digits of the priority of the rule is 5 digits.

It should be noted that, in some embodiments, in the access control list, the value of the first field of the rule with the first position is smaller than the value of the first field of the rule with the position of the second; rules with the same value of the first field, The value of the second field of the rule with the first position is smaller than the value of the second field of the rule with the position below. That is, the rule with the first position in the access control list, the smaller the priority value, the higher the priority.

In the embodiment of the present disclosure, there are two methods for writing the determined priority of the rule to be written into the access control list. One is to write the rule to be written into the absolute position of the access control list, and the other is to write the rule to be written into the absolute position of the access control list. The relative position of the write rule to write the access control list. The details are discussed as follows.

In some embodiments, the writing the rule to be written into the access control list at least according to the priority (ie step S12) includes: using the priority of the rule to be written as the write access control The index of the list, and write the rules to be written into the position in the access control list corresponding to the index.

In this step, the priority of the rule to be written is used as the index of the access control list, and the index corresponds to the position in the access control list, that is, the address in the access control list. For the rules of the same rule type, the value of the second field of the priority of the rule to be written is sequentially increased according to the sequence of issuance, that is, the value of the second field of the priority of the rule to be issued later is larger. For rules of the same rule type, it is ensured that the priority of the rule written each time is always lower than the priority of the rule written before, that is, the rule issued later will always be ranked behind the rule issued first.

Taking FIG. 3 as an example, the method for writing the rules to be written is described in detail. The maximum number of rules that the device's access control list can hold is 32K, so the total number of digits of the priority of the rules to be written is 16 bits, which is converted to hexadecimal to 4 bits. Take the 1-bit high-order field as the first field of the priority of the rule. When the rule type is bound port, SG, VLAN, the priority relationship is port>VLAN>SG. Set the port priority to 0x1, VLAN to 0x2, and SG to 0x3 in the 1-high bit field. This setting can ensure that the port type rules in the access control list must be ranked before the VLAN type rules, and the VLAN type rules must be ranked before the SG type rules. Set the remaining 3 bits as the second field of the priority of the rule.

The port type rule A is issued for the first time. The priority of the rule type of the port is 0x1, and the first field is 0x1. Since the port type rule in the access control list is 0, the value of the second field is related to the access control If the number of rules of the same type in the list is the same, the second field is 000, then the priority of port type rule A is 0x1000, with 0x1000 as the index, write port type rule A into the position of the access control list corresponding to index 0x1000 . The second time the port type rule B is issued, if the rule type is port priority is 0x1, then the first field is 0x1. When the port type rule is issued the second time, the port type rule in the access control list is 1 , The value of the second field is the same as the number of rules of the same type in the access control list, then the second field is 001, the priority of port type rule B is 0x1001, and port type rule B is written to the access corresponding to index 0x1000 The position of the control list is under the rule A of the port type. The VLAN type rule C is issued for the first time, the priority of the rule type is 0x2, and the first field is 0x2. When the VLAN type rule is issued for the first time, the VLAN type rule in the access control list is 0. The value of the second field is the same as the number of rules of the same type in the access control list. If the second field is 000, the priority of VLAN type rule C is 0x2000. Write VLAN type rule C into the access control list corresponding to index 0x2000 In the location. By analogy, the port type rules must precede the VLAN type rules, the VLAN type rules must precede the SG type rules, and the rules of the same rule type that are issued later will always be placed behind the rules that are issued first.

In this method of writing rules to be written, in the initial stage of writing the access control list, there will be no rule movement, and accordingly, there will be no packet loss due to rule movement, thereby reducing the CPU of the network device Consumption, and improve the stability of the network.

In some embodiments, in order to prevent holes in the access control list after the rule is deleted, and at the same time, to avoid the access control list restricting the number of rules written for each rule type, the rules to be written can be written to the relative value of the access control list. position. That is, the writing the rule to be written into the access control list at least according to the priority of the rule to be written (step S12) includes: according to the priority of the rule to be written and the written rule The priority of each rule of the access control list, write the rules to be written into the access control list.

