WO2019179027A1

WO2019179027A1 - Electronic device, firewall provisioning verification method, system and storage medium

Info

Publication number: WO2019179027A1
Application number: PCT/CN2018/102094
Authority: WO
Inventors: 王开强
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-03-23
Filing date: 2018-08-24
Publication date: 2019-09-26
Also published as: CN108494771A; CN108494771B

Abstract

Disclosed in the present application are an electronic device, a firewall provisioning verification method, a system and a storage medium. Said method comprises acquiring, upon reception of a request sent by a client for acquiring service data, a source IP address and source port information of the client; and traversing, on the basis of the source IP address and the source port information, a pre-generated firewall white list, and querying, in the firewall white list, a target IP address and target port information which correspond to the source IP address and the source port information, respectively; and if the corresponding target IP address and target port information are obtained by querying, activating, according to the corresponding target IP address and target port information, a corresponding thread count to execute a firewall provisioning verification instruction. This invention improves the efficiency of verifying whether a firewall is provisioned, and improves the verification accuracy.

Description

Electronic device, firewall opening verification method, system and storage medium

This application claims priority to Chinese Patent Application No. 2018102469623, entitled "Electronic Device, Firewall Opening Verification Method, System and Storage Medium", filed on March 23, 2018, the entire contents of which are incorporated by reference. Combined in this application.

Technical field

The present application relates to the field of Internet security, and in particular, to an electronic device, a firewall opening verification method, a system, and a storage medium.

Background technique

With the development and application of network technology, network security issues have become increasingly serious. In order to increase the security of network data interaction, a firewall is usually provided between the internal network and the external network. When the internal system calls the data of the external system, it needs to verify whether the firewall between the internal system and each external system to be called is enabled.

At present, the commonly used method for verifying whether the firewall is turned on requires manual query of the destination IP address and destination port of each external system to be called by the internal system, and simulates the Http request to establish a communication channel between the internal system and the external system, and then executes the telnet command in sequence. Remote login to query the destination IP address and the external system corresponding to the destination port to verify whether the corresponding firewall is enabled. Since the entire process requires manual query, there is a problem that error is easy, the accuracy is not high, and the verification efficiency is low.

Summary of the invention

In view of this, the present application provides an electronic device, a firewall opening verification method, and a storage medium, which can improve the accuracy and efficiency of verifying whether a firewall is turned on.

First, in order to achieve the above object, the present application provides an electronic device including a memory and a processor connected to the memory, where the processor is configured to execute a firewall opening verification program stored on the memory. When the firewall provisioning verification program is executed by the processor, the following steps are implemented:

A1. After receiving the request for obtaining the service data sent by the client, obtaining the source IP address and source port information of the client;

A2, traversing the pre-generated firewall whitelist based on the source IP address and the source port information, and querying a target IP address mapped to the source IP address and the source port information in the firewall whitelist respectively. And target port information;

A3. If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the corresponding thread number is started according to the target IP address and the target port information, and the verification firewall is opened. Instructions.

In addition, to achieve the above object, the present application further provides a firewall opening verification method, which includes the following steps:

S1. After receiving the request for obtaining service data sent by the client, obtain the source IP address and source port information of the client.

S2, traversing the pre-generated firewall whitelist based on the source IP address and the source port information, and querying a target IP address mapped to the source IP address and the source port information in the firewall whitelist respectively. And target port information;

S3. If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the corresponding thread number is started according to the target IP address and the target port information, and the verification firewall is activated. Instructions.

In addition, to achieve the above object, the present application further provides a firewall provisioning verification system, where the system includes an acquisition module, a query module, and an identification module;

The acquiring module is configured to obtain a source IP address and source port information of the client after receiving the request for acquiring service data sent by the client;

The querying module is configured to traverse the pre-generated firewall whitelist based on the source IP address and the source port information, and query the firewall whitelist to map with the source IP address and the source port information respectively. Target IP address and destination port information;

The identification module is configured to start a corresponding thread according to the target IP address and the target port information, if the target IP address and the target port information mapped to the source IP address and the source port information are queried The number executes the instructions that verify the firewall is turned on. In addition, in order to achieve the above object, the present application further provides a computer readable storage medium storing a firewall provisioning verification program, the firewall provisioning verification program being executable by at least one processor to enable The at least one processor performs the following steps:

After receiving the request for obtaining service data sent by the client, obtaining the source IP address and source port information of the client;

Querying a pre-generated firewall whitelist based on the source IP address and the source port information, and querying a target IP address and a target mapped between the source IP address and the source port information in the firewall whitelist respectively Port information;

If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the corresponding number of threads is started according to the target IP address and the target port information, and the instruction for verifying the opening of the firewall is executed. .

