WO2021226781A1 - 防火墙规则的更新方法、装置、服务器及存储介质 - Google Patents

防火墙规则的更新方法、装置、服务器及存储介质 Download PDF

Info

Publication number
WO2021226781A1
WO2021226781A1 PCT/CN2020/089561 CN2020089561W WO2021226781A1 WO 2021226781 A1 WO2021226781 A1 WO 2021226781A1 CN 2020089561 W CN2020089561 W CN 2020089561W WO 2021226781 A1 WO2021226781 A1 WO 2021226781A1
Authority
WO
WIPO (PCT)
Prior art keywords
rule
version number
server
firewall
application server
Prior art date
Application number
PCT/CN2020/089561
Other languages
English (en)
French (fr)
Inventor
李尧
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to CN202080094887.9A priority Critical patent/CN115023919A/zh
Priority to PCT/CN2020/089561 priority patent/WO2021226781A1/zh
Publication of WO2021226781A1 publication Critical patent/WO2021226781A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management

Definitions

  • This application relates to the field of Internet technology, and more specifically, to a method, device, server, and storage medium for updating firewall rules.
  • firewall technology is one of the important means to ensure network security.
  • the function of the firewall technology is mainly to discover and deal with the security risks and data transmission problems that may exist during the operation of the computer network in time.
  • the pre-set firewall rules are mainly used to filter external requests, and the update of the firewall rules is the key for the firewall to effectively avoid security risks.
  • this application proposes a method, device, server and storage medium for updating firewall rules.
  • an embodiment of the present application provides a method for updating firewall rules, which is applied to a configuration server, and the configuration server is used to configure firewall rules.
  • the method includes: establishing regularly with an application server in a preset list Connection; receiving a rule update request sent by the application server, the rule update request carrying the current version number of the firewall rule of the application server; in response to the rule update request, in the current version number and the specified version number When they are inconsistent, the rule data of the firewall rule corresponding to the designated version number is sent to the application server, and the rule data is used by the application server to update the firewall rule to the firewall rule corresponding to the designated version number.
  • an embodiment of the present application provides a method for updating firewall rules, which is applied to an application server, and the method includes: periodically sending a connection request to a configuration server, where the connection request is used to establish a connection with the configuration server, The configuration server is used to configure firewall rules; after establishing a connection with the configuration server, send a rule update request to the configuration server, and the rule update request carries the current firewall rules of the application server Version number; receiving the rule data of the firewall rule corresponding to the specified version number sent by the configuration server, the rule data being sent by the configuration server when it determines that the current version number is inconsistent with the specified version number; According to the rule data, the firewall rule is updated to the firewall rule corresponding to the specified version number.
  • an embodiment of the present application provides a device for updating firewall rules, which is applied to a configuration server.
  • the configuration server is used to configure firewall rules.
  • the device includes: a connection establishment module, a request receiving module, and a request response. Module, wherein the connection establishment module is used to periodically establish a connection with the application server in the preset list; the request receiving module is used to receive a rule update request sent by the application server, and the rule update request carries The current version number of the firewall rule of the application server; the request response module is used to respond to the rule update request, and when the current version number is inconsistent with the specified version number, the rule of the firewall rule corresponding to the specified version number The data is sent to the application server, and the rule data is used by the application server to update the firewall rule to the firewall rule corresponding to the specified version number.
  • an embodiment of the present application provides an apparatus for updating firewall rules, which is applied to an application server.
  • the apparatus includes: a first request sending module, a second request sending module, a data receiving module, and a rule updating module, wherein:
  • the first request sending module is configured to periodically send a connection request to a configuration server, the connection request is used to establish a connection with the configuration server, and the configuration server is used to configure firewall rules;
  • the second request sending module After establishing a connection with the configuration server, send a rule update request to the configuration server, where the rule update request carries the current version number of the firewall rule of the application server;
  • the data receiving module is used for Receiving the rule data of the firewall rule corresponding to the specified version number sent by the configuration server, the rule data being sent by the configuration server when determining that the current version number is inconsistent with the specified version number;
  • the rule update module It is used to update the firewall rule to the firewall rule corresponding to the specified version number according to the rule data.
  • an embodiment of the present application provides a server, including: one or more processors; a memory; one or more application programs, wherein the one or more application programs are stored in the memory and are It is configured to be executed by the one or more processors, and the one or more programs are configured to execute the method for updating firewall rules provided in the first aspect described above.
  • an embodiment of the present application provides a server, including: one or more processors; a memory; one or more application programs, wherein the one or more application programs are stored in the memory and are It is configured to be executed by the one or more processors, and the one or more programs are configured to execute the method for updating firewall rules provided in the second aspect described above.
  • an embodiment of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores program code, and the program code can be called by a processor to execute the firewall provided in the first aspect.
  • a configuration server used to configure firewall rules periodically establishes a connection with an application server in a preset list, and receives a rule update request sent by the application server.
  • the rule update request carries the firewall rules of the application server.
  • the current version number and then respond to the received rule update request.
  • the rule data of the firewall rule corresponding to the specified version number is sent to the application server.
  • the rule data is used to instruct the application server to
  • the firewall rules are updated to the firewall rules corresponding to the specified version number, so as to realize the regular connection with the application server, the update confirmation of the firewall rules during each connection with the application server, and the firewall rules of the application server when it is necessary to update Update, complete the automatic update of the firewall rules of the application server, and ensure the timeliness of the firewall rules.
  • Fig. 1 shows a schematic diagram of a traditional updating principle of firewall rules provided by an embodiment of the present application.
  • Figure 2 shows a schematic diagram of an application scenario provided by an embodiment of the present application.
  • Fig. 3 shows a flowchart of a method for updating firewall rules according to an embodiment of the present application.
  • Fig. 4 shows a flowchart of a method for updating firewall rules according to another embodiment of the present application.
  • Fig. 5 shows a flowchart of a method for updating firewall rules according to another embodiment of the present application.
  • Fig. 6 shows a flowchart of a method for updating firewall rules according to still another embodiment of the present application.
  • Fig. 7 shows a block diagram of an apparatus for updating firewall rules according to an embodiment of the present application.
  • Fig. 8 shows a block diagram of an apparatus for updating firewall rules according to another embodiment of the present application.
  • FIG. 9 is a block diagram of a server for executing the method for updating firewall rules according to an embodiment of the present application according to an embodiment of the present application.
  • FIG. 10 is a storage unit for storing or carrying program code for implementing the method for updating firewall rules according to the embodiment of the present application according to an embodiment of the present application.
  • WAF Web Application Firewall
  • WAF performs content detection and verification on various requests from web application clients to ensure their security and legitimacy, block illegal requests in real time, and provide security protection for web applications.
  • WAF is divided into hardware WAF, software WAF, code-level WAF, etc.
  • software WAF gradually replaces traditional higher-cost hardware WAF, and the main implementation form of software WAF is an embedded module based on Nginx (an open source high-performance http reverse proxy web server), because Nginx is used as a back-end service
  • Nginx an open source high-performance http reverse proxy web server
  • the main traffic unified entrance of Nginx can perform security inspection and audit on all http (HyperText Transfer Protocol) requests.
  • WAF processing http is divided into four stages: request header, request content, response header, and response content.
  • WAF rules are regulations that define WAF to perform specified actions on http requests that meet certain conditions at a certain stage.
  • WAF rules contain four elements: filter conditions, phases, and actions.
  • WAF rules can be implemented in multiple forms, such as jxWAF (a web application firewall based on openrestry) and openWAF (a comprehensive open source web protection system) in json (a lightweight data exchange format, JavaScript Object Notation) format To achieve, loveshell is implemented in regular form, and naxsi is implemented with Nginx-based conf configuration.
  • WAF formulates rules based on the characteristics of the attacking http request to intercept or audit.
  • WAF When the uniform resource identifier (URI, Uniform Resource Identifier) in the http request matches the content in the regular item, WAF performs the specified action according to the action in the rule. For example, LOG means only record, and BLOCK means intercept, intercept The dropped http request will not reach the back-end business, thereby protecting the back-end business from being affected.
  • URI Uniform Resource Identifier
  • the implementation principle of WAF is as follows: http traffic reaches the Nginx side, and is processed and parsed by the http engine.
  • the http engine can filter out some abnormal messages that do not conform to the HTTP specification, and has no means for attacking messages.
  • the WAF module hooks a hook processing function into Nginx to process all http requests.
  • WAF loops through all the rules and uses the regular engine to match the URI, headers, body, etc. in the http request. If it matches, it will return an intercept page to the requester to indicate that this is an attack request. If there is no match, the request will be released and the request will reach the back-end service.
  • the WAF running on the server mainly uses pre-defined firewall rules to filter external requests to achieve defense protection.
  • Most of the pre-defined firewall rules are stored locally on the server in the form of files.
  • Attackers usually use certain methods to bypass the WAF rules to achieve the purpose of the attack. In confronting the attackers, they need to update the WAF rules in time to deal with sudden attacks.
  • Figure 1 shows the update process of the WAF rules in the traditional technology. After the rule file is modified, the application server (Nginx) performs a reload operation. If there is a high concurrent traffic, it may cause some Abnormal situations such as TCP (Transmission Control Protocol) connection interruption, and these operations require manual operations.
  • TCP Transmission Control Protocol
  • each IDC has multiple Nginx clusters, and each Nginx machine is embedded with a WAF module, then To update the rules once, you need to update the WAF rules in all Nginx machines. This is very inefficient.
  • the artificial copy of the new firewall rules usually has a lag, that is, the real-time performance of the above-mentioned firewall rule update methods is poor, especially today's attack methods are diverse and numerous. In the case of degeneration characteristics, the shortcoming of poor real-time performance of firewall rule update using the above method is more prominent, the gray-scale process is slow, and the 0day attack cannot be resisted.
  • the inventors proposed the method, device, server, and storage medium for updating firewall rules provided by the embodiments of the present application.
  • the firewall rules are updated every time the application server is connected. Confirm that the firewall rules of the application server are updated when the update is required, and the automatic update of the firewall rules of the application server is completed, which ensures the timeliness of the firewall rules.
  • the specific method for updating the firewall rules will be described in detail in the subsequent embodiments.
  • FIG. 2 shows a schematic diagram of an application scenario provided by an embodiment of the present application.
  • the application scenario includes a configuration server 101 and an application server 102.
  • the configuration server 101 is used to configure the firewall rules to implement the update of the firewall rules of the application server 102.
  • the configuration server 101 may communicate with the application server 102 through the HTTP protocol to realize the transmission of update requests, the issuance of rule data of firewall rules, and the like.
  • the application server 102 may periodically establish a TCP connection with the configuration server 101 to periodically interact with the configuration server 101 to confirm whether there is an update of the firewall rules, and update the firewall rules when there is an update of the firewall rules.
  • the configuration server 101 may communicate with one application server 102, or may communicate with multiple application servers 102.
  • the configuration server 101 can configure and manage the firewall rules of multiple application servers 102.
  • the firewall rules need to be updated, it can implement firewalls for multiple application servers 102.
  • the rules are updated.
  • the configuration server 101 may be a traditional server or a cloud server; the application server may be a web application server, such as the aforementioned Nginx server.
  • FIG. 3 shows a schematic flowchart of a method for updating firewall rules according to an embodiment of the present application.
  • the firewall rule updating method is applied to the firewall rule updating device 400 as shown in FIG. 7 and the server 100 configured with the firewall rule updating device 400 (FIG. 9).
  • the following will take a server as an example to illustrate the specific process of this embodiment.
  • the server applied in this embodiment may be a configuration server in the above application scenario, and the configuration server is used to configure firewall rules.
  • the configuration server can be a traditional server or a cloud server, etc., which is not limited here.
  • the following will elaborate on the process shown in FIG. 3, and the method for updating the firewall rules may specifically include the following steps:
  • Step S110 periodically establish a connection with the application server in the preset list.
  • the configuration server can periodically establish a connection with the application server in the preset list, so as to periodically check whether the firewall rules of the application server need to be updated, and when the firewall rules need to be updated, perform the firewall rules of the application server. Update, and then realize the real-time update of the firewall rules of the application server.
  • the preset list may be a preset list composed of servers that need to update firewall rules in real time. That is to say, by setting the application servers that need to update the firewall rules in real time in the preset list, the configuration server can communicate with these application servers on a regular basis, thereby realizing the real-time update of the firewall rules.
  • the preset list can be configured by the user, for example, through the client to upload to the configuration server; the preset list can also be automatically generated by the configuration server, for example, the configuration server is divided into batches according to the application servers it manages Add the application server to the preset list.
  • the specific method of obtaining the preset list may not be limited.
  • the configuration server periodically establishes a connection with the application server in the preset list.
  • the application server in the preset list periodically sends a connection request (for example, a connection request to establish a TCP connection) to the configuration server, and the configuration server responds.
  • the connection request is to establish a connection with the application server that sent the connection request.
  • the application server can subsequently send rule update requests, and the configuration server can send data.
  • Step S120 Receive a rule update request sent by the application server, where the rule update request carries the current version number of the firewall rule of the application server.
  • the application server can send a rule update request to the configuration server to request the configuration server to confirm whether there is an update of firewall rules, and when there is an update of firewall rules , Obtain the updated rule data of the firewall rule from the configuration server.
  • the configuration server can receive the rule update request sent by the application server during this connection process.
  • the rule update request sent by the application server may carry the current version number of the firewall rule of the application server.
  • the version number of the firewall rule is used as the version identifier of the firewall rule, and different version numbers can identify different versions of the firewall rule.
  • the V2 and V3 versions respectively identify the second version and the third version.
  • the application server carries the current version number of the firewall rule in the rule update request, so that the configuration server knows the current version of the firewall rule of the application server, so as to determine whether the firewall rule of the application server needs to be updated.
  • Step S130 In response to the rule update request, when the current version number is inconsistent with the designated version number, the rule data of the firewall rule corresponding to the designated version number is sent to the application server, and the rule data is used for all the rules.
  • the application server updates the firewall rule to the firewall rule corresponding to the specified version number.
  • the configuration server may respond to the rule update request sent by the application server, and determine the application server according to the current version number carried in the rule update request Whether the firewall rules need to be updated. Specifically, the configuration server can compare the current version number with the specified version number to determine whether the current version number is consistent with the specified version number. If the current version number is inconsistent with the specified version number, it can determine the firewall rules of the application server Need to be updated; if the current version number is consistent with the specified version number, it can be determined that the firewall rules of the application server do not need to be updated.
