WO2021139339A1 - 防火墙策略的下发方法、装置、电子设备及存储介质 - Google Patents

防火墙策略的下发方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2021139339A1
WO2021139339A1 PCT/CN2020/124727 CN2020124727W WO2021139339A1 WO 2021139339 A1 WO2021139339 A1 WO 2021139339A1 CN 2020124727 W CN2020124727 W CN 2020124727W WO 2021139339 A1 WO2021139339 A1 WO 2021139339A1
Authority
WO
WIPO (PCT)
Prior art keywords
domain
access
relationship
firewall policy
domain path
Prior art date
Application number
PCT/CN2020/124727
Other languages
English (en)
French (fr)
Inventor
林明锋
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2021139339A1 publication Critical patent/WO2021139339A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management

Definitions

  • This application relates to the field of smart security, and in particular to a method, device, electronic device, and storage medium for issuing firewall policies.
  • firewall strategies are essential for the normal operation of various systems for system security.
  • manual operation and maintenance experience is often used to configure and issue firewall policies.
  • the inventor realizes that with the complexity of the system network structure or frequent changes in business requirements, in order to ensure that the firewall policy is issued, the impact on the system caused by the firewall policy is as small as possible, and the manual requirements will be greater. The higher the level, the more and more manpower is needed, which leads to the inefficiency of issuing firewall policies.
  • this application provides a method, device, electronic device, and storage medium for issuing firewall policies.
  • a method for issuing a firewall policy including:
  • the firewall policy is issued to the access relationship.
  • a firewall policy issuing device including:
  • the first obtaining module is configured to obtain the access relationship of the firewall policy to be issued and determine each single access route included in the access relationship;
  • the second obtaining module is configured to obtain each domain path for which the firewall policy has been configured, where the domain path is a collection of multiple single access routes;
  • a merging module configured to merge single access routes belonging to the same domain path based on the match between the single access route and the domain path to obtain a merged result
  • a dividing module configured to divide the access relationship into sub-access relationships based on the merged result, and determine the target domain path to which each sub-access relationship belongs;
  • the issuing module is configured to issue a firewall policy to the access relationship based on the configured firewall policy corresponding to each of the target domain paths.
  • an electronic device for issuing firewall policies including:
  • the memory is configured to store executable instructions.
  • the processor is configured to execute executable instructions stored in the memory to execute a method for issuing a firewall policy, wherein the method for issuing a firewall policy includes the following steps:
  • the firewall policy is issued to the access relationship.
  • a computer-readable storage medium which stores computer program instructions that, when the computer instructions are executed by the computer, cause the computer to execute a method for issuing a firewall policy, wherein the A method for issuing a firewall policy includes the following steps:
  • the firewall policy is issued to the access relationship.
  • the access relationships are divided into single access routes one by one, and the single access routes belonging to the same domain path are merged according to the matching with the domain path, and then the access relationship is divided into sub-access relationships according to the merged result. Then, the firewall policy is issued to the access relationship according to the configured firewall policy corresponding to the target domain path to which the child access relationship belongs.
  • the firewall policy can be automatically issued without manual intervention, and the efficiency of issuing the firewall policy is improved.
  • Fig. 1 shows a flowchart of a method for issuing a firewall policy according to an exemplary embodiment of the present application.
  • Fig. 2 shows a block diagram of an apparatus for issuing a firewall policy according to an exemplary embodiment of the present application.
  • Fig. 3 shows a detailed flowchart of obtaining access relationships of firewall policies to be issued according to an exemplary embodiment of the present application.
  • Fig. 4 shows a detailed flowchart of merging single access routes belonging to the same domain path based on the matching between the single access route and the domain path according to an exemplary embodiment of the present application.
  • Fig. 5 shows a detailed flowchart before merging single access routes belonging to the same domain path based on the matching between the single access route and the domain path according to an exemplary embodiment of the present application.
  • Fig. 6 shows a detailed flow chart of sorting out the paths of the respective domains based on the topological relationship between the respective graph structure information according to an exemplary embodiment of the present application.
  • Fig. 7 shows a detailed flowchart of sorting out the paths of the respective domains based on the topological relationship between the respective graph structure information according to an exemplary embodiment of the present application.
  • Fig. 8 shows a system architecture diagram of the issuance of a firewall policy according to an exemplary embodiment of the present application.
  • Fig. 9 shows a diagram of an electronic device for issuing a firewall policy according to an exemplary embodiment of the present application.
  • Fig. 10 shows a diagram of a computer-readable storage medium for issuing a firewall policy according to an exemplary embodiment of the present application.
  • the purpose of this application is to improve the efficiency of issuing firewall policies.
  • the method for issuing a firewall policy includes: obtaining the access relationship of the firewall policy to be issued and determining each single access route included in the access relationship; obtaining each domain path of the configured firewall policy, so The domain path is a collection of multiple single access routes; based on the matching between the single access route and the domain path, single access routes belonging to the same domain path are merged to obtain a merged result; based on the merged result
  • the access relationship is divided into sub-access relationships, and the target domain path to which each sub-access relationship belongs is determined; based on the configured firewall policies corresponding to each of the target domain paths, the firewall policy is issued to the access relationship .
  • the access relationships are divided into single access routes one by one, and the single access routes belonging to the same domain path are merged according to the matching with the domain path, and then the access relationship is divided into sub-access relationships according to the merged result. Then, the firewall policy is issued to the access relationship according to the configured firewall policy corresponding to the target domain path to which the child access relationship belongs.
  • the firewall policy can be automatically issued without manual intervention, and the efficiency of issuing the firewall policy is improved.
  • FIG. 1 shows a flowchart of a method for issuing a firewall policy according to an exemplary embodiment of the present application:
  • Step S110 Obtain the access relationship of the firewall policy to be issued and determine each single access route included in the access relationship;
  • Step S120 Obtain each domain path for which a firewall policy has been configured, where the domain path is a collection of multiple single access routes;
  • Step S130 Based on the matching between the single access route and the domain path, merge the single access routes belonging to the same domain path to obtain a merged result;
  • Step S140 Divide the access relationship into sub-access relationships based on the merged result, and determine the target domain path to which each sub-access relationship belongs;
  • Step S150 Based on the configured firewall policies corresponding to each of the target domain paths, issue a firewall policy to the access relationship.
  • the management terminal used for issuing firewall policies is illustratively used as the execution subject of the method provided by this application, and the management terminal is generally a server.
  • step S110 the access relationship of the firewall policy to be issued is obtained and each single access route included in the access relationship is determined.
  • the access relationship of the firewall policy to be issued describes the access from the source address of N to the destination address of M, where N is a positive integer greater than or equal to 1, and M is a positive integer greater than or equal to 1.
  • the access relationship is split one by one to obtain N*M single access routes included in the access relationship.
  • the user specifies the access relationship of the firewall policy to be issued through the user terminal, and sends the access relationship to the management terminal, thereby triggering the management terminal that has obtained the access relationship to split the access relationship to determine the access relationship.
  • Each single access route included in the access relationship is included in the access relationship.
  • step S110 includes:
  • Step S1101 Establish a mirror system of the source system
  • Step S1102 Obtain the service to be launched of the source system
  • Step S1103 By triggering the service to be launched in the mirroring system, the access relationship corresponding to the service to be launched is collected.
  • the access relationship of the firewall policy to be issued is acquired through service triggering.
  • the management end establishes a mirroring system of the source system, and the mirroring system is a copy of the source system.
