WO2020232785A1 - Device security policy configuration method and apparatus - Google Patents

Abstract

Embodiments of the present application provide a device security policy configuration method and apparatus. A normalized policy is constructed on the basis of a unified policy description language according to a target configuration requirement; a policy template corresponding to a target device is obtained from a policy template library; target parameters are screened out from all configuration parameters in the normalized policy according to the policy template, and target command lines are obtained from all command lines in the policy template according to all the target parameters; all the target command lines are converted according to all the target parameters, a configuration policy corresponding to the target device is generated, and finally the configuration policy is issued and configured to the target device. According to the method and apparatus, an administrator does not need to learn the syntax and semantics of various configuration commands, thereby contributing to reducing work costs; moreover, the administrator only needs to issue configuration requirements once, thereby effectively avoiding repeated operations and facilitating improvement of the device security policy configuration efficiency, and thus, it is ensured that a security policy can be configured to a device timely.

Description

Method and device for configuring equipment safety strategy

Cross references to related applications

This application claims the priority of the Chinese patent application filed on May 22, 2019 with the application number 201910427706.9 and the invention title "A method and device for configuring a device security policy", which is fully incorporated into this application by reference.

Technical field

This application relates to the technical field of computer network security, and more specifically, to a method and device for configuring a device security policy.

Background technique

With the development of network technology, the scale of the network has gradually increased, and network nodes have become increasingly intricate, making network threats appear diversified, complicated, and frequent. In order to ensure the security of the network and the system, a large number of diverse devices need to be deployed, and correct and effective security policies are configured for these devices to deal with network threats in a timely manner to ensure stable network operation.

As the devices in the network come from different manufacturers, they have personalized configuration commands and different configuration command syntax and semantics. Therefore, when configuring a large number of devices, the syntax and semantics of different configuration commands need to be compatible. Nowadays, the generally applicable one-by-one configuration method requires administrators to learn different configuration command syntax and semantics, and configure the devices one by one through the command-line interface (CLI) provided by the device. This method requires the administrator to learn a large number of configuration syntax, and the work cost is high; and when the same strategy needs to be configured on multiple devices, the administrator needs to repeat a large number of the same operations, which is inefficient. Therefore, when a network threat occurs, it may cause Security policies cannot be configured to devices in a timely and effective manner, causing unpredictable consequences.

Summary of the invention

In order to overcome the problems of high working cost and low efficiency, which require an administrator to learn a large amount of configuration syntax when configuring a large number of devices in the prior art, the embodiment of the present application provides a method and device for configuring a device security policy.

In the first aspect, an embodiment of the present application provides a method for configuring a device security policy, including:

Constructing a normalized strategy corresponding to the target configuration demand based on the unified strategy description language according to the target configuration demand, the normalized strategy including the strategy type, at least one target device and at least one configuration parameter;

For any target device in the normalized policy, obtain a policy template corresponding to the target device from a policy template library according to the policy type in the normalized policy, and the policy template includes at least one command line ；

Use the policy verification rule to verify the normalization strategy according to the policy template. If the verification passes, all configuration parameters in the normalization strategy are screened according to the policy template, and after screening Each configuration parameter of is used as a target parameter, and the target command line is obtained from all the command lines in the policy template according to all the target parameters;

Using the strategy conversion rule to convert all target command lines according to all target parameters, generate a configuration strategy corresponding to the target device, and configure the target device according to the configuration strategy.

In the second aspect, an embodiment of the present application provides an apparatus for configuring a device security policy, including:

The normalization strategy building module is used to construct a normalization strategy corresponding to the target configuration requirements based on the unified strategy description language according to the target configuration requirements, and the normalization strategy includes a strategy type, at least one target device, and at least one configuration parameter;

The policy template obtaining module is configured to obtain, for any target device in the normalized policy, a policy template corresponding to the target device from a policy template library according to the policy type in the normalized policy, the policy The template contains at least one command line;

The parameter and command line determination module is used for verifying the normalization strategy according to the policy template by using the policy verification rule, and if the verification is passed, then verifying the normalization strategy according to the policy template All configuration parameters are screened, each configuration parameter after screening is taken as a target parameter, and the target command line is obtained from all command lines in the policy template according to all target parameters;

The strategy conversion and configuration module is used to convert all target command lines according to all target parameters using the strategy conversion rules, generate a configuration strategy corresponding to the target device, and configure the target device according to the configuration strategy.

In a third aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The processor executes the program as described in the first aspect. Steps of the provided method.

In a fourth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method provided in the first aspect are implemented.

The device security policy configuration method and device provided in the embodiments of this application construct a normalized policy based on the unified policy description language according to the target configuration requirements, and obtain the policy template corresponding to the target device from the policy template library, and then normalize it from the policy template. Target parameters are filtered out of all configuration parameters in the strategy, and the target command lines are obtained from all command lines in the policy template according to all target parameters, and all target command lines are converted according to all target parameters to generate the configuration corresponding to the target device. Policy, and finally the configuration policy is delivered and configured to the target device. The method and device do not require the administrator to learn the syntax and semantics of different configuration commands, which is beneficial to reduce work costs; and the administrator only needs to issue configuration requirements once, which can effectively avoid repeated operations, and is beneficial to improve the configuration efficiency of equipment security policies. Ensure that the security policy can be configured to the device in time.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description These are some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

FIG. 1 is a schematic flowchart of a method for configuring a device security policy according to an embodiment of the application;

FIG. 2 is a state transition diagram of a target device in a method for configuring a device security policy provided by an embodiment of the application;

3 is a schematic structural diagram of a device security policy configuration device provided by an embodiment of the application;

FIG. 4 is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of this application.

FIG. 1 is a schematic flowchart of a method for configuring a device security policy according to an embodiment of the application. As shown in FIG. 1, an embodiment of the application provides a method for configuring a device security policy, including:

S1: Construct a normalized strategy corresponding to the target configuration requirement based on the unified strategy description language according to the target configuration requirement, and the normalized strategy includes the strategy type, at least one target device and at least one configuration parameter;

It should be noted that the command line formats of devices of different manufacturers, types, and versions are different, and the number of parameters and the number of command lines in a complete configuration behavior are also different. In view of this, the embodiment of the application uses the complete configuration behavior as a unit, analyzes the configuration command lines of various manufacturers, and summarizes the differences in the following four aspects: difference in symbol expression, difference in keyword expression, difference in parameter format, number of parameters and commands The number of rows differs. Among them, the difference in symbol expression means that different manufacturers use different symbols to express the same meaning; the difference in keyword expression means that different manufacturers use different keywords to express the same meaning; the difference in parameter format means that different manufacturers use different formats to express the same parameters ; The difference between the number of parameters and the number of command lines means that different manufacturers use different numbers of parameters and command lines to achieve a configuration behavior.