The electronic device, the firewall opening verification method, the system, and the storage medium provided by the application obtain the source IP address and the source port information of the client after receiving the request for obtaining the service data sent by the client; based on the source IP The address and the source port information traverse the pre-generated firewall whitelist, and query the target IP address and the target port information respectively mapped to the source IP address and the source port information in the firewall whitelist; And to the target IP address and the target port information mapped to the source IP address and the source port information, the corresponding firewall number is started according to the target IP address and the target port information, and the verification firewall opening instruction is executed. Improves the efficiency of verifying the firewall's provisioning and improves verification accuracy.

DRAWINGS

1 is a schematic diagram of an optional hardware architecture of an electronic device proposed by the present application;

2 is a schematic diagram of a program module of a firewall opening verification program in an embodiment of an electronic device of the present application;

3 is a flow chart showing an implementation of a preferred embodiment of the firewall provisioning verification method of the present application.

The implementation, functional features and advantages of the present application will be further described with reference to the accompanying drawings.

detailed description

In order to make the objects, technical solutions, and advantages of the present application more comprehensible, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

It should be noted that the descriptions of "first", "second" and the like in the present application are for the purpose of description only, and are not to be construed as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. . Thus, features defining "first" or "second" may include at least one of the features, either explicitly or implicitly. In addition, the technical solutions between the various embodiments may be combined with each other, but must be based on the realization of those skilled in the art, and when the combination of the technical solutions is contradictory or impossible to implement, it should be considered that the combination of the technical solutions does not exist. Nor is it within the scope of protection required by this application.

Referring to FIG. 1 , it is an optional hardware architecture diagram of the electronic device proposed by the present application. In this embodiment, the electronic device 10 may include, but is not limited to, the memory 11, the processor 12, and the network interface 13 being communicably connected to each other through the communication bus 14. It should be noted that FIG. 1 only shows the electronic device 10 having the components 11-14, but it should be understood that not all illustrated components may be implemented, and more or fewer components may be implemented instead.

The memory 11 includes at least one type of computer readable storage medium including a flash memory, a hard disk, a multimedia card, a card type memory (for example, SD or DX memory, etc.), a random access memory (RAM), and a static memory. Random access memory (SRAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), magnetic memory, magnetic disk, optical disk, and the like. In some embodiments, the memory 11 may be an internal storage unit of the electronic device 10, such as a hard disk or memory of the electronic device 10. In other embodiments, the memory 11 may also be an outsourced storage device of the electronic device 10, such as a plug-in hard disk equipped on the electronic device 10, a smart memory card (SMC), and a secure digital (Secure Digital) (SD). Card, flash card, etc. Of course, the memory 11 can also include both an internal storage unit of the electronic device 10 and an external storage device thereof. In this embodiment, the memory 11 is generally used to store an operating system installed on the electronic device 10 and various types of application software, such as a firewall provisioning verification program. Further, the memory 11 can also be used to temporarily store various types of data that have been output or are to be output.

Processor 12 may be a Central Processing Unit (CPU), controller, microcontroller, microprocessor, or other data processing chip in some embodiments. The processor 12 is typically used to control the overall operation of the electronic device 10. In this embodiment, the processor 12 is configured to run program code or processing data stored in the memory 11, such as a running firewall provisioning verification program.

The network interface 13 may include a wireless network interface or a wired network interface, which is typically used to establish a communication connection between the electronic device 10 and other electronic devices.

Communication bus 14 is used to implement a communication connection between components 11-13.