  • the designated version number may be a version number that needs to be the version of the firewall rule of the application server.
  • the configuration server can generate the updated version number of the firewall rules and use the version number as the designated version number; as another way, the configuration server can be pre-stored There are multiple versions of firewall rules.
  • the configuration server can select the version sent by the user through the client, and then use the version number corresponding to the selected version as the specified version number according to the selection operation.
  • the configuration server after the configuration server compares the current version number with the specified version number, if the current version number is inconsistent with the specified version number, it means that the firewall rules of the application server need to be updated, so the configuration server can change the specified version number
  • the rule data of the corresponding firewall rule is sent to the application server.
  • the configuration server can store at least the rule data of the firewall rule corresponding to the specified version number.
  • the configuration server determines that the current version number is inconsistent with the specified version number, it can read the firewall rule corresponding to the specified version number. And send the rule data to the application server.
  • the configuration server can also store the firewall rule corresponding to the specified version number.
  • the configuration server When the configuration server determines that the current version number is inconsistent with the specified version number, it can read the firewall rule corresponding to the specified version number, and then According to the firewall rules, rule data that can be recognized by the WAF of the application server is generated, and then the rule data is sent to the application server.
  • the application server can update its current firewall rule to the specified version number according to the rule data Corresponding firewall rules, so that the firewall rules of the application server can be updated.
  • firewall rules of multiple application servers can be set in the preset list, if the firewall rules of multiple application servers need to be updated at the same time, set multiple application servers in After the list is preset, the firewall rules of multiple application servers can be updated, and the problem of low efficiency of firewall rules for server clusters in related technologies can be realized.
  • a configuration server for configuring firewall rules periodically establishes a connection with an application server in a preset list, and receives a rule update request sent by the application server.
  • the rule update request carries the The current version number of the firewall rule of the application server, and then in response to the received rule update request, when the current version number is inconsistent with the specified version number, the rule data of the firewall rule corresponding to the specified version number is sent to the application server.
  • the rule data Used to instruct the application server to update the firewall rules to the firewall rules corresponding to the specified version number, so as to realize the regular connection with the application server, and confirm the update of the firewall rules during each connection with the application server.
  • Update the firewall rules of the application server complete the automatic update of the firewall rules of the application server, and ensure the timeliness of the firewall rules.
  • FIG. 4 shows a schematic flowchart of a method for updating firewall rules according to another embodiment of the present application.
  • the method for updating firewall rules can be applied to the above-mentioned server. The following will describe the process shown in FIG. 4 in detail.
  • the method for updating firewall rules may specifically include the following steps:
  • Step S210 Receive the firewall rule with the specified version number sent by the client, and store the firewall rule with the specified version number.
  • the configuration server may receive in advance the firewall rule with the specified version number sent by the client, and store the firewall rule with the specified version number.
  • the firewall rule with the specified version number can be used as the latest firewall rule, or as the firewall rule that the application server needs to update to.
  • the configuration server may pre-receive the firewall rule of the specified version number sent by the client, and store the firewall rule of the specified version number, which may include: receiving a firewall rule editing request sent by the client; In response to the edit request, the content data of the configuration item corresponding to the currently stored firewall rule is sent to the client, where the content data is used by the client to generate the specified content data according to the selection operation of the content data of the configuration item Firewall rules of the version number.
  • the configuration server can store the content data of the configuration items corresponding to the firewall rules, and the configuration server can deliver the content data of these configuration items to the client, and the client can transfer the content of the received configuration items.
  • the data is displayed in the interface.
  • the objects of the firewall rule can be divided into object groups and server groups.
  • the object group can consist of at least one object, and the object includes two attributes of name and IP address;
  • the service group can consist of at least one group of services, and the service includes four attributes of name, protocol, source port, and destination port.
  • the configuration items corresponding to the object group may include the name and IP address;
  • the configuration items corresponding to the service group include the name and protocol; or, at least one of the source port and the destination port and the name and protocol.
  • the client can display a rule configuration page for the user to select the source address, destination address, and service group. Among them, the source address and destination address are selected from the object group, and the service is selected from the service group.
  • the server After the server receives the selection operation sent by the client, it can generate a new firewall rule according to the content data of the selected configuration item, and Set the new firewall rule to the firewall rule of the specified version number.
  • the configuration server can be realized by the web front end for users to select configuration items in the interface to complete the configuration of firewall rules.
  • Step S220 Receive the list data sent by the client, and the list data is generated by the client according to the editing operation of the application server to be controlled by the firewall rule.
  • the configuration server may also receive the list data sent by the client in advance to generate a preset list.
  • the list data can be generated for the client's editing operation of the application server to be controlled by the firewall rules, that is to say, when the firewall rules of the application server need to be updated, the application server can be set through the web front end.
  • These application servers will be set in the preset list, so that the subsequent automatic update of the firewall rules of these application servers can be completed.
  • step S210 may be before step S220, and step S220 may also be before step S210.
  • Step S230 Generate the preset list according to the list data, and store the preset list.
  • the configuration server may generate a preset list based on the list data, and the generated preset list may be stored locally on the configuration server, for example, in a hard disk.
  • the preset list may include the IP address, physical address, etc. of the application server.
  • the preset list may also be determined by the configuration server according to the firewall rules of the specified version number after obtaining the firewall rules of the specified version number.
  • each firewall rule can correspond to different services, and different application servers implement different services. Therefore, the configuration server can determine the application server corresponding to the service according to the service corresponding to the firewall rule of the specified version number. The server in the preset list. In this way, the user only needs to reconfigure the firewall rules, and the subsequent configuration server can automatically generate the preset list, making the update of the firewall rules more intelligent, and effectively saving the user's operating time.
  • Step S240 Receive a connection request periodically sent by the application server.
  • each application server may periodically send a connection request to the configuration server.
  • each application server may include an application server that needs to update the firewall rules this time, and may also include an application server that does not need to update the firewall rules this time.
  • These servers can all be set to periodically send connection requests to the application server, where the specific period for sending the connection request may not be limited, for example, a connection request is sent every 5 minutes.
  • Step S250 If the application server is in the preset list, respond to the connection request and establish a connection with the application server.
  • the configuration server can determine whether the application server is in pre-emptive mode. In the set list, if the application server is in the preset list, it means that the application server that sent the connection request is the application server that needs to update the firewall rules, so it can respond to the connection request and establish a connection with the application server. If the application server is not in the preset list, the configuration server may not respond to the connection request, so as to avoid mistakenly updating the firewall rules of the application server and avoid occupying the resources of the configuration server.
  • the method for updating the firewall rule may further include: obtaining the last update time of the firewall rule of the application server; obtaining the time period between the current time and the update time; if the time period is greater than The first preset duration is to establish a connection with the application server. It is understandable that some application servers may be in the preset list for a long time, and will repeatedly send connection requests to the application server, and these application servers may have been updated to the specified version of the firewall rules. If the configuration server still continues to respond to these applications The connection request of the server will result in a waste of resources.
  • the configuration server can determine whether the time period is greater than the first preset time period based on the time between the current time and the last update time of the firewall rule of the application server. If the time period is greater than the first time period, A connection is established with the application server only after a preset period of time.
  • the specific value of the first preset duration may not be regarded as a limitation.
  • the method for updating the firewall rule may further include: obtaining the editing time of the firewall rule of the specified version number in the application server; obtaining the preset list If the interval between the editing time and the generating time is less than the second preset time period, a connection is established with the application server. It is also understandable that some application servers may be in the preset list for a long time and will repeatedly send connection requests to the application server. These application servers may have been updated to the specified version of the firewall rules. If the configuration server still continues to respond The connection requests of these application servers will result in a waste of resources.
  • the configuration server determines the interval between the generation time of the preset list and the editing time of the firewall rule of the specified version number (the time when the firewall rule is obtained) Whether the interval duration is greater than the second preset duration, and if the interval duration is greater than the second preset duration, the connection with the application server is established.
  • the specific value of the second preset duration may not be regarded as a limitation.
  • Step S260 Receive a rule update request sent by the application server, where the rule update request carries the current version number of the firewall rule of the application server.
  • Step S270 In response to the rule update request, when the current version number is inconsistent with the designated version number, send the rule data of the firewall rule corresponding to the designated version number to the application server, and the rule data is used for all The application server updates the firewall rule to the firewall rule corresponding to the specified version number.
  • step S260 and step S270 can refer to the content of the foregoing embodiment, and will not be repeated here.
  • Step S280 After the rule update requests sent by the application server in the preset list are all responded to, the updated list data sent by the client is received.
  • the client can also respond to the rule update requests sent by the application servers in the preset list, that is, after completing the update detection and update operations for the firewall rules of these application servers, it can also According to the user's operation, the list data updated to the configuration server, that is, other application servers that need to update the firewall rules.
  • Step S290 Update the preset list according to the updated list data.
  • the configuration server can update the preset list after receiving the above updated list data, so that the configuration server can subsequently complete the update of the firewall rules of the newly added application server in the preset list .
  • the configuration server can interact with the client in advance to complete the acquisition of the firewall rules of the specified version number and the acquisition of the preset list, so as to realize the user's firewall rules and the firewall rules to be updated
  • the setting of the application server meets the needs of users.
  • the firewall rules are updated during each connection with the application server, and the firewall rules of the application server are updated when the update is required, and the automatic update of the firewall rules of the application server is completed. , To ensure the timeliness of firewall rules.
  • FIG. 5 shows a schematic flowchart of a method for updating firewall rules according to another embodiment of the present application.
  • the method for updating firewall rules can be applied to the above-mentioned server. The following will describe the process shown in FIG. 5 in detail.
  • the method for updating firewall rules may specifically include the following steps:
  • Step S310 Obtain application servers in the first preset server cluster.
  • the configuration server may also actively configure the preset list.
  • the configuration server may store multiple server clusters in advance.
  • the configuration server may obtain the first preset server cluster among the multiple server clusters, and obtain the first preset server cluster.
  • Set the application servers in the server cluster that is, obtain information such as the IP addresses of these application servers to add these application servers to the preset list.
  • the first preset server cluster may be any server cluster among multiple server clusters; the first preset server cluster may also be a server cluster selected from a plurality of servers in accordance with the order of update of the configuration server, where different The sequence of server clusters is different.
  • the order can also be established from highest to lowest priority corresponding to the server cluster, and the priority can be established according to the importance of the server cluster, or can be established according to the user's setting.
  • the configuration server may execute the step of obtaining the application server in the first preset server cluster when obtaining the firewall rule of the specified version number.
  • the configuration server obtains the firewall rule of the specified version number, it indicates that the firewall rule update process is required. Therefore, the step of obtaining the application server in the first preset server cluster can be automatically executed to complete the firewall rule. Automatic updates.
  • Step S320 Add the application server in the first preset server cluster to the preset list.
  • the configuration server after the configuration server obtains the application server in the first preset server cluster, it can add the application server in the first preset server cluster to the preset list, so as to subsequently complete the first preset server cluster.
  • the firewall rules of the application servers in the server cluster are updated.
  • Step S330 periodically establish a connection with the application server in the preset list.
  • Step S340 Receive a rule update request sent by the application server, where the rule update request carries the current version number of the firewall rule of the application server.
  • Step S350 In response to the rule update request, when the current version number is inconsistent with the designated version number, the rule data of the firewall rule corresponding to the designated version number is sent to the application server, and the rule data is used for all The application server updates the firewall rule to the firewall rule corresponding to the specified version number.
  • steps S330 to S350 can refer to the content of the foregoing embodiment.
  • Step S360 After the rule update requests sent by the application servers in the preset list are all responded to, the application servers in the preset list are updated to the application servers in the second preset server cluster.
  • the configuration server can obtain The application servers in the second preset server cluster, and the application servers in the second preset server cluster are added to the preset list, so as to implement subsequent updates to the firewall rules of the application servers in the second preset server cluster.
  • the firewall rules of the application servers in the next server cluster are updated until all the requirements are completed.
  • the firewall rules of the application servers in the updated server cluster are updated. In this way, the firewall rules of the application servers in multiple server clusters can be updated, and the firewall rules of all application servers can be automatically updated.
  • the configuration server may also perform a grayscale test on the update process before performing the entire process of the firewall rule update method.
  • the firewall rule update method It may also include: setting an application server in the preset list as a designated server, where the designated server includes at least one application server; periodically establishing a connection with the designated server in the preset list; receiving the designated server The sent rule update request, the rule update request carries the current version number of the firewall rule of the application server; in response to the rule update request, if the current version number is inconsistent with the gray version number, the The rule data of the firewall rule corresponding to the gray version number is sent to the application server, and the rule data is used by the application server to update the firewall rule to the firewall rule corresponding to the gray version number, and the gray version number It is the version number of the firewall rule used in the grayscale test.
  • the gray-scale test process of the update process can be consistent with the actual update process.