As shown in Table 1 below, in specific models of firewalls, TOPSEC and Huawei use the "<>" symbol and the "{}" symbol to indicate enumerated parameters, respectively; TOPSEC and Huawei use the keyword "ipaddr" and The "destination-address" keyword guides the destination IP address parameter; TOPSEC and Huawei use the "accept|reject" enumeration value and the "permit|deny" enumeration value respectively to indicate acceptance or rejection; TOPSEC uses 11 parameters and Three related command lines are used to implement the packet filtering function, while Huawei uses 17 parameters and 8 related command lines to implement the packet filtering function.

Table 1 Example of a collection of packet filtering configuration commands for a firewall of Tianrongxin and a firewall of Huawei

Based on the differences in the above four aspects, the embodiment of the present application designs a unified policy description language to be compatible with differences in different configuration command formats. In the unified strategy description language, the above four differences are unified, and the specific design is as follows:

(1) Unified symbol format. Different devices use different symbols to represent the same semantic function. In view of this, the embodiment of the present application uniformly defines different symbols based on semantics.

(2) Unify the way of expressing keywords. Different devices use different keywords to represent the same semantic identification. In view of this, the embodiment of the present application uses a unified encoding to replace character strings with different formats based on the characteristics of simple, universal, and easy calculation of encoding. Keyword encoding is a code set for each parameter with a fixed meaning. Compared with the use of string representation, the encoding representation can be more easily recognized and analyzed by the computer.

(3) Unified parameter format. Different devices use different format representations for the same parameter value. In order to unify the parameter format, the embodiment of the present application defines three representation formats: enumerated type, string type and numeric type, and unified parameter representation format.

(4) Unify the types and quantities of parameters. Different devices have their own capabilities, such as blocking network data. Nowadays, in order to realize a certain capability of the device, the administrator needs to set some target parameters, based on the personalized command line provided by the device, and configure the device to realize the capability through the CLI interface provided by the device. Based on the semantics of capabilities, the embodiment of this application extracts parameters from a collection of command lines that come from different devices that jointly implement the same capability, and organizes them into a complete set, deletes duplicate parameters with the same meaning, and deletes no special meaning and can use other parameters. Parameter substitution parameters, such as the IP object name, can be replaced by the IP address itself. The parameters of the same capability are grouped into a set, and all capabilities are uniformly coded, so a parameter can be uniquely marked through capability encoding and parameter encoding. Compared with the current "intersection" method for parameters of the same capability, this method can retain the individual characteristics of different devices, lay a foundation for precise strategic configuration, and help to better play the value of the device. At the same time, the redundancy of the parameter set is reduced by deleting duplicate semantic parameters and replacing parameters without special meaning with necessary parameters.

On the basis of the above technical solution, when there is a target configuration requirement, a normalized strategy corresponding to the target configuration requirement can be constructed based on the above unified policy description language according to the target configuration requirement. Wherein, the normalized strategy includes a strategy type, at least one target device, and at least one configuration parameter. In addition, the normalization strategy can also include the strategy generator, which can be set according to actual needs, and there is no specific limitation here. The following table 2 is used to specifically describe the normalization strategy in the embodiment of the present application:

Table 2 is an example of the format of the normalized policy provided by the embodiments of this application. In Table 2, the keyword "PolicyType" is used to identify the policy type; the keyword "PolicyObject" is used to identify the policy generator; the keyword "PolicySubject" is used to identify The target device is the policy configuration object; the keyword "PolicyParameter" is used to identify the configuration parameter. Among them, each configuration parameter is represented by a code, such as "Parameter1_SerialNum", "Parameter2_SerialNum", "Parameter3_SerialNum" are the codes of parameter 1, parameter 2, and parameter 3 respectively. The code of each parameter is followed by the corresponding parameter value, such as " "P1_Enum_value1" and "P1_Enum_value2" are the values of "Parameter1_SerialNum", their type is enumerated, which means that the parameter can only choose one of these two values; "P2_String_value" is the value of "Parameter2_SerialNum", expressed in a string format; "P3_Num_value" is the value of "Parameter3_SerialNum", expressed in numerical format. In addition, use the English colon ":" to link the parameter code and parameter value; use the English semicolon ";" as the end identifier of each line of sentences; use the braces "{" and "}" as the beginning of the parameter part of the strategy Start and end identification; use English double quotation marks """ to mark character strings; use square brackets "[" and "]" to mark enumeration type parameters; use vertical bars "|" to separate enumeration parameters.

Table 2 Examples of normalized strategy format

In addition, it should be noted that the types of policies in the embodiments of this application include but are not limited to: packet filtering policies, routing policies, device shutdown policies, device restart policies, service shutdown policies, service restart policies, service Migration strategy, data backup strategy, disconnection strategy (RST), connection closure strategy (FIN), vulnerability repair strategy, process killing strategy, registry modification strategy, user permission modification strategy, file Any one or more of the access authority modification strategy, the user password modification strategy, and the password resource operation strategy.

The target devices in the embodiments of this application include, but are not limited to: firewalls, routers, access gateways, Internet gateways, content filtering devices, terminals (fixed terminals, mobile terminals, satellite terminals), servers, cryptographic devices, authentication devices, VPNs, Any one or more of honeypots, switches, modems, hubs, and bridges.

S2, for any target device in the normalized policy, obtain a policy template corresponding to the target device from the policy template library according to the policy type in the normalized policy, and the policy template includes at least one command line;

Specifically, on the basis of the aforementioned technical solution, if the aforementioned normalization strategy includes multiple target devices, it indicates that the aforementioned normalization strategy needs to be configured for multiple target devices at the same time. On this basis, for any target device in the normalized strategy, the strategy template corresponding to the target device is obtained from the strategy template library according to the target device itself and the strategy type in the normalized strategy. It is understandable that the policy templates of different policy types corresponding to different devices are pre-stored in the policy template library. In other words, devices, policy types, and policy templates are pre-associated and stored in the policy template library. Therefore, the policy template corresponding to the target device can be obtained from the policy template library according to the target device itself and the policy type in the normalized policy. In addition, it should be noted that the policy templates in the policy template library are a collection of command lines for configuring different policy types corresponding to different devices, that is, each policy template in the policy template library contains at least one command line.