In some embodiments, the writing the rule to be written into the access control list according to the priority of the rule to be written and the priority of each rule that has been written into the access control list includes : If the access control list is not empty, sort the priority of the rule to be written and the priority of each rule written in the access control list, and according to the sorting result, sort the rule to be written Write the access control list. If the access control list is empty, the rule to be written is written into the last position of the access control list.

In some embodiments, if the access control list is empty, it means that when the rule to be written is the first rule in the access control list, the rule to be written is written to the end of the access control list. A location. All rules are written in from the last position of the access control list. If the access control list is not empty, each time a rule to be written is written to the access control list, the priority of the rule to be written and the priority of each rule written in the access control list are sorted , According to the sorting result, write the rule to be written into the access control list. Each time, the rules with lower priority are ranked at the lower position in the access control list, that is, the rules with higher priority values are arranged at the lower position.

Taking FIG. 4 as an example, the method for writing the rules to be written is described in detail. The device's access control list can accommodate the maximum number of rules that can support 32K, then a 16-bit data segment is used as the priority of the rules to be written, converted to hexadecimal to 4 bits. Take the 1-bit high-order field as the first field of the priority of the rule. When the rule type is bound port, SG, VLAN, the priority relationship is port>VLAN>SG. Set the port priority to 0x1, VLAN to 0x2, and SG to 0x3 in the 1-high bit field. This setting can ensure that the port type rules in the access control list must be ranked before the VLAN type rules, and the VLAN type rules must be ranked before the SG type rules. Set the remaining 3 bits as the second field of the priority of the rule.

The VLAN type rule A is issued for the first time, the priority of the rule to be written for the VLAN type is 0x2, then the first field is 0x2, the VLAN rule in the access control list is 0, the value of the second field and access control If the number of rules of the same type in the list is the same, the second field is 000, and the priority is 0x2000, and the rule A of the VLAN type is written into the last position of the access control list. The second time the VLAN type rule B is issued, the priority of the rule type is 0x2, and the first field is 0x2. When the VLAN type rule is issued the second time, the VLAN type rule in the access control list is 1 , The value of the second field is the same as the number of rules of the same type in the access control list, and the second field is 001. Therefore, the priority of VLAN type rule B is 0x2001, which is greater than the priority of VLAN type rule A 0x2000. The rule B of the type is pushed in from the last position of the access control list in a stacking manner, and the rule A of the VLAN type is moved up by one position. The port type rule C is issued for the first time. If the rule type is port priority is 0x1, the first field is 0x1. Since the port type rule in the access control list is 0, the value of the second field is the same as in the access control list If the number of rules of the same type is the same, the second field is 000, so the priority of port type rule C is 0x1000, which is less than the priority of VLAN type rule A, 0x2000, so the port type rule C is written into the VLAN type rule The previous position of A. By analogy, each rule to be written must be compared with the priority of all rules that already exist in the access control list, and it will be inserted into the access control list in descending order of value to complete the writing of other rules. , And finally write all rules to keep the full access control list from top to bottom, which is the effect of priority from large to small.

This writing method of the rules to be written is to perform the stack-type writing from bottom to top in order, which can complete dynamic position writing. It can still ensure that most of the rules will not be moved, and the black hole period will be reduced. It will also reduce packet loss due to ACL migration, thereby reducing the CPU consumption of network equipment and improving network stability. And it will not limit the number of writes of a certain type of rule, and there will be no holes due to rule deletion.

The ACL rule management method provided by the embodiment of the present disclosure determines the priority of the rule to be written, and writes the rule to be written into the access control list at least according to the priority of the rule to be written. The priority of writing a rule includes a first field and a second field. The value of the first field is the priority of the rule type to be written in the rule, and the value of the second field is the sequence number of the rule of the rule type in the access control list. The priority of the rules to be written not only considers the priority order between different ACL rule types, but also considers the order in which the rules of the same rule type are issued. And through the two methods of writing rules, you can ensure that the rules are moved as little as possible when writing the access control list, and reduce the CPU consumption of the network equipment. Correspondingly, the black hole period will be reduced, and it will also be reduced. The packet loss phenomenon caused by ACL migration improves the reliability and stability of network equipment.

