WO2024001998A1 - 一种安全策略的处理方法及相关装置 - Google Patents

一种安全策略的处理方法及相关装置 Download PDF

Info

Publication number
WO2024001998A1
WO2024001998A1 PCT/CN2023/102352 CN2023102352W WO2024001998A1 WO 2024001998 A1 WO2024001998 A1 WO 2024001998A1 CN 2023102352 W CN2023102352 W CN 2023102352W WO 2024001998 A1 WO2024001998 A1 WO 2024001998A1
Authority
WO
WIPO (PCT)
Prior art keywords
security
security policy
address
intention
intent
Prior art date
Application number
PCT/CN2023/102352
Other languages
English (en)
French (fr)
Inventor
吴朱亮
谢于明
王仲宇
张亮
韩涛
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024001998A1 publication Critical patent/WO2024001998A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of network security technology, and in particular, to a security policy processing method and related devices.
  • IP Internet Protocol
  • This application provides a security policy processing method and related devices, making the security policy easier to understand and maintain.
  • a first aspect of this application provides a security policy processing method, which can be applied to a first communication device.
  • the first communication device is, for example, a network management device or other devices deployed on an internal network or an external network.
  • the first communication device obtains the first security policy configured on the first security device, and generates a first security intent according to the first security policy.
  • the first security policy indicates a first access behavior of the first address to the second address, and the first access behavior is to allow or deny access.
  • the first address is the source address and the second address is the destination address.
  • the source address is, for example, a Media Access Control (MAC) address, a source IP address, a source port (port), or a combination of the above information.
  • the destination address is, for example, a destination MAC address, a destination IP address, a destination port, or a combination of the above information.
  • the first security intent indicates the first access behavior of the first object to the second object
  • the first object or the second object includes any of the following: the type of user, the name of the service, or the name of the network area.
  • the first security intention is, for example, expressing permission or prohibition of an access behavior in the form of natural language.
  • the first object is the initiator of the first access behavior.
  • the first object can be the type of user who initiates the first access behavior, or the name of the service that initiates the first access behavior, or the name of the network area that initiates the first access behavior.
  • the second object is the recipient of the first access behavior.
  • the second object is the type of user who allows or prohibits the first object to access, or the name of the business that allows or prohibits the first object to access, or allows or prohibits the first object to access.
  • the name of the network zone is the name of the network zone.
  • security intent directly expresses the access requirements between services, networks, and users, or between users, services, and networks. Therefore, the security policy expressed through IP information is converted into an easy-to-understand security intention, making the security policy easier to understand and maintain.
  • the first communication device determines the first object according to the first address, and determines the second object according to the second address.
  • source IP address, source port, protocol type, or a combination of the above information is used to determine the first object.
  • the destination IP address, destination port, protocol type, or a combination of the above information is used to determine the second object.
  • the first communication device determines the first object based on the first address and the object information database, and determines the second object based on the second address and the object information database. That is, the first object corresponding to the first address is obtained from the object information database, and the second object corresponding to the second address is obtained.
  • the object information base includes each object in at least one object and address information of each object.
  • the at least one object includes a first object and a second object, and each object is any of the following: a type of user, a type of business name, or the name of a network zone.
  • the first object corresponding to the first address and the second object corresponding to the second address are determined based on the object description information, which improves the efficiency of converting security policies into security intentions.
  • the first security intent is used to verify whether the first security policy matches the security policy deployment intent.
  • the security policy deployment intention indicates whether to allow or prohibit an object from accessing another object.
  • the aforementioned objects can be specifically expressed as: a user type, a The name of a service or the name of a network area. That is, by comparing the first security intention and the security policy deployment intention, the rationality of the first security policy is verified.
  • the security policy deployment intention indicates the second access behavior of the third object to the fourth object.
  • the first communication device determines the first security The policy matches the security policy deployment intent.
  • both the third object and the first object include the first sub-address may include any of the following situations: the third object includes the first object, the first object includes the third object, or the first sub-address is the third object part of the address pointed to, and the first subaddress is part of the address pointed to by the first object.
  • the first communication device can directly use the first object and the second object according to the first object. Determine the relationship between the third object and the first object. For example, if the third object is Network Area 1 and the first object is Service 1 in Network Area 1, then the third object includes the first object.
  • the address pointed by the first object is part of the address pointed by the third object.
  • the third object is service C
  • service C is provided in network area 1, network area 2, and network area 3, and the first object is network area 1
  • the address pointed by the third object and the address pointed by the first object are both Including the address of the device providing service C in network area 1 (that is, an example of the first sub-address), etc.
  • the first security intent is used to verify whether the newly added security policy deployment intent conflicts with the first security intent.
  • the new security policy deployment intention is, for example, the deployment intention of the security policy determined based on the service to be activated.
  • a new security policy deployment intention is used to indicate whether to allow or prohibit a certain object from accessing another object.
  • a new security policy deployment intention is added to indicate the third access behavior of the fifth object to the sixth object.
  • the first communication device determines that the new security The policy deployment intent conflicts with the first security intent.
  • the first communication device obtains the second security policy configured on the second security device, and generates the second security intent according to the second security policy.
  • the second security policy indicates a fourth access behavior of the first address to the second address.
  • the second security intent instructs the first object to perform a fourth access behavior on the second object.
  • the first security device is located on the access path from the first address to the second address, and the second security device is any other security device on the access path. Obtaining the foregoing information is beneficial to subsequent maintenance of security policies on other security devices on the access path from the first address to the second address.
  • the first security intent and the second security intent are used to verify whether the first security policy and the second security policy match the security policy deployment intent. That is, by comparing the first security intention and the second security intention, and the security policy deployment intention, the rationality of the first security policy and the second security policy is verified.
  • the security policy deployment intention indicates the second access behavior of the third object to the fourth object.
  • the third object and the first object both include the first sub-address
  • the fourth object and the second object both include the second sub-address
  • the first access behavior and the fourth access behavior are the same as the second access behavior
  • the A communications device determines that the first security policy and the second security policy match security policy configuration intent.
  • the first security intent and the second security intent can be used to verify whether there is configuration redundancy. Determining whether there is redundant configuration of security policies on multiple security devices based on the first security intent and the second security intent is conducive to timely discovery of redundant security policies and improves resource utilization of security devices.
  • the first communication device determines that configuration redundancy exists.
  • you want to prohibit the first address from accessing the second address you only need to configure any security device on the access path from the first address to the second address to prohibit the first address from accessing the second address.
  • the security policy is sufficient. Therefore, when both the first security intent and the second security intent indicate that the first object is prohibited from accessing the second object, it can be determined that there is configuration redundancy between the first security policy and the second security policy, which provides a way to determine A specific implementation plan for configuring redundancy enhances the realizability of this plan.
  • the first communication device may display the first security policy and the first security intention to the user through a graphical user interface (GUI) or the second communication device.
  • GUI graphical user interface
  • the security policy and the security intent based on the security policy to users, that is, associate the security intent with the security policy, making it easier for users to understand the meaning of the security policy, which is beneficial to reducing the time spent in the maintenance phase of the security policy. Difficulty.
  • the first communication device may display the first content, the second content and the third content to the user through the GUI or the second communication device.
  • the first content includes the first object, the first address and the corresponding relationship between the first object and the first address
  • the second content includes the second object, the second address and the corresponding relationship between the second object and the second address
  • the third content Content includes first access behavior.
  • the first communication device may display one or more of the following to the user through the GUI or the second communication device: the first verification result, the second verification result, the third verification result, or the fourth verification result.
  • the first verification result indicates whether the first security policy matches the security policy deployment intention.
  • the second verification result indicates whether the newly added security policy deployment intention conflicts with the first security intention.
  • the third verification result indicates whether the first security policy and the second security policy match the security policy deployment intention.
  • the fourth verification result indicates whether configuration redundancy exists. Displaying the above verification results will help prompt users to promptly discover problems in security policies that have been deployed in security devices or security policies that are to be deployed, and will help improve the stability of network operations.
  • the first communication device obtains the third security policy from the third security device, the third security policy indicates whether to allow or prohibit the third address from accessing the fourth address, obtains the seventh object corresponding to the third address, and obtains The eighth object corresponding to the fourth address, and the corresponding relationship between the seventh object and the third address, and the corresponding relationship between the eighth object and the fourth address are added to the object information library to obtain a new object information library .
  • the seventh object or the eighth object includes any of the following: the type of user, the name of the service, or the name of the network area.
  • the user can determine the object corresponding to the address and add the address and the object in the object information base. That is, in the process of generating security intent based on the security policy, the user can Dynamically updating the object information base to continuously improve the object information base will help reduce the difficulty of executing the conversion operation from security policy to security intent in the future.
  • a second aspect of this application provides a security policy processing device.
  • the security policy processing device includes an acquisition module and a generation module.
  • the acquisition module is used to acquire the first security policy configured on the first security device.
  • a generating module configured to generate a first security intention according to the first security policy.
  • the first security policy indicates a first access behavior of the first address to the second address.
  • the first access action is to allow or deny access.
  • the first security intent indicates a first access behavior of the first object to the second object.
  • the first object or the second object includes any of the following: the type of user, the name of the service, or the name of the network area.
  • the generation module is specifically configured to: determine the first object according to the first address, and determine the second object according to the second address.
  • the security policy processing device also includes a determination module.
  • the determining module is configured to determine the first object according to the first address and the object information database, and determine the second object according to the second address and the object information database.
  • the object information base includes each object in at least one object and address information of each object. At least one object includes a first object and a second object. Each object is any of the following: a type of user, the name of a service, or the name of a network area.
  • the first security intent is used to verify whether the first security policy matches the security policy deployment intent.
  • the security policy deployment intention indicates the second access behavior of the third object to the fourth object.
  • the determining module is also configured to determine the third object when both the third object and the first object include a first sub-address, the fourth object and the second object include a second sub-address, and the first access behavior and the second access behavior are the same.
  • a security policy matches the security policy deployment intent.
  • the first security intent is used to verify whether the newly added security policy deployment intent conflicts with the first security intent.
  • a new security policy deployment intention is added to indicate the third access behavior of the fifth object to the sixth object.
  • the determination module is also configured to determine a new access behavior when both the first object and the fifth object include a third sub-address, the second object and the sixth object both include a fourth sub-address, and the first access behavior and the third access behavior are different.
  • the security-increasing policy deployment intention conflicts with the first security intention.
  • the obtaining module is also used to obtain the second security policy configured on the second security device, and the generating module is also used to generate a second security intention according to the second security policy.
  • the second security policy instructs the first address to perform a fourth access behavior to the second address, and the second security intent instructs the first object to perform a fourth access behavior to the second object.
  • the first security device is located on the access path from the first address to the second address, and the second security device is any other security device on the access path.
  • the first security intent and the second security intent are used to verify whether the first security policy and the second security policy match the security policy deployment intent.
  • the security policy deployment intention indicates the second access behavior of the third object to the fourth object.
  • the determining module is also configured to determine the first security policy and the second security policy when the third object includes the first object, the fourth object includes the second object, and the first access behavior and the fourth access behavior are the same as the second access behavior.
  • the policy matches the security policy configuration intent.
  • the first security intent and the second security intent are used to verify configuration redundancy.
  • the determining module is also configured to: when both the first security intention and the second security intention indicate that the first object is prohibited from accessing the second object, Verify that configuration redundancy exists.
  • the security policy processing device also includes a display module.
  • the display module is used to display the first security policy and the first security intention.
  • the display module is also used to display one or more of the following: the first verification result, the second verification result, the third verification result, or the fourth verification result.
  • the first verification result indicates whether the first security policy matches the security policy deployment intention.
  • the second verification result indicates whether the newly added security policy deployment intention conflicts with the first security intention.
  • the third verification result indicates whether the first security policy and the second security policy match the security policy deployment intention.
  • the fourth verification result indicates whether configuration redundancy exists.
  • the security policy processing device also includes an acquisition module.
  • the acquisition module is also used to obtain a third security policy from the third security device, and the third security policy instructs the behavior of running or prohibiting the third address from accessing the fourth address.
  • the acquisition module is also used to acquire the seventh object corresponding to the third address, acquire the eighth object corresponding to the fourth address, and add the corresponding relationship between the seventh object and the third address in the object information base, and the The corresponding relationship between the eight objects and the fourth address is used to obtain a new object information base.
  • the seventh object or the eighth object includes any of the following: the type of user, the name of the service, or the name of the network area.
  • a third aspect of this application provides a network device, including a processor and a memory.
  • the memory is used to store the program code
  • the processor is used to call the program code in the memory to cause the network device to execute the method of the first aspect or any one of the implementations of the first aspect.
  • a fourth aspect of the present application provides a computer-readable storage medium that stores instructions. When the instructions are run on a computer, they cause the computer to execute the method of the first aspect or any one of the embodiments of the first aspect.
  • a fifth aspect of the present application provides a computer program product that, when run on a computer, causes the computer to execute the method of the first aspect or any implementation of the first aspect.
  • a sixth aspect of this application provides a chip including one or more processors. Some or all of the processor is used to read and execute computer instructions stored in the memory to perform the method in any possible implementation of any of the above aspects.
  • the chip also includes memory.
  • the chip also includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used to receive data and/or information that needs to be processed.
  • the processor obtains data and/or information from the communication interface, processes the data and/or information, and outputs the processing results through the communication interface.
  • the communication interface is an input-output interface or a bus interface.
  • Figure 1 is a schematic diagram of a network deployment scenario provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a security policy processing method provided by an embodiment of the present application
  • Figure 3 is a schematic flowchart of a method for obtaining a first object corresponding to a first address provided by an embodiment of the present application
  • Figure 4 is a schematic diagram showing a security policy and security intent provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another security policy processing method provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another security policy processing method provided by an embodiment of the present application.
  • Figure 7 is a schematic diagram of the network topology of a service that has been activated in the network provided by the embodiment of the present application;
  • FIG. 8 is a schematic flowchart of another security policy processing method provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of another security policy processing method provided by an embodiment of the present application.
  • Figure 10 is a network topology diagram of the security policy processing method provided by the embodiment of the present application.
  • Figure 11 is another network topology diagram of the security policy processing method provided by the embodiment of the present application.
  • FIG. 12 is a schematic flowchart of another security policy processing method provided by an embodiment of the present application.
  • Figure 13 is a schematic structural diagram of a network device provided by an embodiment of the present application.
  • Figure 14 is a schematic structural diagram of a security policy processing device provided by an embodiment of the present application.
  • Figure 15 is a schematic structural diagram of another security policy processing device provided by an embodiment of the present application.
  • Figure 16 is a schematic structural diagram of a network device provided by an embodiment of the present application.
  • exemplary means "serving as an example, example, or illustrative.” Any embodiment described herein as “exemplary” is not necessarily to be construed as superior or superior to other embodiments.
  • the embodiment of the present application provides a security policy processing method to reduce the difficulty in understanding the security policy.
  • Embodiments of the present application also provide corresponding security policy processing devices, communication devices, computer-readable storage media, etc.
  • the network architecture includes an internal network, an external network and a first communication device.
  • the internal network includes firewalls, network devices for forwarding messages, and terminal devices.
  • the security devices in the internal network refer to communication devices with security policies deployed in the internal network.
  • the aforementioned security devices may include any of the following or Multiple items: firewalls, network devices or terminal devices used to forward packets, etc.
  • a security device When a security device receives a packet, it can match the deployed security policy with the information of the packet (for example, the source address of the packet, the destination address of the packet, etc.) to determine whether to allow or prohibit the packet from passing.
  • the first communication device shown in Figure 1 is deployed outside the internal network (for example, the first communication device is a cloud device)
  • Figure 1 is only an example of a network deployment scenario. In other scenarios, the first communication device A communication device can also be deployed in an internal network, which is not limited here. For ease of understanding, each device in the network architecture will be introduced in detail below.
  • Internal networks can be divided into multiple network areas, such as the data center network and office campus in Figure 1. Each network area can have different security requirements, so security devices can be deployed in each network area. For example, firewall 1 is deployed on the office campus network shown in Figure 1, and firewall 2 is deployed on the data center network shown in Figure 1. Security devices at different locations can be configured with different security policies.
  • Terminal devices in the internal network may include terminal devices used by users in the internal network (such as terminal device 1 and terminal device 2 in Figure 1), terminal devices used to provide services (such as the database server and Web server in Figure 1 ) or terminal equipment for other purposes (such as the report server and test server in Figure 1), etc., are not limited here.
  • terminal devices include physical devices such as servers, personal computers, laptops, smartphones, tablets, and Internet of Things devices.
  • the terminal device includes a virtualized device deployed on a physical device.
  • the terminal device includes a virtual machine (VM) deployed on a server and used to provide business services.
  • VM virtual machine
  • the network device deployed between the firewall and the terminal device is a packet forwarding device, which is used to forward traffic between the external network and the terminal device in the internal network, as well as traffic between different terminal devices in the internal network.
  • network devices include packet forwarding devices such as switches, gateways, and routers.
  • the network device is implemented as a virtualization device deployed on the hardware device.
  • network devices include VMs, virtual routers, or virtual switches that run programs for sending packets.
  • the first communication device is the execution subject of the security policy acquisition method provided by the embodiment of the present application.
  • the first communication device includes a server or a VM deployed on the server.
  • the server can be deployed in public cloud, private cloud or hybrid cloud.
  • the execution subject of the method for obtaining the security policy provided by the embodiment of the present application can also be other devices, such as a network management device or a certain network device in the internal network (for example, a message forwarding device or a firewall), etc.
  • a network management device or a certain network device in the internal network (for example, a message forwarding device or a firewall), etc.
  • It can be flexibly determined based on actual application scenarios and is not limited here.
  • the first communication device is configured to obtain the first security policy configured on the first security device, and generate the first security intent according to the obtained first security policy.
  • the first security policy indicates the first access behavior of the first address to the second address
  • the first security intent indicates the first access behavior of the first object to the second object.
  • the security policy includes a first address and a second address, and the security policy is used to instruct the security device to allow or prohibit the first address from accessing the second address.
  • the first object or the second object includes any of the following: the type of user, the name of the service, or the name of the network area.
  • the security intent is to allow Internet users to access web services.
  • the first object includes the type of user (ie, Internet user), and the second object includes the name of the service (ie, web service).
  • the security intention is to prohibit Internet users from accessing database services.
  • the first object includes the type of user (ie, Internet user), and the second object includes the name of the service (ie, database service).
  • security intent To allow web services to access database services.
  • the first object includes the name of one service (ie, web service), and the second object includes the name of another service (ie, database service).
  • the security intent is to prohibit office campus access to the data center.
  • the first object includes the name of one network area (ie, office park), and the second object includes the name of another network area (ie, data center).
  • the security intent is to prohibit office campus access to the data center.
  • the first object includes the name of one network area (ie, office park), and the second object includes the name of another network area (ie, data center).
  • the security intention is to prohibit the production workshop from accessing database services.
  • the first object includes the name of a network area (ie, office park), and the second object includes the name of the service (ie, database service). That is, in an easy-to-understand manner, security intent directly represents the access requirements between services, networks, users, or between users, services, and networks. Therefore, generating security intents based on security policies makes it easier for network administrators to understand and maintaining security policies.
  • FIG 2 is a schematic flowchart of a security policy processing method provided by an embodiment of the present application.
  • the security policy processing method provided by the embodiment of this application includes the following steps 201-202:
  • Step 201 Obtain the first security policy configured on the first security device.
  • the first security policy indicates the first access behavior of the first address to the second address.
  • the first access behavior is to allow or deny access.
  • the first communication device obtains the first security policy configured on the first security device.
  • the first security policy includes at least one security policy.
  • the first security policy indicates a first access behavior of the first address to the second address, and the first access behavior is to allow or deny access.
  • the first security device receives the message, it can match the source address and destination address of the message with at least one deployed first security policy to determine whether to allow or prohibit the message from passing.
  • the first communication device may obtain the first address and the second address from each first security policy, for example, the first address is the source address and the second address is the destination address.
  • the source address is, for example, a Media Access Control (MAC) address, a source IP address, a source port (port), or a combination of the above information.
  • the destination address is, for example, a destination MAC address, a destination IP address, a destination port, or a combination of the above information.
  • the first security policy indicates whether the first address is allowed or prohibited from accessing the second address.
  • the first security policy may also include the protocol type used in the first access behavior.
  • the source IP address obtained from the first security policy can be any of the following: at least one IP address, at least one IP address segment, or any.
  • the source IP address can be determined to be arbitrary.
  • the concept of the destination IP address obtained from the first security policy is similar to the concept of the source IP address obtained from the first security policy, and will not be described again here.
  • the source port obtained from the first security policy can be at least one port number or any. When the source port is not set in the first security policy, the source port can be determined to be any.