  • the tester can determine whether the entire update process is normal by updating the firewall rules of the designated server to the firewall rules corresponding to the gray-scale version number. So as to complete the gray-scale test of the update process. Through the gray-scale test, it can effectively ensure that the subsequent process of updating the firewall rules for multiple application servers can proceed smoothly.
  • the configuration server when it is necessary to update the firewall rules of the application servers of multiple server clusters, automatically adds each server to the preset list in turn, so as to realize the control of multiple servers.
  • the automatic update of firewall rules of application servers in the cluster effectively saves manual operation time and improves the efficiency of updating firewall rules.
  • FIG. 6 shows a schematic flowchart of a method for updating firewall rules according to another embodiment of the present application.
  • the method for updating firewall rules can be applied to the application server in the above-mentioned application scenario.
  • the process shown in FIG. 6 will be described in detail below.
  • the method for updating firewall rules may specifically include the following steps:
  • Step S410 Periodically send a connection request to the configuration server, the connection request is used to establish a connection with the configuration server, and the configuration server is used to configure firewall rules.
  • the application server may be an Nginx server, etc., and WAF may be configured in the application server.
  • An http heartbeat connection can be maintained between WAF and the configuration server for WAF rule update operations.
  • WAF provides an asynchronous event mechanism through Nginx to establish an http heartbeat connection with the configuration service, and periodically sends connection requests and receives data.
  • the WAF module initializes, adds a timer, and establishes a TCP connection with the configuration server at regular intervals.
  • Step S420 After establishing the connection with the configuration server, send a rule update request to the configuration server, and the rule update request carries the current version number of the firewall rule of the application server.
  • Nginx's asynchronous event framework mainly provides two types of events: read and write.
  • Read events correspond to the success or failure of connection establishment events in TCP and receive data packets from the other party; write events correspond to empty kernel buffers, and messages can be sent.
  • WAF and the configuration service After WAF and the configuration service successfully establish a TCP connection, organize the current WAF rule version number and other relevant information into an http message, call the asynchronous write function to send it, complete the rule update request, and wait for the callback function to trigger the write event. If the rule update request is sent successfully, add the read event to the monitoring list in the callback function and wait for the read event to be triggered.
  • Step S430 Receive the rule data of the firewall rule corresponding to the specified version number sent by the configuration server, the rule data being sent by the configuration server when it determines that the current version number is inconsistent with the specified version number.
  • the callback function of the read event will be triggered, then the asynchronous read function can be called in the callback function to read the data received by the kernel buffer, and it is parsed according to the http protocol. If the parsing is not completed, the read event will continue to be added to the monitoring list, waiting for the triggering of the read event, and so on until the parsing is completed.
  • the application server can determine whether the firewall rules have been updated according to the content obtained by the analysis, and if there are updates, perform the update operation. Specifically, after successfully parsing the http message, the body part of the http message is parsed according to the json format to determine whether there is a rule update.
  • Step S440 According to the rule data, update the firewall rule to the firewall rule corresponding to the specified version number.
  • the application server can parse the rule data according to the received rule data, and determine whether the current version number is consistent with the specified version number. If the current version number is inconsistent with the specified version number, it means that firewall rules need to be implemented. Update, so update the firewall rule to the firewall rule corresponding to the specified version number; if the current version number is consistent with the specified version number, it means that the firewall rule does not need to be updated, so the update operation is not performed, and the version of the firewall rule is rolled back to The version corresponding to the current version number is to maintain the firewall rules of the version corresponding to the current version number.
  • the version of the firewall rule can also be rolled back to the version corresponding to the current version number, that is, the firewall rule of the version corresponding to the current version number is maintained.
  • the application server may disconnect from the configuration server in order to restart. Perform timing, and then send a rule update request to the configuration server again after the period of the interval is set, and the occupation of resources of the configuration server can be avoided.
  • the application server can also disconnect from the configuration server to avoid occupation of the resources of the configuration server. After the connection with the configuration server is disconnected, the application server repeats the step of periodically sending a connection request to the configuration server after an interval of a preset period of time, that is, the next connection is completed.
  • the application server periodically sends a connection request to the configuration server to establish a connection with the configuration server regularly, and sends a rule update request to the configuration server after each connection is established with the configuration server.
  • FIG. 7 shows a structural block diagram of a firewall rule updating apparatus 400 provided by an embodiment of the present application.
  • the device 400 for updating firewall rules applies the configuration server described above, and the configuration server is used to configure firewall rules.
  • the device 400 for updating firewall rules includes: a connection establishment module 410, a request receiving module 420, and a request response module 430.
  • connection establishment module 410 is configured to periodically establish a connection with the application server in the preset list;
  • the request receiving module 420 is configured to receive a rule update request sent by the application server, and the rule update request carries The current version number of the firewall rule of the application server;
  • the request response module 430 is used to respond to the rule update request, and when the current version number is inconsistent with the specified version number, the firewall rule corresponding to the specified version number
  • the rule data is sent to the application server, and the rule data is used by the application server to update the firewall rule to the firewall rule corresponding to the specified version number.
  • connection establishment module 410 may include: a connection request receiving unit and a connection request responding unit.
  • the connection request receiving unit is configured to receive connection requests periodically sent by the application server;
  • the connection request response unit is configured to respond to the connection request and establish a connection with the application server if the application server is in the preset list.
  • the connection request response unit may include: a first time obtaining subunit, a duration obtaining subunit, and a first connection subunit.
  • the first time obtaining subunit is used to obtain the last update time of the firewall rule of the application server;
  • the duration obtaining subunit is used to obtain the length of time between the current time and the update time;
  • the first connection subunit is used to obtain If the duration is greater than the first preset duration, a connection is established with the application server.
  • connection request response unit may also include: a second time obtaining subunit, a third time obtaining subunit, and a second connection subunit.
  • the second time obtaining subunit is used to obtain the editing time of the firewall rule of the specified version number in the application server;
  • the third time obtaining subunit is used to obtain the generation time of the preset list;
  • the second connecting subunit The unit is configured to establish a connection with the application server if the interval duration between the editing time and the generating time is less than a second preset duration.
  • the device 400 for updating firewall rules may further include a list data receiving module and a list generating module.
  • the list data receiving module is configured to receive the list data sent by the client before comparing the current version number with the gray version number in the response to the rule update request, if the application server is in the preset list,
  • the list data is generated by the client according to the editing operation of the application server to be controlled by firewall rules;
  • the list generation module is used to generate the preset list according to the list data, and store the preset list .
  • the list data receiving module is further configured to receive the updated list data sent by the client after completing the response to the rule update requests sent by the application server in the preset list; the list generating module It is also used to update the preset list according to the updated list data.
  • the device 400 for updating firewall rules may further include: a cluster acquisition module and a server addition module.
  • the cluster acquisition module is configured to, in response to the rule update request, if the application server is in the preset list, before comparing the current version number with the gray-scale version number, acquire the information in the first preset server cluster Application server; the server adding module is used to add the application server in the first preset server cluster to the preset list.
  • the cluster acquisition module may be specifically configured to execute the step of acquiring the application server in the first preset server cluster when the firewall rule of the specified version number is acquired.
  • the server adding module is further configured to update the application server in the preset list to the second preset server after responding to the rule update requests sent by the application servers in the preset list.
  • Application server in the cluster is further configured to update the application server in the preset list to the second preset server after responding to the rule update requests sent by the application servers in the preset list.
  • the device 400 for updating firewall rules may further include a rule receiving module.
  • the rule receiving module is configured to receive the firewall rule with the specified version number sent by the client before the regular connection with the application server in the preset list is established, and store the firewall rule with the specified version number.
  • the device 400 for updating firewall rules may further include: an editing request receiving module and an editing request responding module.
  • the edit request receiving module is configured to receive the firewall rule of the specified version number sent by the client, and before storing the firewall rule of the specified version number, receive the edit request of the firewall rule sent by the client;
  • the request response module is used to respond to the edit request and send the content data of the configuration item corresponding to the currently stored firewall rule to the client.
  • the content data is used by the client according to the content data of the configuration item. Select the operation to generate the firewall rule of the specified version number.
  • the device 400 for updating firewall rules may further include a gray-scale test module.
  • the gray test module is used to: set the application server in the preset list as a designated server, where the designated server includes at least one application server; periodically establish a connection with the designated server in the preset list;
  • the rule update request sent by the designated server, the rule update request carries the current version number of the firewall rule of the application server; in response to the rule update request, if the current version number is inconsistent with the gray version number,
  • the rule data of the firewall rule corresponding to the gray-scale version number is sent to the application server, and the rule data is used by the application server to update the firewall rule to the firewall rule corresponding to the gray-scale version number.
  • the degree version number is the version number of the firewall rule used in the gray-scale test.
  • FIG. 8 shows a structural block diagram of an apparatus 500 for updating firewall rules according to another embodiment of the present application.
  • the device 500 for updating firewall rules applies the above-mentioned application server.
  • the device 500 for updating firewall rules includes: a first request sending module 510, a second request sending module 520, a data receiving module 530, and a rule updating module 540.
  • the first request sending module 510 is used to periodically send a connection request to the configuration server, the connection request is used to establish a connection with the configuration server, and the configuration server is used to configure firewall rules;
  • the second request sending module 520 is configured to send a rule update request to the configuration server after the connection with the configuration server is established, and the rule update request carries the current version number of the firewall rule of the application server;
  • the data receiving module 530 is configured to receive the rule data of the firewall rule corresponding to the specified version number sent by the configuration server, and the rule data is sent by the configuration server when it determines that the current version number is inconsistent with the specified version number ;
  • the rule update module 540 is configured to update the firewall rule to the firewall rule corresponding to the specified version number according to the rule data.
  • the rule update module 540 may include: a version number comparison module and an update execution module.
  • the version number comparison module is used to determine whether the current version number is consistent with the specified version number according to the rule data; the update execution module is used to update the firewall rule if the current version number is inconsistent with the specified version number Is the firewall rule corresponding to the specified version number.
  • the device 500 for updating firewall rules may further include a disconnection module.
  • the connection disconnection module is configured to disconnect the connection with the configuration server when the rule data returned by the configuration server is not received within a third preset time period after the rule update request is sent to the configuration server.
  • the connection disconnection module is further configured to disconnect the connection with the configuration server after the firewall rule is updated to the firewall rule corresponding to the specified version number.
  • the first request sending module 510 is further configured to perform the step of periodically sending a connection request to the configuration server again after the connection with the configuration server is disconnected and after an interval of a preset period of time.
  • the coupling between the modules may be electrical, mechanical or other forms of coupling.
  • the functional modules in the various embodiments of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules.
  • the solution provided by this application regularly establishes a connection with the application server in the preset list through the configuration server used to configure firewall rules, and receives the rule update request sent by the application server.
  • the rule update request carries the application The current version number of the firewall rule of the server, and then respond to the received rule update request.
  • the rule data of the firewall rule corresponding to the specified version number is sent to the application server, and the rule data is used To instruct the application server to update the firewall rules to the firewall rules corresponding to the specified version number, so as to realize the periodic connection with the application server, and confirm the update of the firewall rules during each connection with the application server.
  • the firewall rules of the application server are updated to complete the automatic update of the firewall rules of the application server, ensuring the timeliness of the firewall rules.
  • FIG. 9 shows a structural block diagram of a server provided by an embodiment of the present application.
  • the server 100 may be the aforementioned configuration server or application server.
  • the server 100 in this application may include one or more of the following components: a processor 110, a memory 120, a touch screen 130, and one or more application programs, where one or more application programs may be stored in the memory 120 and configured as Executed by one or more processors 110, one or more programs are configured to execute the methods described in the foregoing method embodiments.
  • the processor 110 may include one or more processing cores.
  • the processor 110 uses various interfaces and lines to connect various parts of the entire server 100, and executes the server by running or executing instructions, programs, code sets, or instruction sets stored in the memory 120, and calling data stored in the memory 120. 100's various functions and processing data.
  • the processor 110 may adopt at least one of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA).
  • DSP Digital Signal Processing
  • FPGA Field-Programmable Gate Array
  • PDA Programmable Logic Array
  • the processor 110 may be integrated with one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a modem, and the like.
  • the CPU mainly processes the operating system, user interface, and application programs; the GPU is used for rendering and drawing of display content; the modem is used for processing wireless communication. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented by a communication chip alone.
  • the memory 120 may include random access memory (RAM) or read-only memory (Read-Only Memory).
  • the memory 120 may be used to store instructions, programs, codes, code sets or instruction sets.
  • the memory 120 may include a program storage area and a data storage area, where the program storage area may store instructions for implementing the operating system and instructions for implementing at least one function (such as touch function, sound playback function, image playback function, etc.) , Instructions used to implement the following various method embodiments, etc.
  • the storage data area can also store data (such as phone book, audio and video data, chat record data) created by the server 100 during use.
  • FIG. 10 shows a structural block diagram of a computer-readable storage medium provided by an embodiment of the present application.
  • the computer-readable medium 800 stores program code, and the program code can be invoked by a processor to execute the method described in the foregoing method embodiment.
  • the computer-readable storage medium 800 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM.
  • the computer-readable storage medium 800 includes a non-transitory computer-readable storage medium.
  • the computer-readable storage medium 800 has storage space for the program code 810 for executing any method steps in the above-mentioned methods. These program codes can be read from or written into one or more computer program products.
  • the program code 810 may be compressed in a suitable form, for example.