  • the management terminal obtains the service to be launched in the source system, and then triggers the service to be launched in the mirroring system.
  • the trigger of the service to be launched will generate a corresponding access relationship, so that the management terminal collects the access relationship.
  • the management side establishes a mirroring system of the financial system, and triggers the "approval service” in the mirroring system.
  • the triggering of the "approval service” will cause the mirroring system to generate an access relationship for realizing the "approval service”, so that the management terminal collects the access relationship and determines each single access route included in the access relationship, so as to build on this basis A firewall policy is issued to the access relationship.
  • the access relationship will change accordingly after the business requirements are changed. Therefore, before changing the "loan business” in the financial system, the management side establishes a mirroring system of the financial system, and triggers the changed "approval business” in the mirroring system. The trigger of the changed "approval service” will cause the mirroring system to generate an access relationship to realize the changed "approval service", so that the management terminal collects the access relationship and determines each single access route included in the access relationship. Thus, on this basis, a firewall policy is issued for the access relationship.
  • the advantage of this embodiment is that by establishing a mirroring system and triggering services in the mirroring system to obtain the access relationship, the access relationship can be obtained while flexibly meeting business requirements while avoiding the impact on the source system and ensuring the system of the source system stability.
  • step S120 each domain path for which the firewall policy has been configured is obtained, and the domain path is a set of multiple single access routes.
  • each domain path is generally a collection of multiple single access routes, and the source domain and destination domain of each domain path can generally be regarded as corresponding network segments.
  • the configured firewall policy corresponding to each domain path will be stored in the firewall database.
  • the method further includes:
  • the management terminal collects firewall policies on a regular basis (for example, every 24 hours), determines the domain path controlled by each firewall policy, and then stores the correspondence between the firewall policy and the corresponding domain path in the firewall database in. Therefore, the management terminal can obtain the domain paths for which the firewall policy has been configured by reading the firewall database.
  • step S130 based on the matching between the single access route and the domain path, the single access routes belonging to the same domain path are merged to obtain a merged result.
  • step S130 includes:
  • Step S1301 Obtain the source address and the destination address corresponding to the single access route
  • Step S1302 Obtain the source domain and the destination domain corresponding to the domain path;
  • Step S1303 Based on the matching of the source address and the source domain and the matching of the destination address and the destination domain, single access routes belonging to the same domain path are merged.
  • the management end determines the source address and destination address of the single access route; for each domain path that has a firewall policy configured, the management end determines the source of the domain path Domain and destination domain.
  • the source domain is a collection of multiple source addresses
  • the destination domain is a collection of multiple destination addresses. Therefore, the management terminal matches the source address with the source domain and the destination address with the destination domain. Specifically, if the source address of the single access route A is in the source domain of domain path A, and the destination address of the single access route A is in the domain In the destination domain of Path A, it is determined that the single access route A belongs to Domain Path A, and then the single access routes belonging to the same domain path are merged.
  • the method further includes:
  • Step S124 express the respective domain paths as corresponding graph structure information
  • Step S128 Based on the topological relationship between each of the graph structure information, organize the paths of each domain.
  • the management end sorts the domain paths.
  • the sorting content mainly includes cutting and pruning the cross-domain pathways, and fusing the domain pathways that can be connected end to end.
  • each graph structure information describes the network segment range of a corresponding domain.
  • each domain path corresponds to a pair of graph structure information, and this pair of graph structure information respectively describes the source domain and destination domain of the domain path.
  • the advantage of this embodiment is that by pre-arranging domain paths, the composition between domain paths can be optimized, so that the merging efficiency of access routes based on domain paths is higher.
  • step S128 includes:
  • Step S1281' Based on the topological relationship between each of the graph structure information, determine the intersection area between the paths of each domain;
  • Step S1282' cutting the paths of each domain based on the intersection area.
  • the management terminal determines the intersection area between each domain path based on the topological relationship between the graph structure information.
  • the intersection area refers to the area where two or more domains overlap.
  • the management terminal cuts each domain path based on the intersection area, and while cutting each domain path, it also adaptively cuts the firewall policy of each domain path that is cut.
  • the source domain of domain path A is domain 1, and the destination domain is domain 2; the source domain of domain path B is domain 3, and the destination domain is domain 4, where domain 1 and domain 3 have overlapping network segments.
  • the domain 1, domain 2, domain 3, and domain 4 are respectively represented as corresponding graph structure information, and the management terminal can determine the intersection area between domain path A and domain path B as domain 1 according to the topological relationship between the graph structure information Overlap area with domain 3.
  • the overlapping area of domain 1 and domain 3 is domain 5, the area in domain 1 except domain 5 is domain 6, and the area in domain 3 except domain 5 is domain 7.
  • the management end cuts the domain path A and domain path B, and the source domain after cutting is obtained, the source domain is domain 6 and the destination domain is domain path A, the source domain is domain 7 and the destination domain is domain path B and source domain.
  • the destination domain is domain path C of domain 2
  • the source domain is domain 5 and the destination domain is domain path C of domain 4.
  • step S128 includes:
  • Step S1281' Based on the topological relationship between each of the graph structure information, determine end-to-end adjacent domain paths;
  • Step S1282' Fusion of the adjacent domain paths based on the end-to-end relationship.
  • the management terminal After the management terminal obtains the graph structure information corresponding to each domain path, based on the topological relationship between each graph structure information, it filters out the adjacent domain paths that can be connected end to end from each domain path.
  • end-to-end means that the source domain of a domain path is the destination domain of another domain path.
  • the management terminal integrates adjacent domain paths, and while fusing adjacent domain paths, it also adaptively integrates the firewall policies of the merged adjacent domain paths.
  • the source domain of domain path A is domain 1, and the destination domain is domain 2; the source domain of domain path B is domain 2, and the destination domain is domain 3.
  • Domain Pathway A and Domain Pathway B are connected end to end, then the management end will merge Domain Pathway A and Domain Pathway B, and while still retaining Domain Pathway A and Domain Pathway B, a new Domain Pathway C will be obtained.
  • the source domain of domain path C is domain 1, and after domain 2, it reaches the destination domain domain 3.
  • step S140 the access relationship is divided into sub-access relationships based on the merged result, and the target domain path to which each sub-access relationship belongs is determined.
  • the management terminal after the management terminal merges the single access routes according to the domain path to obtain the combined result, the access relationship is divided into each sub-access relationship accordingly, and the target domain path to which each sub-access relationship belongs respectively is determined.
  • each sub-access relationship belongs to a target domain path; the set of single access routes included in all sub-access relationships is the single access route included in the access relationship. Therefore, the management terminal can determine all the target domain paths corresponding to the access relationship.
  • step S150 based on the configured firewall policy corresponding to each of the target domain paths, the firewall policy is issued to the access relationship.
  • the management terminal determines all the target domain paths corresponding to the access relationship, it further determines the configured firewall policy corresponding to each target domain path, and then issues the firewall policy to the access relationship on this basis. For example, after the management side splits the access relationship into single access routes, it merges the single access routes according to the domain path, and divides the access relationship into sub-access 1, sub-access relationship 2 and sub-access relationship 3 according to the merged result. .
  • the target domain path corresponding to sub-access relationship 1 is domain path A
  • the target domain path corresponding to sub-access relationship 2 is domain path B