  • the port is arbitrary, which can be understood as the port is 0 ⁇ 65535.
  • the concept of the destination port obtained from the first security policy is similar to the concept of the source port obtained from the first security policy, and will not be described again here.
  • the protocol types used include but are not limited to Transmission Control Protocol (TCP), User Datagram Protocol (UDP) or other types of protocols, etc., which are not exhaustive here.
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • the code forms of security policies deployed on different types of security devices may be different.
  • the following discloses an example of the first security policy configured in the switch and an example of the first security policy configured in the terminal device.
  • an example of the first security policy deployed in the switch is as follows:
  • the source IP address in the first security policy of the switch shown above includes 172.20.201.0/24, the source port is not specified in the first security policy shown above, the destination IP address includes 192.168.10.1 and 192.168.10.2, and the protocol type For TCP, the first access behavior is deny.
  • An example of the first security policy deployed in the end device is as follows:
  • the source IP address and source port are not specified in the first security policy shown above, the source IP address and source port can be determined to be arbitrary, the destination IP address can be determined to be the IP address of the terminal device, and the destination port number includes 12345, The first access behavior in the first sub-security policy is allow (accept). It should be understood that the above two examples are only for the convenience of understanding security policies in different code forms deployed on different types of security devices, and are not used to limit this solution.
  • the first communication device can obtain the first security policy in various ways.
  • the first security device may send the deployed at least one first security policy to the first communication device, and accordingly, the first communication device receives the at least one first security policy sent by the first security device.
  • the first communication device can remotely log in to the first security device based on Secure Shell Protocol (Secure Shell, SSH), Remote Terminal Protocol (TELNET) or other technologies to obtain the information deployed on the first security device. At least a first security strategy.
  • Step 202 Generate a first security intent according to the first security policy.
  • the first security intent indicates the first access behavior of the first object to the second object.
  • the first object or the second object includes any of the following: user type, business name, or the name of a network zone.
  • the first communication device can generate a first security intent corresponding to the first security policy.
  • the first security intention is a security intention.
  • the security intention is, for example, expressed in the form of natural language to allow or prohibit an access behavior.
  • the first object is the initiator of the first access behavior, and the first object includes any of the following: the type of user, the name of the service, or the name of the network area. That is, the first object may be the type of the user who initiates the first access behavior, or the name of the service which initiates the first access behavior, or the name of the network area where the first access behavior is initiated.
  • the second object is the recipient of the first access behavior, and the second object includes any of the following: the type of user, the name of the service, or the name of the network area.
  • the second object is the type of user that is allowed or prohibited from being accessed by the first object, or the name of the service that is allowed or prohibited from being accessed by the first object, or the name of the network area that is permitted or prohibited from being accessed by the first object.
  • step 202 may include: the first communication device determines the first object according to the first address, and determines the second object according to the second address.
  • the first address includes source IP address, source port, protocol type, or a combination of the above information, that is, the source IP address, source port, protocol type, or a combination of the above information is used to determine the first object.
  • the second address includes the destination IP address, destination port, protocol type, or a combination of the above information, that is, the destination IP address, destination port, protocol type, or a combination of the above information is used to determine the second object.
  • the corresponding relationship between the first address and the second address in the security policy and the first object and the second object in the security intent is clarified, which is beneficial to improving the accuracy of the conversion process from the security policy to the security intent.
  • the first communication device may generate a first security intent corresponding to the first security policy.
  • the first security intent indicates a first access behavior of the first object to the second object.
  • the first security intent may specifically represent allowing the first object to access the second object, or prohibiting the first object from accessing the second object.
  • the following is an example of the display form of the first security intent based on the types of the first object and the second object. It should be noted that the content in "[]" in the following examples is optional.
  • Case 1 The first object is anything and the second object is the name of a business
  • the first security intention allow/deny any network area to access the YY business of [XX network area]
  • Case 2 The first object is arbitrary and the second object is the name of a network area
  • First security intent allow/deny any network area to access XX network area
  • Case 3 The first object is a type of user, and the second object is any
  • Case 4 The first object is a type of user, and the second object is the name of a business
  • Case 5 The first object is a type of user, and the second object is the name of a network area.
  • Case 6 The first object is the name of a business, and the second object is any
  • First security intent allow/deny CC services in [BB network area] to access any network area
  • Case 7 The first object is the name of a business, and the second object is the name of a business
  • the first security intention allow/deny the CC service in [BB network area] to access the YY service in [XX network area]
  • Case 8 The first object is the name of a service, and the second object is the name of a network area.
  • First security intent allow/deny CC services in [BB network area] to access XX network area
  • Case 9 The first object is the name of a network area, and the second object is any
  • the first security intention allow/deny the BB network area to access any network area
  • the first object is the name of a network area
  • the second object is the name of a service
  • the first security intention allow/deny the BB network area to access the YY business of [XX network area]
  • Case 11 The first object is the name of a network area, and the second object is the name of a network area.
  • the first security intention allow/deny the BB network area to access the XX network area
  • the first security policy deployed on the above switch can be converted into the first security intent as "student users are prohibited from accessing online learning services", that is, the first object corresponding to 172.20.201.0/24 is the student user, 192.168.10.1: 12345 and 192.168.10.2:
  • the second object corresponding to 12345 is the online learning service;
  • the first security policy deployed on the terminal device is converted into the first security intent and can be "any network area allows access to the online learning service", which should Understand that the examples here are only for the convenience of understanding this solution and are not used to limit this solution.
  • the first address in the first security policy is used to determine the first object
  • the second address in the first security policy is used to determine the second object, which reduces the need for switching from the security policy to The difficulty of the security intent process.
  • the security intent directly represents the access requirements between services, networks, and users, or between users, services, and networks. Therefore, the security policy represented by IP address is converted into the security intention represented by natural language, making it easier for administrators to understand and maintain the security policy.
  • the first communication device may also obtain the name of a network area where the device at the first address is located and the name of a network area where the device at the second address is located from the first security policy.
  • the first network area is the source network area
  • the second network area is the destination network area; if the aforementioned information does not exist in the first security policy, the first communication device may determine that the aforementioned information obtained in the first security policy is empty. .
  • the following is an example based on the first security policy deployed on the above-mentioned switch and terminal device.
  • the information that the first communication device can also obtain from the first security policy can be as follows, which is shown in the form of code below: It should be noted that the content after "//" represents the information obtained based on the code content.
  • the information obtained from the first security policy deployed in the switch can be as follows:
  • the first communication device may use tables, plain text, a combination of graphics and text, or other forms to store the information obtained from the first security policy.
  • the first object and the second object may respectively include the following items: the type of user, the name of the service, or the name of the network area.
  • the user type is used to distinguish different users. Different types of users correspond to different addresses or address segments.
  • the user types can be intranet users, partner users, Internet users, etc.
  • Intranet users include users accessing from the internal network.
  • An internal network is a network controlled by a user (for example, an enterprise).
  • the internal network is, for example, a campus network of an enterprise. Users accessing through the campus network can be called intranet users of the enterprise.
  • the enterprise's internal network has a designated address segment.
  • the first communication device may determine that the first object or the second object is an intranet user.
  • Partner users include users accessing from a partner's network. For example, Enterprise 1 and Enterprise 2 cooperate, and Enterprise 1 agrees that Enterprise 2 accesses Enterprise 1's service 1.
  • the first communication device can determine the first The target is Enterprise 1 users.
  • Internet users include users accessing from any location, whose address corresponds to any.
  • an Internet user can also be a user other than a specific user whose address does not include the address of the specific user.
  • Specific users are, for example, internal users and/or partner users.
  • a specific type of user can also be subdivided into multiple users.
  • internal users can be subdivided into faculty users and student users. Faculty users and student users can correspond to different users respectively. Address or address segment.
  • internal users can be subdivided into administrative office users and production workshop users, and generation workshop users can be subdivided into engine workshop users, tire workshop users, etc. Different types of users are divided into Corresponds to different addresses or address segments.
  • Services are deployed in the internal network to provide services to external or internal users.
  • the names of the services are used to distinguish different services.
  • the name of the business can be personal mobile banking business, personal customer information business, online learning business, Internet business or other business names, etc. The details can be based on the actual situation and are not limited here.
  • Each business provides external services based on the service address.
  • the service address is, for example, a combination of IP address, port and protocol.
  • the web service provides services based on the TCP protocol at IP1:80
  • the domain name resolution service provides services based on the TCP protocol or UDP protocol at IP2:53.
  • the first communication device may determine, based on the first address or the second address included in the security policy, which service address the first address or the second address belongs to, to determine the first object or the second object included in the security intent.
  • the first address or the second address may be the IP address, port, protocol or a combination thereof in the service address.
  • the name of the network zone is used to distinguish different network zones. Different network areas correspond to different addresses or address segments, and the first communication device can determine the name of the network area where the first address or the second address is located based on the first address or the second address included in the security policy.
  • network zones can be named Internal Network Zone, Partner Network Zone, Internet Zone, etc.
  • the internal network area is a network area controlled by one user (for example, an enterprise), such as a campus network of an enterprise.
  • a partner network zone is a network zone controlled by a partner.
  • Enterprise 1 and Enterprise 2 have a cooperative relationship, and the campus network of Enterprise 1 and the campus network of Enterprise 2 can be mutual partner network areas.
  • the Internet zone may generally refer to all network zones or network zones except for specific networks, such as internal network zones and/or partner network zones.
  • a certain network area can also be subdivided into different network areas.
  • the internal network area can be subdivided into "Production Area 1", “Test Area 1”, “Office Area”, “XX Data Center”, “XX Park XX Building” or other names, etc., which can be combined with the actual situation.
  • the application scenario is determined.
  • Different network areas can correspond to different security devices.
  • an enterprise deploys firewalls in "Production Area 1" and “Testing Area 1" respectively, and each firewall controls the network access behavior of the corresponding network area.
  • the first communication device may determine whether the first address obtained from the first security policy is arbitrary, for example, determine whether the source IP address and source port obtained from the first security policy are both arbitrary. If the determination result is yes, the first communication device may determine that the first object includes any network area. If the determination result is no, the first communication device may determine the first object based on the first address and the object information database. Among them, the object information database is used to store each object in at least one object and the address information of each object. Each object is any of the following: a type of user, the name of a service, or the name of a network area. name.
  • the address of each type of user may include an IP address of each user type, and the IP address of each user type may include an IP address segment corresponding to a type of user, or may include an IP address segment corresponding to a type of user.
  • One or more IP addresses may include the IP address and port corresponding to each service, and may also include the supported protocol type.
  • the IP address corresponding to each service may include one or more IP addresses that provide the service, or may include an IP address segment used to provide the service.
  • the port corresponding to each service may include one or more ports that provide the service.
  • the address of each network area may include an IP address segment corresponding to each network area, or may include one or more IP addresses corresponding to each network area.
  • the object information base may also include description information for each object.
  • the description information of the object may include any one or more of the following: the user's role type, the type of network environment in which the device used by the user is located, or other information about the user.
  • the description information of the object may also include any one or more of the following: the role type of the service, the network environment where the device that provides the service is located, the physical location of the device that provides the service, and the type of the device that provides the service. or other descriptive information, etc.
  • the user's role type is a more fine-grained description of the same type of user.
  • the user type is a user of a third-party enterprise, and the user's role type can include administrator or general user.
  • the user's role type may include an application (application, APP) and a browser.
  • the user type is faculty and staff on the campus network.
  • the role types of users can include teachers in administrative positions, teachers in teaching positions, etc. The examples here are only for convenience of understanding this solution and are not used to limit this solution.
  • the type of network environment in which the device used by the user is located may be determined based on the functions of the network environment in which the device used by the user is located. For example, if the network environment where the device used by the user is located is a production workshop, the type of network environment where the device used by the user is located may be production. For another example, if the network environment where the device used by the user is located is a test workshop, the type of the network environment where the device used by the user is located may be testing. For another example, if the network environment where the device used by the user is located is an office campus, the type of the network environment where the device used by the user can be office, etc., is not limited here.
  • the service role type is a more fine-grained division of devices that provide the same service.
  • the division of service role types may be based on the functions of devices that provide services or other types of basis.
  • the name of the business is online learning business
  • the role types of the business can include database, cache, and web server.
  • the role type of database is used to store learning materials used in online learning.
  • the role type of web is used to respond to requests for learning materials, obtain learning materials from the "database”, and manage the learning materials in the "database”. Study materials, etc. It should be understood that the examples here are only for the convenience of understanding the concept of "business role types" and are not used to limit this solution.
  • the type of network environment in which the equipment that provides services is located can be determined based on the functions of the network environment in which the equipment that provides services is located. The concepts are similar and can be understood by referring to them and will not be described in detail here.
  • the physical location where the aforementioned service equipment is provided can be the XX server in the XX computer room of the XX data center, or the physical location where the aforementioned service equipment is provided can be the XX computer room in the XX park, etc. This is not an exhaustive list.
  • the type of equipment that provides one of the aforementioned services includes but is not limited to physical equipment, virtual machines or containers, etc.
  • Table 1 shows the information of an object in the object information database.
  • the first communication device may determine whether the first address exists in the object information database.
  • the first address includes one or more of the following: source IP address, source port, or protocol type.
  • the first communication device may display the first indication information to the user to obtain the first object corresponding to the first address.
  • the first communication device can also add the first object and the first address to the object information library to update the object information library, that is, obtain the updated object information library.
  • the first indication information at least includes the first address.
  • the first instruction information displayed to the user may also include any one or more of the following: the name of the network area associated with the first address, the name of the first security policy, the type of the first object or other information, etc. .
  • the type of the first object is user, business or network area.
  • the first communication device may obtain the name of the network area associated with the first address, and the first indication information displayed to the user includes the first address and the name of the aforementioned source network area.
  • the first communication device may obtain the first object corresponding to the first address from the object information library.
  • the name of the network zone associated with the address is, if the first address does not exist in the object information library.
  • the first communication device can fuzzy match the first address with the address information of multiple objects in the object information database; determine at least one target object associated with the first address from the object information database, and assign the target object to which the target object belongs.
  • the name of the network area is determined to be the name of the network area associated with the first address.
  • the first communication device may perform fuzzy matching between the first address and the address information of multiple objects in the object information library based on the similarity between the first address and the address information of each object in the object information library; At least one target object associated with the first address is determined from the object information base. For example, the similarity between the address information of each target object and the first address may be greater than or equal to the similarity threshold, or at least one target object is at least one with the highest similarity to the first address in the object information database. Objects, etc. are not exhaustive here.
  • the similarity between address A and address B is higher than the similarity between address A and address C.
  • the first address is 192.168.10.6:80.
  • the first address is not accurately matched in the object information database, but the object information database includes the first network area.
  • the addresses of this network area are 192.168.10.1 ⁇ 192.168.10.100.
  • the first address is 192.168.10.6:80.
  • the communication device may determine that the IP address in the first address belongs to the network area, and therefore uses the first network area as the name of the network area of the first address. It should be understood that the examples here are only for convenience of understanding the solution and are not used to limit the solution.
  • the user when the first address does not exist in the object information database, the user can determine the first object corresponding to the first address, and add the first address and the first object to the object information database, that is, in In the process of generating security intentions based on security policies, the object information database can be dynamically updated, thereby continuously improving the object information database, which will help reduce the difficulty of executing the conversion operation from security policies to security intentions in the future.
  • the first communication device when it displays the first indication information to the user, it may also display any one or more of the following fields: role type, type of network environment, physical location of the device that provides the service, and location of the device that provides the service. Type or other fields, etc., the field content of the aforementioned fields can be displayed as empty.
  • the purpose of displaying the aforementioned fields includes instructing the user to input information corresponding to the aforementioned fields. For example, instructing the user to enter any one or more of the following information: the role type of the object, the type of network environment where the object is located, the physical location of the device that provides the service, the The type of business equipment or description information of other objects, etc.
  • the first communication device adding the first address and the first object to the object information library may include: the first communication device may add the first address, the first object, and the description information of the first object to the object information library.
  • a method for the first communication device to obtain the first object corresponding to the first address may display the first indication information to the user through a first graphical user interface (GUI).
  • GUI graphical user interface
  • the first communication device may obtain the first object corresponding to the first address based on a feedback operation input by the user for the first indication information.
  • the above feedback operation may include: the user's response to the source IP address A selection operation of a name and/or a name of a source port, or a user input operation on the first object.
  • the above feedback operation may include: the user's input operation on the first object.
  • the first communication device may send the first indication information to the second communication device, and the second communication device displays the first indication information to the user through the second GUI.
  • the first communication device and the second communication device for two different devices.
  • the second communication device may obtain the first object corresponding to the first address based on the user's feedback operation for the first indication information input, and send the first object to the first communication device.
  • Figure 3 is a schematic flowchart of obtaining the first object corresponding to the first address provided by an embodiment of the present application.
  • the method provided by the embodiment of the present application to obtain the first object corresponding to the first address includes the following steps A1-A6.
  • Step A1 The first communication device determines whether the source IP address and source port are both arbitrary. If the judgment result is yes, proceed to step A2. If the judgment result is no, proceed to step A3.
  • Step A2 The first communication device determines that the first object includes any user in any network area and any service in any network area. The subsequent steps A3 to A6 are no longer performed.
  • Step A3 The first communication device determines whether the first address exists in the object information database. If the determination result is yes, it proceeds to step A4. If the determination result is no, it proceeds to step A5.
  • Step A4 The first communication device obtains the first object corresponding to the first address from the object information database. The subsequent steps A5-A6 are no longer performed.
  • Step A5 The first communication device displays first indication information to the user to obtain the first object corresponding to the first address, and the first indication information indicates that the first address is included.
  • Step A6 The first communication device adds the first address and the first object to the object information database to obtain an updated object information database. It should be understood that the example in Figure 3 is only for convenience of understanding this solution and is not used to limit this solution.
  • a process for determining a second object based on a second address The first communication device can determine whether the destination IP address and destination port obtained from the second security policy are both arbitrary, that is, whether the second address obtained by the second communication device from the second security policy is arbitrary. If the determination result is yes, the second communication device may determine that the second object includes any user in any network area and any service in any network area.
  • the second communication device may determine the second object according to the second address and the object information database. Specifically, the first communication device can determine whether the second address exists in the object information database.
  • the second address includes one or more of the following: destination IP address, destination port, or protocol type. If the second address exists in the object information database, the second object corresponding to the second address is obtained from the object information database.
  • the first communication device can display the second instruction information to the user to obtain the second object corresponding to the second address.
  • the first communication device can also add the second object and the second address to the object information database to update the object information database, that is, to obtain the updated object information database.
  • the specific implementation method for the first communication device to obtain the second object corresponding to the second address is similar to the specific implementation method for obtaining the first object corresponding to the first address.
  • the concept of the second indication information is the same as the first
  • the concepts of instruction information are similar and will not be described in detail here.
  • the first communication device can perform the two steps of "obtaining the first object corresponding to the first address" and “obtaining the second object corresponding to the second address” separately or simultaneously, and then the first communication device displays the first object to the user.
  • the steps of displaying the first indication information and the second indication information to the user can be executed separately or simultaneously, and the details can be flexibly determined based on the actual application scenario.
  • the rightmost column in Table 2 can be edited by the user to input the first object corresponding to the first address. For example, drag the content of the "Name Obtained from Security Policy” column to the "First Object” column to input the first object; or, the user can also directly enter the first object in text form, etc. , the example here is only for the convenience of understanding this solution, and does not limit the way the user inputs the first object.
  • Table 2 is only for the convenience of understanding this solution. In actual products, more or fewer fields may be displayed. For example, fields related to the description information of the first object may also be displayed, or, also, The network area field does not need to be displayed. The specific information to be displayed can be flexibly determined based on the actual application scenario. There is no limit here.
  • At least one object in the network and the address information of each object are summarized to obtain an object information database, so that after obtaining the first address and the second address included in the security policy, the object information database can be determined based on the object information database.
  • the first object corresponding to the first address and the second object corresponding to the second address thereby greatly improving the efficiency of converting the security policy into security intent.
  • the first communication device may also display the first security policy and the first security intent to the user to demonstrate the first security intent and the first security intent to the user. Correspondence between strategies.
  • the first communication device may display the first security intention and the first security policy to the user through the GUI.
  • the first communication device may send the first security intention and the first security policy to the second communication device, and the second communication device displays the first security intention and the first security policy to the user through the GUI.
  • first security intent and first security policy In one implementation, tables, plain text, text combined with graphics, or other methods can be used to display the first security intent and first security policy.
  • the first communication device may display the first content, the second content and the third content to the user through the GUI or the second communication device; wherein the first content includes the first object, the first address and the first object and the third content.