Figure 1 shows only the electronic device 10 with components 11-14 and a firewall provisioning verification procedure, but it should be understood that not all illustrated components may be implemented and that more or fewer components may be implemented instead.

Optionally, the electronic device 10 may further include a user interface (not shown in FIG. 1), and the user interface may include a display, an input unit such as a keyboard, wherein the user interface may further include a standard wired interface, a wireless interface, and the like.

Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED touch device, or the like. Further, the display may also be referred to as a display screen or display unit for displaying information processed in the electronic device 10 and a user interface for displaying visualizations.

In an embodiment, when the firewall provisioning verification program stored in the memory 11 is executed by the processor 12, the following operations are implemented:

If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the corresponding number of threads is started according to the target IP address and the target port information, and an instruction for verifying the opening of the firewall is executed.

It should be noted that, in some embodiments of the present application, if the number of the target IP address and the target port information respectively mapped to the source IP address and the source port information is larger, and exceeds a preset threshold, For convenience, generate a corresponding firewall port information list according to the mutually mapped relationship; and start a corresponding thread number according to the generated firewall port information list to execute an instruction for verifying the firewall opening, and verify each target IP address and target port and the source IP address. Whether the firewall between the address and the source port is open.

Or, in another implementation manner of the present application, if the source IP address and the target IP address and the target port information corresponding to the source port information are not queried, the firewall opening verification command is sent to the predetermined server node. .

It should be noted that the firewall whitelist includes a mapping relationship between the source IP address and the source port information and the target IP address and the target port information. When the firewall provisioning verification program stored in the memory 11 is executed by the processor 12, the method further includes The step of generating the firewall whitelist in advance, the step of generating the firewall whitelist in advance includes:

The predetermined client is monitored in real time or periodically within a preset time. If the client launches the application, the request message sent by the client is monitored, and the request message includes the service code information and the target service system. Describe a target IP address corresponding to the service code information;

In this embodiment, the preset time may be automatically set according to a predetermined service type of the client. For example, if the predetermined client is a mail service system, the preset time may be set to be within the last 3 months, or Within one month, or if the predetermined client is a web browser of the World Wide Web, the preset time may be set to the most recent week, etc.; the service code information of the target service system is a predetermined readable string.

Obtaining a target port information corresponding to the target IP address corresponding to the monitored service code information, and generating a mapping relationship between the monitored target IP address and the obtained target port information and the source IP address and the source port information of the client, The mapping relationship is written to the firewall whitelist.

Further, the firewall white list is stored in a predetermined database.

For example, in an embodiment, after receiving the request for obtaining the service data sent by the client, obtaining the source IP address of the client is 192.168.0.1, the source port information is 8080, and traversing based on the source IP address and the source port information. The pre-generated firewall whitelist is assumed to be queried in the whitelist of the firewall. The destination IP addresses mapped to the source IP address are 192.168.1.1 and 192.168.1.2, and the destination port information mapped to the source port information is 8080. The list of firewall port information that needs to be opened for the client is as follows:

The first group (192.168.0.1 to 192.168.1.1 8080)

The second group (192.168.0.1 to 192.168.1.2 8080)

According to the firewall port information list, the corresponding multi-thread is started to generate a plurality of http requests for linking the source IP address, and the source IP address is 192.168.0.1; if the login success information returned by the client is received, the generated The telnet commands of the target IP addresses 192.168.1.1 8080 and 192.168.1.1 8080 are respectively linked, and if the information about the successful link returned by the service system corresponding to the target IP address is received, it is determined that the firewall is enabled.

According to the above embodiment, the electronic device proposed by the present application obtains the source IP address and source port information of the client after receiving the request for acquiring the service data sent by the client; based on the source IP address and the source The port information traverses the pre-generated firewall whitelist, and queries the target IP address and the target port information respectively mapped to the source IP address and the source port information in the firewall whitelist; if the source and the source are queried The target IP address and the target port information mapped to each other by the IP address and the source port information are used to execute a verification firewall opening command according to the target IP address and the target port information. Improves the efficiency of verifying the firewall's provisioning and improves verification accuracy.