  • the target domain path corresponding to sub-access relationship 3 is domain path C.
  • the management terminal obtains the configured firewall policy of domain path A, the configured firewall policy of domain path B, and the configured firewall policy of domain path C, and then sends the three sets of firewall policies to each sub-access of the access relationship. Relations, so as to achieve the issuance of firewall policies for access relations.
  • a device for issuing a firewall policy which specifically includes:
  • the first obtaining module 210 is configured to obtain the access relationship of the firewall policy to be issued and determine each single access route included in the access relationship;
  • the second obtaining module 220 is configured to obtain each domain path for which a firewall policy has been configured, where the domain path is a set of multiple single access routes;
  • the merging module 230 is configured to merge the single access routes belonging to the same domain path based on the match between the single access route and the domain path to obtain a merged result;
  • the dividing module 240 is configured to divide the access relationship into each sub-access relationship based on the merged result, and determine the target domain path to which each sub-access relationship belongs;
  • the issuing module 250 is configured to issue a firewall policy to the access relationship based on the configured firewall policy corresponding to each of the target domain paths.
  • modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory.
  • the features and functions of two or more modules or units described above may be embodied in one module or unit.
  • the features and functions of a module or unit described above can be further divided into multiple modules or units to be embodied.
  • the example embodiments described here can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) execute the method according to the embodiment of the present application.
  • a non-volatile storage medium which can be a CD-ROM, U disk, mobile hard disk, etc.
  • Including several instructions to make a computing device which can be a personal computer, a server, a mobile terminal, or a network device, etc.
  • Fig. 8 shows a system architecture diagram of the issuance of a firewall policy according to an exemplary embodiment of the present application.
  • the system architecture includes: a management terminal 310, a source system 320, a user terminal 330, and a firewall database 340.
  • the management terminal 310 periodically collects the configured firewall policies, and records the domain path corresponding to the firewall policy into the firewall database 340 together with the firewall policy. If a new access relationship is to be opened in the source system 320, it is necessary to issue a firewall policy to the new access relationship before it can be opened.
  • the user specifies the new access relationship to the management terminal 310 through the user terminal 330. After the management terminal 310 obtains the new access relationship, it splits it to obtain the single access routes it contains, and then reads the domain path in the firewall database 340 to merge the single access routes, and then compares the single access routes according to the merged result.
  • the new access relationship is divided to obtain the child access relationship, and then the target domain path to which the child access relationship belongs is determined, so that all target domain paths corresponding to the new access relationship can be determined, and then all target domain paths corresponding to the configured configuration
  • the firewall policy is to issue the firewall policy to the new access relationship.
  • an electronic device capable of implementing the above method is also provided.
  • the electronic device 400 according to this embodiment of the present application will be described below with reference to FIG. 9.
  • the electronic device 400 shown in FIG. 9 is only an example, and should not bring any limitation to the function and scope of use of the embodiments of the present application.
  • the electronic device 400 is represented in the form of a general-purpose computing device.
  • the components of the electronic device 400 may include, but are not limited to: the aforementioned at least one processing unit 410, the aforementioned at least one storage unit 420, and a bus 430 connecting different system components (including the storage unit 420 and the processing unit 410).
  • the storage unit stores program code, and the program code can be executed by the processing unit 410, so that the processing unit 410 executes the various exemplary methods described in the “Exemplary Method” section of this specification.
  • the processing unit 410 may perform step S110 as shown in FIG.
  • step S120 obtain the access relationship of the firewall policy to be issued and determine each single access route included in the access relationship
  • step S120 obtain the configured firewall policy
  • step S130 based on the matching between the single access route and the domain path, merge the single access routes belonging to the same domain path to obtain a merge Result
  • step S140 Divide the access relationship into sub-access relationships based on the merged result, and determine the target domain path to which each sub-access relationship belongs
  • Step S150 Based on the respective corresponding target domain paths The firewall policy has been configured, and the firewall policy is issued to the access relationship.
  • the storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 4201 and/or a cache storage unit 4202, and may further include a read-only storage unit (ROM) 4203.
  • RAM random access storage unit
  • ROM read-only storage unit
  • the storage unit 420 may also include a program/utility tool 4204 having a set (at least one) program module 4205.
  • program module 4205 includes but is not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples or some combination may include the implementation of a network environment.
  • the bus 430 may represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any bus structure among multiple bus structures. bus.
  • the electronic device 400 may also communicate with one or more external devices 500 (such as keyboards, pointing devices, Bluetooth devices, etc.), and may also communicate with one or more devices that enable a user to interact with the electronic device 400, and/or communicate with Any device (such as a router, modem, etc.) that enables the electronic device 400 to communicate with one or more other computing devices. This communication can be performed through an input/output (I/O) interface 450.
  • the electronic device 400 may also communicate with one or more networks (for example, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through the network adapter 460.
  • networks for example, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet
  • the network adapter 460 communicates with other modules of the electronic device 400 through the bus 430. It should be understood that although not shown in the figure, other hardware and/or software modules can be used in conjunction with the electronic device 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage system, etc.
  • the example embodiments described here can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) execute the method according to the embodiment of the present application.
  • a computing device which can be a personal computer, a server, a terminal device, or a network device, etc.
  • a computer-readable storage medium is also provided.
  • the computer-readable storage medium may be non-volatile or volatile.
  • the program product of the method In some possible implementation manners, various aspects of the present application can also be implemented in the form of a program product, which includes program code.
  • the program product runs on a terminal device, the program code is used to make the The terminal device executes the steps of the method for issuing a firewall policy according to various examples of the application described in the "Exemplary Method" section of this specification, and the method for issuing the firewall policy includes the following steps:
  • the firewall policy is issued to the access relationship.
  • a program product 600 for implementing the above method according to an embodiment of the present application is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be installed in a terminal device, For example, running on a personal computer.
  • the program product of this application is not limited to this.
  • the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or combined with an instruction execution system, device, or device.
  • the program product can use any combination of one or more readable media.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Type programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • the computer-readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • the readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with the instruction execution system, apparatus, or device.
  • the program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.
  • the program code used to perform the operations of this application can be written in any combination of one or more programming languages.
  • the programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming languages. Programming language-such as "C" language or similar programming language.
  • the program code can be executed entirely on the user's computing device, partly on the user's device, executed as an independent software package, partly on the user's computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on.
  • the remote computing device can be connected to a user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using Internet service providers). Business to connect via the Internet).
  • LAN local area network
  • WAN wide area network
  • Internet service providers for example, using Internet service providers.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请涉及智慧安防领域，提供了一种防火墙策略的下发方法、装置、电子设备及存储介质，涉及防火墙领域，所述方法包括：获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。本申请能够提高防火墙策略的下发效率。