S3. Use the policy verification rule to verify the normalization strategy according to the policy template. If the verification passes, then filter all configuration parameters in the normalization strategy according to the policy template, and use each configuration parameter after screening as Target parameters, obtaining target command lines from all command lines in the policy template according to all target parameters;

Specifically, on the basis of the foregoing technical solution, it can be understood that the policy template obtained through the foregoing method steps is a command line set of the target device to configure a normalized policy. In other words, when configuring a normalized policy for the target device, the command line in the policy template needs to be used. On this basis, in the embodiment of this application, in order to verify whether the target device can effectively configure the normalization strategy, the normalization strategy is verified according to the policy template by using the policy verification rule, and if the verification passes, the target device Able to effectively configure the normalization strategy.

On the basis of passing the verification, since the normalization strategy contains at least one target device, that is to say, the normalization strategy needs to be configured for multiple target devices at the same time. Therefore, the configuration parameters included in the normalization strategy are Multiple target devices configure the union of configuration parameters required by the normalization strategy. In view of this, when configuring a normalization strategy for a certain target device, it is necessary to filter the configuration parameters required by the target device from the normalization strategy. In the embodiment of the present application, when configuring a normalization strategy for a certain target device, In a unified strategy, all configuration parameters in the normalized strategy are screened according to the strategy template corresponding to the target device, and each configuration parameter after screening is used as the target parameter. It can be understood that the target parameter is a parameter required by the target device to configure a normalization strategy.

After the target parameter is obtained, the target parameter may not contain a required parameter and/or optional parameter of a certain command line in the policy template, so that the command line cannot be effectively configured. In view of this, in order to verify whether all the command lines in the policy template can be effectively configured, in the embodiment of the present application, the target command lines are obtained from all the command lines in the policy template according to all target parameters, so that each target command line All the parameters (including mandatory and optional parameters) in are included in the target parameters, so as to ensure that each target command line can be effectively configured.

S4: Use the strategy conversion rule to convert all target command lines according to all target parameters, generate a configuration strategy corresponding to the target device, and configure the target device according to the configuration strategy.

Specifically, on the basis of the above technical solution, the strategy conversion rule is used to convert all target command lines according to all target parameters, that is, the target parameter is filled into the corresponding position of the target command line by the strategy conversion rule to realize the target command Conversion of lines. Regarding the converted target command line as the configuration strategy corresponding to the target device, it can be understood that the configuration strategy corresponding to the target device refers to the command line set that the target device can recognize, and the command line set can realize the normalization strategy Configuration. Finally, the target device is configured according to the configuration strategy, that is, the configuration strategy is delivered and configured to the target device.

It should be noted that, in this embodiment of the application, when the administrator needs to configure a certain type of security policy for one or more target devices, he only needs to issue a target configuration requirement including the policy type, target device, and configuration parameters. Through the above method steps, the target configuration requirement is converted into a configuration strategy that can be recognized by each target device, and the configuration strategy is finally issued and configured to each target device. There is no need for the administrator to learn different configuration command syntax and semantics, which is beneficial Reduce work costs; and the administrator only needs to issue configuration requirements once, which can effectively avoid repeated operations and help improve the configuration efficiency of device security policies to ensure that security policies can be configured to devices in a timely manner.

The device security policy configuration method provided by the embodiment of the application constructs a normalized policy based on the unified policy description language according to the target configuration requirements, and obtains the policy template corresponding to the target device from the policy template library, and obtains the policy template corresponding to the target device according to the policy template. Filter out the target parameters from all the configuration parameters in the, and obtain the target command lines from all the command lines in the policy template according to all target parameters, convert all target command lines according to all target parameters, and generate the configuration policy corresponding to the target device. Finally, the configuration policy is delivered and configured to the target device. This method does not require the administrator to learn the syntax and semantics of different configuration commands, which is beneficial to reduce work costs; and the administrator only needs to issue configuration requirements once, which can effectively avoid repeated operations, and is beneficial to improve the configuration efficiency of device security policies to ensure Configure the security policy to the device in time.

Based on any of the above embodiments, a device security policy configuration method is provided. According to the policy type in the normalized policy, the policy template corresponding to the target device is obtained from the policy template library. Before this, it also includes: A strategy type is used as the target strategy type. For any target strategy type, all command lines corresponding to the target strategy type are obtained from the device manual corresponding to the target device; all command lines corresponding to the target strategy type are converted based on the unified strategy description language, Combine all the converted command lines into a policy template; store the target device, target policy type and policy template in association with the policy template library.

Specifically, in the embodiment of the present application, before obtaining the policy template corresponding to the target device from the policy template library according to the policy type in the normalized policy, it is also necessary to associate the policy templates of different policy types corresponding to the target device to the policy. In the template library, the specific implementation process is as follows:

It is understandable that the policy types allowed to be configured on different devices are not the same, and the policy types allowed to be configured on the same device are often more than one. In the embodiment of this application, each policy type allowed to be configured by the target device is taken as the target policy type. On this basis, for any target policy type, obtain all the command lines corresponding to the target policy type from the device manual corresponding to the target device. It is understandable that all the command lines corresponding to the target policy type refer to all the command lines involved in configuring the target policy type by the target device. In other embodiments, all the command lines corresponding to the target strategy type can also be obtained from other databases other than the device manual, which can be set according to actual requirements, and no specific limitation is made here.

After all the command lines corresponding to the target strategy type are obtained, all the command lines corresponding to the target strategy type are converted based on the unified strategy description language, that is, the unified strategy description language is used to convert the keywords and keywords in all the command lines corresponding to the target strategy type. The symbol and parameter formats are unified, and the specific conversion steps are as follows:

(1) Reserve the characters that the device needs to use. As shown in Table 1 above, the bold characters in each command line are the characters that the device needs to use when parsing the command line. Therefore, all characters of this type are reserved without any modification. For example, the "define add host name" string in the TOPSEC firewall configuration command line must be recognized by the device to determine the command line function.

(2) Modify the characters used for prompting. There are two types of characters used to prompt the user for input in the command line: prompt string and prompt symbol. The prompt string is a string in the command line that does not need to be recognized by the device, and is used to prompt the user for the filling position of the parameter. As shown in Table 1 above, the unbold italic string in each command line is a prompt string. For example, the "hostname" in the first command line of Tianrongxin is used to prompt the user to enter the IP address name parameter here. In practice, the device does not recognize this string. Different manufacturers may use different character strings in order to identify information with the same meaning, and these character strings do not need to be transmitted to the device. Therefore, the embodiment of the present application uses parameter encoding instead of complex and changeable character strings based on a unified policy description language. The prompt symbol is a symbol in the command line that does not need to be recognized by the device. It is used to prompt the user for related information. For example, "#" identifies the beginning of a command line, and Huawei firewall uses "{}" to identify enumeration parameters. Different manufacturers may use different symbols to identify information with the same meaning, and these symbols do not need to be transmitted to the device. Therefore, the embodiment of the present application defines seven symbols based on the unified policy description language to uniformly identify the corresponding meaning information. The 7 types of symbols include: "#", "@", "%", "[]", "<>", "{}" and "|". The "#" symbol is used to identify the required command line, the "@" symbol is used to identify the optional command line, the "%" symbol is used to identify the position of the parameter, and the "[]" symbol is used to identify the optional parameter, "<> The "" symbol is used to identify the target format of the parameter, the "{}" symbol is used to identify the required parameter of the enumeration type, and the "|" is used to separate the enumeration parameter or the target format.