  • the correspondence between an address and the second content includes the second object, the second address and the correspondence between the second object and the second address, and the third content includes the first access behavior.
  • the first communication device can also display the description information of the first object and/or the description information of the second object to the user through the GUI or the second communication device.
  • description information of the first object and/or the second object For the meaning of "descriptive information of an object”, please refer to the above introduction to the meaning of "descriptive information of an object” and will not be elaborated here.
  • Figure 4 is a schematic diagram showing the first security policy and the first security intention provided by an embodiment of the present application.
  • the first security policy shown in Figure 4 is the first security policy deployed on the firewall as an example.
  • the first security policy and first security intent shown include the source network area where the first object is located ( That is, any area in Figure 4), the first object (that is, any area in Figure 4), and the source IP address (that is, any IP address in Figure 4) and source port (that is, any IP address in Figure 4) corresponding to the first object (that is, any area in Figure 4) 4), also includes the destination network area where the second object is located (that is, the data center in Figure 4), the second object (that is, the online learning service in Figure 4), the protocol type, and the connection with the second object.
  • the destination IP address and destination port corresponding to the object also include the first access (that is, the permission in Figure 4). It should be understood that the example in Figure 4 is only for convenience of understanding this solution and is not used to limit this solution.
  • the security policy and the security intent obtained based on the security policy are displayed to the user, that is, the security intent and the security policy are associated, making it easier for the user to understand the meaning of the security policy, which is beneficial to reducing the difficulty of maintaining the security policy.
  • the following uses a specific example to introduce the processing method of the security policy provided by this application in conjunction with the application scenario diagram shown in Figure 1.
  • Figure 1 There are two offices and data centers in the internal network. In different network areas, firewall 1 is deployed between the office campus and the Internet area, and firewall 2 is deployed between the office campus and the data center.
  • the first communication device obtains a first security policy in the form of code deployed in the firewall 1 as an example.
  • the embodiment shown in Figure 5 below is only for convenience of understanding this solution and is not used to limit this solution.
  • the security policy processing method provided by the embodiment of the present application includes the following steps 501-504.
  • Step 501 Obtain the first security policy in code form in firewall 1.
  • step 501 for the specific implementation of step 501, please refer to the description of step 201 in the corresponding embodiment in Figure 2, and will not be described again here.
  • first security policy in code form deployed on firewall 1 is as follows:
  • the source address (src-addr) in the above-mentioned first security policy is Any
  • the destination IP address (dst-addr) is 192.168.1.1/32
  • the destination port includes 12345
  • the protocol type (protocol) is TCP.
  • An access action (action) is permit (permit).
  • Step 502 Obtain the first address and the second address from the first security policy in code form.
  • step 502 shows the information obtained by the first communication device from the first security policy on firewall 1 and firewall 2 in the form of code.
  • the information obtained from the first security policy on firewall 1 is as follows:
  • the source network zone (src_zone) corresponding to the first address is any
  • the source address (src_addrgrp) included in the first address is any
  • the destination network zone (dst_zone) corresponding to the second address is any
  • the The destination IP address included in the second address is 192.168.10.1/32
  • the destination port included in the second address is 12345
  • the protocol type is TCP
  • the first access action (action) is allow.
  • Step 503 Obtain the first object corresponding to the first address and the second object corresponding to the second address.
  • step 503 for the specific implementation of step 503, please refer to the description of step 202 in the corresponding embodiment in Figure 2, and will not be described again here.
  • the second address does not exist in the object information database to illustrate obtaining the second object corresponding to the second address.
  • the second indication information displayed to the user by the first communication device may be as shown in Table 3 below.
  • the rightmost column in Table 3 can be edited by the user to input the first object corresponding to the first address. It should be noted that the fields shown in Table 3 are only for the convenience of understanding this solution. More or fewer fields may be displayed in actual products, and there are no limitations here.
  • Step 504 Generate a first security intent corresponding to the first security policy.
  • step 504 please refer to the description of step 202 in the corresponding embodiment in Figure 2, and will not be described again here.
  • the user entered "online learning service” as the second object in Table 3 and the first security intent can be as shown in Table 4 below:
  • the first security intention it can be used to verify whether the first security policy matches the existing security policy deployment intention.
  • the security policy deployment intention is also expressed in the form of natural language, which is used to indicate whether to allow or prohibit an object from accessing another object.
  • the aforementioned objects can be specifically expressed as: a user type, the name of a business, or a network The name of the zone.
  • Security policy deployment intentions may include any one or more of the following: at least one security rule specified by the user in accordance with security specification requirements, security policy deployment intentions determined to implement services that have been opened, or other types of security policy deployment intentions.
  • the security rules may be prohibiting the Internet area from accessing the data center area, prohibiting the Internet area from accessing the data center area personnel information management services, or other security rules.
  • the security policy deployment intention determined in order to realize the services that have been opened may include allowing users on the Internet to access service 1, allowing service 1 to access service 2, etc., and the list is not exhaustive here.
  • the first security intent can be used to verify whether the newly added security policy deployment intent conflicts with the first security intent.
  • the new security policy deployment intention is, for example, the deployment intention of the security policy determined based on the service to be activated.
  • a new security policy deployment intention is used to indicate whether to allow or prohibit an object from accessing another object. For example, if the business to be opened is to open the online learning service of the data center to Internet users, the deployment intention of the new security policy may include allowing Internet users to access the online learning service.
  • the example here is only for the convenience of understanding this solution and is not used for limitation. this program.
  • Scenario 1 The first security intent is used to verify whether the first security policy matches the existing security policy deployment intent
  • FIG. 6 is a schematic flowchart of a security policy processing method provided by an embodiment of the present application.
  • the security policy processing method provided by the embodiment of the present application includes the following steps 601-605.
  • Step 601 Obtain the first security policy configured on the first security device.
  • the first security policy indicates the first access behavior of the first address to the second address.
  • the first access behavior is to allow or deny access.
  • Step 602 Generate a first security intent according to the first security policy.
  • the first security intent indicates the first access behavior of the first object to the second object.
  • the first object or the second object includes any of the following: user type, business name, or the name of a network zone.
  • steps 601 and 602 is similar to the specific implementation manner of steps 201 and 202 in the corresponding embodiment of Figure 2, and will not be described again here.
  • Step 603 Determine whether the first security policy matches the security policy deployment intent according to the first security intent.
  • the first communication device can obtain at least one security policy deployment intention that has been stored on the first security device, and target any one of the at least one security policy deployment intention (for convenience of description, hereinafter referred to as "Target security policy deployment intention"), the first communication device may determine whether the first security policy matches the target security policy deployment intention according to the first security intention.
  • the target security policy deployment intention indicates the second access behavior of the third object to the fourth object.
  • the third object includes or the fourth object includes any of the following: the type of user, the name of the service, or the name of the network area, and the second access behavior is to allow or deny access.
  • the third object and the first object both include the first sub-address
  • the fourth object and the second object both include the second sub-address
  • the first access behavior and the second access behavior are the same, , it is determined that the first security policy matches the target security policy deployment intention.
  • both the third object and the first object include the first sub-address may include any of the following situations: the third object includes the first object, the first object includes the third object, or the first sub-address is the third object part of the address pointed to, and the first subaddress is part of the address pointed to by the first object.
  • the third object includes the first object includes that the address pointed by the third object is the same as the address pointed by the first object, that is, the third object and the first object are the same object; or, the address pointed by the first object is the third object. Part of the address pointed to by the object.
  • the concept of "the first object includes the third object” is similar to the concept of "the third object includes the first object” and will not be described again here.
  • the concepts of the address pointed by the third object, the address pointed by the first object, the first sub-address and the second sub-address are used to explain the relationship between the third object and the first object.
  • the first communication device may directly determine the relationship between the third object and the first object based on the first object and the second object. For example, if the third object is Network Area 1 and the first object is Service 1 in Network Area 1, then the third object includes the first object. In this example, the address pointed by the first object is part of the address pointed by the third object. . For another example, the third object is network area 2 and the first object is user Z in network area 2. Then the third object includes the first object.
  • the address pointed by the first object is the address pointed by the third object. part.
  • the third object includes the first object.
  • the address pointed by the first object and the address pointed by the third object are the same.
  • the address pointed by the third object and the address pointed by the first object are both Including the address of the device providing service C in network area 1 (that is, an example of the first sub-address), etc., which are not exhaustive here.
  • the address pointed by the first object includes the IP address used by a type of user; if the first object is the name of a service, the address pointed by the first object includes the IP address used by the user.
  • the meaning of "the address pointed to by the third object" is similar to that of "the address pointed by the first object" and will not be described again here.
  • the fourth object includes the second object
  • the address pointed by the fourth object is the same as the address pointed by the second object, or that the address pointed by the second object is part of the address pointed by the fourth object.
  • the address pointed by the second object includes the IP address, port and protocol type used for the aforementioned service; if the second object is the name of a network area, the address pointed by the second object The address includes the IP address used by the aforementioned network area.
  • the meaning of "the address pointed to by the fourth object" is similar to that of "the address pointed by the second object" and will not be described again here.
  • the first access behavior and the second access behavior are the same includes: when the first access behavior is allowed, the second access behavior is also allowed; When the first access behavior is prohibited, the second access behavior is also prohibited.
  • the third object and the first object both include the first sub-address
  • the fourth object and the second object both include the second sub-address
  • the first access behavior and the second access behavior are different, then it is determined
  • the first security policy does not match (that is, conflicts with) the deployment intention of the target security policy.
  • the first communication device may repeatedly perform the above operations to determine whether the first security policy matches each of the at least one security policy deployment intent. If the first security policy matches each of the security policy deployment intentions, then Determine that the first security policy matches the existing security policy deployment intent; if the first security policy does not match any of the at least one security policy deployment intent, determine that the first security policy matches the existing security policy deployment intent on the first security device. The existing security policy deployment intent does not match.
  • a specific judgment method for determining whether the first security policy matches the security policy deployment intention based on the first security intention is clarified, which reduces the difficulty of the judgment process of whether the security policy matches the security policy deployment intention.
  • Step 604 Display the first security policy and the first security intent.
  • step 604 for the specific implementation of step 604, please refer to the description of step 202 in the corresponding embodiment in Figure 2, and will not be described again here.
  • Step 605 Display the first verification result, which indicates whether the first security policy and the security policy deployment intention match.
  • the first communication device may also display the first verification result to the user through the GUI or through the second communication device, and the first verification result indicates whether the first security policy and the security policy deployment intention match.
  • the first communication device may also display warning information to the user to remind the user of the conflict between the first security policy and the first security policy deployment intention.
  • Processing is performed; the first security policy deployment intent is a security policy intent among at least one stored first security policy deployment intent.
  • Steps 604 and 605 can be executed simultaneously, that is, the first communication device can display the first security policy to the user through the GUI or through the second communication device. , the first security intention and the first verification result.
  • step 604 may be performed first, and then step 605 may be performed; or step 605 may be performed first, and then step 604 is performed.
  • Figure 7 is a network topology diagram of a service that has been activated in the network provided by the embodiment of the present application.
  • the IP address of Client-A is, for example, 101.10.1.1
  • the IP address of the personal customer information service is, for example, 182.101.1.1
  • the IP address segment of the Internet area is the public network address
  • the IP address segment of the office area is 192.168. .1.0/24
  • the IP address segment of the data center is, for example, 182.101.1.0/24.
  • the network has already opened services provided by personal customer information services to Internet users.
  • firewall FW-A the same first security policy is deployed on both firewall FW-A and firewall FW-B.
  • Examples of the first security policy are as follows:
  • the above-mentioned first security policy indicates that the IP address 101.10.1.1 mask 255.255.255.255 is allowed to access the IP address 182.101.1.1 mask 255.255.255.255.
  • the first communication device can generate a first security intent corresponding to the first security policy.
  • the first security intent corresponding to the above-mentioned first security policy may indicate: the first access behavior of Client-A among the Internet users to the personal customer information service, and the first access behavior is to allow access.
  • the first communication device obtains a security policy deployment intention from at least one existing security policy deployment intention as follows: Internet The second access behavior of the network to the data center, the second access behavior is prohibited. Since the Internet (an example of the name of the network area) includes Client-A among Internet users and the data center (an example of the name of the network area) includes personal customer information services, the first access behavior and the second access behavior are different, so it is determined The first security intent conflicts with (that is, does not match) the existing security policy deployment intent. Then the first security policy deployed on firewall FW-A and firewall FW-B both conflicts with the security policy deployment intent.
  • the first communication device displays the first verification result and the first security policy corresponding to the first security intention to the user.
  • the first verification result is as shown in Table 5, for example, and the first security policy corresponding to the first security intention is as shown in Table 6, for example.
  • the first security policy after obtaining the first security intent, it can be verified according to the first security intent whether the first security policy matches the existing security policy deployment intent, that is, by determining whether the first security intent matches the security policy deployment intention.
  • the deployment intention matching method is used to determine whether the first security policy matches the security policy deployment intention, thereby realizing the rationality verification of the first security policy.
  • Scenario 2 The first security intent is used to verify whether the new security policy deployment intent conflicts with the first security intent.
  • FIG. 8 is a schematic flowchart of a security policy processing method provided by an embodiment of the present application.
  • the security policy processing method provided by the embodiment of the present application includes the following steps 801-805.
  • Step 801 Obtain the first security policy configured on the first security device.
  • the first security policy indicates the first access behavior of the first address to the second address.
  • the first access behavior is to allow or deny access.
  • Step 802 Generate a first security intent according to the first security policy.
  • the first security intent instructs the first object to perform a first access behavior to the second object.
  • the first object or the second object includes any of the following: user type, business name, or the name of a network zone.
  • steps 801 and 802 is similar to the specific implementation manner of steps 201 and 202 in the corresponding embodiment of Figure 2, and will not be described again here.
  • Step 803 Determine whether the newly added security policy deployment intention conflicts with the first security intent according to the first security intent.
  • the first communication device when it receives a new security policy deployment intention, it can obtain a security intent set corresponding to at least one first security policy deployed on the first security device.
  • the security intent set includes at least one first security policy.
  • Security Intent The first communication device determines whether the newly added security policy deployment intention conflicts with each first security policy in the at least one first security policy. If the new security policy deployment intention conflicts with each first security policy in the at least one first security policy, If none of the policies conflict, it is determined that the new security policy deployment intention does not conflict with the security intent set; if the new security policy deployment intention conflicts with any first security policy in at least one first security policy, it is determined that the new security policy deployment is The intent conflicts with the security intent collection.
  • the newly added security policy deployment intention indicates the third access behavior of the fifth object to the sixth object.
  • the third access behavior is to allow or deny access;
  • the fifth object or the sixth object includes any of the following: user type, business name, or the name of a network zone.
  • step 803 may include: when the first object and the fifth object both include the third sub-address, the second object and the sixth object both include the fourth sub-address. sub-address, and the first access behavior and the third access behavior are different, it is determined that the new security policy deployment intention conflicts with the first security intention.
  • both the first object and the fifth object include the third sub-address
  • both the second object and the sixth object include the fourth sub-address
  • “Subaddress” means that the address pointed by the second object and the address pointed by the sixth object both include the fourth subaddress.
  • both the first object and the fifth object include the third sub-address
  • the second object and the sixth object both include the fourth sub-address
  • the first access behavior and the third access behavior are the same
  • it is determined that the new security policy deployment intention is consistent with The first security intention does not conflict.
  • the address pointed by the first object and the address pointed by the fifth object do not intersect, or the address pointed by the second object and the address pointed by the sixth object do not intersect, it is determined that the new security policy deployment intention does not conflict with the first security intention. .
  • a specific method for determining whether a new security policy deployment intention conflicts with the first security intention is clarified, which reduces the difficulty of the judgment process of whether a new security policy deployment intention conflicts with the first security intention.
  • Step 804 Display the first security policy and the first security intent.
  • Step 805 Display the second verification result.
  • the second verification result indicates whether the newly added security policy deployment intention conflicts with the first security intention.
  • steps 804 and 805 is similar to the specific implementation manner of steps 604 and 605 in the corresponding embodiment of Figure 6, and will not be described again here.
  • the first communication device can also display warning information to the user, To remind the user to handle the conflict situation between the first security policy and the target first security intention.
  • Steps 804 and 805 can be executed simultaneously, that is, the first communication device can display the first security policy to the user through the GUI or through the second communication device. , the first security intention and the first verification result.
  • step 804 may be performed first, and then step 805 may be performed; or step 805 may be performed first, and then step 804 is performed.
  • the first communication device can also determine each second security device according to the access path of the first address to the second address.
  • the second security device is Any other security device on the access path except the first security device.
  • the first communication device obtains the security policy configured on the second security device, and generates a security intent corresponding to the security policy configured on the second security device.
  • the first security intent and the second security intent can be used to verify whether the first security policy and the second security policy match the existing security policy deployment intent.
  • the first security intent and the second security intent are used to verify configuration redundancy.
  • the second security device located on the access path of the first address to the second address can also be obtained, and the second security intent corresponding to the second security policy on the second security device can be obtained, which is beneficial to subsequent access.
  • the first address maintains security policies on other security devices on the access path of the second address.
  • Scenario 1 The first security intent and the second security intent are used to verify whether the first security policy and the second security policy match the existing Security policy deployment intent.
  • FIG. 9 is a schematic flowchart of a security policy processing method provided by an embodiment of the present application.
  • the security policy processing method provided by the embodiment of the present application includes the following steps 901-907.
  • Step 901 Obtain the first security policy configured on the first security device.
  • the first security policy indicates the first access behavior of the first address to the second address.
  • the first access behavior is to allow or deny access.
  • Step 902 Generate a first security intent according to the first security policy.
  • the first security intent indicates the first access behavior of the first object to the second object.
  • the first object or the second object includes any of the following: user type, business name, or the name of a network zone.
  • steps 901 and 902 is similar to the specific implementation manner of steps 201 and 202 in the corresponding embodiment of Figure 2, and will not be described again here.
  • Step 903 Obtain the security policy configured on the second security device.
  • the first security device and the second security device are both located on the target access path from the first address to the second address.
  • the first security device and the second security device are different. safety equipment.
  • Step 904 Generate a security intent corresponding to the security policy configured on the second security device.
  • steps 903 and 904 is similar to the specific implementation manner of steps 201 and 202 in the corresponding embodiment of Figure 2, and will not be described again here.
  • steps 901 and 902 may be executed first, and then steps 903 and 904 are executed; steps 903 and 904 may also be executed first, and then steps 903 and 904 are executed. Steps 901 and 902.
  • Step 905 Determine whether the first security policy and the second security policy match the security policy deployment intent according to the first security intent and the second security intent.
  • the first communication device determines at least one security device included in the target access path of the first address to the second address based on the first address and the second address, if the at least one security device included in the target access path If the number is at least two security devices, it may be determined that at least one second security device is included on the target access path.
  • target second security device For any one of the at least one second security device (for convenience of description, hereafter referred to as the "target second security device"), there may be multiple security devices corresponding to multiple security policies in the target second security device. intention.
  • the first communication device may determine whether there is a second security intent corresponding to the second security policy among the plurality of security intentions corresponding to the target second security device, wherein the second security policy indicates a fourth step between the first address and the second address.
  • the access behavior, the fourth access behavior is to allow or deny access, and the second security intent indicates the fourth access behavior of the first object to the second object.
  • the first communication device can determine the first security policy based on the first security intent and the second security intent corresponding to the target second security device. and whether the second security policy on the target second security device matches the target security policy deployment intention, where the target security policy deployment intention is any one of the at least one security policy deployment intention.
  • the first security policy matches the security policy deployment intent, and the second security intent does not conflict with the first security intent, then it is determined that the first security policy and the target second security
  • the secondary security policies in the device all match the security policy deployment intent.
  • the first communication device determines that the second security intention does not conflict with the first security intention, that is, the first security policy on the first security device is the same as the first security policy on the target second security device.
  • the second security policy does not conflict.
  • the first communication device determines that the second security intention conflicts with the first security intention, that is, the first security policy on the first security device and the target second security device The second security policy conflicts.
  • step 905 does not need to be performed.
  • a specific implementation method is provided for verifying whether the first security policy and the second security policy match the security policy deployment intention based on the first security intent and the second security intent, which reduces the implementation difficulty of this solution.
  • the first communication device may determine that the second security policy is missing on the target second security device.
  • the first communication device may also display warning information to the user through the GUI or through the second communication device, where the warning information is used to inform the user that the second security policy is missing on the target second security device.
  • FIG. 10 is a network topology diagram of the security policy processing method provided by the embodiment of the present application.
  • FIG. 10 includes two sub-schematic diagrams, upper and lower.