It should be further noted that the firewall provisioning verification program of the present application may be described by using a program module having the same function according to different functions implemented by the various parts thereof. Please refer to FIG. 2 , which is a schematic diagram of a program module of a mutual firewall opening verification program in an embodiment of the electronic device of the present application. In this embodiment, the firewall provisioning verification program may be divided into the obtaining module 201, the query module 202, and the verification module 203 according to different functions implemented by the respective parts. As can be seen from the above description, the program module referred to in the present application refers to a series of computer program instruction segments capable of performing a specific function, and is more suitable than the program to describe the execution process of the firewall provisioning verification program in the electronic device 10. The functions or operational steps implemented by the modules 201-203 are similar to the above, and are not described in detail herein, by way of example, for example:

The obtaining module 201 is configured to obtain the source IP address and the source port information of the client after receiving the request for acquiring the service data sent by the client.

The querying module 202 is configured to traverse the pre-generated firewall whitelist based on the source IP address and the source port information, and query the mapping between the source IP address and the source port information in the firewall whitelist. Target IP address and destination port information;

The identification module 203 is configured to: if the target IP address and the target port information mapped to the source IP address and the source port information are queried, start the verification firewall according to the target IP address and the target port information to start the corresponding thread number. Open the order.

In addition, the present application also provides a firewall provisioning verification method. Referring to FIG. 3, the firewall provisioning verification method includes the following steps:

Step S301, after receiving the request for acquiring service data sent by the client, acquiring source IP address and source port information of the client;

Step S302, traversing the pre-generated firewall whitelist based on the source IP address and the source port information, and querying a target IP mapped between the source IP address and the source port information in the firewall whitelist. Address and destination port information;

Step S303, if the target IP address and the target port information mapped to the source IP address and the source port information are queried, the corresponding thread number is started according to the target IP address and the target port information, and the verification firewall opening instruction is executed. .

It should be noted that, in various embodiments of the present application, the firewall whitelist includes a mapping relationship between a source IP address and source port information and a target IP address and target port information, and the firewall provisioning verification method further includes The step of generating the firewall whitelist, the step of pre-generating the firewall whitelist includes:

Obtaining the target port information of the target IP address corresponding to the monitored service code information, and generating a mapping relationship between the monitored target IP address and the obtained target port information and the source IP address and source port information of the client, and mapping the mapping The relationship is written to the firewall whitelist.

Further, the firewall white list is stored in a predetermined database.

The first group (192.168.0.1 to 192.168.1.1 8080)

The second group (192.168.0.1 to 192.168.1.2 8080)

According to the foregoing embodiment, the firewall provisioning verification method of the present application obtains the source IP address and source port information of the client after receiving the request for obtaining the service data sent by the client; based on the source IP address and the location The source port information traverses the pre-generated firewall whitelist, and queries the target IP address and the target port information respectively mapped to the source IP address and the source port information in the firewall whitelist; Determining the target IP address and the target port information that the source IP address and the source port information are mutually mapped, and starting the corresponding thread number according to the target IP address and the target port information to execute the verification firewall opening instruction. Improves the efficiency of verifying the firewall's provisioning and improves verification accuracy.

In addition, the present application further provides a computer readable storage medium on which a firewall provisioning verification program is stored, and when the firewall provisioning verification program is executed by the processor, the following operations are implemented:

If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the corresponding thread number is started according to the target IP address and the target port information, and the verification firewall opening instruction is executed at the same time. Verify that the firewall between each target IP address and destination port and the source IP address and the source port is open.

Further, when the firewall provisioning verification program is executed by the processor, the following operations are also implemented:

If the source IP address and the target IP address and the target port information corresponding to the source port information are not queried, the firewall opening verification command is sent to the predetermined server node.

The predetermined client is monitored in real time or periodically within a preset time. If the client launches the application, the request message sent by the client is monitored, and the request message includes the service code information and the target service system. The IP address corresponding to the service code information;

Obtaining the port information of the IP address corresponding to the monitored service code information, and generating a mapping relationship between the monitored IP address and the obtained port information and the source IP address and the source port information of the client, and writing the mapping relationship The firewall whitelist.