(3) Add parameter format information recognized by the device. The parameter format is the manifestation of the parameter. The parameter format recognized by different manufacturers' equipment is different. For example, the action parameter in the packet filtering configuration command line, TOPSEC firewall uses the "accept" logo to receive data packets, while the Huawei firewall uses the "permit" logo For receiving data packets, another example is the hardware address parameter in the configuration command line for layer 2 data packet filtering. TOPSEC firewall uses the format "xx:xx:xx:xx:xx:xx" and Huawei firewall uses "xx-xx-xx" -xx-xx-xx" format identification. In order to convert a unified policy into a set of personalized configuration commands, the embodiment of the application formulates a target format information for each parameter that needs to be converted based on the unified parameter format in the unified policy description language, and fills it in the policy template command line In the "<>" symbol after the corresponding parameter encoding. If the parameter format recognized by the target device is the same as the parameter format in the unified policy description language, the "<>" symbol and target format information are not required after the corresponding parameter encoding.

(4) Modify the composition of the command line in the conversion template. As shown in Table 1 above, each command line has its own definite function. In actual use, some command lines may be used multiple times. Therefore, the command line in the conversion template is not just a collection of command lines given by the device manufacturer. It may contain multiple command lines with the same function. As shown in the command line that defines the IP address in the packet filtering policy configuration command line set of TOPSEC firewall, the command line does not restrict the use of IP addresses, so it can be used to define the source IP address and the destination IP address. Therefore, there should be two such command lines in the conversion template. Modify the parameter prompt string to the source IP address parameter code and the destination IP address parameter code to define the source IP address and destination IP address respectively.

Through the above method steps, all the command lines corresponding to the target strategy type can be converted, and all the converted command lines are formed into a strategy template corresponding to the target strategy type. Finally, the target device, the target policy type, and the policy template are associated and stored in the policy template library, so that the policy template corresponding to the target device can be obtained from the policy template library according to the policy type in the normalized policy.

Based on any of the above embodiments, a method for configuring a device security policy is provided. The normalized policy is verified according to a policy template using policy verification rules, specifically: obtaining all required parameters from all command lines of the policy template Dependent parameters corresponding to each mandatory parameter; determine whether all mandatory parameters and all dependent parameters are included in the normalization strategy; if all mandatory parameters and all dependent parameters are included, the normalization strategy is determined to pass, if If all required parameters and all dependent parameters are not included, it is determined that the normalization strategy verification fails.

Specifically, in the embodiment of the present application, the normalized policy is verified according to the policy template using the policy verification rule, and the specific implementation process is as follows:

It should be noted that different devices have different requirements for the same policy. For some devices, some parameters are necessary parameters for configuring the current policy. That is, if the parameter is missing, the entire policy configuration will fail. In the embodiment of this application, Set the required parameters for configuring the current strategy as mandatory parameters. In addition, some parameters have dependencies, that is, configuring a certain parameter requires configuring other related parameters at the same time. In the embodiment of the present application, a parameter having a dependency relationship with a certain parameter is used as the dependent parameter corresponding to the parameter.

Based on the foregoing principles and facts, in this embodiment of the application, all mandatory parameters and dependent parameters corresponding to each mandatory parameter are obtained from all command lines of the policy template, and on this basis, it is determined whether all mandatory parameters are included in the normalization strategy. Select parameters and all dependent parameters; if the normalization strategy includes all required parameters and all dependent parameters, the normalization strategy is determined to pass, which means that the target device can configure the normalization strategy; if the normalization strategy is If all required parameters and all dependent parameters are not included, it is determined that the normalization strategy verification fails, which means that the target device cannot be configured with the normalization strategy.

The device security policy configuration method provided by the embodiment of the application uses the policy verification rule to verify the normalized policy according to the policy template to determine whether the target device can configure the normalized policy, which can effectively reduce the probability of policy configuration failure .

Based on any of the above embodiments, a method for configuring a device security policy is provided. All configuration parameters in a normalized policy are filtered according to a policy template. Specifically, for any configuration parameter in the normalized policy, if the policy If the template does not contain configuration parameters, delete the configuration parameters from the normalization strategy; obtain all optional parameters and the dependent parameters corresponding to each optional parameter from all command lines in the strategy template. For any optional parameter, if If the normalization strategy includes optional parameters, and the normalization strategy does not include the dependent parameters corresponding to the optional parameters, the optional parameters are deleted from the normalization strategy.

Specifically, since the normalization strategy includes at least one target device, that is, multiple target devices need to be configured with a normalization strategy at the same time, therefore, the configuration parameters included in the normalization strategy are multiple target device configurations. The union of the configuration parameters required by the normalization strategy. In view of this, when configuring a normalization strategy for one of the target devices, it is necessary to filter the configuration parameters required by the target device from the normalization strategy. In the embodiment of the present application, for any configuration parameter in the normalization strategy, if the configuration parameter is not included in the policy template, the configuration parameter is deleted from the normalization strategy. In addition, all optional parameters and dependent parameters corresponding to each optional parameter are obtained from all the command lines of the policy template. For any optional parameter, if the optional parameter is included in the normalization strategy, and the normalization strategy If the dependent parameter corresponding to the optional parameter is not included, the optional parameter is deleted in the normalization strategy. After passing the above screening steps, each remaining configuration parameter in the normalization strategy is taken as the target parameter.

Based on any of the above embodiments, a method for configuring a device security policy is provided. The target command line is obtained from all the command lines in the policy template according to all target parameters, specifically: for any command line in the policy template, if the command All required parameters in the line belong to the target parameter, the command line is regarded as the candidate command line; for any candidate command line, the optional parameters that are not the target parameter in the candidate command line are deleted to obtain the target command line.