Description

防火墙策略的下发方法、装置、电子设备及存储介质
本申请要求于2020年7月30日提交中国专利局、申请号为202010751565.9，发明名称为“防火墙策略的下发方法、装置、电子设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。   
技术领域
本申请涉及智慧安防领域，特别是涉及防火墙策略的下发方法、装置、电子设备及存储介质。
 背景技术
在互联网技术的高速发展过程中，出于系统安全的需要防火墙策略对于各类系统的正常运作而言是必不可少的。现有技术中，多采用人工运维经验的方式进行防火墙策略的配置与下发。而发明人意识到，随着系统网络结构的复杂化或者业务需求的频繁变更，为保证下发防火墙策略的同时尽量使得下发防火墙策略对系统所造成的影响尽量小，对人工的要求将越来越高，需要花费越来越多的人力，导致下发防火墙策略的效率低下。
 技术问题
基于此，为解决相关技术中如何从技术层面上解决防火墙策略下发效率低所面临的技术问题，本申请提供了一种防火墙策略的下发方法、装置、电子设备及存储介质。
 技术解决方案
根据本申请的第一方面，提供了一种防火墙策略的下发方法，包括：
获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
根据本申请的第二方面，提供了一种防火墙策略的下发装置，包括：
第一获取模块，配置为获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
第二获取模块，配置为获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
合并模块，配置为基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
划分模块，配置为基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
下发模块，配置为基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
根据本申请的第三方面，提供了一种防火墙策略的下发电子设备，包括：
存储器，配置为存储可执行指令。
处理器，配置为执行所述存储器中存储的可执行指令，以执行一种防火墙策略的下发方法，其中，所述一种防火墙策略的下发方法包括以下步骤：
获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
根据本申请的第四方面，提供一种计算机可读存储介质，其存储有计算机程序指令，当所述计算机指令被计算机执行时，使计算机执行一种防火墙策略的下发方法，其中，所述一种防火墙策略的下发方法包括以下步骤：
获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
 有益效果
本申请实施例将访问关系一一拆分为单一访问路由，再根据与域通路的匹配将属于同一域通路的单一访问路由进行合并，进而再根据合并结果将访问关系划分为各子访问关系，进而根据子访问关系所属的目标域通路所对应的已配置防火墙策略向访问关系下发防火墙策略。通过这种方法，能够在无人工干涉的情况下自动下发防火墙策略，提高了防火墙策略的下发效率。
 附图说明
图1示出根据本申请一示例实施方式的防火墙策略的下发方法的流程图。
图2示出根据本申请一示例实施方式的防火墙策略的下发装置的方框图。
图3示出根据本申请一示例实施方式的获取待下发防火墙策略的访问关系的详细流程图。
图4示出根据本申请一示例实施方式的基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并的详细流程图。
图5示出根据本申请一示例实施方式的在基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并之前的详细流程图。
图6示出根据本申请一示例实施方式的基于各所述图结构信息之间的拓扑关系，对所述各域通路进行整理的详细流程图。
图7示出根据本申请一示例实施方式的基于各所述图结构信息之间的拓扑关系，对所述各域通路进行整理的详细流程图。
图8示出根据本申请一示例实施方式的防火墙策略的下发的系统架构图。
图9示出根据本申请一示例实施方式的防火墙策略的下发的电子设备图。
图10示出根据本申请一示例实施方式的防火墙策略的下发的计算机可读存储介质图。
 本发明的最佳实施方式
现在将参考附图更全面地描述示例实施方式。然而，示例实施方式能够以多种形式实施，且不应被理解为限于在此阐述的范例；相反，提供这些实施方式使得本申请将更加全面和完整，并将示例实施方式的构思全面地传达给本领域的技术人员。所描述的特征、结构或特性可以以任何合适的方式结合在一个或更多实施方式中。在下面的描述中，提供许多具体细节从而给出对本申请的实施方式的充分理解。然而，本领域技术人员将意识到，可以实践本申请的技术方案而省略所述特定细节中的一个或更多，或者可以采用其它的方法、组元、装置、步骤等。在其它情况下，不详细示出或描述公知技术方案以避免喧宾夺主而使得本申请的各方面变得模糊。
此外，附图仅为本申请的示意性图解，并非一定是按比例绘制。图中相同的附图标记表示相同或类似的部分，因而将省略对它们的重复描述。附图中所示的一些方框图是功能实体，不一定必须与物理或逻辑上独立的实体相对应。可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
本申请的目的在于提高防火墙策略的下发效率。根据本申请一个实施例的防火墙策略的下发方法，包括：获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。本申请实施例将访问关系一一拆分为单一访问路由，再根据与域通路的匹配将属于同一域通路的单一访问路由进行合并，进而再根据合并结果将访问关系划分为各子访问关系，进而根据子访问关系所属的目标域通路所对应的已配置防火墙策略向访问关系下发防火墙策略。通过这种方法，能够在无人工干涉的情况下自动下发防火墙策略，提高了防火墙策略的下发效率。
下面，将结合附图对本示例实施方式中上述防火墙策略下发的各步骤进行详细的解释以及说明。
图1示出根据本申请一示例实施方式的防火墙策略的下发方法的流程图：
步骤S110：获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
步骤S120：获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
步骤S130：基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
步骤S140：基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
步骤S150：基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
本申请实施例中，示例性地以用于下发防火墙策略的管理端为本申请所提供方法的执行主体，管理端一般为服务器。
在步骤S110中，获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由。
本申请实施例中，待下发防火墙策略的访问关系描述的是N源地址到M目的地址的访问，其中，N为大于等于1的正整数，M为大于等于1的正整数，则对该访问关系进行一一拆分可以得到该访问关系包含的N*M条单一访问路由。
在一实施例中，用户通过用户端指定待下发防火墙策略的访问关系，并将该访问关系发送至管理端，从而触发获取到该访问关系的管理端对该访问关系进行拆分进而确定该访问关系所包含的各单一访问路由。
在一实施例中，如图3所示，步骤S110包括：
步骤S1101：建立源系统的镜像系统；
步骤S1102：获取所述源系统的待上线业务；
步骤S1103：通过在所述镜像系统中触发所述待上线业务，采集所述待上线业务所对应的所述访问关系。
该实施例中，通过业务触发的方式获取待下发防火墙策略的访问关系。具体的，对于该待下发防火墙策略的访问关系所在的源系统，管理端建立该源系统的镜像系统，该镜像系统是该源系统的复制。管理端获取到该源系统的待上线业务，进而在该镜像系统中触发该待上线业务。待上线业务的触发会相应生成对应的访问关系，从而管理端采集该访问关系。
例如：在金融系统中上线新的“审批业务”之前，管理端建立该金融系统的镜像系统，并在该镜像系统触发该“审批业务”。该“审批业务”的触发会导致该镜像系统生成用以实现该“审批业务”的访问关系，从而管理端采集该访问关系，并确定该访问关系包含的各单一访问路由，从而在此基础上对该访问关系下发防火墙策略。