Abstract

本申请公开了一种防火墙规则的更新方法、装置、服务器及存储介质，该防火墙规则的更新方法应用于配置服务器，该防火墙规则的更新方法包括：定期与预设名单中的应用服务器建立连接；接收所述应用服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；响应所述规则更新请求，在所述当前版本号与指定版本号不一致时，将所述指定版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述指定版本号对应的防火墙规则。本方法可以实现自动对应用服务器的防火墙规则进行实时的更新，有效保证了应用服务器的安全。

Description

防火墙规则的更新方法、装置、服务器及存储介质 技术领域
本申请涉及互联网技术领域，更具体地，涉及一种防火墙规则的更新方法、装置、服务器及存储介质。
背景技术
随着互联网的快速发展，互联网技术遍布于人们生活中的各个方面，而网络安全是互联网技术中的重点研究方向。其中，防火墙技术是保证网络安全的重要手段之一，防火墙技术的功能主要在于及时发现并处理计算机网络运行时可能存在的安全风险、数据传输等问题。在防火墙技术中，主要利用预先设置的防火墙规则对外部请求进行过滤，而防火墙规则的更新是防火墙能够有效避免安全风险的关键。
发明内容
鉴于上述问题，本申请提出了一种防火墙规则的更新方法、装置、服务器及存储介质。
第一方面，本申请实施例提供了一种防火墙规则的更新方法，应用于配置服务器，所述配置服务器用于进行防火墙规则的配置，所述方法包括：定期与预设名单中的应用服务器建立连接；接收所述应用服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；响应所述规则更新请求，在所述当前版本号与指定版本号不一致时，将所述指定版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述指定版本号对应的防火墙规则。
第二方面，本申请实施例提供了一种防火墙规则的更新方法，应用于应用服务器，所述方法包括：定期向配置服务器发送连接请求，所述连接请求用于与所述配置服务器建立连接，所述配置服务器用于进行防火墙规则的配置；在建立与所述配置服务器的连接之后，向所述配置服务器发送规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；接收所述配置服务器发送的指定版本号对应的防火墙规则的规则数据，所述规则数据由所述配置服务器在确定出所述当前版本号与所述指定版本号不一致时发送；根据所述规则数据，将防火墙规则更新为所述指定版本号对应的防火墙规则。
第三方面，本申请实施例提供了一种防火墙规则的更新装置，应用于配置服务器，所述配置服务器用于进行防火墙规则的配置，所述装置包括：连接建立模块、请求接收模块以及请求响应模块，其中，所述连接建立模块用于定期与预设名单中的应用服务器建立连接；所述请求接收模块用于接收所述应用服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；所述请求响应模块用于响应所述规则更新请求，在所述当前版本号与指定版本号不一致时，将所述指定版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述指定版本号对应的防火墙规则。
第四方面，本申请实施例提供了一种防火墙规则的更新装置，应用于应用服务器，所述装置包括：第一请求发送模块、第二请求发送模块、数据接收模块以及规则更新模块，其中，所述第一请求发送模块用于定期向配置服务器发送连接请求，所述连接请求用于与所述配置服务器建立连接，所述配置服务器用于进行防火墙规则的配置； 所述第二请求发送模块用于在建立与所述配置服务器的连接之后，向所述配置服务器发送规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；所述数据接收模块用于接收所述配置服务器发送的指定版本号对应的防火墙规则的规则数据，所述规则数据由所述配置服务器在确定出所述当前版本号与所述指定版本号不一致时发送；所述规则更新模块用于根据所述规则数据，将防火墙规则更新为所述指定版本号对应的防火墙规则。
第五方面，本申请实施例提供了一种服务器，包括：一个或多个处理器；存储器；一个或多个应用程序，其中所述一个或多个应用程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序配置用于执行上述第一方面提供的防火墙规则的更新方法。
第六方面，本申请实施例提供了一种服务器，包括：一个或多个处理器；存储器；一个或多个应用程序，其中所述一个或多个应用程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序配置用于执行上述第二方面提供的防火墙规则的更新方法。
第七方面，本申请实施例提供了一种计算机可读取存储介质，所述计算机可读取存储介质中存储有程序代码，所述程序代码可被处理器调用执行上述第一方面提供的防火墙规则的更新方法、或者第二方面提供的防火墙规则的更新方法。
本申请提供的方案，通过用于配置防火墙规则的配置服务器定期与预设名单中的应用服务器建立连接，接收应用服务器发送的规则更新请求，该规则更新请求中携带有该应用服务器的防火墙规则的当前版本号，然后响应接收到的规则更新请求，在该当前版本号与指定版本号不一致时，将指定版本号对应的防火墙规则的规则数据发送至应用服务器，该规则数据用于指示应用服务器将防火墙规则更新为该指定版本号对应的防火墙规则，从而实现通过定期的与应用服务器连接，在每次与应用服务器连接的过程中进行防火墙规则的更新确认，需要进行更新时对应用服务器的防火墙规则进行更新，完成对应用服务器的防火墙规则的自动更新，保证了防火墙规则的时效性。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出了本申请实施例提供的传统的防火墙规则的更新原理示意图。
图2示出了本申请实施例提供的应用场景的示意图。
图3示出了根据本申请一个实施例的防火墙规则的更新方法流程图。
图4示出了根据本申请另一个实施例的防火墙规则的更新方法流程图。
图5示出了根据本申请又一个实施例的防火墙规则的更新方法流程图。
图6示出了根据本申请再一个实施例的防火墙规则的更新方法流程图。
图7示出了根据本申请一个实施例的防火墙规则的更新装置的一种框图。
图8示出了根据本申请另一个实施例的防火墙规则的更新装置的一种框图。
图9是本申请实施例的用于执行根据本申请实施例的防火墙规则的更新方法的服务器的框图。
图10是本申请实施例的用于保存或者携带实现根据本申请实施例的防火墙规则的更新方法的程序代码的存储单元。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
目前，Web应用防火墙技术主要通过Web应用防火墙(Web Application Firewall，WAF)实现，WAF代表了一类新兴的信息安全技术，用以解决Web应用的安全问题。
WAF对来自Web应用程序客户端的各类请求进行内容检测和验证，确保其安全性与合法性，对非法的请求予以实时阻断，为web应用提供安全防护。WAF分为硬件WAF、软件WAF、代码级WAF等。目前软件WAF逐渐替代传统的成本较高的硬件WAF，而软件WAF主要实现形式是基于Nginx(一种开源的高性能http反向代理的web服务器)的一个嵌入式模块，因为Nginx作为后端服务的主要流量统一入口，在Nginx端可以对所有的http(超文本传输协议，HyperText Transfer Protocol)请求进行安全检查和审计。
WAF处理http分为四个阶段：请求头部，请求内容，响应头部，响应内容。WAF规则就是定义在某个阶段WAF对符合某种条件的http请求执行指定动作的条例。WAF规则包含四个元素：过滤条件，阶段，动作。WAF规则有多种实现形式，如jxWAF(一款基于openrestry开发的web应用防火墙)和openWAF(全方位开源的web防护系统)用json(一种轻量级的数据交换格式，JavaScript Object Notation)格式实现，loveshell用正则形式实现，naxsi用基于Nginx的conf配置实现。WAF根据攻击http请求的特征来制定规则，从而进行拦截或审计。当http请求中的统一资源标识符(URI，Uniform Resource Identifier)匹配到了正则项中的内容时，WAF就根据规则中的动作来执行指定的动作，如LOG表示只记录，而BLOCK表示拦截，拦截掉的http请求就不会到达后端业务，从而保护后端业务不受影响。
在相关技术中，WAF的实现原理如下：http流量到达Nginx端，经过http引擎进行处理和解析，http引擎能过滤掉一些不符合http规范的异常报文，对于攻击报文则无手段。WAF模块在Nginx中挂入钩子处理函数，处理所有的http请求。WAF循环遍历所有规则，利用正则引擎匹配http请求中URI、headers(请求头)、body(请求体)等，如果匹配中，就会给请求方返回一个拦截页面表示这是一个攻击请求。如果都没有匹配中，则放行该次请求，该请求就会达到后端服务。
另外，在相关技术中，运行于服务器中的WAF主要是利用预先制定好的防火墙规则对外部请求进行过滤来实现防御保护，预先制定好的防火墙规则大多都是以文件的形式存放在服务器本地。通常攻击者会采用一定手段来绕过WAF规则来达到攻击目的，在与攻击者对抗中需要及时更新WAF规则来应对突如其来的攻击。请参阅图1，图1示出了传统技术中WAF规则的更新过程，其中，修改规则文件之后，应用服务器(Nginx)进行reload(重新加载)操作，如果在高并发流量情况下可能会导致一些异常情况如TCP(传输控制协议，Transmission Control Protocol)连接中断，而且这些操作都需要人工操作。
发明人经过长期的研究发现，在大型企业中，有多个互联网数据中心(IDC，Internet Data Center)，每一个IDC都有多个Nginx集群，每一台装有Nginx机器都嵌入WAF模块，那么更新一次规则就需要更新所有Nginx机器中的WAF规则，这样效率很低，人为拷贝新防火墙规则通常具有滞后性，也就是上述防火墙规则更新方式的实时性差，尤其是当今攻击手段具有多样性、多变性特点的情况下，应用上述方式进行防火墙规则更新实时性差这一缺点更加突出，灰度过程缓慢，无法对抗0day攻击。
针对上述问题，发明人提出了本申请实施例提供的防火墙规则的更新方法、装置、服务器以及存储介质，通过定期的与应用服务器连接，在每次与应用服务器连接的过程中进行防火墙规则的更新确认，需要进行更新时对应用服务器的防火墙规则进行更新，完成对应用服务器的防火墙规则的自动更新，保证了防火墙规则的时效性。其中，具体的防火墙规则的更新方法在后续的实施例中进行详细的说明。
下面对本申请实施例提供的防火墙规则的更新方法的应用场景进行介绍。请参阅图2，图2示出了本申请实施例提供的一种应用场景示意图，该应用场景包括配置服务 器101以及应用服务器102。其中，配置服务器101用于进行防火墙规则的配置，实现对应用服务器102的防火墙规则的更新。配置服务器101可以通过与应用服务器102通过HTTP协议进行通信，以实现更新请求的传输、防火墙规则的规则数据的下发等。具体地，应用服务器102可以与配置服务器101定期建立TCP连接，以定期与配置服务器101进行交互，确认是否有防火墙规则的更新，并在有防火墙规则的更新时，进行防火墙规则的更新。
需要说明的是，配置服务器101可以与一个应用服务器102通信，也可以与多个应用服务器102通信。在配置服务器101与多个应用服务器102进行通信时，可以实现配置服务器101对多个应用服务器102的防火墙规则的配置和管控，在需要更新防火墙规则时，可以实现对多个应用服务器102的防火墙规则进行更新。配置服务器101可以为传统服务器，也可以为云服务器；应用服务器可以为web应用服务器，例如上述的Nginx服务器等。
请参阅图3，图3示出了本申请一个实施例提供的防火墙规则的更新方法的流程示意图。在具体的实施例中，所述防火墙规则的更新方法应用于如图7所示的防火墙规则的更新装置400以及配置有所述防火墙规则的更新装置400的服务器100(图9)。下面将以服务器为例，说明本实施例的具体流程，本实施例所应用的服务器可以为上述应用场景中的配置服务器，配置服务器用于进行防火墙规则的配置。当然，可以理解的，配置服务器可以传统服务器，也可以为云服务器等，在此不做限定。下面将针对图3所示的流程进行详细的阐述，所述防火墙规则的更新方法具体可以包括以下步骤：
步骤S110：定期与预设名单中的应用服务器建立连接。
在本申请实施例中，配置服务器可以定期与预设名单中的应用服务器建立连接，以实现定期检查应用服务器的防火墙规则是否需要更新，并在需要更新防火墙规则时，对应用服务器的防火墙规则进行更新，进而实现对应用服务器的防火墙规则的实时更新。
在一些实施方式中，预设名单可以为预先设置的需要对防火墙规则进行实时更新的服务器所构成的名单。也就是说，通过将需要进行实时更新防火墙规则的应用服务器设置于预设名单，从而配置服务器可以与这些应用服务器定期进行通信，进而实现防火墙规则的实时更新。其中，预设名单可以由用户进行配置，例如，通过客户端进行设置后上传至配置服务器；预设名单也可以由配置服务器自动进行生成，例如，配置服务器根据其管理的应用服务器，分批次的将应用服务器加入至预设名单。当然，预设名单的具体获取方式可以不做限定。
在一些实施方式中，配置服务器定期与预设名单中的应用服务器建立连接，可以是预设名单中的应用服务器定期向配置服务器发送连接请求(例如建立TCP连接的连接请求)，然后配置服务器响应连接请求，与发送连接请求的应用服务器建立连接。配置服务器在与应用服务器建立连接之后，在本次连接过程中，则可以实现应用服务器后续进行规则更新请求的发送，配置服务器进行数据的下发等。
步骤S120：接收所述应用服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号。
在本申请实施例中，配置服务器在每次与应用服务器建立连接之后，应用服务器可以向配置服务器发送规则更新请求，以请求配置服务器确认是否有防火墙规则的更新，并在有防火墙规则的更新时，从配置服务器获取更新的防火墙规则的规则数据。对应的，配置服务器在本次连接过程中，可以接收到应用服务器发送的规则更新请求。
在一些实施方式中，应用服务器发送的规则更新请求中可以携带有应用服务器的防火墙规则的当前版本号。其中，防火墙规则的版本号作为防火墙规则的版本标识，不同的版本号可以标识不同版本的防火墙规则，例如，V2、V3版本分别标识了第2个 版本和第3个版本。应用服务器通过在规则更新请求中携带防火墙规则的当前版本号，以使配置服务器知晓应用服务器的防火墙规则的当前版本，从而确定是否需要对该应用服务器的防火墙规则进行更新。
步骤S130：响应所述规则更新请求，在所述当前版本号与指定版本号不一致时，将所述指定版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述指定版本号对应的防火墙规则。