The specific embodiment of the computer readable storage medium of the present application is substantially the same as the foregoing embodiments of the electronic device and the firewall opening verification method, and is not described herein.

The serial numbers of the embodiments of the present application are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the foregoing embodiment method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases, the former is better. Implementation. Based on such understanding, the technical solution of the present application, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the methods described in various embodiments of the present application.

The above is only a preferred embodiment of the present application, and is not intended to limit the scope of the patent application, and the equivalent structure or equivalent process transformations made by the specification and the drawings of the present application, or directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of this application.

Claims

An electronic device, comprising: a memory, and a processor connected to the memory, wherein the processor is configured to execute a firewall provisioning verification program stored on the memory, and the firewall opening verification program is The processor implements the following steps when executed:

A1. After receiving the request for obtaining the service data sent by the client, obtaining the source IP address and source port information of the client;

A2, traversing the pre-generated firewall whitelist based on the source IP address and the source port information, and querying a target IP address mapped to the source IP address and the source port information in the firewall whitelist respectively. And target port information;

A3. If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the corresponding thread number is started according to the target IP address and the target port information, and the verification firewall is opened. Instructions.
The electronic device according to claim 1, wherein the step A3 is replaced by the following steps:

If the source IP address and the target IP address and the target port information corresponding to the source port information are not queried, the firewall opening verification command is sent to the predetermined server node.
The electronic device according to claim 1, wherein the step A3 is replaced by the following steps:

If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the source IP address, the source port information, the queried target IP address, and the target port information are obtained according to the source IP address and the target port information. Generate a firewall port information list, and start the corresponding number of threads according to the generated firewall port information list to execute the instruction to verify the firewall opening.
The electronic device according to claim 1, wherein in the step A2, the firewall whitelist includes a mapping relationship between a source IP address and source port information and a target IP address and target port information, When the firewall provisioning verification program is executed by the processor, the following steps are also implemented:

The predetermined client is monitored in real time or periodically within a preset time. If the client launches the application, the request message sent by the client is monitored, and the request message includes the service code information and the target service system. Describe a target IP address corresponding to the service code information;

Obtaining the target port information corresponding to the monitored target IP address, and generating a mapping relationship between the monitored target IP address and the obtained target port information and the source IP address and the source port information of the client, and writing the mapping relationship The firewall whitelist.
The electronic device according to claim 4, wherein the service code information of the target service system is a predetermined readable character string.
A firewall provisioning verification method, characterized in that the method comprises the following steps:

S1. After receiving the request for obtaining service data sent by the client, obtain the source IP address and source port information of the client.

S2, traversing the pre-generated firewall whitelist based on the source IP address and the source port information, and querying a target IP address mapped to the source IP address and the source port information in the firewall whitelist respectively. And target port information;

S3. If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the corresponding thread number is started according to the target IP address and the target port information, and the verification firewall is activated. Instructions.
The method for verifying the opening of a firewall according to claim 6, wherein the step S3 is replaced by the following steps:

If the source IP address and the target IP address and the target port information corresponding to the source port information are not queried, the firewall opening verification command is sent to the predetermined server node.
The method for verifying the opening of a firewall according to claim 6, wherein the step S3 is replaced by the following steps:

If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the source IP address, the source port information, the queried target IP address, and the target port information are obtained according to the source IP address and the target port information. Generate a firewall port information list, and start the corresponding number of threads according to the generated firewall port information list to execute the instruction to verify the firewall opening.
The firewall provisioning verification method according to claim 6, wherein in the step S2, the firewall white list includes a mapping relationship between a source IP address and source port information, a target IP address, and target port information, The method further includes the following steps:

The predetermined client is monitored in real time or periodically within a preset time. If the client launches the application, the request message sent by the client is monitored, and the request message includes the service code information and the target service system. Describe a target IP address corresponding to the service code information;

Obtaining the target port information corresponding to the monitored target IP address, and generating a mapping relationship between the monitored target IP address and the obtained target port information and the source IP address and the source port information of the client, and writing the mapping relationship The firewall whitelist.
The firewall provisioning verification method according to claim 4, wherein the service coding information of the target service system is a predetermined readable character string.
A firewall provisioning verification system, characterized in that the system comprises an acquisition module, a query module and an identification module;