又例如：要对金融系统中已有的“贷款业务”进行业务需求的变更，业务需求变更后访问关系也会相应地变更。因此，在金融系统中变更该“贷款业务”之前，管理端建立该金融系统的镜像系统，并在该镜像系统触发变更后的“审批业务”。变更后的“审批业务”的触发会导致该镜像系统生成用以实现该变更后的“审批业务”的访问关系，从而管理端采集该访问关系，并确定该访问关系包含的各单一访问路由，从而在此基础上对该访问关系下发防火墙策略。
该实施例的优点在于，通过建立镜像系统并在镜像系统中触发业务以获取访问关系，使得访问关系的获取在灵活满足业务需求的同时，避免了对源系统造成影响，保证了源系统的系统稳定性。
在步骤S120中，获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合。
本申请实施例中，管理端获取已配置防火墙策略的各域通路。其中，每一域通路一般为多个单一访问路由的集合，每一域通路的源域以及目的域一般均可以看作对应的网段。各域通路对应的已配置防火墙策略会存储在防火墙数据库中。
在一实施例中，该方法还包括：
定期采集已配置的防火墙策略；
解析并确定所述防火墙策略对应的域通路，并存储所述对应关系。
该实施例中，管理端定期（例如：每隔24小时）采集防火墙策略，确定各防火墙策略分别所约束控制的域通路，进而将防火墙策略与对应的域通路之间的对应关系存储入防火墙数据库中。从而，管理端可以通过读取防火墙数据库，获取已配置防火墙策略的各域通路。
在步骤S130中，基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果。
在一实施例中，如图4所示，步骤S130包括：
步骤S1301：获取所述单一访问路由对应的源地址以及目的地址；
步骤S1302：获取所述域通路对应的源域以及目的域；
步骤S1303：基于所述源地址与所述源域的匹配以及所述目的地址与所述目的域的匹配，将属于同一域通路的单一访问路由进行合并。
该实施例中，对于访问关系所包含的每一单一访问路由，管理端确定该单一访问路由的源地址以及目的地址；对于已配置防火墙策略的每一域通路，管理端确定该域通路的源域以及目的域。其中，源域是多个源地址的集合，目的域是多个目的地址的集合。从而管理端根据源地址与源域的匹配以及目的地址与目的域的匹配，具体的，若单一访问路由A的源地址在域通路甲的源域中，且单一访问路由A的目的地址在域通路甲的目的域中，则确定单一访问路由A属于域通路甲，进而将属于同一域通路的单一访问路由进行合并。
在一实施例中，如图5所示，在步骤S130之前还包括：
步骤S124：将所述各域通路分别表示为对应的图结构信息；
步骤S128：基于各所述图结构信息之间的拓扑关系，对所述各域通路进行整理。
该实施例中，在根据域通路对单一访问路由进行合并之前，管理端对各域通路进行整理。其中，整理内容主要包括对存在交叉的域通路进行切割修剪、对能够首尾相连的域通路进行融合。
管理端获取到已配置防火墙策略的各域通路后，将该各域通路分别表示为对应的图结构信息，每一图结构信息描述着对应的一个域的网段范围。具体的，每一域通路对应着一对图结构信息，这一对图结构信息分别描述着该域通路的源域以及目的域。通过对图结构信息之间的拓扑关系的处理，管理端能够实现对域之间的拓扑关系的处理，从而在此基础上对各域通路进行整理。
该实施例的优点在于，通过预先对域通路进行整理，能够优化域通路之间的组成，从而使得在域通路的基础上所进行的访问路由的合并效率更高。
在一实施例中，如图6所示，步骤S128包括：
步骤S1281’：基于各所述图结构信息之间的拓扑关系，确定所述各域通路之间的交叉区域；
步骤S1282’：基于所述交叉区域对所述各域通路进行切割。
该实施例中，管理端获取到各域通路分别对应的图结构信息后，基于各图结构信息之间的拓扑关系，确定各域通路之间的交叉区域。其中，交叉区域指的是两个或者两个以上的域发生重叠的区域。进而，管理端基于该交叉区域对各域通路进行切割，切割各域通路的同时，还会对所切割的各域通路的防火墙策略进行适应性地切割。
例如：域通路甲的源域为域1，目的域为域2；域通路乙的源域为域3，目的域为域4，其中，域1与域3存在发生重叠的网段。将域1、域2、域3以及域4分别表示为对应的图结构信息，管理端即可根据图结构信息之间的拓扑关系确定域通路甲与域通路乙之间的交叉区域为域1与域3的重叠区域。记域1与域3的重叠区域为域5，域1中除去域5的区域为域6，域3中除去域5的区域为域7。则管理端对域通路甲与域通路乙进行切割，得到切割后的源域为域6目的域为域2的域通路甲、源域为域7目的域为域4的域通路乙、源域为域5目的域为域2的域通路丙、源域为域5目的域为域4的域通路丁。切割的同时，对域通路甲的防火墙策略以及域通路乙的防火墙策略进行适应性地切割。
需要说明的是，该实施例只是示例性的说明，不应对本申请的功能和使用范围造成限制。
在一实施例中，如图7所示，步骤S128包括：
步骤S1281’’：基于各所述图结构信息之间的拓扑关系，确定首尾相连的相邻域通路；
步骤S1282’’：基于所述首尾相连的关系对所述相邻域通路进行融合。
该实施例中，管理端获取到各域通路分别对应的图结构信息后，基于各图结构信息之间的拓扑关系，从各域通路中筛选出能够首尾相连的相邻域通路。其中，首尾相连指的是一个域通路的源域是另一个域通路的目的域。进而，管理端对相邻域通路进行融合，融合相邻域通路的同时，还会对所融合的相邻域通路的防火墙策略进行适应性地整合。
例如：域通路甲的源域为域1，目的域为域2；域通路乙的源域为域2，目的域为域3。域通路甲与域通路乙首尾相连，则管理端将域通路甲与域通路乙进行融合，在仍旧保留域通路甲与域通路乙的同时，得到新的域通路丙。其中，域通路丙的源域为域1，经过域2后到达目的域域3。
需要说明的是，该实施例只是示例性的说明，不应对本申请的功能和使用范围造成限制。
在步骤S140中，基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路。
本申请实施例中，管理端在根据域通路对单一访问路由进行合并得到合并结果之后，相应地将访问关系划分为各子访问关系，并确定各子访问关系分别所属的目标域通路。其中，每一子访问关系属于一个目标域通路；所有子访问关系所包含的单一访问路由的集合即为该访问关系所包含的单一访问路由。由此管理端可以确定访问关系所对应的所有目标域通路。
在步骤S150中，基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
本申请实施例中，管理端确定访问关系所对应的所有目标域通路后，进一步确定各目标域通路分别对应的已配置防火墙策略，进而在此基础上向访问关系下发防火墙策略。例如：管理端将访问关系一一拆分为各单一访问路由后，根据域通路对各单一访问路由进行合并，根据合并结果将访问关系划分为子访问1、子访问关系2以及子访问关系3。其中，子访问关系1对应的目标域通路为域通路甲、子访问关系2对应的目标域通路为域通路乙、子访问关系3对应的目标域通路为域通路丙。进而管理端获取域通路甲的已配置防火墙策略、域通路乙的已配置防火墙策略以及域通路丙的已配置防火墙策略，进而将这三组防火墙策略分别对应下发至该访问关系的各子访问关系处，从而实现对访问关系的防火墙策略的下发。
在一实施例中，如图2所示，提供了一种防火墙策略的下发装置，具体包括：
第一获取模块210，配置为获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
第二获取模块220，配置为获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
合并模块230，配置为基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
划分模块240，配置为基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
下发模块250，配置为基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
上述装置中各个模块的功能和作用的实现过程具体详见上述防火墙策略的下发方法中对应步骤的实现过程，在此不再赘述。
应当注意，尽管在上文详细描述中提及了用于动作执行的设备的若干模块或者单元，但是这种划分并非强制性的。实际上，根据本申请的实施方式，上文描述的两个或更多模块或者单元的特征和功能可以在一个模块或者单元中具体化。反之，上文描述的一个模块或者单元的特征和功能可以进一步划分为由多个模块或者单元来具体化。
此外，尽管在附图中以特定顺序描述了本申请中方法的各个步骤，但是，这并非要求或者暗示必须按照该特定顺序来执行这些步骤，或是必须执行全部所示的步骤才能实现期望的结果。附加的或备选的，可以省略某些步骤，将多个步骤合并为一个步骤执行，以及/或者将一个步骤分解为多个步骤执行等。