在本申请实施例中，配置服务器在接收到应用服务器发送的规则更新请求之后，可以对该应用服务器发送的规则更新请求进行响应，并根据规则更新请求中携带的当前版本号，确定该应用服务器的防火墙规则是否需要进行更新。具体地，配置服务器可以将当前版本号与指定版本号进行比较，以确定当前版本号是否与指定版本号是否一致，如果当前版本号与指定版本号不一致时，则可以确定该应用服务器的防火墙规则需要进行更新；如果当前版本号与指定版本号一致时，则可以确定该应用服务器的防火墙规则不需要进行更新。
在一些实施方式中，指定版本号可以为需要作为应用服务器的防火墙规则的版本的版本号。作为一种方式，在最近更新应用服务器的防火墙规则之后，配置服务器可以生成更新后的防火墙规则的版本号，并将该版本号作为指定版本号；作为另一种方式，配置服务器中可以预先存储有多个版本的防火墙规则，配置服务器可以根据用户通过客户端发送的对版本的选择操作，然后根据选择操作，将选择的版本对应的版本号作为指定版本号。
在本申请实施例中，配置服务器在比较当前版本号与指定版本号之后，如果当前版本号与指定版本号不一致时，表示该应用服务器的防火墙规则需要进行更新，因此配置服务器可以将指定版本号对应的防火墙规则的规则数据发送至该应用服务器。在一些方式中，配置服务器中可以至少存储有该指定版本号对应的防火墙规则的规则数据，配置服务器在确定出当前版本号与指定版本号不一致时，可以读取该指定版本号对应的防火墙规则的规则数据，并将该规则数据发送至该应用服务器。在另一些方式中，配置服务器中也可以存储有该指定版本号对应的防火墙规则，配置服务器在确定出当前版本号与指定版本号不一致时，可以读取该指定版本号对应的防火墙规则，然后根据该防火墙规则生成应用服务器的WAF能够识别的规则数据，再将规则数据发送至该应用服务器。
在本申请实施例中，配置服务器在将指定版本号对应的防火墙规则的规则数据发送至该应用服务器后，该应用服务器则可以根据该规则数据，将其当前的防火墙规则更新为该指定版本号对应的防火墙规则，从而可以实现对该应用服务器的防火墙规则的更新。
通过本申请实施例提供的防火墙规则的更新方法，由于可以将多个应用服务器设置于预设名单，因此如果在同时需要对多个应用服务器的防火墙规则进行更新时，将多个应用服务器设置于预设名单后，则可以实现对多个应用服务器的防火墙规则的更新，实现相关技术中针对服务器集群的防火墙规则的效率低下的问题。
本申请实施例提供的防火墙规则更新的方法，通过用于配置防火墙规则的配置服务器定期与预设名单中的应用服务器建立连接，接收应用服务器发送的规则更新请求，该规则更新请求中携带有该应用服务器的防火墙规则的当前版本号，然后响应接收到的规则更新请求，在该当前版本号与指定版本号不一致时，将指定版本号对应的防火墙规则的规则数据发送至应用服务器，该规则数据用于指示应用服务器将防火墙规则更新为该指定版本号对应的防火墙规则，从而实现通过定期的与应用服务器连接，在每次与应用服务器连接的过程中进行防火墙规则的更新确认，需要进行更新时对应用服务器的防火墙规则进行更新，完成对应用服务器的防火墙规则的自动更新，保证了防火墙规则的时效性。
请参阅图4，图4示出了本申请另一个实施例提供的防火墙规则的更新方法的流程示意图。该防火墙规则的更新方法可应用于上述服务器，下面将针对图4所示的流程进行详细的阐述，所述防火墙规则的更新方法具体可以包括以下步骤：
步骤S210：接收客户端发送的指定版本号的防火墙规则，将所述指定版本号的防火墙规则进行存储。
在本申请实施例中，配置服务器可以预先接收客户端发送的指定版本号的防火墙规则，并将该指定版本号的防火墙规则进行存储。其中，该指定版本号的防火墙规则可以作为最新的防火墙规则，或者作为应用服务器需要更新为的防火墙规则。
在一些实施方式中，配置服务器可以预先接收客户端发送的指定版本号的防火墙规则，并将该指定版本号的防火墙规则进行存储，可以包括：接收所述客户端发送的防火墙规则的编辑请求；响应所述编辑请求，向所述客户端发送当前存储的防火墙规则对应的配置项的内容数据，所述内容数据用于所述客户端根据对所述配置项的内容数据的选择操作，生成指定版本号的防火墙规则。
在该实施方式中，配置服务器中可以存储有防火墙规则对应的配置项的内容数据，并且配置服务器可以将这些配置项的内容数据下发至客户端，客户端可以将接收到的配置项的内容数据于界面中进行展示。
该实施方式中，防火墙规则的对象可以分为对象组和服务器组。其中，对象组可以由至少一个对象，对象包含名称和IP地址两个属性；服务组可以由至少一组服务，服务包含名称、协议、源端口和目的端口4个属性。对应的，对象组对应的配置项可以包括名称和IP地址；服务组对应的配置项包括名称和协议；或者，源端口和目的端口中至少一个与名称和协议。示例性地，客户端可以显示规则配置页面，供用户选择源地址、目的地址和服务组。其中，源地址和目的地址从对象组中选择，服务从服务组中选择，服务器在接收到客户端发送的选择操作之后，则可以根据选择的配置项的内容数据，生成新的防火墙规则，并将该新的防火墙规则设置为指定版本号的防火墙规则。通过以上方式，配置服务器可以实现由Web前端供用户在界面中，选择配置项，即可完成防火墙规则的配置。
步骤S220：接收客户端发送的名单数据，所述名单数据由所述客户端根据对待进行防火墙规则的管控的应用服务器的编辑操作生成。
在本申请实施例中，配置服务器还可以预先接收客户端发送的名单数据，以生成预设名单。其中，该名单数据可以为客户端对待进行防火墙规则的管控的应用服务器的编辑操作生成，也就是说，在需要对应用服务器的防火墙规则进行更新时，可以通过Web前端对应用服务器进行设置，设置的这些应用服务器会被设置于预设名单中，从而后续可以完成对这些应用服务器的防火墙规则的自动更新。
需要说明的是，指定版本号的防火墙规则的获取，与预设名单的获取之间的顺序可以不作为限定，也就是说，步骤S210可以在步骤S220之前，步骤S220也可以在步骤S210之前。
步骤S230：根据所述名单数据生成所述预设名单，并将所述预设名单进行存储。
在本申请实施例中，配置服务器在接收到名单数据之后，则可以根据名单数据生成预设名单，生成的预设名单可以存储于配置服务器的本地，例如存储于硬盘中。在一些实施方式中，预设名单中可以包括应用服务器的IP地址、物理地址等。
在一些实施方式中，预设名单也可以由配置服务器在获取到指定版本号的防火墙规则之后，根据指定版本号的防火墙规则，自行确定预设名单。作为一种方式，各个防火墙规则可以对应不同的业务，不同的应用服务器实现的业务不同，因此，配置服务器可以根据指定版本号的防火墙规则所对应的业务，确定与该业务相对应的应用服务器作为预设名单中的服务器。通过该方式，可以使用户仅需要重新配置防火墙规则，后续配置服务器即可自动生成预设名单，使防火墙规则的更新更加的智能化，有效节 省了用户的操作时间。
步骤S240：接收应用服务器定期发送的连接请求。
在本申请实施例中，各个应用服务器可以定期向配置服务器发送连接请求。其中，各个应用服务器可以包括本次需要进行防火墙规则的更新的应用服务器，也可以包括本次不需要进行防火墙规则的更新的应用服务器。这些服务器都可以被设置为定期向应用服务器发送连接请求，其中，具体发送连接请求的周期可以不作为限定，例如，每隔5分钟发一次连接请求等。
步骤S250：如果所述应用服务器处于所述预设名单中，响应所述连接请求，与所述应用服务器建立连接。
在本申请实施例中，配置服务器在接收到应用服务器发送的连接请求之后，由于可能是本次不需要进行防火墙规则的更新的应用服务器发送的连接请求，因此配置服务器可以确定应用服务器是否处于预设名单中，如果应用服务器处于预设名单中，则表示发送该连接请求的应用服务器为本次需要进行防火墙规则更新的应用服务器，因此可以响应该连接请求，与该应用服务器建立连接。而如果应用服务器不处于预设名单中，则配置服务器可以不响应所述连接请求，以避免误对该应用服务器的防火墙规则进行更新，且避免了占用配置服务器的资源。
在一些实施方式中，在配置服务器与应用服务器建立连接之前，该防火墙规则的更新方法还可以包括：获取应用服务器上一次更新防火墙规则的更新时间；获取当前时间距离更新时间的时长；如果时长大于第一预设时长，则与应用服务器建立连接。可以理解的，可能一些应用服务器会长期处于预设名单中，并且会不断重复向应用服务器发送连接请求，而这些应用服务器可能会已经更新到了指定版本的防火墙规则，如果配置服务器仍然继续响应这些应用服务器的连接请求，则会导致资源的浪费，因此配置服务器可以根据当前时间距离该应用服务器上一次更新防火墙规则的更新时间的时长，确定该时长是否大于第一预设时长，如果该时长大于第一预设时长时，才与应用服务器建立连接。其中，该第一预设时长的具体数值可以不作为限定。
在一些实施方式中，在配置服务器与应用服务器建立连接之前，该防火墙规则的更新方法还可以包括：获取所述应用服务器中所述指定版本号的防火墙规则的编辑时间；获取所述预设名单的生成时间；如果所述编辑时间与所述生成时间的间隔时长小于第二预设时长，则与所述应用服务器建立连接。同样可以理解的是，可能一些应用服务器会长期处于预设名单中，并且会不断重复向应用服务器发送连接请求，而这些应用服务器可能会已经更新到了指定版本的防火墙规则，如果配置服务器仍然继续响应这些应用服务器的连接请求，则会导致资源的浪费，因此配置服务器根据预设名单的生成时间与指定版本号的防火墙规则的编辑时间(获取到该防火墙规则的时间)之间的间隔时长，确定该间隔时长是否大于第二预设时长，如果该间隔时长大于第二预设时长时，才与该应用服务器建立连接。其中，该第二预设时长的具体数值可以不作为限定。
步骤S260：接收所述应用服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号。
步骤S270：响应所述规则更新请求，在所述当前版本号与指定版本号不一致时，将所述指定版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述指定版本号对应的防火墙规则。
在本申请实施例中，步骤S260以及步骤S270可以参阅前述实施例的内容，在此不再赘述。
步骤S280：在对所述预设名单中的应用服务器发送的规则更新请求均完成响应后，接收所述客户端发送的更新后的名单数据。
在本申请实施例中，客户端还可以在对预设名单中的应用服务器发送的规则更新 请求均完成响应后，也就是对这些应用服务器的防火墙规则均完成更新检测以及更新操作之后，还可以根据用户的操作，向配置服务器更新后的名单数据，也就是需要更新防火墙规则的其他应用服务器。
步骤S290：根据所述更新后的名单数据，对所述预设名单进行更新。
在本申请实施例中，配置服务器在接收到以上更新后的名单数据之后，则可以对预设名单进行更新，从而配置服务器后续可以完成对预设名单中新加入的应用服务器的防火墙规则的更新。
需要说明的是，本申请实施例中提供的指定版本号的防火墙规则的获取方式，以及预设名单的获取方式也可以应用于其他实施例中。
本申请实施例提供的防火墙规则的更新方法，配置服务器可以预先与客户端交互，完成对指定版本号的防火墙规则的获取，以及对预设名单的获取，实现用户对防火墙规则以及待更新防火墙规则的应用服务器的设置，满足了用户的需求。另外，通过定期的与应用服务器连接，在每次与应用服务器连接的过程中进行防火墙规则的更新确认，需要进行更新时对应用服务器的防火墙规则进行更新，完成对应用服务器的防火墙规则的自动更新，保证了防火墙规则的时效性。
请参阅图5，图5示出了本申请又一个实施例提供的防火墙规则的更新方法的流程示意图。该防火墙规则的更新方法可应用于上述服务器，下面将针对图5所示的流程进行详细的阐述，所述防火墙规则的更新方法具体可以包括以下步骤：
步骤S310：获取第一预设服务器集群中的应用服务器。
在本申请实施中，在需要对应用服务器的防火墙规则进行更新时，配置服务器也可以主动对预设名单进行配置。在一些方式中，配置服务器可以预先存储有多个服务器集群，在需要对应用服务器的防火墙规则进行更新时，配置服务器可以获取多个服务器集群中的第一预设服务器集群，并获取第一预设服务器集群中的应用服务器，即获取这些应用服务器的IP地址等信息，以将这些应用服务器添加于预设名单中。其中，第一预设服务器集群可以为多个服务器集群中的任一服务器集群；第一预设服务器集群也可以是配置服务器按照更新的先后顺序从多个服务器中选择的服务器集群，其中，不同服务器集群对应的先后顺序不同。当然，该先后顺序还可以由服务器集群对应的优先级的从高到底的顺序建立，优先级可以为根据服务器集群的重要性建立，也可以为根据用户的设置建立。
在一些实施方式中，配置服务器可以在获取到指定版本号的防火墙规则时，执行获取第一预设服务器集群中的应用服务器的步骤。也就是说，配置服务器可以在获取到指定版本号的防火墙规则时，表示需要进行防火墙规则的更新流程，因此，可以自动执行获取第一预设服务器集群中的应用服务器的步骤，以完成防火墙规则的自动更新。
步骤S320：将所述第一预设服务器集群中的应用服务器添加至预设名单。
在本申请实施例中，配置服务器在获取到第一预设服务器集群中的应用服务器之后，则可以将第一预设服务器集群中的应用服务器添加至预设名单，以便后续完成对第一预设服务器集群中的应用服务器的防火墙规则的更新。
步骤S330：定期与预设名单中的应用服务器建立连接。
步骤S340：接收所述应用服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号。
步骤S350：响应所述规则更新请求，在所述当前版本号与指定版本号不一致时，将所述指定版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述指定版本号对应的防火墙规则。
在本申请实施例中，步骤S330至步骤S350可以参阅前述实施例的内容。
步骤S360：在对所述预设名单中的应用服务器发送的规则更新请求均完成响应后， 将所述预设名单中的应用服务器更新为第二预设服务器集群中的应用服务器。
在本申请实施例中，配置服务器在预设名单中的应用服务器发送的规则更新请求均完成响应后，也就是对这些应用服务器的防火墙规则均完成更新检测以及更新操作之后，配置服务器则可以获取第二预设服务器集群中的应用服务器，并将第二预设服务器集群中的应用服务器添加至预设名单，从而实现后续对第二预设服务器集群中的应用服务器的防火墙规则的更新。通过不断的对预设名单中的应用服务器进行更新，即完成对一个服务器集群中应用服务器的防火墙规则的更新之后，再对下一服务器集群中应用服务器的防火墙规则进行更新，直至完成对所有需求更新的服务器集群中的应用服务器的器的防火墙规则的更新。从而可以实现对多个服务器集群中应用服务器的防火墙规则的更新，完成对所有应用服务器的自动更新防火墙规则。
在一些实施方式中，配置服务器还可以在进行防火墙规则的更新方法的整个流程之前，对更新流程进行灰度测试，具体地，在执行步骤S310至步骤S360的过程之前，该防火墙规则的更新方法还可以包括：将所述预设名单中的应用服务器设置为指定服务器，其中，所述指定服务器包括至少一个应用服务器；定期与所述预设名单中的指定服务器建立连接；接收所述指定服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；响应所述规则更新请求，如果所述当前版本号与灰度版本号不一致时，将所述灰度版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述灰度版本号对应的防火墙规则，所述灰度版本号为灰度测试时使用的防火墙规则的版本号。可以理解的，对更新流程进行灰度测试的流程，可以与实际的更新流程一致，测试人员可以通过对指定服务器的防火墙规则更新为灰度版本号对应的防火墙规则，确定整个更新流程是否正常，从而完成对更新流程的灰度测试。通过灰度测试，可以有效地保证后续在对多个应用服务器进行防火墙规则的更新过程能够顺利进行。