  • the upper sub-schematic diagram of FIG. 10 shows a network topology diagram
  • the lower sub-schematic diagram of FIG. 10 shows warning information for informing the user that the second security policy is missing.
  • the IP address of Client-A is 192.168.1.1
  • the IP address of the personal customer information service is 172.101.1.1.
  • the above security policy indicates that the IP address 192.168.1.1 mask 255.255.255.255 is allowed to access the IP address 172.101.1.1mask 255.255.255.255.
  • the first communication device may generate a first security intent corresponding to the first security policy based on the above-mentioned first security policy of the firewall FW-A.
  • the first security intent corresponding to the above-mentioned first security policy may indicate: the first access behavior of Client-A among the Internet users to the personal customer information service, and the first access behavior is to allow access.
  • the first communication device determines that the target access path between Client-A and the personal customer information service includes firewall FW-A and firewall FW- B and firewall FW-C are three security devices, and firewall FW-A and firewall FW-C are determined to be the two second security devices on the target access path between Client-A and the personal customer information business.
  • the first communication device determines whether there is a second security intention in the security intention corresponding to at least one security policy on the firewall FW-B. Since the determination result is no, it determines that the firewall FW The second security policy is missing on -B, which means a warning message needs to be output to the user.
  • the first communication device determines whether there is a second security intent in the security intent corresponding to at least one security policy on the firewall FW-C. Since the judgment result is yes, and the second security intent corresponding to the firewall FW-C If the fourth access behavior does not conflict with the first access behavior, it is determined that the first security policy on firewall FW-A and the second security policy on firewall FW-C both match the security policy deployment intention.
  • the second security intent on FW-A and the second security intent on FW-C match the security policy deployment intent, and the second security policy is missing on FW-B.
  • the ⁇ shown in Figure 10 indicates that the security intent on the corresponding firewall prohibits Client-A from accessing personal customer information services, and the circle indicates that the corresponding firewall lacks a security policy.
  • Step 906 Display the first security policy and the first security intent.
  • Step 907 Display the third verification result.
  • the third verification result indicates whether the first security policy and the second security policy match the security policy deployment intention.
  • the third verification result includes that both the first security policy and the second security policy on the target second security device match the security policy deployment intention; or the first security intention determines that the first security policy matches the security policy deployment intention. , and the second security policy in the target second security device does not match the security policy deployment intention.
  • the specific implementation manner of steps 906 and 907 is similar to steps 604 and 605 in the corresponding embodiment of Figure 6, and will not be described again here.
  • Figure 11 is a network topology diagram of the security policy processing method provided by the embodiment of the present application.
  • Figure 11 includes two sub-schematic diagrams, upper and lower.
  • the upper sub-schematic diagram of Figure 11 shows a network topology diagram
  • the lower sub-schematic diagram of Figure 11 shows the third verification result.
  • the IP address of Client-A is 192.168.1.1
  • the IP address of the personal customer information service is 172.101.1.1.
  • firewall FW-B The security policy deployed on firewall FW-B is as follows:
  • the above security policy instructions prohibit the IP address 192.168.1.1 mask 255.255.255.255 from accessing the IP address 172.101.1.1 mask 255.255.255.255.
  • firewalls FW-A and FW-C The same security policy is deployed on firewalls FW-A and FW-C.
  • An example of the same security policy is as follows:
  • the above security policy indicates that the IP address 192.168.1.1 mask 255.255.255.255 is allowed to access the IP address 172.101.1.1 mask 255.255.255.255.
  • the first communication device may generate a first security intent corresponding to the first security policy.
  • the first security intent corresponding to the above-mentioned first security policy may indicate: Client-A's first access behavior to the personal customer information service, and the first access behavior is to prohibit access.
  • the first communication device determines that the target access path between Client-A's personal customer information services includes three security devices: firewall FW-A, firewall FW-B, and firewall FW-C, and determines firewall FW-A and firewall FW- C is the two second security devices on the target access path between Client-A's personal customer information business.
  • the first communication device can generate a security intent corresponding to the security policy on the firewall FW-A and the firewall FW-C, and obtain the security intent from the firewall FW-A and the firewall FW-C respectively.
  • the second security intent is determined from at least one security intent corresponding to the security policy on firewall A and FW-C.
  • the second security intent corresponding to the firewall FW-A and the firewall FW-C may indicate: the fourth access behavior performed by Client-A on the personal customer information business, and the fourth access behavior is to allow access.
  • ⁇ shown in Figure 11 indicates that the security intent indication on the corresponding firewall prohibits Client-A from accessing the personal customer information business, and ⁇ indicates that the security intent indication on the corresponding firewall allows Client-A to access the personal customer information business.
  • the first communication device After the first communication device determines that the first security policy matches the security policy deployment intent, it can determine whether the second security intent corresponding to the firewall FW-A and the firewall FW-C conflicts with the first security intent. If the second security intent corresponding to FW-C conflicts with the first security intent, the third verification result is to determine that the first security policy on firewall FW-B matches the security policy deployment intent, and that on firewall FW-A and firewall FW-C The second security policy does not match the security policy deployment intent.
  • the first security policy and the second security policy match the security policy deployment intent based on the first security intent and the second security intent, providing another application method of the first security intent.
  • the application scenarios of this solution are expanded and the flexibility of this solution is further improved.
  • it can be verified not only whether the security policy on a single security device matches the security policy deployment intention, but also whether all security devices on the access path of the first address to the second address match the security policy deployment intention, that is, by Comparing the first security intention and the second security intention, and the security policy deployment intention, the rationality of the first security policy and the second security policy is verified.
  • Scenario 2 The first security intent and the second security intent are used to verify configuration redundancy.
  • FIG 12 is a schematic flowchart of a security policy acquisition method provided by an embodiment of the present application.
  • the security policy acquisition method provided by the embodiment of this application includes the following steps 1201-1207:
  • Step 1201 Obtain the first security policy configured on the first security device.
  • the first security policy indicates the first access behavior of the first address to the second address.
  • the first access behavior is to allow or deny access.
  • Step 1202 Generate a first security intent according to the first security policy.
  • the first security intent indicates the first access behavior of the first object to the second object.
  • the first object or the second object includes any of the following: user type, business name, or the name of a network zone.
  • steps 1201 and 1202 is similar to the specific implementation manner of steps 201 and 202 in the corresponding embodiment of Figure 2, and will not be described again here.
  • Step 1203 Obtain the security policy configured on the second security device.
  • the first security device and the second security device are both located on the target access path from the first address to the second address.
  • the first security device and the second security device are different. safety equipment.
  • Step 1204 Generate a security intent corresponding to the security policy configured on the second security device.
  • steps 1203 and 1204 is similar to the specific implementation manner of steps 201 and 202 in the corresponding embodiment of Figure 2, and will not be described again here.
  • Step 1205 Determine whether the first security policy and the second security policy are configured redundantly based on the first security intent and the second security intent.
  • the first communication device determines at least one security device included in the target access path of the first address to the second address based on the first address and the second address, if the at least one security device included in the target access path If the number is at least two security devices, it may be determined that at least one second security device is included on the target access path.
  • the target second security device For any one of the at least one second security device (for convenience of description, hereafter referred to as the "target second security device"), when the first access behavior is to prohibit access, the target second security device There may be multiple security intentions corresponding to multiple security policies, and the first communication device may obtain the second security intent corresponding to the second security policy from the multiple security intentions corresponding to the target second security device, where the second The security policy indicates a fourth access behavior of the first address to the second address, the fourth access behavior is a permitted or prohibited access behavior, and the second security intent instructs the first object to perform a fourth access behavior to the second object.
  • the fourth access behavior is prohibited, that is, there is at least one second security intent among the multiple security intentions corresponding to the target second security device. If the instruction prohibits the first object from accessing the second object, it is determined that the first security policy and the second security policy on the target second security device are configured for redundancy. If there is no second security intent in the at least one second security intent indicating that the first object is prohibited from accessing the second object, it is determined that there is no configuration redundancy between the first security policy and the second security policy on the target second security device.
  • the first communication device performs the above operations on each of the at least one second security device to determine whether there is configuration redundancy between the first security policy and the second security policy on each second security device. If there is configuration redundancy between the first security policy and the second security policy on at least one second security device on the target access path, it is determined that there is configuration redundancy between the first security policy and the second security policy.
  • Step 1206 Display the first security policy and the first security intent.
  • Step 1207 Display the fourth verification result.
  • the fourth verification result indicates whether there is configuration redundancy between the first security policy and the second security policy.
  • steps 1206 and 1207 are similar to steps 604 and 605 in the corresponding embodiment of Figure 6, and will not be described again here.
  • treatment suggestions may also be displayed to the user through the GUI or the second communication device according to the deployment strategy of the security policy.
  • the disposition recommendation is used to indicate which security policy on the security device on the target access path is retained;
  • the deployment strategy of the security policy includes one or more of the following: near first object policy, near second object policy, resource comparison policy, random Strategies or other strategies, etc., will not be exhaustive here.
  • the near first object policy is used to select and retain the security policy on the security device closest to the first object among at least one security device passed by the target access path
  • the near second object policy is used to select and retain the security policy on at least one security device passed by the target access path.
  • select and retain the security policy on the security device closest to the second object select and retain the security policy on the security device closest to the second object.
  • the resource comparison policy is used to select and retain the security policy on the security device with the most security resources among at least one security device passed by the target access path.
  • the security resources It is the free storage space in the security device used to store security policies.
  • Figure 13 is a network topology diagram of a security policy processing method provided by an embodiment of the present application.
  • Figure 13 includes two sub-schematic diagrams, upper and lower.
  • the upper sub-schematic diagram of Figure 13 shows a network topology diagram
  • the lower sub-schematic diagram of Figure 13 shows the fourth verification result.
  • the IP address of Client-A is 192.168.1.1
  • the IP address of the personal customer information business is 172.101.1.1.
  • firewall FW-A The security policies deployed on both firewall FW-A and firewall FW-B are as follows:
  • the above security policy instructions prohibit the IP address 192.168.1.1 mask 255.255.255.255 from accessing the IP address 172.101.1.1 mask 255.255.255.255.
  • the first communication device may generate a first security intent corresponding to the first security policy.
  • the first security intent corresponding to the above-mentioned first security policy may indicate: Client-A's first access behavior to the personal customer information service, and the first access behavior is to prohibit access.
  • the first communication device determines that the target access path between Client-A's personal customer information service includes two security devices, firewall FW-A and firewall FW-B, and determines that firewall FW-B is Client-A's personal customer information service.
  • the first communication device can generate a second security intent corresponding to the second security policy.
  • the second security intent corresponding to the second security policy on firewall FW-B may indicate: Client-A performs a fourth access behavior on the personal customer information business, and the fourth access behavior is to prohibit access.
  • the first communication device determines that the second security intent corresponding to the firewall FW-B indicates that Client-A is prohibited from accessing the personal customer information service, and determines that the first security policy in the firewall FW-A and the second security policy in the firewall FW-B are Configure redundancy.
  • the security policy on FW-A and the security policy on FW-B have redundant configurations.
  • the ⁇ in the lower diagram indicates that the security intent of the corresponding firewall prohibits Client-A from accessing personal customer information services. It should be understood that the example in Figure 13 is only for convenience of understanding this solution and is not used to limit this solution.
  • the present application it can also be determined based on the first security intention and the second security intention whether there is redundant configuration of security policies on multiple security devices, which is conducive to timely discovery of redundant security policies and improves the control of security devices. Resource utilization.
  • another application method of the first security intention is provided, which expands the application scenarios of this solution and further improves the flexibility of this solution.
  • One or more verification results can also be displayed to the user, which is helpful to prompt the user to promptly discover problems in the security policy that has been deployed in the security device or the security policy to be deployed, and to help the user promptly discover existing or potential risks. , which is conducive to improving the stability of network operation.
  • the security policy processing device 1400 includes an acquisition module 1401 and a generation module 1402 .
  • the acquisition module 1401 is configured to acquire the first security policy configured on the first security device.
  • the first security policy indicates the first access behavior of the first address to the second address, and the first access behavior is to allow or prohibit access.
  • Generating module 1402, configured to generate a first security intent according to the first security policy, where the first security intent indicates a first access behavior of the first object to the second object.
  • the first object or the second object includes any of the following: the type of user, the name of the service, or the name of the network area.
  • FIG. 15 is a schematic structural diagram of a security policy processing device provided by an embodiment of the present application.
  • the security policy processing device 1400 also includes a determination module 1403 .
  • the determining module 1403 is configured to determine the first object according to the first address and the second object according to the second address.
  • the determination module 1403 is also configured to determine the first object based on the first address and the object information database, and determine the second object based on the second address and the object information database.
  • the object information base includes each object in at least one object and address information of each object. At least one object includes a first object and a second object. Each object is any of the following: a type of user, the name of a service, or the name of a network area.
  • the first security intent is used to verify whether the first security policy matches the security policy deployment intent.
  • the security policy deployment intention indicates the second access behavior of the third object to the fourth object.
  • the determination module 1403 is also used when the third object and the first object both include the first sub-address, the fourth object and the second object both include the second sub-address, and the first access behavior and the second access behavior are When they are the same, it is determined that the first security policy matches the security policy deployment intention.
  • the first security intent is used to verify whether the newly added security policy deployment intent conflicts with the first security intent.
  • a new security policy deployment intention is added to indicate the third access behavior of the fifth object to the sixth object.
  • the determination module 1403 is also used when the first object and the fifth object both include the third sub-address, the second object and the sixth object both include the fourth sub-address, and the first access behavior and the third access behavior At the same time, it is determined that the new security policy deployment intention conflicts with the first security intention.
  • the obtaining module 1401 is also used to obtain the second security policy configured on the second security device, and the generating module 1402 is also used to generate a second security intention according to the second security policy.
  • the second security policy instructs the first address to perform a fourth access behavior to the second address, and the second security intent instructs the first object to perform a fourth access behavior to the second object.
  • the first security device is located on the access path from the first address to the second address, and the second security device is any other security device on the access path.
  • the first security intent and the second security intent are used to verify whether the first security policy and the second security policy match the security policy deployment intent.
  • the security policy deployment intention indicates the second access behavior of the third object to the fourth object.
  • the determination module 1403 is also configured to determine the first security when the third object includes the first object, the fourth object includes the second object, and the first access behavior and the fourth access behavior are the same as the second access behavior.
  • the policy and the secondary security policy match the security policy configuration intent.
  • the first security intent and the second security intent are used to verify configuration redundancy.
  • the determination module 1403 is also configured to determine that configuration redundancy exists when both the first security intention and the second security intention indicate that the first object is prohibited from accessing the second object.
  • the security policy processing device 1400 also includes a display module 1404 .
  • the display module 1404 is used to display the first security policy and the first security intention.
  • the display module 1404 is also used to display one or more of the following: the first verification result, the second verification result, the third verification result, or the fourth verification result.
  • the first verification result indicates whether the first security policy matches the security policy deployment intention.
  • the second verification result indicates whether the newly added security policy deployment intention conflicts with the first security intention.
  • the third verification result indicates whether the first security policy and the second security policy match the security policy deployment intention.
  • the fourth verification result indicates whether configuration redundancy exists.
  • the obtaining module 1401 is also configured to obtain a third security policy from the third security device, where the third security policy indicates whether to allow or prohibit the third address from accessing the fourth address.
  • the acquisition module 1401 is also used to acquire the seventh object corresponding to the third address, acquire the eighth object corresponding to the fourth address, and add the seventh object between the seventh object and the third address in the object information library.
  • the corresponding relationship, as well as the corresponding relationship between the eighth object and the fourth address, is used to obtain a new object information base.
  • the seventh object or the eighth object includes any of the following: the type of user, the name of the service, or the name of the network area.
  • Figure 16 is a schematic structural diagram of a network device 1600 provided in an embodiment of the application.
  • Network device 1600 is equipped with the above security policy processing device.
  • Network device 1600 is implemented by a general bus architecture.
  • Network device 1600 includes at least one processor 1601, a communication bus 1602, a memory 1603, and at least one communication interface 1604.
  • the processor 1601 is a general processor (central processing unit, CPU), a network processor (network processor, NP), a microprocessor, or one or more integrated circuits used to implement the solution of this application, For example, application-specific integrated circuit (ASIC), programmable logic device (PLD) or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above-mentioned PLD is a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL) or any combination thereof.
  • Communication bus 1602 is used to transfer information between the above-mentioned components.
  • the communication bus 1602 is divided into an address bus, a data bus, a control bus, etc.
  • address bus a data bus
  • control bus a control bus
  • only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.
  • the memory 1603 is a read-only memory (ROM) or other type of static storage device that can store static information and instructions.
  • memory 1603 is random access memory (RAM) or other types of dynamic storage devices that can store information and instructions.
  • the memory 1603 is electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disc storage ( Including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be used by a computer Any other medium for access, but not limited to this.
  • the memory 1603 exists independently and is connected to the processor 1601 through the communication bus 1602.
  • the memory 1603 and the processor 1601 are integrated together.
  • Communication interface 1604 uses any transceiver-like device for communicating with other devices or communication networks.
  • Communication interface 1604 includes a wired communication interface.
  • the communication interface 1604 also includes a wireless communication interface.
  • the wired communication interface is, for example, an Ethernet interface.
  • the Ethernet interface is an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface is a wireless local area networks (WLAN) interface, a cellular network communication interface or a combination thereof, etc.
  • WLAN wireless local area networks
  • the processor 1601 includes one or more CPUs, such as CPU0 and CPU1 as shown in FIG. 16 .
  • the network device 1600 includes multiple processors, such as the processor 1601 and the processor 1605 shown in Figure 16 .
  • processors are a single-core processor (single-CPU), or a multi-core processor (multi-CPU).
  • a processor here refers to one or more devices, circuits, and/or processing cores for processing data (such as computer program instructions).
  • the memory 1603 is used to store the program code 1616 for executing the solution of the present application, and the processor 1601 executes the program code 1616 stored in the memory 1603. That is to say, the network device 1600 implements the above method embodiment through the processor 1601 and the program code 1616 in the memory 1603.
  • A refers to B, which means that A is the same as B or that A is a simple transformation of B.
  • first and second in the description and claims of the embodiments of this application are used to distinguish different objects, rather than to describe a specific order of objects, and cannot be understood to indicate or imply relative importance. sex.
  • first speed-limited channel and the second speed-limited channel are used to distinguish different speed-limited channels, rather than describing a specific order of speed-limited channels, nor can it be understood that the first speed-limited channel is more powerful than the second speed-limited channel. important.