Specifically, because the target parameter may not include a required parameter of a certain command line in the policy template, the command line cannot be effectively configured. In view of this, in the embodiment of the present application, the target command line is obtained from all the command lines in the policy template according to all the target parameters. The specific steps are as follows:

For any command line in the policy template, obtain all required parameters in the command line, and determine whether all required parameters in the command line belong to the target parameter. If all required parameters in the command line belong to The target parameter indicates that the command line can be configured, and the command line is used as a candidate command line. After all candidate command lines are obtained, it is also necessary to determine whether the optional parameters in the candidate command lines can be configured. In view of this, in the embodiment of the present application, for any candidate command line, all the options in the candidate command line are obtained. Select parameters, and then judge whether each optional parameter belongs to the target parameter. If an optional parameter does not belong to the target parameter, delete the optional parameter in the candidate command line. That is, the optional parameters that are not the target parameters in the candidate command line are deleted. After deleting the optional parameters that are not target parameters in the candidate command line, the target command line can be obtained. It can be understood that the required parameters and optional parameters in the target command line are all target parameters, so that the target command line can be effectively configured.

Based on any of the above embodiments, a method for configuring device security policies is provided, which uses policy conversion rules to convert all target command lines according to all target parameters. Specifically, for any target command line, set each target command line As the parameters to be converted, the position of each parameter to be converted in the target command line is obtained as the position to be filled, and the format corresponding to each parameter to be converted is obtained in the target command line as the target format; Conversion parameter: Obtain the target parameter that matches the parameter to be converted from all target parameters, as a matching parameter, convert the matching parameter according to the target format corresponding to the parameter to be converted, and fill the matching parameter after format conversion into the parameter to be converted The corresponding position to be filled.

Specifically, in the embodiment of the present application, all target command lines are converted according to all target parameters by using policy conversion rules, and the specific conversion steps are as follows:

For any target command line, take each parameter in the target command line as the parameter to be converted, obtain the position of each parameter to be converted in the target command line as the position to be filled, and obtain each parameter in the target command line. The format corresponding to the conversion parameter is used as the target format; thus, the position and corresponding format of each parameter to be converted in the target command line can be obtained. On this basis, for any parameter to be converted, a target parameter matching the parameter to be converted is obtained from all target parameters as a matching parameter, and the matching parameter is formatted according to the target format corresponding to the parameter to be converted. It is understandable that the matching parameter is a parameter in the normalization strategy, and its parameter format cannot be applied to all target devices; and the target format corresponding to the parameter to be converted is a parameter format that the target device can recognize, so the matching parameter The format is converted to the target format. For example, the normalized IP address numeric parameter 0x0ca85a10 is converted into the format "192.168.90.10" required by the device according to the dotted decimal target format information required by the target device. Finally, the matching parameters after format conversion are filled into the positions to be filled corresponding to the parameters to be converted. In addition, you need to delete strings and characters that are not recognized by the device in the target command line, including custom codes and symbols, such as "#" "[]", etc. Finally, all the converted target command lines are combined into the configuration strategy corresponding to the target device.

Based on any of the above embodiments, a method for configuring a device security policy is provided. The target device is configured according to the configuration policy, specifically: each command line in the configuration policy is issued and configured to the target device, and each The configuration result of the command line; if the currently obtained configuration result is a failure, the configuration is interrupted or reconfigured, and all the obtained configuration results are fed back to the user for analysis.

Specifically, in the embodiment of the present application, after obtaining the configuration policy corresponding to the target device, the target device is configured according to the configuration policy. The specific configuration process is as follows:

Send and configure each command line in the configuration policy to the target device, and obtain the configuration result of each command line. In the embodiment of this application, the configuration result is determined by keyword comparison, that is, the keyword in the personalized configuration reply message of the device is recorded, and the configuration result is determined by comparing the keywords in different situations. For example, it will be returned when the configuration command of TOPSEC firewall fails The "error" keyword and the specific error code, so record the "error" keyword. When the keyword exists in the comparison configuration response message, it means that the current command line configuration has failed, otherwise it means the configuration is successful. On this basis, for any current moment, if the currently obtained configuration result is a failure, the configuration is interrupted or reconfigured, and all the obtained configuration results are fed back to the user for analysis.

In the embodiment of this application, in the process of delivering and configuring the configuration policy to the target device, the target device has four states: Status0 indicates that the target device is in the state of monitoring data; Status1 indicates the state of the target device receiving the connection; Status2 indicates The target device is ready to configure the status after receiving the command line set; Status3 represents the status of the target device obtaining the configuration result after configuring the command line. Figure 2 is a state transition diagram of the target device in the device security policy configuration method provided by an embodiment of the application. As shown in Figure 2, first the target device is in the Status0 state, and enters the Status1 state when it monitors the connection; it receives in the Status1 state. When the command line set is not empty, it enters the Status2 state, and when the connection is timed out or receives a close connection signal, the connection is closed and enters the Status0 state; in the Status2 state, when the command line set is not empty, the command line is configured and the command line enters the Status3 state. , And when the command line set is empty, enter the Status1 state and continue to wait to receive the command line; in the Status3 state, return the configuration success result and enter the Status2 state to continue the configuration, and return the configuration failure result to enter the Status1 state and receive the command line again.

In order to facilitate the understanding of the method steps in the above method embodiments, the following examples are used for specific descriptions:

Example 1: Unified configuration of TOPSEC firewall and Huawei firewall packet filtering policy, the target configuration requirement is to allow the source IP address to be "10.11.12.13" (0x0a0b0c0d), the source port number to be 3344, and the destination IP address to be "13.12.11.10" (0x0d0c0b0a), the destination port number is 7788, the protocol number is 6, and the strategy number is 1. Based on the unified policy description language, the corresponding normalization strategy is constructed according to the above target configuration requirements. The normalization strategy constructed is shown in Table 3 below:

Table 3 Examples of normalization strategies

The above-mentioned normalization strategy includes four types of information: the first type is the current policy type, which is identified by the keyword "PolicyType", and the packet filtering policy is coded as 0001 here; the second type is the policy generator, which uses the "PolicyObject "Keyword identification, the administrator who configures the current policy is User1; the third category is the policy configuration object, that is, the target device, which is identified by the keyword "PolicySubject". The target device configured by the current policy is TOPSEC firewall and Huawei firewall; The fourth type is configuration parameter information, identified by the keyword "PolicyParameter", each parameter is expressed in the form of "key: value", a parameter has a unique code, and the code is used as the "key" value and its "value" value It is expressed according to the parameter format defined in the unified policy description language. The parameter codes in the normalization strategy described above indicate actions, source starting IP address, source ending IP address, source starting port number, source ending port number, destination starting IP address, destination ending IP address, in order from 1 to 11 The destination start port number, destination end port number, protocol number, and policy number. When the source/destination start IP address parameter is not empty and the source/destination end IP address parameter is empty, the source/destination start IP address parameter represents a single IP address.