本申请实施例提供的防火墙规则的更新方法，在需要对多个服务器集群的应用服务器进行防火墙规则的更新时，配置服务器通过自动将每个服务器进去依次添加至预设名单，实现对多个服务器集群中应用服务器的防火墙规则的自动更新，有效节省了人工操作时间，提升了防火墙规则的更新效率。
请参阅图6，图6示出了本申请再一个实施例提供的防火墙规则的更新方法的流程示意图。该防火墙规则的更新方法可应用于上述应用场景中的应用服务器，下面将针对图6所示的流程进行详细的阐述，所述防火墙规则的更新方法具体可以包括以下步骤：
步骤S410：定期向配置服务器发送连接请求，所述连接请求用于与所述配置服务器建立连接，所述配置服务器用于进行防火墙规则的配置。
在本申请实施例中，应用服务器可以为Nginx服务器等，应用服务器中可以配置WAF。WAF与配置服务器之间可以保持一条http心跳连接用来进行WAF规则更新操作。其中，WAF通过Nginx提供异步事件机制与配置服务建立http心跳连接，并定期发送连接请求和接收数据。在一些实施方式中，应用服务器在启动之后，WAF模块进行初始化，添加定时器，每隔一定的时间与配置服务器建立TCP连接。
步骤S420：在建立与所述配置服务器的连接之后，向所述配置服务器发送规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号。
Nginx的异步事件框架主要提供读和写两种事件，读事件对应TCP中连接建立成功或失败事件，以及收到对方发送的数据包；写事件对应内核缓冲区为空，可以发送报文。WAF和配置服务建立TCP连接成功之后，将当前WAF规则版本号等相关信息组织成http报文，调用异步write函数发送出去，完成规则更新请求的发送，并等待触发写事件的回调函数。如果规则更新请求发送成功，在回调函数中将读事件加入监控列表等待触发读事件。
步骤S430：接收所述配置服务器发送的指定版本号对应的防火墙规则的规则数据，所述规则数据由所述配置服务器在确定出所述当前版本号与所述指定版本号不一致时发送。
在本申请实施例中，如果配置服务器有数据发送过来，将会触发读事件的回调函数，那么在回调函数中就可以调用异步read函数读取内核缓冲区接受到的数据，同时按照http协议解析报文，如果解析未完成则将读事件继续加入监控列表中，等待触发读事件，如此直至解析完成。应用服务器可以根据解析得到的内容，确定防火墙规则是否有更新，如果有更新时，则执行更新操作。具体地，解析http报文成功之后，再按照json格式解析http报文中的body(身体)部分，从而来判断是否有规则更新。
步骤S440：根据所述规则数据，将防火墙规则更新为所述指定版本号对应的防火墙规则。
在一些实施方式中，应用服务器可以根据接收到的规则数据，对规则数据进行解析后，确定当前版本号与指定版本号是否一致，如果当前版本号与指定版本号不一致，表示需要对防火墙规则进行更新，因此将防火墙规则更新为指定版本号对应的防火墙规则；如果当前版本号与指定版本号一致，表示不需要对防火墙规则进行更新，因此不执行更新操作，并将防火墙规则的版本回滚到当前版本号对应的版本，即保持当前版本号对应的版本的防火墙规则。
另外，如果对规则数据进行解析失败时，也可以将防火墙规则的版本回滚到当前版本号对应的版本，即保持当前版本号对应的版本的防火墙规则。
在一些实施方式中，应用服务器在向配置服务器发送规则更新请求之后，在第三预设时长内未接收到所述配置服务器返回的规则数据时，则可以断开与配置服务器的连接，以便重新进行计时，进而在间隔设置的周期时长后，再次向配置服务器发送规则更新请求，并且可以避免对配置服务器的资源的占用。另外，在将防火墙规则更新为指定版本号对应的防火墙规则之后，应用服务器也可以断开与配置服务器的连接，避免对配置服务器的资源的占用。在断开与配置服务器的连接之后，应用服务器在间隔预设时长后，再次执行定期向配置服务器发送连接请求的步骤，即完成下一次的连接。
本申请实施例提供的防火墙规则的更新方法，应用服务器通过定期向配置服务器发送连接请求，以实现定期与配置服务器建立连接，在每次建立与配置服务器的连接之后，向配置服务器发送规则更新请求，以从配置服务器获取指定版本号对应的防火墙规则的规则数据，然后完成将防火墙规则更新为指定版本号对应的防火墙规则，从而完成应用服务器的防火墙规则的自动更新，节省工作人员的操作时间的同时，保证了防火墙规则的时效性。
请参阅图7，其示出了本申请一个实施例提供的一种防火墙规则的更新装置400的结构框图。该防火墙规则的更新装置400应用上述的配置服务器，所述配置服务器用于进行防火墙规则的配置。该防火墙规则的更新装置400包括：连接建立模块410、请求接收模块420以及请求响应模块430。其中，所述连接建立模块410用于定期与预设名单中的应用服务器建立连接；所述请求接收模块420用于接收所述应用服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；所述请求响应模块430用于响应所述规则更新请求，在所述当前版本号与指定版本号不一致时，将所述指定版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述指定版本号对应的防火墙规则。
在一些实施方式中，连接建立模块410可以包括：连接请求接收单元以及连接请求响应单元。其中，连接请求接收单元用于接收应用服务器定期发送的连接请求；连接请求响应单元用于如果所述应用服务器处于所述预设名单中，响应所述连接请求， 与所述应用服务器建立连接。
在一些方式中，连接请求响应单元可以包括：第一时间获取子单元、时长获取子单元以及第一连接子单元。其中，第一时间获取子单元用于获取所述应用服务器上一次更新防火墙规则的更新时间；时长获取子单元用于获取当前时间距离所述更新时间的时长；第一连接子单元用于如果所述时长大于第一预设时长，则与所述应用服务器建立连接。
在另一些方式中，连接请求响应单元也可以包括：第二时间获取子单元、第三时间获取子单元以及第二连接子单元。其中，第二时间获取子单元用于获取所述应用服务器中所述指定版本号的防火墙规则的编辑时间；第三时间获取子单元用于获取所述预设名单的生成时间；第二连接子单元用于如果所述编辑时间与所述生成时间的间隔时长小于第二预设时长，则与所述应用服务器建立连接。
在一些实施方式中，该防火墙规则的更新装置400还可以包括：名单数据接收模块以及名单生成模块。名单数据接收模块用于在所述响应所述规则更新请求，如果所述应用服务器处于预设名单中，将所述当前版本号与灰度版本号进行比较之前，接收客户端发送的名单数据，所述名单数据由所述客户端根据对待进行防火墙规则的管控的应用服务器的编辑操作生成；名单生成模块用于根据所述名单数据生成所述预设名单，并将所述预设名单进行存储。
在该实施方式中，名单数据接收模块还用于在对所述预设名单中的应用服务器发送的规则更新请求均完成响应后，接收所述客户端发送的更新后的名单数据；名单生成模块还用于根据所述更新后的名单数据，对所述预设名单进行更新。
在一些实施方式中，该防火墙规则的更新装置400还可以包括：集群获取模块以及服务器添加模块。集群获取模块用于在所述响应所述规则更新请求，如果所述应用服务器处于预设名单中，将所述当前版本号与灰度版本号进行比较之前，获取第一预设服务器集群中的应用服务器；服务器添加模块用于将所述第一预设服务器集群中的应用服务器添加至预设名单。
在该实施方式中，集群获取模块可以具体用于：在获取到所述指定版本号的防火墙规则时，执行所述获取第一预设服务器集群中的应用服务器的步骤。
在该实施方式中，服务器添加模块还用于在对所述预设名单中的应用服务器发送的规则更新请求均完成响应后，将所述预设名单中的应用服务器更新为第二预设服务器集群中的应用服务器。
在一些实施方式中，该防火墙规则的更新装置400还可以包括：规则接收模块。规则接收模块用于在所述定期与预设名单中的应用服务器建立连接之前，接收客户端发送的指定版本号的防火墙规则，将所述指定版本号的防火墙规则进行存储。
在该实施方式中，该防火墙规则的更新装置400还可以包括：编辑请求接收模块以及编辑请求响应模块。其中，编辑请求接收模块用于在所述接收客户端发送的指定版本号的防火墙规则，将所述指定版本号的防火墙规则进行存储之前，接收所述客户端发送的防火墙规则的编辑请求；编辑请求响应模块用于响应所述编辑请求，向所述客户端发送当前存储的防火墙规则对应的配置项的内容数据，所述内容数据用于所述客户端根据对所述配置项的内容数据的选择操作，生成指定版本号的防火墙规则。
在该实施方式中，该防火墙规则的更新装置400还可以包括：灰度测试模块。灰度测试模块用于：将所述预设名单中的应用服务器设置为指定服务器，其中，所述指定服务器包括至少一个应用服务器；定期与所述预设名单中的指定服务器建立连接；接收所述指定服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；响应所述规则更新请求，如果所述当前版本号与灰度版本号不一致时，将所述灰度版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述灰度版本号对应的 防火墙规则，所述灰度版本号为灰度测试时使用的防火墙规则的版本号。
请参阅图8，其示出了本申请另一个实施例提供的一种防火墙规则的更新装置500的结构框图。该防火墙规则的更新装置500应用上述的应用服务器。该防火墙规则的更新装置500包括：第一请求发送模块510、第二请求发送模块520、数据接收模块530以及规则更新模块540。其中，所述第一请求发送模510块用于定期向配置服务器发送连接请求，所述连接请求用于与所述配置服务器建立连接，所述配置服务器用于进行防火墙规则的配置；所述第二请求发送模块520用于在建立与所述配置服务器的连接之后，向所述配置服务器发送规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；所述数据接收模块530用于接收所述配置服务器发送的指定版本号对应的防火墙规则的规则数据，所述规则数据由所述配置服务器在确定出所述当前版本号与所述指定版本号不一致时发送；所述规则更新模块540用于根据所述规则数据，将防火墙规则更新为所述指定版本号对应的防火墙规则。
在一些实施方式中，规则更新模块540可以包括：版本号比较模块以及更新执行模块。版本号比较模块用于根据所述规则数据，确定所述当前版本号与所述指定版本号是否一致；更新执行模块用于如果所述当前版本号与所述指定版本号不一致，将防火墙规则更新为所述指定版本号对应的防火墙规则。
在一些实施方式中，防火墙规则的更新装置500还可以包括：连接断开模块。连接断开模块用于在所述向所述配置服务器发送规则更新请求之后，在第三预设时长内未接收到所述配置服务器返回的规则数据时，断开与所述配置服务器的连接。连接断开模块还用于在所述将防火墙规则更新为所述指定版本号对应的防火墙规则之后，断开与所述配置服务器的连接。
在该实施方式中，第一请求发送模块510还用于在所述断开与所述配置服务器的连接之后，在间隔预设时长后，再次执行所述定期向配置服务器发送连接请求的步骤。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述装置和模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，模块相互之间的耦合可以是电性，机械或其它形式的耦合。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
综上所述，本申请提供的方案，通过用于配置防火墙规则的配置服务器定期与预设名单中的应用服务器建立连接，接收应用服务器发送的规则更新请求，该规则更新请求中携带有该应用服务器的防火墙规则的当前版本号，然后响应接收到的规则更新请求，在该当前版本号与指定版本号不一致时，将指定版本号对应的防火墙规则的规则数据发送至应用服务器，该规则数据用于指示应用服务器将防火墙规则更新为该指定版本号对应的防火墙规则，从而实现通过定期的与应用服务器连接，在每次与应用服务器连接的过程中进行防火墙规则的更新确认，需要进行更新时对应用服务器的防火墙规则进行更新，完成对应用服务器的防火墙规则的自动更新，保证了防火墙规则的时效性。
请参考图9，其示出了本申请实施例提供的一种服务器的结构框图。该服务器100可以是上述的配置服务器或者应用服务器。本申请中的服务器100可以包括一个或多个如下部件：处理器110、存储器120、触摸屏130以及一个或多个应用程序，其中一个或多个应用程序可以被存储在存储器120中并被配置为由一个或多个处理器110执行，一个或多个程序配置用于执行如前述方法实施例所描述的方法。
处理器110可以包括一个或者多个处理核。处理器110利用各种接口和线路连接整个服务器100内的各个部分，通过运行或执行存储在存储器120内的指令、程序、 代码集或指令集，以及调用存储在存储器120内的数据，执行服务器100的各种功能和处理数据。可选地，处理器110可以采用数字信号处理(Digital Signal Processing，DSP)、现场可编程门阵列(Field－Programmable Gate Array，FPGA)、可编程逻辑阵列(Programmable Logic Array，PLA)中的至少一种硬件形式来实现。处理器110可集成中央处理器(Central Processing Unit，CPU)、图像处理器(Graphics Processing Unit，GPU)和调制解调器等中的一种或几种的组合。其中，CPU主要处理操作系统、用户界面和应用程序等；GPU用于负责显示内容的渲染和绘制；调制解调器用于处理无线通信。可以理解的是，上述调制解调器也可以不集成到处理器110中，单独通过一块通信芯片进行实现。
存储器120可以包括随机存储器(Random Access Memory，RAM)，也可以包括只读存储器(Read-Only Memory)。存储器120可用于存储指令、程序、代码、代码集或指令集。存储器120可包括存储程序区和存储数据区，其中，存储程序区可存储用于实现操作系统的指令、用于实现至少一个功能的指令(比如触控功能、声音播放功能、图像播放功能等)、用于实现下述各个方法实施例的指令等。存储数据区还可以存储服务器100在使用中所创建的数据(比如电话本、音视频数据、聊天记录数据)等。
请参考图10，其示出了本申请实施例提供的一种计算机可读存储介质的结构框图。该计算机可读介质800中存储有程序代码，所述程序代码可被处理器调用执行上述方法实施例中所描述的方法。
计算机可读存储介质800可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。可选地，计算机可读存储介质800包括非易失性计算机可读介质(non-transitory computer-readable storage medium)。计算机可读存储介质800具有执行上述方法中的任何方法步骤的程序代码810的存储空间。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。程序代码810可以例如以适当形式进行压缩。
最后应说明的是：以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不驱使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (20)