  • the above embodiments may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with the embodiments of the present application are generated in whole or in part.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer instructions may Stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center via wired (e.g., simultaneous Axial cable, optical fiber, Digital Subscriber Line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means to transmit to another website, computer, server or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that contains one or more available media integrated.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media (eg, solid state disk (Solid State Disk, SSD)), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

一种安全策略的处理方法，涉及网络安全技术领域。第一通信设备获取第一安全设备上配置的第一安全策略，根据第一安全策略生成第一安全意图。其中，第一安全策略指示第一地址对第二地址的第一访问行为，第一访问行为为允许或禁止访问，第一安全意图指示第一对象对第二对象的第一访问行为，第一对象或第二对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称。基于易理解的方式，安全意图直接表示了业务间、网络间、用户间，或者用户、业务和网络相互间的访问需求。将通过IP信息表示的安全策略，转换为易于理解的安全意图，使得网络管理员更容易理解和维护安全策略。

Description

一种安全策略的处理方法及相关装置
本申请要求于2022年06月29日提交中国专利局、申请号为202210752166.3、发明名称为“一种安全策略的处理方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络安全技术领域，尤其涉及一种安全策略的处理方法及相关装置。
背景技术
近年来，网络安全问题日益突出。为了保证网络的安全性，安全设备(例如，防火墙)被部署以阻止外部攻击。
网络管理员通常基于互联网协议(Internet Protocol，IP)五元组逐条设置安全策略，以使得防火墙识别需要阻止的报文或者允许通过的报文，但基于IP五元组的安全策略不便于理解和维护。
发明内容
本申请提供了一种安全策略的处理方法和相关装置，使得安全策略更易理解和维护。
本申请第一方面提供一种安全策略的处理方法，可以应用于第一通信设备。第一通信设备例如为网管设备或部署于内部网络或外部网络的其他设备。第一通信设备获取第一安全设备上配置的第一安全策略，并根据第一安全策略生成第一安全意图。
其中，第一安全策略指示第一地址对第二地址的第一访问行为，第一访问行为为允许或禁止访问。例如，第一地址为源地址，第二地址为目的地址。源地址例如为媒体存取控制(Media Access Control，MAC)地址、源IP地址、源端口(port)，或者上述信息的组合。目的地址例如为目的MAC地址、目的IP地址、目的端口，或者上述信息的组合。
其中，第一安全意图指示第一对象对第二对象的第一访问行为，第一对象或第二对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称。第一安全意图例如是采用自然语言的形式表达允许或禁止一种访问行为。第一对象是第一访问行为的发起者，例如第一对象可以为发起第一访问行为的用户的类型，或发起第一访问行为的业务的名称，或发起第一访问行为的网络区域的名称。第二对象是第一访问行为的接受者，例如第二对象为允许或禁止第一对象访问的用户的类型、或者允许或禁止第一对象访问的业务的名称，或者允许或禁止第一对象访问的网络区域的名称。
本方案中，基于易理解的方式，安全意图直接表示了业务间、网络间、用户间，或者用户、业务和网络相互间的访问需求。因此，将通过IP信息表示的安全策略，转换为易于理解的安全意图，使得安全策略更易理解和维护。
可选的，第一通信设备根据第一地址确定第一对象，并根据第二地址确定第二对象。例如，源IP地址、源端口、协议类型，或者上述信息的组合用于确定第一对象。例如，目的IP地址、目的端口、协议类型，或者上述信息的组合用于确定第二对象。
明确了安全策略中的第一地址和第二地址与安全意图中的第一对象和第二对象之间的对应关系，有利于提高安全意图到安全策略的转换过程的准确度。
可选的，第一通信设备根据第一地址和对象信息库确定第一对象，根据第二地址和对象信息库确定第二对象。也即从对象信息库中获取与第一地址对应的第一对象，获取与第二地址对应的第二对象。对象信息库包括至少一个对象中的每个对象和每个对象的地址信息，至少一个对象包括第一对象和第二对象，每个对象为以下任一项：一种用户的类型，一种业务的名称，或一个网络区域的名称。
本方案中，根据对象描述信息确定与第一地址对应的第一对象以及与第二地址对应的第二对象，提高了安全策略转换为安全意图的效率。
可选的，第一安全意图用于校验第一安全策略是否匹配安全策略部署意图。其中，安全策略部署意图指示允许或禁止某一个对象对另一个对象的访问行为，前述对象具体可以表现为：一种用户类型、一 个业务的名称或者一个网络区域的名称。即，通过比较第一安全意图和安全策略部署意图，实现了校验第一安全策略的合理性。
可选的，安全策略部署意图指示第三对象对第四对象的第二访问行为。当第三对象和第一对象均包括第一子地址，第四对象和第二对象均包括第二子地址，且第一访问行为和第二访问行为相同时，第一通信设备确定第一安全策略匹配安全策略部署意图。
例如，“第三对象和第一对象均包括第一子地址”可以包括如下任一种情况：第三对象包括第一对象、第一对象包括第三对象，或者第一子地址为第三对象指向的地址中的一部分，且第一子地址为第一对象指向的地址中的一部分。需要说明的是，本申请中借助第一子地址和第二子地址的概念是用来解释第三对象和第一对象之间的关系，第一通信设备可以直接根据第一对象和第二对象确定第三对象和第一对象之间的关系。例如，第三对象为网络区域1，第一对象为网络区域1中的业务1，则第三对象包括第一对象，本示例中第一对象指向的地址是第三对象指向的地址中的一部分。又例如，第三对象为业务C，网络区域1、网络区域2和网络区域3中均提供业务C，第一对象为网络区域1，则第三对象指向的地址和第一对象指向的地址均包括网络区域1中提供业务C的设备的地址(也即第一子地址的一个示例)等。
可选的，第一安全意图用于校验新增安全策略部署意图是否与第一安全意图冲突。新增安全策略部署意图例如是基于待开通的业务确定的安全策略的部署意图，一个新增安全策略部署意图用于指示允许或禁止某一个对象对另一个对象的访问行为。当出现新增安全策略部署意图之后，在配置与新增安全策略部署意图对应的安全策略之前，先校验新增安全策略部署意图是否与前述多个第一安全意图冲突，有利于降低新增加的安全策略与已经存在的安全策略出现冲突的可能性，从而提高网络运行过程的稳定性，也有利于保证网络能够顺利的向用户提供业务。
可选的，新增安全策略部署意图指示第五对象对第六对象的第三访问行为。当第一对象和第五对象均包括第三子地址，第二对象和第六对象均包括第四子地址，且第一访问行为和第三访问行为不同时，第一通信设备确定新增安全策略部署意图与第一安全意图冲突。
可选的，第一通信设备获取第二安全设备上配置的第二安全策略，并根据第二安全策略生成第二安全意图。第二安全策略指示第一地址对第二地址的第四访问行为。第二安全意图指示第一对象对第二对象执行第四访问行为。第一安全设备位于第一地址对第二地址的访问路径上，第二安全设备是访问路径上的任意一个其他安全设备。获取前述信息有利于后续对第一地址对第二地址的访问路径上其它安全设备上的安全策略进行维护。
可选的，第一安全意图和第二安全意图用于校验第一安全策略和第二安全策略是否匹配安全策略部署意图。即，通过比较第一安全意图和第二安全意图，以及安全策略部署意图，实现了校验第一安全策略和第二安全策略的合理性。
可选的，安全策略部署意图指示第三对象对第四对象的第二访问行为。当第三对象和所述第一对象均包括第一子地址，第四对象和第二对象均包括第二子地址，且第一访问行为和第四访问行为与第二访问行为相同时，第一通信设备确定第一安全策略和第二安全策略匹配安全策略配置意图。
可选的，若第一访问行为是禁止访问，则第一安全意图和第二安全意图可以用于校验是否存在配置冗余。基于第一安全意图和第二安全意图确定多个安全设备上是否存在安全策略的配置冗余，有利于及时发现冗余的安全策略，提高安全设备的资源的利用率。
可选的，当第一安全意图和第二安全意图均指示禁止第一对象访问第二对象时，第一通信设备确定存在配置冗余。当想要禁止第一地址对第二地址的访问行为时，只要在第一地址至第二地址的访问路径上的任一个安全设备上配置用于禁止第一地址对第二地址的访问行为的安全策略即可，因此当第一安全意图和第二安全意图均指示禁止第一对象访问第二对象时，就可以确定第一安全策略和第二安全策略之间存在配置冗余，提供了确定配置冗余的一种具体实现方案，增强了本方案的可实现性。
可选的，第一通信设备可以通过图形用户界面(graphic user interface,GUI)或第二通信设备向用户显示第一安全策略和第一安全意图。向用户展示安全策略和基于安全策略得到的安全意图，也即将安全意图和安全策略关联起来，使用户更容易理解安全策略的含义，有利于降低安全策略的维护阶段的 难度。
可选地，第一通信设备可以通过GUI或第二通信设备向用户显示第一内容、第二内容和第三内容。其中，第一内容包括第一对象、第一地址以及第一对象和第一地址的对应关系，第二内容包括第二对象、第二地址以及第二对象和第二地址的对应关系，第三内容包括第一访问行为。
可选的，第一通信设备可以通过GUI或第二通信设备向用户显示以下一项或多项：第一校验结果，第二校验结果，第三校验结果，或者第四校验结果。第一校验结果指示第一安全策略是否匹配安全策略部署意图。第二校验结果指示新增安全策略部署意图是否与第一安全意图冲突。第三校验结果指示第一安全策略和第二安全策略是否匹配安全策略部署意图。第四校验结果指示是否存在配置冗余。显示上述校验结果，有利于提示用户及时发现安全设备中已经部署的安全策略或者待部署的安全策略中存在的问题，有利于提高网络运行的稳定性。
可选的，第一通信设备从第三安全设备获取第三安全策略，第三安全策略指示允许或禁止第三地址对第四地址的访问行为，获取与第三地址对应的第七对象，获取与第四地址对应的第八对象，并在对象信息库中添加第七对象和第三地址之间的对应关系，以及第八对象和第四地址之间的对应关系，得到新的对象信息库。第七对象或第八对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称。当对象信息库中不存在一个地址时，可以由用户来确定与该地址对应的对象，并在对象信息库中添加该地址和该对象，也即在基于安全策略生成安全意图的过程中，可以动态更新对象信息库，从而不断完善对象信息库，有利于降低以后执行安全策略到安全意图的转换操作的难度。
本申请第二方面提供一种安全策略的处理装置。安全策略的处理装置包括获取模块和生成模块。获取模块，用于获取第一安全设备上配置的第一安全策略。生成模块，用于根据第一安全策略生成第一安全意图。第一安全策略指示第一地址对第二地址的第一访问行为。第一访问行为为允许或禁止访问。第一安全意图指示第一对象对第二对象的第一访问行为。第一对象或第二对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称。
可选的，生成模块，具体用于：根据第一地址确定第一对象，根据第二地址确定第二对象。
可选的，安全策略的处理装置还包括确定模块。确定模块用于根据第一地址和对象信息库确定第一对象，根据第二地址和对象信息库确定第二对象。对象信息库包括至少一个对象中的每个对象和每个对象的地址信息。至少一个对象包括第一对象和第二对象。每个对象为以下任一项：一种用户的类型，一种业务的名称，或一个网络区域的名称。
可选的，第一安全意图用于校验第一安全策略是否匹配安全策略部署意图。
可选的，安全策略部署意图指示第三对象对第四对象的第二访问行为。确定模块，还用于当第三对象和第一对象均包括第一子地址，第四对象和第二对象均包括第二子地址，且第一访问行为和第二访问行为相同时，确定第一安全策略匹配安全策略部署意图。
可选的，第一安全意图用于校验新增安全策略部署意图是否与第一安全意图冲突。
可选的，新增安全策略部署意图指示第五对象对第六对象的第三访问行为。确定模块，还用于当第一对象和第五对象均包括第三子地址，第二对象和第六对象均包括第四子地址，且第一访问行为和第三访问行为不同时，确定新增安全策略部署意图与第一安全意图冲突。
可选的，获取模块还用于获取第二安全设备上配置的第二安全策略，生成模块，还用于根据第二安全策略生成第二安全意图。第二安全策略指示第一地址对第二地址的第四访问行为，第二安全意图指示第一对象对第二对象执行第四访问行为。第一安全设备位于第一地址对第二地址的访问路径上，第二安全设备是访问路径上的任意一个其他安全设备。可选的，第一安全意图和第二安全意图用于校验第一安全策略和第二安全策略是否匹配安全策略部署意图。
可选的，安全策略部署意图指示第三对象对第四对象的第二访问行为。确定模块，还用于当第三对象包括第一对象，第四对象包括第二对象，且第一访问行为和第四访问行为与第二访问行为相同时，确定第一安全策略和第二安全策略匹配安全策略配置意图。
可选的，第一安全意图和第二安全意图用于校验配置冗余。
可选的，确定模块，还用于当第一安全意图和第二安全意图均指示禁止第一对象访问第二对象时， 确定存在配置冗余。
可选的，安全策略的处理装置还包括显示模块。显示模块用于显示第一安全策略和第一安全意图。
可选的，显示模块，还用于显示以下一项或多项：第一校验结果，第二校验结果，第三校验结果，或者第四校验结果。第一校验结果指示第一安全策略是否匹配安全策略部署意图。第二校验结果指示新增安全策略部署意图是否与第一安全意图冲突。第三校验结果指示第一安全策略和第二安全策略是否匹配安全策略部署意图。第四校验结果指示是否存在配置冗余。
可选的，安全策略的处理装置还包括获取模块。获取模块还用于从第三安全设备获取第三安全策略，第三安全策略指示运行或禁止第三地址对第四地址的访问行为。获取模块，还用于获取与第三地址对应的第七对象，获取与第四地址对应的第八对象，并在对象信息库中添加第七对象和第三地址之间的对应关系，以及第八对象和第四地址之间的对应关系，得到新的对象信息库。第七对象或第八对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称。
本申请第三方面提供一种网络设备，包括处理器和存储器。存储器用于存储程序代码，处理器用于调用存储器中的程序代码以使得网络设备执行如第一方面或第一方面的任意一种实施方式的方法。
本申请第四方面提供一种计算机可读存储介质，存储有指令，当指令在计算机上运行时，使得计算机执行如第一方面或第一方面的任意一种实施方式的方法。
本申请第五方面提供一种计算机程序产品，当其在计算机上运行时，使得计算机执行如第一方面或第一方面的任意一种实施方式的方法。
本申请第六方面提供一种芯片，包括一个或多个处理器。处理器中的部分或全部用于读取并执行存储器中存储的计算机指令，以执行上述任一方面任意可能的实施方式中的方法。可选的，芯片还包括存储器。可选的，芯片还包括通信接口，处理器与通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从通信接口获取数据和/或信息，并对数据和/或信息进行处理，并通过通信接口输出处理结果。可选的，通信接口是输入输出接口或者总线接口。本申请提供的方法由一个芯片实现，或者由多个芯片协同实现。
上述第二方面至第六方面提供的方案，用于实现或配合实现上述第一方面提供的方法，因此能够与第一方面达到相同或相应的有益效果，此处不再进行赘述。
附图说明
图1为本申请实施例提供的一种网络部署场景的示意图；
图2为本申请实施例提供的一种安全策略的处理方法的流程示意图；
图3为本申请实施例提供的一种获取与第一地址对应的第一对象的方法流程示意图；
图4为本申请实施例提供的一种安全策略和安全意图的展示示意图；
图5为本申请实施例提供的另一种安全策略的处理方法的流程示意图；
图6为本申请实施例提供的另一种安全策略的处理方法的流程示意图；
图7为本申请实施例提供的网络中已经开通的一种业务的网络拓扑示意图；
图8为本申请实施例提供的另一种安全策略的处理方法的流程示意图；
图9为本申请实施例提供的另一种安全策略的处理方法的流程示意图；
图10为本申请实施例提供的安全策略的处理方法的一种网络拓扑图；
图11为本申请实施例提供的安全策略的处理方法的另一种网络拓扑图；
图12为本申请实施例提供的另一种安全策略的处理方法的流程示意图；
图13为本申请实施例提供的一种网络设备的结构示意图；
图14为本申请实施例提供的一种安全策略的处理装置的结构示意图；
图15为本申请实施例提供的另一种安全策略的处理装置的结构示意图；
图16为本申请实施例提供的一种网络设备的结构示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
在这里专用的词“示例性”意为“用作例子、实施例或说明性”。这里作为“示例性”所说明的任何实施例不必解释为优于或好于其它实施例。
本申请实施例提供了一种安全策略的处理方法，用于降低理解安全策略时的难度。本申请实施例还提供了相应的安全策略的处理装置、通信设备和计算机可读存储介质等。为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请的实施方式作进一步地详细描述。
请参阅图1，图1为本申请实施例提供的一种网络部署场景的示意图。如图1所示，网络架构中包括内部网络、外部网络和第一通信设备。其中，内部网络包括防火墙、用于转发报文的网络设备和终端设备，内部网络中的安全设备指的是内部网络中部署有安全策略的通信设备，则前述安全设备可以包括如下任一项或多项：防火墙、用于转发报文的网络设备或终端设备等。
当安全设备接收到报文时，可以匹配部署的安全策略和报文的信息(例如，报文的源地址，报文的目的地址等)，以确定允许或禁止该报文通过。应理解，虽然图1中示出的第一通信设备部署于内部网络之外(例如，第一通信设备为云端设备)，但图1仅为网络部署场景的一个示例，在其他场景中，第一通信设备也可以部署于内部网络中，此处不做限定。为便于理解，以下将详细介绍网络架构中的各个设备。
内部网络可以划分为多个网络区域，例如图1中的数据中心网络和办公园区。每个网络区域可以有不同的安全要求，所以每个网络区域均可以部署安全设备，例如，图1所示的办公园区网络部署防火墙1，图1所示的数据中心网络部署防火墙2。不同位置处的安全设备可以配置不同的安全策略。
内部网络中的终端设备可以包括内部网络中的用户使用的终端设备(例如图1中的终端设备1和终端设备2)、用于提供业务的终端设备(例如图1中的数据库服务器和Web服务器)或其他用途的终端设备(例如图1中的报表服务器和测试服务器)等，此处不做限定。
示例性地，终端设备包括服务器、个人电脑、笔记本电脑、智能手机、平板电脑以及物联网设备等物理设备。可选的，终端设备包括部署于物理设备上的虚拟化设备，例如终端设备包括部署于服务器上且用于提供业务服务的虚拟机(virtual machine，VM)。
部署于防火墙和终端设备之间的网络设备为报文转发设备，用于转发外部网络与内部网络中的终端设备之间的流量以及内部网络中不同终端设备之间的流量。示例性地，网络设备包括交换机、网关以及路由器等报文转发设备。可选的，网络设备的实现为部署在硬件设备上的虚拟化设备。例如，网络设备包括运行有用于发送报文的程序的VM，虚拟路由器或虚拟交换机。
第一通信设备是本申请实施例提供的安全策略的获取方法的执行主体。示例性地，第一通信设备包括服务器或者部署在服务器上的VM。该服务器可以部署于公有云、私有云或混合云中。应理解，本申请实施例提供的安全策略的获取方法的执行主体还可以是其他设备，例如，网管设备或者是内部网络中的某个网络设备(例如，报文转发设备或防火墙)等，具体可以结合实际应用场景灵活确定，此处不做限定。
具体地，第一通信设备用于获取第一安全设备上配置的第一安全策略，并根据获取到的第一安全策略，生成第一安全意图。其中，第一安全策略指示第一地址对第二地址的第一访问行为，第一安全意图指示第一对象对第二对象的第一访问行为。