通过以上的实施方式的描述，本领域的技术人员易于理解，这里描述的示例实施方式可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本申请实施方式的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质（可以是CD-ROM，U盘，移动硬盘等）中或网络上，包括若干指令以使得一台计算设备（可以是个人计算机、服务器、移动终端、或者网络设备等）执行根据本申请实施方式的方法。
图8示出根据本申请一示例实施方式的防火墙策略的下发的系统架构图。该系统架构包括：管理端310、源系统320、用户端330、防火墙数据库340。
在一实施例中，管理端310定期采集已配置的防火墙策略，并将防火墙策略对应的域通路与防火墙策略一起录入防火墙数据库340中。若要在源系统320中开通新的访问关系，则需要向该新的访问关系下发防火墙策略才可以开通。用户通过用户端330向管理端310指定该新的访问关系。管理端310获取到该新的访问关系后，对其进行拆分得到其所包含的各单一访问路由，再读取防火墙数据库340中的域通路对各单一访问路由进行合并，进而根据合并结果对该新的访问关系进行划分得到子访问关系，进而确定子访问关系所属的目标域通路，从而能够确定该新的访问关系所对应的所有目标域通路，进而根据所有目标域通路分别对应的已配置防火墙策略，向该新的访问关系下发防火墙策略。
通过以上对系统架构的描述，本领域的技术人员易于理解，这里描述的系统架构能够实现图2所示的防火墙策略的下发装置中各个模块的功能。
在本申请的示例性实施例中，还提供了一种能够实现上述方法的电子设备。
所属技术领域的技术人员能够理解，本申请的各个方面可以实现为系统、方法或程序产品。因此，本申请的各个方面可以具体实现为以下形式，即：完全的硬件实施方式、完全的软件实施方式（包括固件、微代码等），或硬件和软件方面结合的实施方式，这里可以统称为“电路”、“模块”或“系统”。
下面参照图9来描述根据本申请的这种实施方式的电子设备400。图9显示的电子设备400仅仅是一个示例，不应对本申请实施例的功能和使用范围带来任何限制。
如图9所示，电子设备400以通用计算设备的形式表现。电子设备400的组件可以包括但不限于：上述至少一个处理单元410、上述至少一个存储单元420、连接不同系统组件（包括存储单元420和处理单元410）的总线430。
其中，所述存储单元存储有程序代码，所述程序代码可以被所述处理单元410执行，使得所述处理单元410执行本说明书上述“示例性方法”部分中描述的根据本申请各种示例性实施方式所示出的防火墙策略的下发方法的步骤。例如，所述处理单元410可以执行如图1中所示步骤S110：获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；步骤S120：获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；步骤S130：基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；步骤S140：基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；步骤S150：基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
存储单元420可以包括易失性存储单元形式的可读介质，例如随机存取存储单元（RAM）4201和/或高速缓存存储单元4202，还可以进一步包括只读存储单元（ROM）4203。
存储单元420还可以包括具有一组（至少一个）程序模块4205的程序/实用工具4204，这样的程序模块4205包括但不限于：操作系统、一个或者多个应用程序、其它程序模块以及程序数据，这些示例中的每一个或某种组合中可能包括网络环境的实现。
总线430可以为表示几类总线结构中的一种或多种，包括存储单元总线或者存储单元控制器、外围总线、图形加速端口、处理单元或者使用多种总线结构中的任意总线结构的局域总线。
电子设备400也可以与一个或多个外部设备500（例如键盘、指向设备、蓝牙设备等）通信，还可与一个或者多个使得用户能与该电子设备400交互的设备通信，和/或与使得该电子设备400能与一个或多个其它计算设备进行通信的任何设备（例如路由器、调制解调器等等）通信。这种通信可以通过输入/输出（I/O）接口450进行。并且，电子设备400还可以通过网络适配器460与一个或者多个网络（例如局域网（LAN），广域网（WAN）和/或公共网络，例如因特网）通信。如图所示，网络适配器460通过总线430与电子设备400的其它模块通信。应当明白，尽管图中未示出，可以结合电子设备400使用其它硬件和/或软件模块，包括但不限于：微代码、设备驱动器、冗余处理单元、外部磁盘驱动阵列、RAID系统、磁带驱动器以及数据备份存储系统等。
通过以上的实施方式的描述，本领域的技术人员易于理解，这里描述的示例实施方式可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本申请实施方式的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质（可以是CD-ROM，U盘，移动硬盘等）中或网络上，包括若干指令以使得一台计算设备（可以是个人计算机、服务器、终端装置、或者网络设备等）执行根据本申请实施方式的方法。
在本申请的示例性实施例中，还提供了一种计算机可读存储介质，所述计算机可读存储介质可以是非易失性，也可以是易失性，其上存储有能够实现本说明书上述方法的程序产品。在一些可能的实施方式中，本申请的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当所述程序产品在终端设备上运行时，所述程序代码用于使所述终端设备执行本说明书上述“示例性方法”部分中描述的根据本申请各种示例性所示出的防火墙策略的下发方法的步骤，所述防火墙策略的下发方法包括以下步骤：
获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
参考图10所示，描述了根据本申请的实施方式的用于实现上述方法的程序产品600，其可以采用便携式紧凑盘只读存储器(CD-ROM)并包括程序代码，并可以在终端设备，例如个人电脑上运行。然而，本申请的程序产品不限于此，在本数据中，可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
所述程序产品可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以为但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子（非穷举的列表）包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器（RAM）、只读存储器（ROM）、可擦式可编程只读存储器（EPROM或闪存）、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
计算机可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了可读程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。可读信号介质还可以是可读存储介质以外的任何可读介质，该可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于无线、有线、光缆、RF等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本申请操作的程序代码，所述程序设计语言包括面向对象的程序设计语言—诸如Java、C++等，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。在涉及远程计算设备的情形中，远程计算设备可以通过任意种类的网络，包括局域网（LAN）或广域网（WAN），连接到用户计算设备，或者，可以连接到外部计算设备（例如利用因特网服务提供商来通过因特网连接）。
此外，上述附图仅是根据本申请示例性实施例的方法所包括的处理的示意性说明，而不是限制目的。易于理解，上述附图所示的处理并不表明或限制这些处理的时间顺序。另外，也易于理解，这些处理可以是例如在多个模块中同步或异步执行的。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本申请的其他实施例。本申请旨在涵盖本申请的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本申请的一般性原理并包括本申请未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本申请的真正范围和精神由权利要求指出。