Obtain the configuration command lines that may be involved in a firewall packet filtering policy of TOPSEC from the device manual. As shown in Table 4 below, the fourth configuration command line is mandatory for adding firewall rules, involving filtering action "action", log switch "log", service "service", IP address "sip", "dip" and other information. Except that the filter action parameter "action" is not added with "[]", it means that it is a parameter that must be configured, and the rest of the parameters are enclosed in "[]", which means that it can be set according to the actual situation. The service "service" and IP address "sip" and "dip" information need to refer to the service and IP address object, so if you want to set this parameter, you must first define the related object. Use the first command line to define the source IP address object, and use the second command line to define the destination IP address object. Use the third command line to define the service object. If you need to set the protocol number and port number, define the service object through this command. In the third command, the service name "name", protocol number "protocol" and port 1 "port1" are required parameters to set the port number corresponding to a protocol, port 2 "port2" is optional, if it is configured This parameter indicates that the port range of the service object is from port 1 "port1" to port 2 "port2".

Table 4 A collection of command lines for packet filtering configuration of a firewall of Tianrongxin

Obtain the configuration command lines that may be involved in a Huawei firewall packet filtering policy from the device manual. As shown in Table 5 below, the first 1, 2, 3, 7 and 8 commands are mandatory, so the involved action parameters are mandatory. The 4th, 5th, and 6th commands are optional and can be selected according to actual configuration requirements. The 4th command sets the source address related information of the packet filtering policy, and the 5th command sets the destination address of the packet filtering policy. For related information, the fifth command sets the service-related information of the packet filtering strategy. The parameters enclosed in "[]" indicate that they are optional, and the symbol "{}" indicates that the parameters can be selected, but it must be selected. One kind.

Table 5 A collection of Huawei firewall packet filtering configuration command lines

All the command lines in Table 4 and Table 5 are converted based on the unified policy description language. The specific conversion steps are as follows:

(1) Reserve the characters that the device needs to use. As shown in Table 4 and Table 5, the bold characters in each command line are the characters that the device needs to use when parsing the command line. Therefore, all characters of this type are reserved without any modification.

(2) Modify the characters used for prompting. As shown in Table 4 and Table 5, the non-bold italicized character string in each command line is a prompt character string. Based on the unified policy description language, parameter encoding is used to replace the complex and changeable character string. For the parameters used for unique identification such as object name and rule name, use the corresponding object or rule content as the name. For example, use source IP address parameter encoding instead of source IP address object name, or use policy number instead of rule name parameter, use The default mask value replaces the mask parameters that need to be filled. In addition, seven symbols are used to uniformly identify prompt characters. That is, the "#" symbol is used to identify the required command line, the "@" symbol is used to identify the optional command line, the "%" symbol is used to identify the position of the parameter, the "[]" symbol is used to identify the optional parameter, and the "<>" symbol is used to identify Parameter target format, use "{}" symbol to identify enumerated mandatory parameters, and use "|" to separate enumerated parameters or target format.

(3) Add parameter format information recognized by the device. For TOPSEC firewall, there are two parameters that need to be converted: IP address type parameters and enumeration type parameters. For IP address parameters, you need to convert the IP address in a unified hexadecimal format to a dotted decimal IP address that the device can recognize, so fill "%d.%" in the "<>" after the IP address parameter d.%d.%d" format information indicates the format that needs to be converted; for enumeration parameters, the enumeration parameters in the unified shaping format need to be converted into enumeration strings that the device can recognize, such as action parameters and log switch parameters The following "<>" symbols enumerate the enumerated strings in sequence, and use the "|" symbol to separate them. For Huawei firewalls, there are the same two parameters that need to be converted: IP address type parameters and enumeration type parameters. For IP address parameters, you need to convert the IP address in a unified hexadecimal format to a dotted decimal IP address that the device can recognize, so fill "%d.%" in the "<>" after the IP address parameter d.%d.%d" format information indicates the format that needs to be converted; for enumeration parameters, the enumeration parameters in the unified plastic format need to be converted into enumeration strings that can be recognized by the device, such as the "< >" enumerates the enumerated strings in turn, separated by the "|" symbol.

Through the above conversion steps, you can obtain the policy template of the packet filtering policy of TOPSEC firewall (see Table 6 below) and the policy template of the packet filtering policy of Huawei firewall (Table 7 below).

Table 6 Policy template of TOPSEC firewall packet filtering policy

Table 7 Policy template of Huawei firewall's packet filtering policy

Use the policy verification rules to verify the normalized policies in Table 3 according to the policy templates in Table 6 and Table 7 respectively. Specifically, in Table 6, the mandatory parameters in the mandatory command line are mandatory parameters, that is, the action parameter "action" in the last command line is a mandatory parameter. If this parameter is missing, the entire policy configuration will fail. The selected parameters do not depend on other parameters. The normalization strategy in Table 3 contains the action parameters, so the verification passes; in Table 7, the mandatory parameters in the mandatory command line are mandatory parameters, and the second command line The rule name parameter "rule name" and the action parameter "action" of the 8th command line are mandatory parameters. If this parameter is missing, the entire policy configuration will fail. At the same time, the mandatory parameter does not depend on other parameters, as shown in Table 3. The normalized strategy contains strategy number parameters and action parameters, so the verification passes.

All the configuration parameters in the normalized strategy in Table 3 are filtered according to the strategy templates in Table 6 and Table 7. Specifically, according to Table 6, it can be seen that TOPSEC firewall cannot identify source port parameters and policy number parameters. Therefore, these two parameters are deleted from the normalization strategy in Table 3, and the remaining parameters are regarded as the corresponding parameters of TOPSEC firewall. Target parameters. According to Table 7, Huawei firewall can identify all the parameters in the normalization strategy in Table 3, so there is no need to delete any parameters, and all parameters in Table 3 can be used as Huawei firewall target parameters.

Obtain the target command line corresponding to the TOPSEC firewall from all the command lines in the policy template in Table 6 according to the target parameters corresponding to the TOPSEC firewall, and obtain all the commands in the policy template in Table 7 according to the target parameters corresponding to the Huawei firewall Obtain the target command line corresponding to Huawei firewall from the line. Specifically, for TOPSEC firewall, it is necessary to use the command line defining the IP address twice to define the source IP address and the destination IP address, and use the command line defining the service once to define the destination port and protocol number, and in the last one Select the source IP address, destination IP address, and service parameters in the command line; for Huawei firewalls, in addition to the command lines necessary to configure the policy, you need to select the 4th, 5th, and 6th command lines to define the source IP address and destination IP respectively Address and port protocol, etc., the fourth and fifth items select a single IP address parameter, and the sixth item uses a single port parameter.