The acquiring module is configured to obtain a source IP address and source port information of the client after receiving the request for acquiring service data sent by the client;

The querying module is configured to traverse the pre-generated firewall whitelist based on the source IP address and the source port information, and query the firewall whitelist to map with the source IP address and the source port information respectively. Target IP address and destination port information;

The identification module is configured to start a corresponding thread according to the target IP address and the target port information, if the target IP address and the target port information mapped to the source IP address and the source port information are queried The number executes the instructions that verify the firewall is turned on.
The firewall provisioning verification system according to claim 6, wherein the identification module is further configured to: if the source IP address and the destination port address and the target port information corresponding to the source port information are not queried, A firewall provisioning verification command is sent to the predetermined server node.
The firewall provisioning verification system according to claim 10, wherein the identification module is further configured to: if the target IP address and the target port information mapped to the source IP address and the source port information are queried, And generating a firewall port information list according to the source IP address, the source port information, the queried target IP address, and the target port information, and starting the corresponding thread number according to the generated firewall port information list to execute an instruction for verifying the firewall opening.
The firewall provisioning verification method according to claim 10, wherein the firewall whitelist includes a mapping relationship between a source IP address and source port information and a target IP address and target port information, and the system further includes a monitoring module. The monitoring module is configured to monitor a predetermined client in real time or periodically within a preset time. If a client launch application is detected, the request message sent by the client is monitored, and the request message includes a target service. a service coded information of the system and a target IP address corresponding to the service coded information;

Obtaining the target port information corresponding to the monitored target IP address, and generating a mapping relationship between the monitored target IP address and the obtained target port information and the source IP address and the source port information of the client, and writing the mapping relationship The firewall whitelist.
The firewall provisioning verification method according to claim 14, wherein the service encoding information of the target service system is a predetermined readable character string.
A computer readable storage medium storing a firewall provisioning verification program, the firewall provisioning verification program being executable by at least one processor to cause the at least one processor to perform the following steps:

After receiving the request for obtaining service data sent by the client, obtaining the source IP address and source port information of the client;

Querying a pre-generated firewall whitelist based on the source IP address and the source port information, and querying a target IP address and a target mapped between the source IP address and the source port information in the firewall whitelist respectively Port information;

If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the corresponding number of threads is started according to the target IP address and the target port information, and the instruction for verifying the opening of the firewall is executed. .
The storage medium according to claim 16, wherein the source IP address and the target port information mapped to the source IP address and the source port information are queried according to the target IP address and The step A3 of the instruction that the target port information starts the corresponding thread number to execute the verification firewall opening may be replaced by the following steps:

If the source IP address and the target IP address and the target port information corresponding to the source port information are not queried, the firewall opening verification command is sent to the predetermined server node.
The storage medium according to claim 16, wherein the source IP address and the target port information mapped to the source IP address and the source port information are queried according to the target IP address and The step of the target port information initiating the corresponding number of threads to execute the instruction to verify the firewall opening may be replaced by the following steps:

If the target IP address and the target port information mapped to the source IP address and the source port information are queried, the source IP address, the source port information, the queried target IP address, and the target port information are obtained according to the source IP address and the target port information. Generate a firewall port information list, and start the corresponding number of threads according to the generated firewall port information list to execute the instruction to verify the firewall opening.
The storage medium according to claim 16, wherein the firewall whitelist comprises a mapping relationship between a source IP address and source port information and a target IP address and target port information, and the firewall provisioning verification procedure is The processor also implements the following steps when executed:

The predetermined client is monitored in real time or periodically within a preset time. If the client launches the application, the request message sent by the client is monitored, and the request message includes the service code information and the target service system. Describe a target IP address corresponding to the service code information;

Obtaining the target port information corresponding to the monitored target IP address, and generating a mapping relationship between the monitored target IP address and the obtained target port information and the source IP address and the source port information of the client, and writing the mapping relationship The firewall whitelist.
The storage medium according to claim 19, wherein the service encoding information of the target service system is a predetermined readable character string.