Based on the same technical concept, an embodiment of the present disclosure also provides an ACL rule management device. As shown in FIG. 7, the ACL rule management device includes a determining module 1 and a writing module 2, and the determining module 1 is set to: The priority of the rule to be written is determined, and the priority of the rule to be written is determined by the priority of the rule type of the rule to be written and the sequence number of the rule of the rule type in the access control list.

The writing module 2 is configured to write the rules to be written into the access control list at least according to the priority of the rules to be written.

In some embodiments, the priority of the rule to be written includes a first field and a second field, the value of the first field is the priority of the rule type of the rule to be written, and the second field The value of is the sequence number of the rule of the rule type in the access control list, and the determination module 1 is set as:

Determine the total number of digits of the priority of the rule to be written.

The value of the first field is determined according to the rule type of the rule to be written and the preset mapping relationship between the rule type and the priority of the rule type.

The number of bits in the second field is determined according to the total number of bits and the preset number of bits in the first field.

The value of the second field is determined according to the number of digits in the second field and the number of rules of the rule type in the access control list.

The value of the first field and the value of the second field are spliced to generate the priority of the rule to be written.

In some embodiments, the determining module 1 is set to:

According to the maximum number of rules that can be accommodated in the access control list, the total number of digits of the priority of the rules to be written is determined.

In some embodiments, the higher the priority of the rule type, the smaller the value of the first field;

In some embodiments, the determining module 1 is set to:

Determine the number of rules of the rule type in the current access control list.

The number is used as the value of the second field, and the number of bits in the second field is used to represent the value of the second field.

In some embodiments, in the access control list, the value of the first field of the rule with the first position is smaller than the value of the first field of the rule with the position of the latter; the rule with the same value of the first field has the first field. The value of the second field of the rule of is less than the value of the second field of the rule that follows.

In some embodiments, the write module 2 is set to:

The priority of the rule to be written is used as an index to be written into the access control list, and the rule to be written is written into a position in the access control list corresponding to the index.

In some embodiments, the write module 2 is set to:

According to the priority of the rule to be written and the priority of each rule that has been written in the access control list, the rule to be written is written into the access control list.

In some embodiments, the write module 2 is set to:

If the access control list is not empty, then the priority of the rule to be written and the priority of each rule written in the access control list are sorted.

According to the sorting result, the rule to be written is written into the access control list.

In some embodiments, the write module 2 is set to:

If the access control list is empty, the rule to be written is written into the last position of the access control list.

The embodiment of the present disclosure also provides a computer device, including: one or more processors; a storage device, wherein one or more programs are stored thereon; when the one or more programs are used by the one or more When executed by each processor, the one or more processors implement the ACL rule management method provided in the foregoing embodiments.

The embodiments of the present disclosure also provide a computer-readable medium on which a computer program is stored, wherein the program implements the ACL rule management method provided in the foregoing embodiments when the program is executed.

According to the ACL rule management method, device, computer equipment, and computer-readable medium provided by the embodiments of the present disclosure, the priority of the rule to be written is determined, and the rule to be written is at least based on the priority of the rule to be written. The access control list is written, wherein the priority of the rule to be written is determined by the priority of the rule type of the rule to be written and the sequence number of the rule of the rule type in the access control list. The priority of the rules to be written takes into account the priority order between different ACL rule types, and also the order in which the rules of the same rule type are issued. In this way, the priority of the rules to be written is changed according to the priority of the rules to be written. When the entry rules are written into the access control list, the migration phenomenon can be minimized, and the CPU consumption of the network device can be reduced. Correspondingly, the black hole period is reduced, and the packet loss caused by ACL migration will also be reduced, thereby improving the performance of the network device. Reliability and stability.

A person of ordinary skill in the art can understand that all or some of the steps in the method disclosed above, and the functional modules/units in the device can be implemented as software, firmware, hardware, and appropriate combinations thereof. In the hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may consist of several physical components. The components are executed cooperatively. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit . Such software may be distributed on a computer-readable medium, and the computer-readable medium may include a computer storage medium (or non-transitory medium) and a communication medium (or transitory medium). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile data implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Sexual, removable and non-removable media. Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or Any other medium used to store desired information and that can be accessed by a computer. In addition, as is well known to those of ordinary skill in the art, communication media usually contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as carrier waves or other transmission mechanisms, and may include any information delivery media. .