Finally, the strategy conversion rule is used to convert the target command line corresponding to the TOPSEC firewall according to the target parameters corresponding to the TOPSEC firewall to generate the TOPSEC firewall packet filtering configuration policy. At the same time, the policy conversion rule is used to convert the target command line corresponding to the Huawei firewall according to the target parameters corresponding to the Huawei firewall to generate the Huawei firewall packet filtering configuration policy. The generated data packet filtering configuration strategy of TOPSEC firewall and Huawei firewall data packet filtering configuration strategy are shown in Table 8 below.

Table 8 Data packet filtering configuration policies of Tianrongxin firewall and Huawei firewall

Finally, the above-mentioned TOPSEC firewall packet filtering configuration policy is issued and configured to TOPSEC equipment, and the above-mentioned Huawei firewall packet filtering configuration policy is distributed and configured to Huawei equipment.

Fig. 3 is a schematic structural diagram of a device security policy configuration device provided by an embodiment of the application. As shown in Fig. 3, the device includes: a normalized policy construction module 31, a policy template acquisition module 32, and a parameter and command line determination module 33 And strategy conversion and configuration module 34, where:

The normalization strategy construction module 31 is configured to construct a normalization strategy corresponding to the target configuration requirements based on the unified strategy description language according to the target configuration requirements. The normalization strategy includes a strategy type, at least one target device and at least one configuration parameter.

Specifically, the embodiment of the present application designs a unified policy description language to be compatible with differences in different configuration command formats. On this basis, when there is a target configuration requirement, the normalization strategy construction module 31 constructs a normalization strategy corresponding to the target configuration requirement based on the unified policy description language according to the target configuration requirement. Wherein, the normalized strategy includes a strategy type, at least one target device, and at least one configuration parameter. In addition, the normalization strategy can also include the strategy generator, which can be set according to actual needs, and there is no specific limitation here.

The policy template obtaining module 32 is configured to obtain a policy template corresponding to the target device from the policy template library according to the policy type in the normalized policy for any target device in the normalized policy, and the policy template includes at least one command line.

Specifically, if the aforementioned normalization strategy includes multiple target devices, it indicates that the aforementioned normalization strategy needs to be configured for multiple target devices at the same time. On this basis, for any target device in the normalized policy, the policy template obtaining module 32 obtains the policy template corresponding to the target device from the policy template library according to the target device itself and the policy type in the normalized policy. It is understandable that the policy templates of different policy types corresponding to different devices are pre-stored in the policy template library. In other words, devices, policy types, and policy templates are pre-associated and stored in the policy template library. Therefore, the policy template corresponding to the target device can be obtained from the policy template library according to the target device itself and the policy type in the normalized policy.

The parameter and command line determination module 33 is used for verifying the normalized strategy according to the policy template by using the policy verification rule. If the verification is passed, all the configuration parameters in the normalized strategy are filtered according to the policy template, Each subsequent configuration parameter is used as a target parameter, and the target command line is obtained from all the command lines in the policy template according to all the target parameters.

Specifically, on the basis of the above technical solution, the parameter and command line determination module 33 uses the policy verification rule to verify the normalization strategy according to the policy template. If the verification passes, it means that the target device can verify the normalization strategy. Make effective configuration. On the basis of passing the verification, the parameter and command line determination module 33 screens all configuration parameters in the normalized strategy according to the strategy template corresponding to the target device, and uses each configuration parameter after screening as the target parameter. It is understandable that the target parameter is a parameter required by the target device to configure a normalization strategy. After the target parameter is obtained, the target parameter may not contain the required and/or optional parameters of a certain command line in the policy template, which results in that the command line cannot be effectively configured. In view of this, in order to verify whether all the command lines in the policy template can be effectively configured, in the embodiment of the present application, the parameter and command line determination module 33 obtains the target command line from all the command lines in the policy template according to all target parameters. In this way, all parameters (including mandatory and optional parameters) in each target command line are included in the target parameters, so as to ensure that each target command line can be effectively configured.

The strategy conversion and configuration module 34 is configured to convert all target command lines according to all target parameters by using the strategy conversion rules, generate a configuration strategy corresponding to the target device, and configure the target device according to the configuration strategy.

Specifically, on the basis of the above technical solution, the strategy conversion and configuration module 34 uses the strategy conversion rule to convert all target command lines according to all target parameters, that is, uses the strategy conversion rule to fill the target parameters into the corresponding positions of the target command line. , To achieve the conversion of the target command line. Regarding the converted target command line as the configuration strategy corresponding to the target device, it can be understood that the configuration strategy corresponding to the target device refers to the command line set that the target device can recognize, and the command line set can realize the normalization strategy Configuration. Finally, the target device is configured according to the configuration strategy, that is, the configuration strategy is delivered and configured to the target device.

The device security policy configuration device provided by the embodiments of the present application specifically executes the procedures of the foregoing method embodiments. For details, please refer to the content of the foregoing method embodiments, and details are not repeated here.

The device security policy configuration device provided in the embodiment of the application constructs a normalized policy based on the unified policy description language according to the target configuration requirements, and obtains the policy template corresponding to the target device from the policy template library, and obtains the policy template corresponding to the target device according to the policy template. Filter out the target parameters from all the configuration parameters in the, and obtain the target command lines from all the command lines in the policy template according to all target parameters, convert all target command lines according to all target parameters, and generate the configuration policy corresponding to the target device. Finally, the configuration policy is delivered and configured to the target device. The device does not require the administrator to learn the syntax and semantics of different configuration commands, which is beneficial to reduce work costs; and the administrator only needs to issue configuration requirements once, which can effectively avoid repeated operations and help improve the configuration efficiency of equipment security policies to ensure Configure the security policy to the device in time.

FIG. 4 is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the application. 4, the electronic device includes: a processor (processor) 41, a memory (memory) 42 and a bus 43; wherein the processor 41 and the memory 42 communicate with each other through the bus 43; The processor 41 is configured to call the program instructions in the memory 42 to execute the method provided in any of the foregoing method embodiments, for example, including: constructing a normalized strategy corresponding to the target configuration requirement based on the unified policy description language according to the target configuration requirement , The normalized strategy includes the strategy type, at least one target device and at least one configuration parameter; for any target device in the normalized strategy, the corresponding target device is obtained from the strategy template library according to the strategy type in the normalized strategy Policy template, the policy template contains at least one command line; the normalized policy is verified according to the policy template by the policy verification rule, and if the verification is passed, all configuration parameters in the normalized policy are performed according to the policy template Screening, each configuration parameter after screening is used as the target parameter, and the target command line is obtained from all the command lines in the policy template according to all target parameters; all target command lines are converted according to all target parameters by the strategy conversion rule to generate the target The configuration strategy corresponding to the device configures the target device according to the configuration strategy.