Claims (20)

  1. 一种防火墙策略的下发方法，其中，所述方法包括：
    获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
    获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
    基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
    基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
    基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
  2. 根据权利要求1所述的方法，其中，获取待开通的访问关系，包括：
    建立源系统的镜像系统；
    获取所述源系统的待上线业务；
    通过在所述镜像系统中触发所述待上线业务，采集所述待上线业务所对应的所述访问关系。
  3. 根据权利要求1所述的方法，其中，基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，包括：
    获取所述单一访问路由对应的源地址以及目的地址；
    获取所述域通路对应的源域以及目的域；
    基于所述源地址与所述源域的匹配以及所述目的地址与所述目的域的匹配，将属于同一域通路的单一访问路由进行合并。
  4. 根据权利要求1所述的方法，其中，所述方法还包括：
    定期采集已配置的防火墙策略；
    解析并确定所述防火墙策略对应的域通路，并存储所述对应关系。
  5. 根据权利要求1所述的方法，其中，在基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的各所述单一访问路由进行合并之前，所述方法还包括：
    将所述各域通路分别表示为对应的图结构信息；
    基于各所述图结构信息之间的拓扑关系，对所述各域通路进行整理。
  6. 根据权利要求5所述的方法，其中，基于各所述图结构信息之间的拓扑关系，对所述各域通路进行整理，包括：
    基于各所述图结构信息之间的拓扑关系，确定所述各域通路之间的交叉区域；
    基于所述交叉区域对所述各域通路进行切割。
  7. 根据权利要求5所述的方法，其中，基于各所述图结构信息之间的拓扑关系，对所述各域通路进行整理，包括：
    基于各所述图结构信息之间的拓扑关系，确定首尾相连的相邻域通路；
    基于所述首尾相连的关系对所述相邻域通路进行融合。
  8. 一种防火墙策略的下发装置，其中，包括：
    第一获取模块，配置为获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
    第二获取模块，配置为获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
    合并模块，配置为基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
    划分模块，配置为基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
    下发模块，配置为基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
  9. 一种防火墙策略的下发电子设备，其中，包括：
    存储器，配置为存储可执行指令；
    处理器，配置为执行所述存储器中存储的可执行指令，以执行一种防火墙策略的下发方法：其中，所述防火墙策略的下发方法包括：
    获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
    获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
    基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
    基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
    基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
  10. 根据权利要求9所述的防火墙策略的下发电子设备，其中，获取待开通的访问关系，包括：
    建立源系统的镜像系统；
    获取所述源系统的待上线业务；
    通过在所述镜像系统中触发所述待上线业务，采集所述待上线业务所对应的所述访问关系。
  11. 根据权利要求9所述的防火墙策略的下发电子设备，其中，基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，包括：
    获取所述单一访问路由对应的源地址以及目的地址；
    获取所述域通路对应的源域以及目的域；
    基于所述源地址与所述源域的匹配以及所述目的地址与所述目的域的匹配，将属于同一域通路的单一访问路由进行合并。
  12. 根据权利要求9所述的防火墙策略的下发电子设备，其中，还包括：
    定期采集已配置的防火墙策略；
    解析并确定所述防火墙策略对应的域通路，并存储所述对应关系。
  13. 根据权利要求9所述的防火墙策略的下发电子设备，其中，在基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的各所述单一访问路由进行合并之前，还包括：
    将所述各域通路分别表示为对应的图结构信息；
    基于各所述图结构信息之间的拓扑关系，对所述各域通路进行整理。
  14. 根据权利要求13所述的防火墙策略的下发电子设备，其中，基于各所述图结构信息之间的拓扑关系，对所述各域通路进行整理，包括：
    基于各所述图结构信息之间的拓扑关系，确定所述各域通路之间的交叉区域；
    基于所述交叉区域对所述各域通路进行切割。
  15. 根据权利要求13所述的防火墙策略的下发电子设备，其中，基于各所述图结构信息之间的拓扑关系，对所述各域通路进行整理，包括：
    基于各所述图结构信息之间的拓扑关系，确定首尾相连的相邻域通路；
    基于所述首尾相连的关系对所述相邻域通路进行融合。
  16. 一种计算机可读存储介质，其中，其存储有计算机程序指令，当所述计算机指令被计算机执行时，使计算机执行一种防火墙策略的下发方法，其中，所述一种防火墙策略的下发方法包括以下步骤：
    获取待下发防火墙策略的访问关系并确定所述访问关系所包含的各单一访问路由；
    获取已配置防火墙策略的各域通路，所述域通路为多个单一访问路由的集合；
    基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，得到合并结果；
    基于所述合并结果将所述访问关系划分为各子访问关系，并确定所述各子访问关系分别所属的目标域通路；
    基于各所述目标域通路分别对应的已配置防火墙策略，向所述访问关系下发防火墙策略。
  17. 根据权利要求16所述的计算机可读存储介质，其中，获取待开通的访问关系，包括：
    建立源系统的镜像系统；
    获取所述源系统的待上线业务；
    通过在所述镜像系统中触发所述待上线业务，采集所述待上线业务所对应的所述访问关系。
  18. 根据权利要求16所述的计算机可读存储介质，其中，基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的单一访问路由进行合并，包括：
    获取所述单一访问路由对应的源地址以及目的地址；
    获取所述域通路对应的源域以及目的域；
    基于所述源地址与所述源域的匹配以及所述目的地址与所述目的域的匹配，将属于同一域通路的单一访问路由进行合并。
  19. 根据权利要求16所述的计算机可读存储介质，其中，还包括：
    定期采集已配置的防火墙策略；
    解析并确定所述防火墙策略对应的域通路，并存储所述对应关系。
  20. 根据权利要求16所述的计算机可读存储介质，其中，在基于所述单一访问路由与所述域通路之间的匹配，将属于同一域通路的各所述单一访问路由进行合并之前，还包括：
    将所述各域通路分别表示为对应的图结构信息；
    基于各所述图结构信息之间的拓扑关系，对所述各域通路进行整理。
PCT/CN2020/124727 2020-07-30 2020-10-29 防火墙策略的下发方法、装置、电子设备及存储介质 WO2021139339A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010751565.9 2020-07-30
CN202010751565.9A CN111935117B (zh) 2020-07-30 2020-07-30 防火墙策略的下发方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2021139339A1 true WO2021139339A1 (zh) 2021-07-15