  1. 一种防火墙规则的更新方法，其特征在于，应用于配置服务器，所述配置服务器用于进行防火墙规则的配置，所述方法包括：
    定期与预设名单中的应用服务器建立连接；
    接收所述应用服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；
    响应所述规则更新请求，在所述当前版本号与指定版本号不一致时，将所述指定版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述指定版本号对应的防火墙规则。
  2. 根据权利要求1所述的方法，其特征在于，所述定期与预设名单中的应用服务器建立连接，包括：
    接收应用服务器定期发送的连接请求；
    如果所述应用服务器处于所述预设名单中，响应所述连接请求，与所述应用服务器建立连接。
  3. 根据权利要求2所述的方法，其特征在于，在所述与所述应用服务器建立连接之前，所述方法还包括：
    获取所述应用服务器上一次更新防火墙规则的更新时间；
    获取当前时间距离所述更新时间的时长；
    如果所述时长大于第一预设时长，则与所述应用服务器建立连接。
  4. 根据权利要求2所述的方法，其特征在于，在所述与所述应用服务器建立连接之前，所述方法还包括：
    获取所述应用服务器中所述指定版本号的防火墙规则的编辑时间；
    获取所述预设名单的生成时间；
    如果所述编辑时间与所述生成时间的间隔时长小于第二预设时长，则与所述应用服务器建立连接。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，在所述响应所述规则更新请求，如果所述应用服务器处于预设名单中，将所述当前版本号与灰度版本号进行比较之前，所述方法还包括：
    接收客户端发送的名单数据，所述名单数据由所述客户端根据对待进行防火墙规则的管控的应用服务器的编辑操作生成；
    根据所述名单数据生成所述预设名单，并将所述预设名单进行存储。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    在对所述预设名单中的应用服务器发送的规则更新请求均完成响应后，接收所述客户端发送的更新后的名单数据；
    根据所述更新后的名单数据，对所述预设名单进行更新。
  7. 根据权利要求1-4任一项所述的方法，其特征在于，在所述响应所述规则更新请求，如果所述应用服务器处于预设名单中，将所述当前版本号与灰度版本号进行比较之前，所述方法还包括：
    获取第一预设服务器集群中的应用服务器；
    将所述第一预设服务器集群中的应用服务器添加至预设名单。
  8. 根据权利要求7所述的方法，其特征在于，所述获取第一预设服务器集群中的应用服务器，包括：
    在获取到所述指定版本号的防火墙规则时，执行所述获取第一预设服务器集群中 的应用服务器的步骤。
  9. 根据权利要求7或8所述的方法，其特征在于，所述方法还包括：
    在对所述预设名单中的应用服务器发送的规则更新请求均完成响应后，将所述预设名单中的应用服务器更新为第二预设服务器集群中的应用服务器。
  10. 根据权利要求1-9任一项所述的方法，其特征在于，在所述定期与预设名单中的应用服务器建立连接之前，所述方法还包括：
    接收客户端发送的指定版本号的防火墙规则，将所述指定版本号的防火墙规则进行存储。
  11. 根据权利要求10所述的方法，其特征在于，在所述接收客户端发送的指定版本号的防火墙规则，将所述指定版本号的防火墙规则进行存储之前，所述方法还包括：
    接收所述客户端发送的防火墙规则的编辑请求；
    响应所述编辑请求，向所述客户端发送当前存储的防火墙规则对应的配置项的内容数据，所述内容数据用于所述客户端根据对所述配置项的内容数据的选择操作，生成指定版本号的防火墙规则。
  12. 根据权利要求1-11任一项所述的方法，其特征在于，在所述定期与预设名单中的应用服务器建立连接之前，所述方法还包括：
    将所述预设名单中的应用服务器设置为指定服务器，其中，所述指定服务器包括至少一个应用服务器；
    定期与所述预设名单中的指定服务器建立连接；
    接收所述指定服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；
    响应所述规则更新请求，如果所述当前版本号与灰度版本号不一致时，将所述灰度版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述灰度版本号对应的防火墙规则，所述灰度版本号为灰度测试时使用的防火墙规则的版本号。
  13. 一种防火墙规则的更新方法，其特征在于，应用于应用服务器，所述方法包括：
    定期向配置服务器发送连接请求，所述连接请求用于与所述配置服务器建立连接，所述配置服务器用于进行防火墙规则的配置；
    在建立与所述配置服务器的连接之后，向所述配置服务器发送规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；
    接收所述配置服务器发送的指定版本号对应的防火墙规则的规则数据，所述规则数据由所述配置服务器在确定出所述当前版本号与所述指定版本号不一致时发送；
    根据所述规则数据，将防火墙规则更新为所述指定版本号对应的防火墙规则。
  14. 根据权利要求13所述的方法，其特征在于，所述根据所述规则数据，将防火墙规则更新为所述指定版本号对应的防火墙规则，包括：
    根据所述规则数据，确定所述当前版本号与所述指定版本号是否一致；
    如果所述当前版本号与所述指定版本号不一致，将防火墙规则更新为所述指定版本号对应的防火墙规则。
  15. 根据权利要求13或14所述的方法，其特征在于，在所述向所述配置服务器发送规则更新请求之后，所述方法还包括：
    在第三预设时长内未接收到所述配置服务器返回的规则数据时，断开与所述配置服务器的连接；
    在所述将防火墙规则更新为所述指定版本号对应的防火墙规则之后，所述方法还包括：
    断开与所述配置服务器的连接。
  16. 根据权利要求15所述的方法，其特征在于，在所述断开与所述配置服务器的连 接之后，所述方法还包括：
    在间隔预设时长后，再次执行所述定期向配置服务器发送连接请求的步骤。
  17. 一种防火墙规则的更新装置，其特征在于，应用于配置服务器，所述配置服务器用于进行防火墙规则的配置，所述装置包括：连接建立模块、请求接收模块以及请求响应模块，其中，
    所述连接建立模块用于定期与预设名单中的应用服务器建立连接；
    所述请求接收模块用于接收所述应用服务器发送的规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；
    所述请求响应模块用于响应所述规则更新请求，在所述当前版本号与指定版本号不一致时，将所述指定版本号对应的防火墙规则的规则数据发送至所述应用服务器，所述规则数据用于所述应用服务器将防火墙规则更新为所述指定版本号对应的防火墙规则。
  18. 一种防火墙规则的更新装置，其特征在于，应用于应用服务器，所述装置包括：第一请求发送模块、第二请求发送模块、数据接收模块以及规则更新模块，其中，
    所述第一请求发送模块用于定期向配置服务器发送连接请求，所述连接请求用于与所述配置服务器建立连接，所述配置服务器用于进行防火墙规则的配置；
    所述第二请求发送模块用于在建立与所述配置服务器的连接之后，向所述配置服务器发送规则更新请求，所述规则更新请求中携带有所述应用服务器的防火墙规则的当前版本号；
    所述数据接收模块用于接收所述配置服务器发送的指定版本号对应的防火墙规则的规则数据，所述规则数据由所述配置服务器在确定出所述当前版本号与所述指定版本号不一致时发送；
    所述规则更新模块用于根据所述规则数据，将防火墙规则更新为所述指定版本号对应的防火墙规则。
  19. 一种服务器，其特征在于，包括：
    一个或多个处理器；
    存储器；
    一个或多个应用程序，其中所述一个或多个应用程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序配置用于执行如权利要求1-17任一项所述的方法。
  20. 一种计算机可读取存储介质，其特征在于，所述计算机可读取存储介质中存储有程序代码，所述程序代码可被处理器调用执行如权利要求1-17任一项所述的方法。
PCT/CN2020/089561 2020-05-11 2020-05-11 防火墙规则的更新方法、装置、服务器及存储介质 WO2021226781A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080094887.9A CN115023919A (zh) 2020-05-11 2020-05-11 防火墙规则的更新方法、装置、服务器及存储介质
PCT/CN2020/089561 WO2021226781A1 (zh) 2020-05-11 2020-05-11 防火墙规则的更新方法、装置、服务器及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/089561 WO2021226781A1 (zh) 2020-05-11 2020-05-11 防火墙规则的更新方法、装置、服务器及存储介质