In addition, the aforementioned logic instructions in the memory 42 can be implemented in the form of software functional units and when sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application can be embodied in the form of software products in essence or the parts that contribute to the prior art or the parts of the technical solutions, and the computer software products are stored in a storage medium. , Including several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program code .

The embodiments of the present application also provide a non-transitory computer-readable storage medium on which a computer program is stored. The computer program is implemented when executed by a processor to perform the methods provided in the foregoing embodiments, for example, including: description based on a unified policy The language constructs the normalization strategy corresponding to the target configuration requirements according to the target configuration requirements. The normalization strategy includes the strategy type, at least one target device and at least one configuration parameter; for any target device in the normalization strategy, according to the normalization strategy The policy type in the standardized policy obtains the policy template corresponding to the target device from the policy template library. The policy template contains at least one command line; the normalized policy is verified according to the policy template by the policy verification rule, and if the verification passes, All configuration parameters in the normalized strategy are filtered according to the strategy template, and each configuration parameter after filtering is used as the target parameter, and the target command line is obtained from all the command lines in the strategy template according to all the target parameters; using strategy conversion The rule converts all target command lines according to all target parameters, generates a configuration strategy corresponding to the target device, and configures the target device according to the configuration strategy.

The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solutions of the embodiments. Those of ordinary skill in the art can understand and implement it without creative work.

Through the description of the above implementation manners, those skilled in the art can clearly understand that each implementation manner can be implemented by software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions can be embodied in the form of software products, which can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., include a number of instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiment.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the application, not to limit them; although the application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions recorded in the foregoing embodiments are modified, or some of the technical features are equivalently replaced; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims (10)

1. A method for configuring a device security policy is characterized in that it includes:

   Constructing a normalized strategy corresponding to the target configuration requirement based on the unified strategy description language according to the target configuration requirement, where the normalized strategy includes a strategy type, at least one target device, and at least one configuration parameter;

   For any target device in the normalized policy, obtain a policy template corresponding to the target device from a policy template library according to the policy type in the normalized policy, and the policy template includes at least one command line ；

   Use the policy verification rule to verify the normalization strategy according to the policy template. If the verification passes, all configuration parameters in the normalization strategy are screened according to the policy template, and after screening Each configuration parameter of is used as a target parameter, and the target command line is obtained from all the command lines in the policy template according to all the target parameters;

   Using the strategy conversion rule to convert all target command lines according to all target parameters, generate a configuration strategy corresponding to the target device, and configure the target device according to the configuration strategy.
2. The method for configuring a device security policy according to claim 1, wherein the method for obtaining the policy template corresponding to the target device from the policy template library according to the policy type in the normalized policy further comprises:

   Use each policy type that the target device is allowed to configure as the target policy type, and for any target policy type, obtain all the command lines corresponding to the target policy type from the device manual corresponding to the target device;

   Converting all command lines corresponding to the target policy type based on the unified policy description language, and composing all the converted command lines into a policy template;

   The target device, the target policy type, and the policy template are associated and stored in the policy template library.
3. The method for configuring a device security policy according to claim 1, wherein the verification of the normalized policy according to the policy template using a policy verification rule is specifically:

   Obtain all mandatory parameters and dependent parameters corresponding to each mandatory parameter from all command lines of the policy template;

   Determine whether the normalization strategy includes all required parameters and all dependent parameters;

   If all mandatory parameters and all dependent parameters are included, it is determined that the normalization strategy verification passes, and if all mandatory parameters and all dependent parameters are not included, it is determined that the normalization strategy verification fails.
4. The method for configuring a device security policy according to claim 1, wherein the filtering of all configuration parameters in the normalized policy according to the policy template is specifically:

   For any configuration parameter in the normalization strategy, if the configuration parameter is not included in the policy template, delete the configuration parameter in the normalization strategy;

   Obtain all optional parameters and dependent parameters corresponding to each optional parameter from all the command lines of the policy template. For any optional parameter, if the normalization strategy includes the optional parameter, and If the normalization strategy does not include the dependent parameter corresponding to the optional parameter, then the optional parameter is deleted from the normalization strategy.
5. The method for configuring a device security policy according to claim 1, wherein the target command line is obtained from all command lines in the policy template according to all target parameters, specifically:

   For any command line in the policy template, if all mandatory parameters in the command line belong to the target parameter, then the command line is used as a candidate command line;

   For any candidate command line, delete optional parameters that do not belong to the target parameter in the candidate command line to obtain the target command line.
6. The method for configuring a device security policy according to claim 1, wherein the strategy conversion rule is used to convert all target command lines according to all target parameters, specifically:

   For any target command line, each parameter in the target command line is used as a parameter to be converted, the position of each parameter to be converted in the target command line is obtained as the position to be filled, and the target command Obtain the format corresponding to each parameter to be converted from the row as the target format;

   For any parameter to be converted, a target parameter that matches the parameter to be converted is obtained from all target parameters as a matching parameter, the matching parameter is formatted according to the target format corresponding to the parameter to be converted, and the format The converted matching parameters are filled in the positions to be filled corresponding to the parameters to be converted.
7. The device security policy configuration method according to claim 1, wherein the configuration of the target device according to the configuration policy is specifically:

   Deliver and configure each command line in the configuration policy to the target device, and obtain the configuration result of each command line;

   If the currently obtained configuration result is a failure, the configuration is interrupted or reconfigured, and all the obtained configuration results are fed back to the user for analysis.
8. A device for configuring an equipment security policy is characterized in that it includes:

   The normalization strategy building module is used to construct a normalization strategy corresponding to the target configuration requirements based on the unified strategy description language according to the target configuration requirements, and the normalization strategy includes a strategy type, at least one target device, and at least one configuration parameter;

   The policy template obtaining module is configured to obtain, for any target device in the normalized policy, a policy template corresponding to the target device from a policy template library according to the policy type in the normalized policy, the policy The template contains at least one command line;

   The parameter and command line determination module is used for verifying the normalization strategy according to the policy template by using the policy verification rule, and if the verification is passed, then verifying the normalization strategy according to the policy template All configuration parameters are screened, each configuration parameter after screening is taken as a target parameter, and the target command line is obtained from all command lines in the policy template according to all target parameters;

   The strategy conversion and configuration module is used to convert all target command lines according to all target parameters using the strategy conversion rules, generate a configuration strategy corresponding to the target device, and configure the target device according to the configuration strategy.
9. An electronic device, comprising at least one processor, and at least one memory communicatively connected with the processor, the memory storing program instructions executable by the processor, and is characterized in that the processor calls the The program instructions can execute the method according to any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions cause the computer to execute the method according to any one of claims 1 to 7 .

Images