Family

ID=73315728

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/124727 WO2021139339A1 (zh) 2020-07-30 2020-10-29 防火墙策略的下发方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN111935117B (zh)
WO (1) WO2021139339A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114143090A (zh) * 2021-11-30 2022-03-04 招商局金融科技有限公司 基于网络安全架构的防火墙部署方法、装置、设备及介质
CN114172718A (zh) * 2021-12-03 2022-03-11 北京天融信网络安全技术有限公司 安全策略配置方法、装置、电子设备及存储介质
CN114465771A (zh) * 2021-12-30 2022-05-10 奇安信科技集团股份有限公司 基于防火墙流量自动推荐安全策略的方法、装置及防火墙
CN114978678A (zh) * 2022-05-20 2022-08-30 中国工商银行股份有限公司 防火墙策略变更方法、装置、计算机设备和存储介质
CN116094929A (zh) * 2023-03-06 2023-05-09 天津金城银行股份有限公司 配置下发方法、装置、电子设备及计算机可读存储介质
CN117596139A (zh) * 2024-01-18 2024-02-23 银联数据服务有限公司 一种防火墙的配置命令生成方法及装置

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112787867B (zh) * 2021-01-25 2023-02-10 上海瀚银信息技术有限公司 一种防火墙策略任务自动处理系统及方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101714997A (zh) * 2010-01-15 2010-05-26 中国工商银行股份有限公司 防火墙策略生成方法、装置及系统
US20180007000A1 (en) * 2016-06-29 2018-01-04 Nicira, Inc. Translation Cache for Firewall Configuration
CN109495508A (zh) * 2018-12-26 2019-03-19 成都科来软件有限公司 基于服务访问数据的防火墙配置方法
CN110290153A (zh) * 2019-07-19 2019-09-27 国网安徽省电力有限公司信息通信分公司 一种防火墙的端口管理策略自动下发方法及装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2802667B1 (fr) * 1999-12-21 2002-01-25 Bull Sa Procede et dispositif de configuration de pare-feu dans un systeme informatique
CN103023707B (zh) * 2012-12-28 2016-03-09 华为技术有限公司 一种策略配置的方法、管理服务器以及网络系统
US10462104B2 (en) * 2016-02-29 2019-10-29 Level 3 Communications, Llc Systems and methods for dynamic firewall policy configuration
CN105871930A (zh) * 2016-06-21 2016-08-17 上海携程商务有限公司 基于应用的防火墙安全策略的自适应配置方法及系统
CN106657047A (zh) * 2016-12-14 2017-05-10 北京启明星辰信息安全技术有限公司 一种网络访问关系的生成方法及装置
CN111277586A (zh) * 2020-01-17 2020-06-12 武汉思普崚技术有限公司 一种防火墙安全策略的调整方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101714997A (zh) * 2010-01-15 2010-05-26 中国工商银行股份有限公司 防火墙策略生成方法、装置及系统
US20180007000A1 (en) * 2016-06-29 2018-01-04 Nicira, Inc. Translation Cache for Firewall Configuration
CN109495508A (zh) * 2018-12-26 2019-03-19 成都科来软件有限公司 基于服务访问数据的防火墙配置方法
CN110290153A (zh) * 2019-07-19 2019-09-27 国网安徽省电力有限公司信息通信分公司 一种防火墙的端口管理策略自动下发方法及装置

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114143090A (zh) * 2021-11-30 2022-03-04 招商局金融科技有限公司 基于网络安全架构的防火墙部署方法、装置、设备及介质
CN114143090B (zh) * 2021-11-30 2024-02-06 招商局金融科技有限公司 基于网络安全架构的防火墙部署方法、装置、设备及介质
CN114172718A (zh) * 2021-12-03 2022-03-11 北京天融信网络安全技术有限公司 安全策略配置方法、装置、电子设备及存储介质
CN114172718B (zh) * 2021-12-03 2024-01-23 北京天融信网络安全技术有限公司 安全策略配置方法、装置、电子设备及存储介质
CN114465771A (zh) * 2021-12-30 2022-05-10 奇安信科技集团股份有限公司 基于防火墙流量自动推荐安全策略的方法、装置及防火墙
CN114465771B (zh) * 2021-12-30 2024-04-05 奇安信科技集团股份有限公司 基于防火墙流量自动推荐安全策略的方法、装置及防火墙
CN114978678A (zh) * 2022-05-20 2022-08-30 中国工商银行股份有限公司 防火墙策略变更方法、装置、计算机设备和存储介质
CN114978678B (zh) * 2022-05-20 2024-02-20 中国工商银行股份有限公司 防火墙策略变更方法、装置、计算机设备和存储介质
CN116094929A (zh) * 2023-03-06 2023-05-09 天津金城银行股份有限公司 配置下发方法、装置、电子设备及计算机可读存储介质
CN117596139A (zh) * 2024-01-18 2024-02-23 银联数据服务有限公司 一种防火墙的配置命令生成方法及装置

Also Published As

Publication number Publication date
CN111935117B (zh) 2023-01-31
CN111935117A (zh) 2020-11-13

Similar Documents

Publication Publication Date Title
WO2021139339A1 (zh) 防火墙策略的下发方法、装置、电子设备及存储介质
US20220070065A1 (en) Enriched flow data for network analytics
US11146454B2 (en) Intent driven network policy platform
US20150236935A1 (en) Network segmentation
US11106671B2 (en) Executing graph path queries
TW201445461A (zh) 使用以邏輯多維度標籤為基礎之原則模型的分散式網路管理
US7516475B1 (en) Method and apparatus for managing security policies on a network
US20180054397A1 (en) Filtration of Network Traffic Using Virtually-Extended Ternary Content-Addressable Memory (TCAM)
CN112887309B (zh) 一种工业协议解析系统
CN117581239A (zh) 用于人工智能定义网络的系统和方法
US10250446B2 (en) Distributed policy store
CN111639356A (zh) 一种智慧城市数据共享系统及方法
WO2021190659A1 (zh) 系统的数据获取方法、装置、介质及电子设备
CN105099916A (zh) 开放流路由交换设备及其对数据报文的处理方法
CN113391967B (zh) 防火墙的包过滤测试方法及装置
CN112333105A (zh) 云端机器人的通信方法及装置
CN102769495B (zh) 一种光纤接入网设备通信方法、装置及系统
CN114900430B (zh) 容器网络优化方法、装置、计算机设备和存储介质
WO2020167539A1 (en) System and method for complex it process annotation, tracing, analysis, and simulation
CN111064619A (zh) 一种配置信息管理方法、装置、电子设备和存储介质
US9191267B2 (en) Device management for determining the effects of management actions
US10860409B2 (en) Tracelog isolation of failed sessions at scale
CN112015590A (zh) 一种多层级灾备方法、装置及电子设备
CN114389982B (zh) 一种网络质量的评估方法、装置、设备和介质
US20230113301A1 (en) Managing queries to non-relational databases with multiple paths to storage system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20912275

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20912275

Country of ref document: EP

Kind code of ref document: A1