Publications (1)

Publication Number Publication Date
WO2021226781A1 true WO2021226781A1 (zh) 2021-11-18

Family

ID=78526057

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/089561 WO2021226781A1 (zh) 2020-05-11 2020-05-11 防火墙规则的更新方法、装置、服务器及存储介质

Country Status (2)

Country Link
CN (1) CN115023919A (zh)
WO (1) WO2021226781A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114422234A (zh) * 2022-01-17 2022-04-29 北京金山云网络技术有限公司 一种waf规则加载方法、装置、电子设备及存储介质
CN114499970A (zh) * 2021-12-27 2022-05-13 天翼云科技有限公司 一种网络安全服务配置方法、装置及电子设备
CN115346287A (zh) * 2022-07-18 2022-11-15 北京经纬恒润科技股份有限公司 信息配置方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105426748A (zh) * 2014-09-18 2016-03-23 腾讯科技（深圳）有限公司 一种规则文件的更新方法和设备
US20160149861A1 (en) * 2014-11-26 2016-05-26 Rockwell Automation Technologies, Inc. Firewall with Application Packet Classifier
CN105812326A (zh) * 2014-12-29 2016-07-27 北京网御星云信息技术有限公司 一种异构防火墙策略的集中控制方法和系统
CN106973058A (zh) * 2017-03-31 2017-07-21 北京奇艺世纪科技有限公司 一种Web应用防火墙规则更新方法、装置及系统
CN109495435A (zh) * 2017-09-13 2019-03-19 北京国双科技有限公司 服务器的防火墙更新方法和装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105592086B (zh) * 2015-12-22 2019-09-17 Tcl集团股份有限公司 一种针对Android平台管理防火墙的方法及装置
CN109660548B (zh) * 2018-12-28 2022-07-05 奇安信科技集团股份有限公司 基于全局网络拓扑结构的防火墙规则生成方法及服务器
CN110290148B (zh) * 2019-07-16 2022-05-03 深圳乐信软件技术有限公司 一种web防火墙的防御方法、装置、服务器及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105426748A (zh) * 2014-09-18 2016-03-23 腾讯科技（深圳）有限公司 一种规则文件的更新方法和设备
US20160149861A1 (en) * 2014-11-26 2016-05-26 Rockwell Automation Technologies, Inc. Firewall with Application Packet Classifier
CN105812326A (zh) * 2014-12-29 2016-07-27 北京网御星云信息技术有限公司 一种异构防火墙策略的集中控制方法和系统
CN106973058A (zh) * 2017-03-31 2017-07-21 北京奇艺世纪科技有限公司 一种Web应用防火墙规则更新方法、装置及系统
CN109495435A (zh) * 2017-09-13 2019-03-19 北京国双科技有限公司 服务器的防火墙更新方法和装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114499970A (zh) * 2021-12-27 2022-05-13 天翼云科技有限公司 一种网络安全服务配置方法、装置及电子设备
CN114499970B (zh) * 2021-12-27 2023-06-23 天翼云科技有限公司 一种网络安全服务配置方法、装置及电子设备
CN114422234A (zh) * 2022-01-17 2022-04-29 北京金山云网络技术有限公司 一种waf规则加载方法、装置、电子设备及存储介质
CN115346287A (zh) * 2022-07-18 2022-11-15 北京经纬恒润科技股份有限公司 信息配置方法及装置

Also Published As

Publication number Publication date
CN115023919A (zh) 2022-09-06

Similar Documents

Publication Publication Date Title
WO2021226781A1 (zh) 防火墙规则的更新方法、装置、服务器及存储介质
CN109547511B (zh) 一种web消息实时推送方法、服务器、客户端及系统
CN115004673B (zh) 消息推送方法、装置、电子设备及计算机可读介质
CN108390950A (zh) 一种消息推送方法、装置及设备
CN104184756A (zh) 一种数据同步方法、装置及系统
WO2017185615A1 (zh) 一种业务处理设备的业务状态确定方法及调度设备
WO2019056203A1 (zh) 一种低延时音视频传输方法、装置及计算机可读存储介质
WO2017097210A1 (zh) 软件升级方法、装置及系统
CN112751847A (zh) 接口调用请求的处理方法、装置、电子设备及存储介质
CN113660350A (zh) 分布式锁协调方法、装置、设备及存储介质
CN111400041A (zh) 服务器配置文件的管理方法、装置及计算机可读存储介质
CN115023699A (zh) 恶意进程的检测方法、装置、电子设备及存储介质
CN111064626A (zh) 配置更新方法、装置、服务器及可读存储介质
CN109947081B (zh) 网联车辆控制方法及装置
CN114118447A (zh) 新型联邦学习系统、方法、装置、计算机设备及存储介质
CN113452774A (zh) 消息推送方法、装置、设备及存储介质
US20220166842A1 (en) Data distribution method and electronic device
CN110418092B (zh) 视频录制管理系统、方法、控制管理节点以及录制节点
CN113965628A (zh) 消息调度方法、服务器和存储介质
CN111416851A (zh) 在多个负载均衡器之间进行会话同步的方法和负载均衡器
WO2017032110A1 (zh) 一种应用消息的处理系统、方法及应用设备
CN112511595B (zh) 一种消息推送方法及消息服务系统
WO2022134830A1 (zh) 区块节点数据的处理方法、装置、计算机设备和存储介质
CN110290215B (zh) 一种信号传输方法及装置
CN111416852A (zh) 在多个负载均衡器之间进行会话同步的方法和负载均衡器

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20935730

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 17/04/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20935730

Country of ref document: EP

Kind code of ref document: A1