安全策略包括第一地址和第二地址，安全策略用于指示安全设备允许或禁止第一地址访问第二地址。第一对象或第二对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称。例如，安全意图为允许互联网用户访问web服务。此时，第一对象包括用户的类型(即，互联网用户)，第二对象包括业务的名称(即，web服务)。又例如，安全意图为禁止互联网用户访问数据库服务。此时，第一对象包括用户的类型(即，互联网用户)，第二对象包括业务的名称(即，数据库服务)。又例如，安全意图 为允许web服务访问数据库服务。此时，第一对象包括一个业务的名称(即，web服务)，第二对象包括另一个业务的名称(即，数据库服务)。又例如，安全意图为禁止办公园区访问数据中心。此时，第一对象包括一个网络区域的名称(即，办公园区)，第二对象包括另一个网络区域的名称(即，数据中心)。又例如，安全意图为禁止办公园区访问数据中心。此时，第一对象包括一个网络区域的名称(即，办公园区)，第二对象包括另一个网络区域的名称(即，数据中心)。又例如，安全意图为禁止生产车间访问数据库服务。此时，第一对象包括一个网络区域的名称(即，办公园区)，第二对象包括业务的名称(即，数据库服务)。即，基于易理解的方式，安全意图直接表示了业务间、网络间、用户间，或者用户、业务和网络相互间的访问需求，因此，根据安全策略生成安全意图，使得网络管理员更容易理解和维护安全策略。
需要说明的是，本申请实施例所在的网络部署场景中可以有更多或更少的设备，图1仅为方便理解本方案的一个示例，不用于限定本方案。
以上介绍了本申请实施例提供的安全策略的处理方法所应用的场景，以下将详细介绍本申请实施例提供的安全策略的处理方法的具体实现过程。
请参阅图2，图2为本申请实施例提供的安全策略的处理方法的一种流程示意图。如图2所示，本申请实施例提供的安全策略的处理方法包括以下步骤201-202：
步骤201，获取第一安全设备上配置的第一安全策略，第一安全策略指示第一地址对第二地址的第一访问行为，第一访问行为为允许或禁止访问。
本实施例中，第一通信设备获取第一安全设备上配置的第一安全策略。第一安全策略包括至少一个安全策略。第一安全策略指示第一地址对第二地址的第一访问行为，第一访问行为为允许或禁止访问。当第一安全设备接收到报文时，可以将报文的源地址和目的地址与部署的至少一个第一安全策略匹配，以确定允许或禁止该报文通过。
第一通信设备可以从每个第一安全策略中获取第一地址和第二地址，例如，第一地址为源地址，第二地址为目的地址。源地址例如为媒体存取控制(Media Access Control，MAC)地址、源IP地址、源端口(port)，或者上述信息的组合。目的地址例如为目的MAC地址、目的IP地址、目的端口，或者上述信息的组合。第一安全策略指示允许或禁止第一地址访问第二地址。可选的，第一安全策略还可以包括第一访问行为所采用的协议类型。
从第一安全策略中获取到的源IP地址可以为以下任一项：至少一个IP地址、至少一个IP地址段，或者任意(any)，当第一安全策略中未设置源IP地址时，则可以将源IP地址确定为任意。从第一安全策略中获取到的目的IP地址的概念与从第一安全策略中获取到的源IP地址的概念类似，此处不做赘述。
从第一安全策略中获取到的源端口可以为至少一个端口号或者任意，当第一安全策略中未设置源端口时，则可以将源端口确定为任意。端口为任意可以理解为端口为0～65535。从第一安全策略中获取到的目的端口的概念与从第一安全策略中获取到的源端口的概念类似，此处不做赘述。
采用的协议类型包括但不限于传输控制协议(Transmission Control Protocol，TCP)、用户数据包协议(User Datagram Protocol，UDP)或其他类型的协议等，此处不做穷举。
不同类型的安全设备上部署的安全策略的代码形式可能不同，例如，以下分别公开了交换机中配置的第一安全策略的一个示例和终端设备中配置的第一安全策略的一个示例。其中，交换机中部署的第一安全策略的一个示例如下：
ip access-list AA
10 deny tcp 172.20.201.0/24 192.168.10.1 eq 12345
20 deny tcp 172.20.201.0/24 192.168.10.2 eq 12345
上述示出的交换机中的第一安全策略中源IP地址包括172.20.201.0/24，上述示出的第一安全策略中未指定源端口，目的IP地址包括192.168.10.1和192.168.10.2，协议类型为TCP，第一访问行为为禁止(deny)。
终端设备中部署的第一安全策略的一个示例如下：
iptables-I INPUT-p tcp--dport 12345-j ACCEPT#允许目的端口为12345的报文流入
上述示出的第一安全策略中未指定源IP地址和源端口，则源IP地址和源端口均可以确定为任意，目的IP地址可以确定为该终端设备的IP地址，目的端口号包括12345，第一子安全策略中的第一访问行为为允许(accept)。应理解，上述两个示例仅为方便理解不同类型的安全设备上部署的不同代码形式的安全策略，不用于限定本方案。
第一通信设备可以通过多种方式获取第一安全策略。在一种实现方式中，第一安全设备可以将部署的至少一个第一安全策略发送给第一通信设备，相应地，第一通信设备接收第一安全设备发送的至少一个第一安全策略。在另一种实现方式中，第一通信设备可以基于安全外壳协议(Secure Shell，SSH)、远程终端协议(TELNET)或其他技术远程登录第一安全设备，以获取到第一安全设备上部署的至少一个第一安全策略。
步骤202，根据第一安全策略生成第一安全意图，第一安全意图指示第一对象对第二对象的第一访问行为，第一对象或第二对象包括如下任一项：用户的类型，业务的名称，或者网络区域的名称。
本实施例中，第一通信设备从第一安全策略中获取到第一地址、第二地址和第一访问行为后，可以生成与第一安全策略对应的第一安全意图。
其中，第一安全意图是一种安全意图，安全意图例如是采用自然语言的形式表达允许或禁止一种访问行为。第一对象是第一访问行为的发起者，第一对象包括以下任一项：用户的类型、业务的名称、或者网络区域的名称。即，第一对象可以为发起第一访问行为的用户的类型，或发起第一访问行为的业务的名称，或发起第一访问行为的网络区域的名称。第二对象是第一访问行为的接受者，第二对象包括以下任一项：用户的类型、业务的名称或者网络区域的名称。即，第二对象为允许或禁止第一对象访问的用户的类型、或者允许或禁止第一对象访问的业务的名称，或者允许或禁止第一对象访问的网络区域的名称。
可选的，步骤202可以包括：第一通信设备根据第一地址确定第一对象，根据第二地址确定第二对象。例如第一地址包括源IP地址、源端口、协议类型，或者上述信息的组合，也即源IP地址、源端口、协议类型，或者上述信息的组合用于确定第一对象。例如第二地址包括目的IP地址、目的端口、协议类型，或者上述信息的组合，也即目的IP地址、目的端口、协议类型，或者上述信息的组合用于确定第二对象。
本申请实施例中，明确了安全策略中的第一地址和第二地址与安全意图中的第一对象和第二对象之间的对应关系，有利于提高安全策略到安全意图的转换过程的准确度。
第一通信设备在获取到第一对象和第二对象之后，可以生成与第一安全策略对应的第一安全意图。其中，第一安全意图指示第一对象对第二对象的第一访问行为。第一安全意图具体可以表现允许第一对象访问第二对象，或者，禁止第一对象访问第二对象。以下结合第一对象和第二对象的类型对第一安全意图的展示形式进行举例介绍。需要说明的是，以下示例中“[]”中的内容为可选内容。
情况1：第一对象为任意，第二对象为一种业务的名称
第一安全意图：允许/禁止任意网络区域访问[XX网络区域]的YY业务
情况2：第一对象为任意，第二对象为一个网络区域的名称
第一安全意图：允许/禁止任意网络区域访问XX网络区域
情况3：第一对象为一种用户的类型，第二对象为任意
第一安全意图：允许/禁止[BB网络区域]的ZZ用户访问任意网络区域
情况4：第一对象为一种用户的类型，第二对象为一种业务的名称
第一安全意图：允许/禁止[BB网络区域]的ZZ用户访问[XX网络区域]的YY业务
情况5：第一对象为一种用户的类型，第二对象为一个网络区域的名称
第一安全意图：允许/禁止[BB网络区域]的ZZ用户访问XX网络区域
情况6：第一对象为一种业务的名称，第二对象为任意
第一安全意图：允许/禁止[BB网络区域]的CC业务访问任意网络区域
情况7：第一对象为一种业务的名称，第二对象为一种业务的名称
第一安全意图：允许/禁止[BB网络区域]的CC业务访问[XX网络区域]的YY业务
情况8：第一对象为一种业务的名称，第二对象为一个网络区域的名称
第一安全意图：允许/禁止[BB网络区域]的CC业务访问XX网络区域
情况9：第一对象为一个网络区域的名称，第二对象为任意
第一安全意图：允许/禁止BB网络区域访问任意网络区域
情况10：第一对象为一个网络区域的名称，第二对象为一种业务的名称
第一安全意图：允许/禁止BB网络区域访问[XX网络区域]的YY业务
情况11：第一对象为一个网络区域的名称，第二对象为一个网络区域的名称
第一安全意图：允许/禁止BB网络区域访问XX网络区域
例如，上述交换机上部署的第一安全策略转换成第一安全意图可以为“学生用户禁止访问在线学习服务”，也即172.20.201.0/24所对应的第一对象为学生用户,192.168.10.1：12345和192.168.10.2：12345所对应的第二对象为在线学习服务；又例如，终端设备上部署的第一安全策略转换成第一安全意图可以为“任意网络区域允许访问在线学习服务”，应理解，此处举例仅为方便理解本方案，不用于限定本方案。本申请实施例中，明确了第一安全策略中的第一地址是用于确定第一对象的，第一安全策略中的第二地址是用于确定第二对象的，降低了从安全策略转换为安全意图过程的难度。
本申请实施例中，基于易理解的方式，安全意图直接表示了业务间、网络间、用户间，或者用户、业务和网络相互间的访问需求。因此，将通过IP地址表示的安全策略，转换为通过自然语言表示的安全意图，使得管理员可以更容易理解和维护安全策略。
可选的，第一通信设备还可以从第一安全策略中获取位于第一地址的设备所在的一个网络区域的名称和位于第二地址的设备所在的一个网络区域的名称。例如第一网络区域为源网络区域，第二网络区域为目的网络区域；若第一安全策略中不存在前述信息，则第一通信设备可以将第一安全策略中获取到的前述信息确定为空。
为进一步理解本方案，以下结合上述交换机和终端设备上部署的第一安全策略进行举例，第一通信设备还可以从第一安全策略中获取到的信息可以如下，以下以代码的形式进行展示，需要说明的是，“//”后面的内容表示基于代码内容获取到的信息。
1.从交换机中部署的第一安全策略中获取到的信息可以如下：

应理解，上述示例仅为方便理解本方案，不用于限定本方案。
其中，第一通信设备可以采用表格、纯文本、图形和文本结合或其他形式来存储从第一安全策略中获取到的信息。
第一对象和第二对象分别可以包括如下一项：用户的类型、业务的名称、或者网络区域的名称。用户的类型用于区分不同的用户。不同类型的用户对应于不同的地址或地址段。例如，用户的类型可以为内网用户、合作伙伴用户和互联网用户等。内网用户包括从内部网络接入的用户。内部网络是受一个用户(例如，一家企业)管控的网络，内部网络例如为某个企业的园区网，通过该园区网接入的用户可以称为该企业的内网用户。该企业的内部网络有指定的地址段。当安全策略中的第一地址或第二地址包括 于该指定的地址段，第一通信设备可以确定第一对象或第二对象为内网用户。合作伙伴用户包括从合作伙伴的网络接入的用户。例如企业1和企业2合作，企业1同意企业2访问企业1的服务1，则当安全策略中包括的第一地址包括于企业1对应的地址或地址段时，第一通信设备可以确定第一对象为企业1用户。互联网用户包括从任意位置接入的用户，其地址对应于any。当然，互联网用户还可以是除特定用户之外的用户，其地址不包括特定用户的地址。特定用户例如为内部用户和/或合作伙伴用户。某一特定类型的用户还可以细分为多种用户，例如，当内部网络为校园网时，内部用户可以细分为教职工用户和学生用户，教职工用户和学生用户可以分别对应于不同的地址或地址段。又例如，当内部网络为车企的园区网时，内部用户可以细分为行政办公用户、生产车间用户，生成车间用户又可以细分为发动机车间用户、轮胎车间用户等，不同类型的用户分别对应于不同的地址或地址段。
业务部署于内部网络中，对外或对内提供服务，业务的名称用于区分不同的业务。例如，业务的名称可以为个人手机银行业务、个人客户信息业务、线上学习业务、互联网业务或其他业务的名称等等，具体可以结合实际情况，此处不做限定。每个业务都基于服务地址对外提供服务。服务地址例如为IP地址、端口和协议的组合。例如，web服务在IP1:80基于TCP协议提供服务，域名解析服务在IP2:53基于TCP协议或UDP协议提供服务。第一通信设备可以基于安全策略包括的第一地址或第二地址，确定第一地址或第二地址属于哪个业务的服务地址，以确定安全意图包括的第一对象或第二对象。其中，第一地址或第二地址可以是服务地址中的IP地址、端口、协议或者他们的组合。
网络区域的名称用于区分不同的网络区域。不同的网络区域对应于不同的地址或地址段，第一通信设备可以基于安全策略包括的第一地址或第二地址，确定第一地址或第二地址所在的网络区域的名称。例如，网络区域的名称可以为内部网络区域、合作伙伴网络区域和互联网区域等。内部网络区域是受一个用户(例如，一家企业)管控的网络区域，例如为某个企业的园区网。合作伙伴网络区域是受一个合作伙伴管控的网络区域。例如，企业1和企业2具有合作关系，企业1的园区网和企业2的园区网可以互为合作伙伴网络区域。互联网区域可以泛指所有的网络区域或除特定网络之外的网络区域，特定网络例如为内部网络区域和/或合作伙伴网络区域。某一网络区域还可以细分为不同的网络区域。例如，内部网络区域可以细分为“生产1区”、“测试1区”、“办公区”、“XX地数据中心”、“XX园区XX栋楼”或其他名称等等，均可以结合实际应用场景确定。
不同的网络区域可以分别对应不同的安全设备。例如，企业分别在“生产1区”和“测试1区”部署防火墙，每个防火墙分别管控对应的网络区域的网络访问行为。
第一通信设备可以判断从第一安全策略中获取到的第一地址是否为任意，例如判断从第一安全策略中获取到的源IP地址和源端口是否均为任意。若判断结果为是，则第一通信设备可以确定第一对象包括任意网络区域。若判断结果为否，则第一通信设备可以根据第一地址和对象信息库，确定第一对象。其中，对象信息库用于存储至少一个对象中的每个对象和每个对象的地址信息，每个对象为以下任一项：一种用户的类型，一种业务的名称，或一个网络区域的名称。例如，每个类型的用户的地址可以包括每个用户类型的IP地址，每个用户类型的IP地址可以包括与一个类型的用户对应的IP地址段，或者，可以包括与一个类型的用户对应的一个或多个IP地址。例如，每个业务的地址可以包括每个业务所对应的IP地址和端口，还可以包括支持的协议类型。每个业务所对应的IP地址可以包括提供业务的一个或多个IP地址，或者可以包括用于提供业务的IP地址段。每个业务所对应的端口可以包括提供业务的一个或多个端口。例如，每个网络区域的地址可以包括每个网络区域所对应的IP地址段，或者可以包括每个网络区域所对应的一个或多个IP地址。
可选的，对象信息库还可以包括每个对象的描述信息。若对象为一种类型的用户，则对象的描述信息可以包括如下任一项或多项：用户的角色类型、用户使用的设备所在的网络环境的类型或用户的其它信息。若对象为一个业务，则对象的描述信息还可以包括如下任一项或多项：业务的角色类型、提供业务的设备所在的网络环境、提供业务的设备的物理位置、提供业务的设备的类型或其他描述信息等。
其中，用户的角色类型是对同一类型的用户进行更细粒度的描述。例如，用户的类型为第三方企业的用户，用户的角色类型可以包括管理员或一般用户。又例如，用户的类型为互联网用户，则用户的角色类型可以包括应用程序(application，APP)和浏览器。又例如，用户的类型为校园网中的教职工， 用户的角色类型可以包括行政岗位的老师和教学岗位的老师等，此处举例仅为方便理解本方案，不用于限定本方案。
用户使用的设备所在的网络环境的类型可以基于用户使用的设备所在的网络环境的功能确定。例如，若用户使用的设备所在的网络环境为生产车间，则用户使用的设备所在的网络环境的类型可以为生产。又例如，若用户使用的设备所在的网络环境为测试车间，则用户使用的设备所在的网络环境的类型可以为测试。又例如，若用户使用的设备所在的网络环境为办公园区，则用户使用的设备所在的网络环境的类型可以为办公等等，此处不做限定。
业务的角色类型是对提供同一业务的设备进行更细粒度的划分。业务的角色类型的划分依据可以为提供业务的设备的功能或其他类型的依据等。例如，业务的名称为线上学习业务，业务的角色类型可以包括数据库(database)、高速缓存存储器(cache)和网络服务器(web server)。角色类型为数据库的用于存储线上学习时用到的学习资料，角色类型为web的用于响应于对学习资料的获取请求，从“数据库”中获取学习资料，并管理“数据库”中的学习资料等。应理解，此处举例仅为方便理解“业务的角色类型”这一概念，不用于限定本方案。
提供业务的设备所在的网络环境的类型可以基于提供业务的设备所在的网络环境的功能确定，“提供业务的设备所在的网络环境的类型”和“用户使用的设备所在的网络环境的类型”的概念类似，可以参阅理解，此处不做赘述。例如，提供前述一种业务设备的物理位置可以为XX数据中心XX机房的XX服务器，或者，提供前述一种业务设备的物理位置可以为XX园区的XX机房等，此处不做穷举。提供前述一种业务设备的类型包括但不限于物理设备、虚拟机或容器等等。
示例性的，表1给出了对象信息库中一个对象的信息的示意。
表1
具体的，第一通信设备可以判断对象信息库中是否存在第一地址。第一地址包括如下一项或多项：源IP地址，源端口，或者协议类型。
若对象信息库中存在第一地址，则从对象信息库中获取与第一地址对应的第一对象。若对象信息库中不存在第一地址，第一通信设备可以向用户展示第一指示信息，以获取与第一地址对应的第一对象。 第一通信设备还可以在对象信息库中添加第一对象和第一地址，以更新该对象信息库，也即获取到更新后的对象信息库。
其中，第一指示信息至少包括第一地址。可选的，向用户展示的第一指示信息还可以包括如下任一项或多项：与第一地址关联的网络区域的名称、第一安全策略的名称、第一对象的类型或其他信息等。第一对象的类型为用户、业务或网络区域。
例如，第一通信设备可以获取与第一地址关联的网络区域的名称，向用户展示的第一指示信息包括第一地址和前述源网络区域的名称。
若第一通信设备没有从对象信息库中获取到与第一地址对应的第一对象，也即若对象信息库中不存在第一地址，第一通信设备可以从对象信息库中获取与第一地址关联的网络区域的名称。
具体的，第一通信设备可以将第一地址与对象信息库中的多个对象的地址信息进行模糊匹配；从对象信息库中确定与第一地址关联的至少一个目标对象，将目标对象归属的网络区域的名称确定为与第一地址关联的网络区域的名称。
可选地，第一通信设备可以基于第一地址与对象信息库中每个对象的地址信息之间的相似度，将第一地址与对象信息库中的多个对象的地址信息进行模糊匹配；从对象信息库中确定与第一地址关联的至少一个目标对象。例如，每个目标对象的地址信息与第一地址之间的相似度可以大于或等于相似度阈值，或者，至少一个目标对象是对象信息库中与第一地址之间的相似度最高的至少一个对象等，此处不做穷举。例如，若地址A为192.168.10.1，地址B为192.168.10.2，地址C为172.20.201.0，则地址A和地址B之间的相似度，高于地址A和地址C之间的相似度。例如，第一地址为192.168.10.6:80,对象信息库中未精确匹配到第一地址，但对象信息库包括第一网络区域，该网络区域的地址为192.168.10.1～192.168.10.100，第一通信设备可判断第一地址中的IP地址属于该网络区域，因此将第一网络区域作为第一地址的网络区域的名称。应理解，此处举例仅为方便理解本方案，不用于限定本方案。
本实施例中，当对象信息库中不存在第一地址时，可以由用户来确定与第一地址对应的第一对象，并在对象信息库中添加第一地址和第一对象，也即在基于安全策略生成安全意图的过程中，可以动态更新对象信息库，从而不断完善对象信息库，有利于降低以后执行安全策略到安全意图的转换操作的难度。
可选的，第一通信设备向用户展示第一指示信息的时候，还可以展示如下任一个或多个字段：角色类型、网络环境的类型、提供业务的设备的物理位置、提供业务的设备的类型或其他字段等，前述字段的字段内容可以展示为空。展示前述字段的目的包括指示用户输入与前述字段对应的信息，例如指示用户输入如下任一种或多种信息：对象的角色类型、对象所在网络环境的类型、提供业务的设备的物理位置、提供业务的设备的类型或其他对象的描述信息等。
则第一通信设备将第一地址和第一对象添加至对象信息库可以包括：第一通信设备可以将第一地址、第一对象和第一对象的描述信息添加至对象信息库。