Example embodiments have been disclosed herein, and although specific terms are adopted, they are used and should only be interpreted as general descriptive meanings, and are not used for the purpose of limitation. In some instances, it is obvious to those skilled in the art that, unless clearly indicated otherwise, the features, characteristics, and/or elements described in combination with a specific embodiment may be used alone, or features, characteristics, and/or elements described in combination with other embodiments may be used, Combination of features and/or components. Therefore, those skilled in the art will understand that various changes in form and details can be made without departing from the scope of the present invention as set forth in the appended claims.

Claims

An ACL rule management method, including:

Determining the priority of the rule to be written, the priority of the rule to be written is determined by the priority of the rule type of the rule to be written and the sequence number of the rule of the rule type in the access control list;

At least according to the priority of the rule to be written, the rule to be written is written into the access control list.
The method according to claim 1, wherein the priority of the rule to be written includes a first field and a second field, and the value of the first field is the priority of the rule type of the rule to be written, The value of the second field is the sequence number of the rule of the rule type in the access control list, and the determining the priority of the rule to be written includes:

Determine the total number of digits of the priority of the rule to be written;

Determine the value of the first field according to the rule type of the rule to be written and the preset mapping relationship between the rule type and the priority of the rule type;

Determine the number of digits in the second field according to the total number of digits and the preset number of digits in the first field;

Determine the value of the second field according to the number of digits in the second field and the number of rules of the rule type in the access control list;

The value of the first field and the value of the second field are spliced to generate the priority of the rule to be written.
The method according to claim 2, wherein the determining the total number of bits of the priority of the rule to be written comprises:

According to the maximum number of rules that the access control list can accommodate, the total number of digits of the priority of the rules to be written is determined.
The method of claim 2, wherein the higher the priority of the rule type, the smaller the value of the first field;

The determining the value of the second field according to the number of digits in the second field and the number of rules of the rule type in the access control list includes:

Determine the number of rules of the rule type in the current access control list;

The number is used as the value of the second field, and the number of bits in the second field is used to represent the value of the second field.
The method according to claim 4, wherein, in the access control list, the value of the first field of the rule with the first position is smaller than the value of the first field of the rule with the position of the second; the value for the first field is the same In the rule, the value of the second field of the rule with the first position is less than the value of the second field of the rule with the second position.
5. The method according to any one of claims 1 to 5, wherein the writing the rule to be written into the access control list at least according to the priority comprises:

The priority of the rule to be written is used as an index to be written into the access control list, and the rule to be written is written into a position in the access control list corresponding to the index.
5. The method according to any one of claims 1 to 5, wherein the writing the rule to be written into the access control list at least according to the priority of the rule to be written comprises:

According to the priority of the rule to be written and the priority of each rule that has been written in the access control list, the rule to be written is written into the access control list.
The method according to claim 7, wherein the said rules are written into the said rules according to the priority of the rules to be written and the priorities of the rules already written in the access control list. Access control list, including:

If the access control list is not empty, sort the priority of the rules to be written and the priority of the rules already written in the access control list;

According to the sorting result, the rule to be written is written into the access control list.
The method according to claim 7, wherein the said rules are written into the said rules according to the priority of the rules to be written and the priorities of the rules already written in the access control list. Access control list, including:

If the access control list is empty, the rule to be written is written into the last position of the access control list.
An ACL rule management device, including:

The determining module is configured to determine the priority of the rule to be written, and the priority of the rule to be written is determined by the priority of the rule type of the rule to be written and the sequence number of the rule of the rule type in the access control list;

The writing module is set to write the rules to be written into the access control list at least according to the priority of the rules to be written.
A computer device includes: one or more processors; a storage device on which one or more programs are stored; wherein, when the one or more programs are executed by the one or more processors, The one or more processors implement the ACL rule management method according to any one of claims 1-9.
A computer readable medium storing a computer program, wherein when the program is executed, the ACL rule management method according to any one of claims 1-9 is realized.