针对第一通信设备获取与第一地址对应的第一对象的方式。在一种实现方式中，第一通信设备可以通过第一图形用户界面(graphical user interface，GUI)向用户展示第一指示信息。第一通信设备可以基于用户针对第一指示信息输入的反馈操作，获取与第一地址对应的第一对象。
其中，若第一指示信息中包括与第一地址对应的名称，与第一地址对应的名称包括源IP地址的名称和/或源端口的名称；则上述反馈操作可以包括：用户对源IP地址的名称和/或源端口的名称中一个名称的选择操作，或者，用户对第一对象的输入操作。
若第一指示信息中不包括与第一地址对应的名称，则上述反馈操作可以包括：用户对第一对象的输入操作。
在另一种实现方式中，第一通信设备可以将第一指示信息发送给第二通信设备，第二通信设备通过第二GUI向用户展示第一指示信息，第一通信设备和第二通信设备为两个不同的设备。第二通信设备可以基于用户针对第一指示信息输入的反馈操作，获取与第一地址对应的第一对象，将第一对象发送给第一通信设备。
为了更直观地理解本方案，请参阅图3，图3为本申请实施例提供的获取与第一地址对应的第一对象的一种流程示意图。本申请实施例提供的获取与第一地址对应的第一对象的方法包括以下步骤A1-A6。
步骤A1，第一通信设备判断源IP地址和源端口是否均为任意。若判断结果为是，则进入步骤A2。若判断结果为否，则进入步骤A3。
步骤A2，第一通信设备确定第一对象包括任意网络区域的任意用户和任意网络区域的任意业务。不再执行后续步骤A3～A6。
步骤A3，第一通信设备判断对象信息库中是否存在第一地址，若判断结果为是，则进入步骤A4，若判断结果为否，则进入步骤A5。
步骤A4，第一通信设备从对象信息库中获取与第一地址对应的第一对象。不再执行后续步骤A5～A6。
步骤A5，第一通信设备向用户展示第一指示信息，以获取与第一地址对应的第一对象，第一指示信息指示包括第一地址。
步骤A6，第一通信设备将第一地址和第一对象添加至对象信息库，得到更新后的对象信息库。应理解，图3中的示例仅为方便理解本方案，不用于限定本方案。
针对根据第二地址确定第二对象的过程。第一通信设备可以判断从第二安全策略中获取到的目的IP地址和目的端口是否均为任意，也即判断第二通信设备从第二安全策略中获取到的第二地址是否为任意。若判断结果为是，则第二通信设备可以确定第二对象包括任意网络区域的任意用户和任意网络区域中的任意业务。
若判断结果为否，则第二通信设备可以根据第二地址和对象信息库，确定第二对象。具体的，第一通信设备可以判断对象信息库中是否存在第二地址，第二地址包括如下一项或多项：目的IP地址，目的端口，或者协议类型。若对象信息库中存在第二地址，则从对象信息库中获取与第二地址对应的第二对象。
若对象信息库中不存在第二地址，第一通信设备可以向用户展示第二指示信息，以获取与第二地址对应的第二对象。第一通信设备还可以在对象信息库中添加第二对象和第二地址，以更新该对象信息库，也即获取到更新后的对象信息库。
需要说明的是，第一通信设备获取与第二地址对应的第二对象的具体实现方式，和获取与第一地址对应的第一对象的具体实现方式类似，第二指示信息的概念和第一指示信息的概念类似，此处均不做赘述。
第一通信设备可以分开执行“获取与第一地址对应的第一对象”和“获取第二地址对应的第二对象”这两个步骤，也可以同时执行，则第一通信设备向用户展示第一指示信息和向用户展示第二指示信息的步骤可以分开执行，也可以同时执行，具体可以结合实际应用场景灵活确定。
为了进一步理解本方案，以下结合上述示出的三个第一安全策略进行举例，通过表2的形式展示第一指示信息和第二指示信息中携带哪些信息。
表2
其中，表2中最右侧的一列可以由用户进行编辑，以输入与第一地址对应的第一对象。例如将“从安全策略中获取到的名称”这一列的内容拖拽至“第一对象”这一列，以实现对第一对象的输入；或者，用户也可以直接输入文本形式的第一对象等，此处举例仅为方便理解本方案，不限定用户输入第一对象的方式。
需要说明的是，表2中示出的字段仅为方便理解本方案，实际产品中可以展示更多或更少的字段，例如还可以展示与第一对象的描述信息相关的字段，或者，也可以不展示网络区域这一字段等，具体展示哪些信息可以结合实际应用场景灵活确定，此处不做限定。
本申请实施例中，对网络中至少一个对象和每个对象的地址信息进行汇总得到对象信息库，从而在获取到安全策略中包括的第一地址和第二地址之后，可以根据对象信息库确定与第一地址对应的第一对象以及与第二地址对应的第二对象，从而大大提高了安全策略转换为安全意图的效率。
可选的，第一通信设备在生成与第一安全策略对应的第一安全意图之后，还可以向用户显示第一安全策略和第一安全意图，以向用户展示第一安全意图和第一安全策略之间的对应关系。
具体的，第一通信设备可以通过GUI向用户显示第一安全意图和第一安全策略。或者，第一通信设备可以向第二通信设备发送第一安全意图和第一安全策略，第二通信设备通过GUI向用户显示第一安全意图和第一安全策略。
针对“第一安全意图和第一安全策略”的显示形式，在一种实现方式，可以采用表格、纯文本、文本结合图形或其他方式等来展示第一安全意图和第一安全策略。
可选地，第一通信设备可以通过GUI或第二通信设备向用户显示第一内容、第二内容和第三内容；其中，第一内容包括第一对象、第一地址以及第一对象和第一地址的对应关系，第二内容包括第二对象、第二地址以及第二对象和第二地址的对应关系，第三内容包括第一访问行为。
可选的，第一通信设备还可以通过GUI或第二通信设备向用户展示第一对象的描述信息和/或第二对象的描述信息，对于“第一对象的描述信息和/或第二对象的描述信息”的含义可以参阅上述对“对象的描述信息”的含义的介绍，此处不做赘述。
为了更直观地理解本方案，请参阅图4，图4为本申请实施例提供的展示第一安全策略和第一安全意图的一种示意图。如图4所示，图4中以展示的第一安全策略为防火墙上部署的第一安全策略为例，展示的第一安全策略和第一安全意图中包括第一对象所在的源网络区域(也即图4中的任意区域)、第一对象(也即图4中的任意)以及与第一对象对应的源IP地址(也即图4中的任意IP地址)和源端口(也即图4中的任意端口)，还包括第二对象所在的目的网络区域(也即图4中的数据中心)、第二对象(也即图4中的线上学习业务)、协议类型以及与第二对象对应的目的IP地址和目的端口，还包括第一访问(也即图4中的允许)，应理解，图4中的示例仅为方便理解本方案，不用于限定本方案。
本申请实施例中，向用户展示安全策略和基于安全策略得到的安全意图，也即将安全意图和安全策略关联起来，使用户更容易理解安全策略的含义，有利于降低安全策略的维护难度。
为了进一步理解本方案，以下结合图1示出的应用场景图，通过一个具体的示例对本申请提供的安全策略的处理方法进行介绍，请参阅图1，内部网络中存在办公园区和数据中心两个不同的网络区域，办公园区和互联网区域之间部署有防火墙1，办公园区和数据中心之间部署有防火墙2。图5中以第一通信设备获取防火墙1中部署的代码形式的一个第一安全策略为例，需要说明的是，如下图5示出的实施例仅为方便理解本方案，不用于限定本方案。如图5所示，本申请实施例提供的安全策略的处理方法包括以下步骤501-504。
步骤501，获取防火墙1中代码形式的第一安全策略。
本实施例中，步骤501的具体实现方式可以参阅图2对应实施例中步骤201中的描述，此处不做赘述。其中，如下对防火墙1上部署的代码形式的第一安全策略进行举例。防火墙1上部署的代码形式的一个第一安全策略如下：
其中，上述第一安全策略中源地址(src-addr)为任意(Any)，目的IP地址(dst-addr)为192.168.1.1/32，目的端口包括12345，协议类型(protocol)为TCP，第一访问行为(action)为允许(permit)。
步骤502，从代码形式的第一安全策略中获取第一地址和第二地址。
本实施例中，步骤502的具体实现方式可以参阅图2对应实施例中步骤201中的描述，此处不做赘述。作为示例，以下通过代码的形式分别展示第一通信设备从防火墙1和防火墙2上的第一安全策略中获取到的信息，从防火墙1上的第一安全策略中获取到的信息如下：

其中，与第一地址对应的源网络区域(src_zone)为任意(any)，第一地址中包括的源地址(src_addrgrp)为任意，与第二地址对应的目的网络区域(dst_zone)为任意，第二地址中包括的目的IP地址为192.168.10.1/32，第二地址中包括的目的端口为12345，协议类型为TCP，第一访问行为(action)为允许。
步骤503，获取第一地址所对应的第一对象以及第二地址所对应的第二对象。
本实施例中，步骤503的具体实现方式可以参阅图2对应实施例中步骤202中的描述，此处不做赘述。作为示例，此处以对象信息库中不存在第二地址为例说明获取与第二地址对应的第二对象，第一通信设备向用户展示的第二指示信息可以如下表3所示。
表3
其中，表3中最右侧的一列可以由用户进行编辑，以输入与第一地址对应的第一对象。需要说明的是，表3中示出的字段仅为方便理解本方案，实际产品中可以展示更多或更少的字段，此处不做限定。
步骤504，生成与第一安全策略对应的第一安全意图。
本实施例中，步骤504的具体实现方式可以参阅图2对应实施例中步骤202中的描述，此处不做赘述。例如，用户输入了“在线学习服务”作为表3中的第二对象，第一安全意图可以如下表4所示：
表4
在图2至图5示出的实施例的基础上，第一通信设备在获取到与第一安全策略对应的第一安全意图之后，可选的，在一种应用场景中，第一安全意图可以用于校验第一安全策略是否匹配已经存在的安全策略部署意图。
其中，安全策略部署意图也是通过自然语言的形式表达，用于指示允许或禁止某一个对象对另一个对象的访问行为，前述对象具体可以表现为：一种用户类型、一个业务的名称或者一个网络区域的名称。
安全策略部署意图可以包括如下任一项或多项：用户根据安全规范要求指定的至少一条安全规则、为了实现已经开通的业务而确定的安全策略部署意图或其他类型的安全策略部署意图等。
例如，安全规则可以为禁止互联网区域访问数据中心区域、禁止互联网区域访问数据中心区域人员信息管理服务或其他安全规则等。例如为了实现已经开通的业务而确定的安全策略部署意图可以包括允许互联网中的用户访问业务1、允许业务1访问业务2等，此处不做穷举。
在另一种应用场景中，第一安全意图可以用于校验新增安全策略部署意图是否与第一安全意图冲突。新增安全策略部署意图例如为基于待开通的业务确定的安全策略的部署意图，一个新增安全策略部署意图用于指示允许或禁止某一个对象对另一个对象的访问行为。例如，待开通的业务为向互联网用户开通数据中心的线上学习业务，则新增安全策略部署意图可以包括允许互联网用户访问线上学习业务，此处举例仅为方便理解本方案，不用于限定本方案。
由于上述两个应用场景的具体实现方案有所不同，以下分别对上述两个场景的具体实现方式进行介绍。
场景1：第一安全意图用于校验第一安全策略是否匹配已经存在的安全策略部署意图
请参阅图6，图6为本申请实施例提供的安全策略的处理方法的一种流程示意图。如图6所示，本申请实施例提供的安全策略的处理方法包括以下步骤601-605。
步骤601，获取第一安全设备上配置的第一安全策略，第一安全策略指示第一地址对第二地址的第一访问行为，第一访问行为为允许或禁止访问。
步骤602，根据第一安全策略生成第一安全意图，第一安全意图指示第一对象对第二对象的第一访问行为，第一对象或第二对象包括如下任一项：用户的类型，业务的名称，或者网络区域的名称。
本实施例中，步骤601和602的具体实现方式和图2对应实施例中的步骤201和202的具体实现方式类似，此处不做赘述。
步骤603，根据第一安全意图，确定第一安全策略是否匹配安全策略部署意图。
本实施例中，第一通信设备可以获取第一安全设备上已经存储的至少一个安全策略部署意图，针对至少一个安全策略部署意图中的任意一个安全策略部署意图(为方便描述，后续称为“目标安全策略部署意图”)，第一通信设备可以根据第一安全意图，确定第一安全策略是否匹配目标安全策略部署意图。
其中，目标安全策略部署意图指示第三对象对第四对象的第二访问行为。第三对象包括或第四对象包括如下任一项：用户的类型，业务的名称，或者网络区域的名称，第二访问行为为允许或禁止访问。
具体的，在一种情况中，若第三对象和第一对象均包括第一子地址，第四对象和第二对象均包括第二子地址，且第一访问行为和第二访问行为相同时，则确定第一安全策略匹配目标安全策略部署意图。
例如，“第三对象和第一对象均包括第一子地址”可以包括如下任一种情况：第三对象包括第一对象、第一对象包括第三对象，或者第一子地址为第三对象指向的地址中的一部分，且第一子地址为第一对象指向的地址中的一部分。
“第三对象包括第一对象”包括第三对象指向的地址和第一对象指向的地址相同，也即第三对象和第一对象为同一个对象；或者，第一对象指向的地址是第三对象指向的地址中的一部分。“第一对象包括第三对象”的概念与“第三对象包括第一对象”的概念类似，此处不做赘述。
需要说明的是，本申请实施例中借助第三对象指向的地址、第一对象指向的地址、第一子地址和第二子地址的概念是用来解释第三对象和第一对象之间的关系，第一通信设备可以直接根据第一对象和第二对象确定第三对象和第一对象之间的关系。例如，第三对象为网络区域1，第一对象为网络区域1中的业务1，则第三对象包括第一对象，本示例中第一对象指向的地址是第三对象指向的地址中的一部分。又例如，第三对象为网络区域2，第一对象是网络区域2中的用户Z，则第三对象包括第一对象，本示例中第一对象指向的地址是第三对象指向的地址中的一部分。又例如，第三对象为网络区域3，第一对象是网络区域3，则第三对象包括第一对象，本示例中第一对象指向的地址和第三对象指向的地址相同。又例如，第三对象为业务C，网络区域1、网络区域2和网络区域3中均提供业务C，第一对象为网络区域1，则第三对象指向的地址和第一对象指向的地址均包括网络区域1中提供业务C的设备的地址(也即第一子地址的一个示例)等，此处不做穷举。
可选的，若第一对象为用户类型，则第一对象指向的地址包括一类用户所采用的IP地址；若第一对象为一种业务的名称，则第一对象指向的地址包括用于前述一种业务的IP地址、端口和协议类型；若第一对象为一个网络区域的名称，则第一对象指向的地址包括前述网络区域所采用的IP地址。“第三对象指向的地址”的含义和“第一对象指向的地址”类似，此处不做赘述。
对应的，“第四对象包括第二对象”包括第四对象指向的地址和第二对象指向的地址相同，或者，第二对象指向的地址是第四对象指向的地址中的一部分。
若第二对象为一种业务的名称，则第二对象指向的地址包括用于前述一种业务的IP地址、端口和协议类型；若第二对象为一个网络区域的名称，则第二对象指向的地址包括前述网络区域所采用的IP地址。“第四对象指向的地址”的含义和“第二对象指向的地址”类似，此处不做赘述。
“第一访问行为和第二访问行为相同”包括：当第一访问行为是允许时，第二访问行为也是允许； 当第一访问行为是禁止时，第二访问行为也是禁止。
在另一种情况中，若第三对象和第一对象没有交集，或者，第四对象和第二对象没有交集，则确定第一安全策略匹配目标安全策略部署意图。
在一种情况中，若第三对象和第一对象均包括第一子地址，第四对象和第二对象均包括第二子地址，且第一访问行为和第二访问行为不同时，则确定第一安全策略与目标安全策略部署意图不匹配(也即冲突)。
第一通信设备可以重复执行上述操作，以确定第一安全策略与至少一个安全策略部署意图中每个安全策略部署意图是否均匹配，若第一安全策略与每个安全策略部署意图均匹配，则确定第一安全策略与已经存在的安全策略部署意图匹配；若第一安全策略与至少一个安全策略部署意图中任意一个安全策略部署意图不匹配，则确定第一安全策略与第一安全设备上已经存在的安全策略部署意图不匹配。
本申请实施例中，明确了根据第一安全意图确定第一安全策略是否匹配安全策略部署意图的一种具体判断方法，降低了安全策略是否匹配安全策略部署意图的判断过程的难度。
步骤604，显示第一安全策略和第一安全意图。
本实施例中，步骤604的具体实现方式可以参阅图2对应实施例中的步骤202的描述，此处不做赘述。
步骤605，显示第一校验结果，第一校验结果指示第一安全策略和安全策略部署意图是否匹配。
本实施例中，第一通信设备还可以通过GUI或者通过第二通信设备向用户显示第一校验结果，第一校验结果指示第一安全策略和安全策略部署意图是否匹配。
可选的，若第一安全策略与第一安全策略部署意图不匹配，则第一通信设备还可以向用户显示警示信息，以提醒用户对第一安全策略和第一安全策略部署意图的冲突情况进行处理；第一安全策略部署意图为已经存储的至少一个第一安全策略部署意图中的一个安全策略意图。
需要说明的是，本申请实施例不限定步骤604和605的执行顺序，可以同时执行步骤604和605，也即第一通信设备可以通过GUI或者通过第二通信设备向向用户显示第一安全策略、第一安全意图和第一校验结果。或者，也可以先执行步骤604，再执行步骤605；或者，也可以先执行步骤605，再执行步骤604。
为更直观地理解本方案，以下通过一个具体的示例对确定第一校验结果的过程进行介绍，需要说明的是，如下图7示出的实施例仅为方便理解本方案，不用于限定本方案。请参阅图7，图7为本申请实施例提供的网络中已经开通的一种业务的网络拓扑图。
如图7所示，Client-A的IP地址例如为101.10.1.1，个人客户信息业务的IP地址例如为182.101.1.1，互联网区域的IP地址段为公网地址，办公区域的IP地址段为192.168.1.0/24，数据中心的IP地址段例如为182.101.1.0/24。网络中已经开通了由个人客户信息业务向互联网用户提供的业务。
为了实现上述业务，在防火墙FW-A和防火墙FW-B上均部署了相同的第一安全策略，第一安全策略的示例如下：
其中，上述第一安全策略指示允许101.10.1.1 mask 255.255.255.255这一IP地址对182.101.1.1 mask 255.255.255.255这一IP地址的访问行为。
第一通信设备分别从防火墙FW-A和防火墙FW-B均获取到上述第一安全策略之后，可以生成与第一安全策略对应的第一安全意图。与上述第一安全策略对应的第一安全意图可以指示：互联网用户中的Client-A对个人客户信息业务的第一访问行为，第一访问行为是允许访问。
第一通信设备从已经存在的至少一个安全策略部署意图中获取到一条安全策略部署意图如下：互联 网对数据中心的第二访问行为，第二访问行为是禁止。由于互联网(网络区域的名称的一个示例)包括互联网用户中的Client-A，数据中心(网络区域的名称的一个示例)包括个人客户信息业务，第一访问行为和第二访问行为不同，因此确定第一安全意图和已经存在的安全策略部署意图冲突(也即不匹配)，则防火墙FW-A和防火墙FW-B上部署的第一安全策略均与安全策略部署意图冲突。
第一通信设备向用户显示的第一校验结果和第一安全意图所对应的第一安全策略。第一校验结果例如如表5所示，第一安全意图所对应的第一安全策略例如表6所示。
表5
表6
应理解，上述示例仅为方便理解本方案，不用于限定本方案。
本申请实施例中，在获取到第一安全意图之后，可以根据第一安全意图校验第一安全策略是否与已经存在的安全策略部署意图匹配，也即通过判断第一安全意图是否与安全策略部署意图匹配的方式来确定第一安全策略是否匹配安全策略部署意图，实现了校验第一安全策略的合理性。
场景2：第一安全意图用于校验新增安全策略部署意图是否与第一安全意图冲突
请参阅图8，图8为本申请实施例提供的安全策略的处理方法的一种流程示意图。如图8所示，本申请实施例提供的安全策略的处理方法包括以下步骤801-805。
步骤801，获取第一安全设备上配置的第一安全策略，第一安全策略指示第一地址对第二地址的第一访问行为，第一访问行为为允许或禁止访问。
步骤802，根据第一安全策略生成第一安全意图，第一安全意图指示第一对象对第二对象执行第一访问行为，第一对象或第二对象包括如下任一项：用户的类型，业务的名称，或者网络区域的名称。
本实施例中，步骤801和802的具体实现方式和图2对应实施例中的步骤201和202的具体实现方式类似，此处不做赘述。
步骤803，根据第一安全意图，确定新增安全策略部署意图是否与第一安全意图冲突。
本实施例中，当第一通信设备接收到新增安全策略部署意图时，可以获取与第一安全设备上部署的至少一个第一安全策略对应的安全意图集合，安全意图集合包括至少一个第一安全意图。第一通信设备判断新增安全策略部署意图与至少一个第一安全策略中的每个第一安全策略是否冲突，若新增安全策略部署意图与至少一个第一安全策略中的每个第一安全策略均不冲突，则确定新增安全策略部署意图与安全意图集合不冲突；若新增安全策略部署意图与至少一个第一安全策略中任意一个第一安全策略冲突，则确定新增安全策略部署意图与安全意图集合冲突。
其中，新增安全策略部署意图指示第五对象对第六对象的第三访问行为，第三访问行为是允许或禁止访问；第五对象或第六对象包括如下任一项：用户类型，业务的名称，或者网络区域的名称。
针对至少一个第一安全意图中的任意一个第一安全意图，具体的，步骤803可以包括：当第一对象和第五对象均包括第三子地址，第二对象和第六对象均包括第四子地址，且第一访问行为和第三访问行为不同时，确定新增安全策略部署意图与第一安全意图冲突。
其中，“第一对象和第五对象均包括第三子地址”代表第一对象指向的地址和第五对象指向的地址均包括第三子地址，“第二对象和第六对象均包括第四子地址”代表第二对象指向的地址和第六对象指向的地址均包括第四子地址，具体含义可以参阅上述对“第三对象和第一对象均包括第一子地址”的描述，此处不做赘述。
当第一对象和第五对象均包括第三子地址，第二对象和第六对象均包括第四子地址，且第一访问行为和第三访问行为相同时，确定新增安全策略部署意图与第一安全意图不冲突。当第一对象指向的地址和第五对象指向的地址没有交集，或者，第二对象指向的地址和第六对象指向的地址没有交集时，确定新增安全策略部署意图与第一安全意图不冲突。
本申请实施例中，明确了新增安全策略部署意图是否与第一安全意图冲突的一种具体判断方法，降低了新增安全策略部署意图是否与第一安全意图冲突的判断过程的难度。
步骤804，显示第一安全策略和第一安全意图。
步骤805，显示第二校验结果，第二校验结果指示新增安全策略部署意图是否与第一安全意图冲突。
本实施例中，步骤804和805的具体实现方式和图6对应实施例中的步骤604和605的具体实现方式类似，此处不做赘述。
可选的，若校验新增安全策略部署意图与一个第一安全意图(为方面描述，后续称为“目标第一安全意图”)冲突，则第一通信设备还可以向用户显示警示信息，以提醒用户对第一安全策略和目标第一安全意图的冲突情况进行处理。
需要说明的是，本申请实施例不限定步骤804和805的执行顺序，可以同时执行步骤804和805，也即第一通信设备可以通过GUI或者通过第二通信设备向向用户显示第一安全策略、第一安全意图和第一校验结果。或者，也可以先执行步骤804，再执行步骤805；或者，也可以先执行步骤805，再执行步骤804。
本申请实施例中，当出现新增安全策略部署意图之后，在配置与新增安全策略部署意图对应的安全策略之前，先校验新增安全策略部署意图是否与前述多个第一安全意图冲突，有利于降低新增加的安全策略与已经存在的安全策略出现冲突的可能性，从而提高网络运行过程的稳定性，也有利于保证网络能够顺利的向用户提供业务。此外，提供了第一安全意图的另一种应用方式，扩展了本方案的应用场景，提高了本方案的灵活性。
在图2至图8示出的实施例的基础上，可选的，第一通信设备还可以根据第一地址对第二地址的访问路径，确定每个第二安全设备，第二安全设备是访问路径上除了第一安全设备之外的任意一个其他安全设备。第一通信设备获取第二安全设备上配置的安全策略，生成与第二安全设备上配置的安全策略对应的安全意图。
确定与第二安全策略对应的第二安全意图，其中，第二安全策略指示第一地址对第二地址的第四访问行为，其中，第二安全意图指示第一对象对第二对象执行第四访问行为。
可选的，在一种应用场景中，第一安全意图和第二安全意图可以用于校验第一安全策略和第二安全策略是否匹配已经存在的安全策略部署意图。
在另一种应用场景中，若第一访问行为是禁止的访问行为，则第一安全意图和第二安全意图用于校验配置冗余。本申请实施例中，还可以获取位于第一地址对第二地址的访问路径上的第二安全设备，并获取第二安全设备上第二安全策略所对应的第二安全意图，有利于后续对第一地址对第二地址的访问路径上其它安全设备上的安全策略进行维护。
由于上述两个应用场景的具体实现方案有所不同，以下分别对上述两个场景的具体实现方式进行介绍。
场景1：第一安全意图和第二安全意图用于校验第一安全策略和第二安全策略是否匹配已经存在的 安全策略部署意图。
请参阅图9，图9为本申请实施例提供的安全策略的处理方法的一种流程示意图。如图9所示，本申请实施例提供的安全策略的处理方法包括以下步骤901-907。
步骤901，获取第一安全设备上配置的第一安全策略，第一安全策略指示第一地址对第二地址的第一访问行为，第一访问行为为允许或禁止访问。
步骤902，根据第一安全策略生成第一安全意图，第一安全意图指示第一对象对第二对象的第一访问行为，第一对象或第二对象包括如下任一项：用户的类型，业务的名称，或者网络区域的名称。
本实施例中，步骤901和902的具体实现方式和图2对应实施例中的步骤201和202的具体实现方式类似，此处不做赘述。
步骤903，获取第二安全设备上配置的安全策略，第一安全设备和第二安全设备均位于第一地址对第二地址的目标访问路径上，第一安全设备和第二安全设备为不同的安全设备。
步骤904，生成与第二安全设备上配置的安全策略对应的安全意图。
本实施例中，步骤903和904的具体实现方式和图2对应实施例中的步骤201和202的具体实现方式类似，此处不做赘述。
需要说明的是，本申请实施例不限定步骤901至902和步骤903至904的执行顺序，可以先执行步骤901和902，再执行步骤903和904；也可以先执行步骤903和904，再执行步骤901和902。
步骤905，根据第一安全意图和第二安全意图，确定第一安全策略和第二安全策略是否匹配安全策略部署意图。
本实施例中，第一通信设备在根据第一地址和第二地址，确定第一地址对第二地址的目标访问路径包括的至少一个安全设备之后，若目标访问路径包括的至少一个安全设备的数量为至少两个安全设备，则可以确定目标访问路径上包括的至少一个第二安全设备。
针对至少一个第二安全设备中的任意一个第二安全设备(为方便描述，后续称为“目标第二安全设备”)，目标第二安全设备中可以存在与多个安全策略对应的多个安全意图。
第一通信设备可以判断与目标第二安全设备对应的多个安全意图中是否存在与第二安全策略对应的第二安全意图，其中，第二安全策略指示第一地址对第二地址的第四访问行为，第四访问行为为允许或禁止访问，第二安全意图指示第一对象对第二对象的第四访问行为。
若目标第二安全设备中存在与第二安全策略对应的第二安全意图，则第一通信设备可以根据第一安全意图和目标第二安全设备所对应的第二安全意图，确定第一安全策略和目标第二安全设备上的第二安全策略是否匹配目标安全策略部署意图，目标安全策略部署意图为至少一个安全策略部署意图中任意一个安全策略部署意图。
具体的，在一种情况中，若基于第一安全意图确定第一安全策略匹配安全策略部署意图，且第二安全意图和第一安全意图不冲突，则确定第一安全策略和目标第二安全设备中的第二安全策略均匹配安全策略部署意图。对于“基于第一安全意图确定第一安全策略是否匹配安全策略部署意图”的具体实现方式可以参阅上述图6对应实施例中步骤603中的描述，此处不做赘述。
其中，若第一访问行为和第四访问行为相同，第一通信设备确定第二安全意图和第一安全意图不冲突，也即第一安全设备上的第一安全策略和目标第二安全设备上的第二安全策略不冲突。
因此，也即当第三对象包括第一对象，第四对象包括第二对象，且第一访问行为和第四访问行为与第二访问行为相同时，确定第一安全策略和第二安全策略均匹配安全策略部署意图。
在另一种情况中，若基于第一安全意图确定第一安全策略匹配安全策略部署意图，且第二安全意图和第一安全意图冲突，则确定第一安全意图确定第一安全策略匹配安全策略部署意图，且目标第二安全设备中的第二安全策略与安全策略部署意图不匹配。
其中，若第一访问行为和第四访问行为不同时，第一通信设备确定第二安全意图和第一安全意图冲突，也即第一安全设备上的第一安全策略和目标第二安全设备上的第二安全策略冲突。
在另一种情况中，若基于第一安全意图确定第一安全策略与安全策略部署意图不匹配，则不需要执行步骤905。
本申请实施例中，提供了根据第一安全意图和第二安全意图校验第一安全策略和第二安全策略是否匹配安全策略部署意图的一种具体实现方式，降低了本方案的实现难度。
若目标第二安全设备中不存在与第二安全策略对应的第二安全意图，则第一通信设备可以确定目标第二安全设备上缺失第二安全策略。可选的，第一通信设备还可以通过GUI或通过第二通信设备向用户展示警示信息，前述警示信息用于告知用户目标第二安全设备上缺失第二安全策略。
为更直观地理解本方案，以下通过一个具体的示例对确定第一校验结果的过程进行介绍，图10为本申请实施例提供的安全策略的处理方法的一种网络拓扑图。图10包括上和下两个子示意图，图10的上子示意图示出的为一种网络拓扑图，图10的下子示意图示出的为用于告知用户缺失第二安全策略的警示信息。如图10所示，Client-A的IP地址为192.168.1.1，个人客户信息业务的IP地址为172.101.1.1。
防火墙FW-A和FW-C上均部署了相同的安全策略，该相同的安全策略的示例如下：
其中，上述安全策略指示允许192.168.1.1 mask 255.255.255.255这一IP地址对172.101.1.1mask 255.255.255.255这一IP地址的访问行为。
第一通信设备分别从防火墙FW-A上述第一安全策略之后，可以生成与第一安全策略对应的第一安全意图。与上述第一安全策略对应的第一安全意图可以指示：互联网用户中的Client-A对个人客户信息业务的第一访问行为，第一访问行为是允许访问。
第一通信设备根据第一安全意图确定第一安全策略匹配安全策略部署意图之后，第一通信设备确定Client-A对个人客户信息业务之间的目标访问路径上包括防火墙FW-A、防火墙FW-B和防火墙FW-C三个安全设备，并确定防火墙FW-A和防火墙FW-C为Client-A对个人客户信息业务之间的目标访问路径上的两个第二安全设备。
在第一访问行为是允许的情况下，第一通信设备判断与防火墙FW-B上的至少一个安全策略对应的安全意图中，是否存在第二安全意图，由于判断结果为否，则确定防火墙FW-B上缺失第二安全策略，也即需要向用户输出警示信息。
第一通信设备判断与防火墙FW-C上的至少一个安全策略对应的安全意图中，是否存在第二安全意图，由于判断结果为是，且防火墙FW-C所对应的第二安全意图中的第四访问行为和第一访问行为不冲突，则确定防火墙FW-A上的第一安全策略和防火墙FW-C上第二安全策略均匹配安全策略部署意图。
如图10的下子示意图所示，FW-A上的第二安全意图和FW-C上的第二安全意图匹配安全策略部署意图，FW-B上缺失第二安全策略。图10所示的√表示对应防火墙上的安全意图指示禁止Client-A对个人客户信息业务的访问，圆圈表示对应防火墙缺失安全策略。
应理解，图10中的示例仅为方便理解本方案，不用于限定本方案。
步骤906，显示第一安全策略和第一安全意图。
步骤907，显示第三校验结果，第三校验结果指示第一安全策略和第二安全策略是否匹配安全策略部署意图。
本实施例中，第三校验结果包括第一安全策略和目标第二安全设备上的第二安全策略均匹配安全策略部署意图；或者，第一安全意图确定第一安全策略匹配安全策略部署意图，且目标第二安全设备中的第二安全策略与安全策略部署意图不匹配。步骤906和907的具体实现方式与图6对应实施例中步骤604和605类似，此处不做赘述。
为更直观地理解本方案，以下通过一个具体的示例对确定第一校验结果的过程进行介绍，图11为本申请实施例提供的安全策略的处理方法的一种网络拓扑图。图11包括上和下两个子示意图，图11的上子示意图示出的为一种网络拓扑图，图11的下子示意图示出的为第三校验结果。如图11所示，Client-A的IP地址为192.168.1.1，个人客户信息业务的IP地址为172.101.1.1。
在防火墙FW-B上部署了安全策略如下：
其中，上述安全策略指示禁止192.168.1.1 mask 255.255.255.255这一IP地址对172.101.1.1 mask 255.255.255.255这一IP地址的访问行为。
在防火墙FW-A和FW-C上部署了相同的安全策略，该相同的安全策略的示例如下：
其中，上述安全策略指示允许192.168.1.1 mask 255.255.255.255这一IP地址对172.101.1.1 mask 255.255.255.255这一IP地址的访问行为。
第一通信设备从防火墙FW-B获取到上述第一安全策略之后，可以生成与第一安全策略对应的第一安全意图。与上述第一安全策略对应的第一安全意图可以指示：Client-A对个人客户信息业务的第一访问行为，第一访问行为是禁止访问。
第一通信设备确定Client-A对个人客户信息业务之间的目标访问路径上包括防火墙FW-A、防火墙FW-B和防火墙FW-C三个安全设备，并确定防火墙FW-A和防火墙FW-C为Client-A对个人客户信息业务之间的目标访问路径上的两个第二安全设备。
第一通信设备从防火墙FW-A和防火墙FW-C上获取到上述安全策略之后，可以生成与防火墙FW-A和防火墙FW-C上的安全策略对应的安全意图，并分别从与防火墙FW-A和防火墙FW-C上的安全策略对应的至少一个安全意图中确定第二安全意图。与防火墙FW-A和防火墙FW-C对应的第二安全意图可以指示：Client-A对个人客户信息业务执行的第四访问行为，第四访问行为是允许访问。图11所示的√表示对应防火墙上的安全意图指示禁止Client-A对个人客户信息业务的访问，×表示对应防火墙的安全意图指示允许Client-A对个人客户信息业务的访问。
第一通信设备确定第一安全策略匹配安全策略部署意图之后，可以判断与防火墙FW-A和防火墙FW-C对应的第二安全意图是否与第一安全意图冲突，由于与防火墙FW-A和防火墙FW-C对应的第二安全意图与第一安全意图冲突，则第三校验结果为确定防火墙FW-B上的第一安全策略匹配安全策略部署意图，防火墙FW-A和防火墙FW-C上的第二安全策略与安全策略部署意图不匹配。
第一通信设备向用户显示的第三校验结果具体可以参阅如下表7和表8：
表7
表8
如图11的下子示意图所示，FW-A上的第二安全意图和FW-C上的第二安全意图与安全策略部署意图冲突，FW-B上的第一安全意图与安全策略部署意图匹配，应理解，图11中的示例仅为方便理解本方案，不用于限定本方案。
本申请实施例中，还可以根据第一安全意图和第二安全意图来校验第一安全策略和第二安全策略是否匹配安全策略部署意图，提供了第一安全意图的又一种应用方式，扩展了本方案的应用场景，进一步提高了本方案的灵活性。此外，不仅可以校验单个安全设备上的安全策略是否匹配安全策略部署意图，还可以校验第一地址对第二地址的访问路径上的所有安全设备是否均匹配安全策略部署意图，即，通过比较第一安全意图和第二安全意图，以及安全策略部署意图，实现了校验第一安全策略和第二安全策略的合理性。
场景2：第一安全意图和第二安全意图用于校验配置冗余。
请参阅图12，图12为本申请实施例提供的安全策略的获取方法的一种流程示意图。如图12所示，本申请实施例提供的安全策略的获取方法包括以下步骤1201-1207：
步骤1201，获取第一安全设备上配置的第一安全策略，第一安全策略指示第一地址对第二地址的第一访问行为，第一访问行为为允许或禁止访问。
步骤1202，根据第一安全策略生成第一安全意图，第一安全意图指示第一对象对第二对象的第一访问行为，第一对象或第二对象包括如下任一项：用户的类型，业务的名称，或者网络区域的名称。
本实施例中，步骤1201和1202的具体实现方式和图2对应实施例中的步骤201和202的具体实现方式类似，此处不做赘述。
步骤1203，获取第二安全设备上配置的安全策略，第一安全设备和第二安全设备均位于第一地址对第二地址的目标访问路径上，第一安全设备和第二安全设备为不同的安全设备。
步骤1204，生成与第二安全设备上配置的安全策略对应的安全意图。
本实施例中，步骤1203和1204的具体实现方式和图2对应实施例中的步骤201和202的具体实现方式类似，此处不做赘述。
需要说明的是，本申请实施例不限定步骤1201至1202和步骤1203至1204的执行顺序，可以先执 行步骤1201和1202，再执行步骤1203和1204；也可以先执行步骤1203和1204，再执行步骤1201和1202。
步骤1205，根据第一安全意图和第二安全意图，确定第一安全策略和第二安全策略是否为配置冗余。
本实施例中，第一通信设备在根据第一地址和第二地址，确定第一地址对第二地址的目标访问路径包括的至少一个安全设备之后，若目标访问路径包括的至少一个安全设备的数量为至少两个安全设备，则可以确定目标访问路径上包括的至少一个第二安全设备。
针对至少一个第二安全设备中的任意一个第二安全设备(为方便描述，后续称为“目标第二安全设备”)，在第一访问行为是禁止访问的情况下，目标第二安全设备中可以存在与多个安全策略对应的多个安全意图，第一通信设备可以从与目标第二安全设备对应的多个安全意图中获取与第二安全策略对应的第二安全意图，其中，第二安全策略指示第一地址对第二地址的第四访问行为，第四访问行为为允许或禁止的访问行为，第二安全意图指示第一对象对第二对象执行第四访问行为。
若与目标第二安全设备对应的多个安全意图中存在第二安全意图，且第四访问行为为禁止，也即与目标第二安全设备对应的多个安全意图中存在至少一个第二安全意图指示禁止第一对象访问第二对象，则确定第一安全策略与目标第二安全设备上的第二安全策略为配置冗余。若至少一个第二安全意图中不存在一个第二安全意图指示禁止第一对象访问第二对象，则确定第一安全策略与目标第二安全设备上的第二安全策略不存在配置冗余。
第一通信设备对至少一个第二安全设备中的每个第二安全设备均执行上述操作，以确定第一安全策略与每个第二安全设备上的第二安全策略是否存在配置冗余。若第一安全策略与目标访问路径上的至少一个第二安全设备上的第二安全策略存在配置冗余，则确定第一安全策略和第二安全策略存在配置冗余。
若第一安全策略与目标访问路径上的每个第二安全设备上的第二安全策略均不存在配置冗余，则确定第一安全策略和第二安全策略不存在配置冗余。
本申请实施例中，由于当想要禁止第一地址对第二地址的访问行为时，则只要在第一地址至第二地址的访问路径上的任一个安全设备上配置用于禁止第一地址对第二地址的访问行为的安全策略即可，因此当第一安全意图和第二安全意图均指示禁止第一对象访问第二对象时，就可以确定第一安全策略和第二安全策略之间存在配置冗余，有利于及时发现冗余的安全策略，提高安全设备的资源的利用率。
步骤1206，显示第一安全策略和第一安全意图。
步骤1207，显示第四校验结果，第四校验结果指示第一安全策略和第二安全策略是否存在配置冗余。
本实施例中，步骤1206和1207的具体实现方式与图6对应实施例中步骤604和605类似，此处不做赘述。
可选的，当确定第一安全策略和第二安全策略存在配置冗余时，还可以根据安全策略的部署策略，通过GUI或第二通信设备向用户显示处置建议。其中，处置建议用于指示保留目标访问路径上哪个安全设备上的安全策略；安全策略的部署策略包括以下一项或多项：近第一对象策略、近第二对象策略、资源对比策略、随机策略或其他策略等，此处不做穷举。
其中，近第一对象策略用于在目标访问路径经过的至少一个安全设备中选择保留距离第一对象最近的安全设备上的安全策略，近第二对象策略用于在目标访问路径经过的至少一个安全设备中选择保留距离第二对象最近的安全设备上的安全策略，资源对比策略用于在目标访问路径经过的至少一个安全设备中选择保留拥有最多安全资源的安全设备上的安全策略，安全资源为安全设备中用于存储安全策略的空闲存储空间。
为更直观地理解本方案，以下通过一个具体的示例对确定第四校验结果的过程进行介绍，需要说明的是，如下图13示出的实施例仅为方便理解本方案，不用于限定本方案。请参阅图13，图13为本申请实施例提供的安全策略的处理方法的一种网络拓扑图。图13包括上和下两个子示意图，图13的上子示意图示出的为一种网络拓扑图，图13的下子示意图示出的为第四校验结果。Client-A的IP地址为192.168.1.1，个人客户信息业务的IP地址为172.101.1.1。
在防火墙FW-A和防火墙FW-B上均部署了安全策略如下：

其中，上述安全策略指示禁止192.168.1.1 mask 255.255.255.255这一IP地址对172.101.1.1 mask 255.255.255.255这一IP地址的访问行为。
第一通信设备从防火墙FW-A获取到上述第一安全策略之后，可以生成与第一安全策略对应的第一安全意图。与上述第一安全策略对应的第一安全意图可以指示：Client-A对个人客户信息业务的第一访问行为，第一访问行为是禁止访问。
第一通信设备确定Client-A对个人客户信息业务之间的目标访问路径上包括防火墙FW-A和防火墙FW-B两个安全设备，并确定防火墙FW-B为Client-A对个人客户信息业务之间的目标访问路径上的一个第二安全设备。
第一通信设备从防火墙FW-B上获取到上述第二安全策略之后，可以生成与第二安全策略对应的第二安全意图。与防火墙FW-B上的第二安全策略对应的第二安全意图可以指示：Client-A对个人客户信息业务执行的第四访问行为，第四访问行为是禁止访问。
第一通信设备确定与防火墙FW-B对应的第二安全意图指示禁止Client-A访问个人客户信息业务，确定防火墙FW-A中的第一安全策略与防火墙FW-B中的第二安全策略为配置冗余。
第一通信设备向用户显示的第四校验结果具体可以参阅如下表9和表10：
表9
与安全意图对应的安全策略：
表10
如图13的下子示意图所示，FW-A上的安全策略和FW-B上的安全策略存在配置冗余。的下子示意图中的×表示对应防火墙的安全意图指示禁止Client-A对个人客户信息业务的访问。应理解，图13中的示例仅为方便理解本方案，不用于限定本方案。
本申请实施例中，还可以根据第一安全意图和第二安全意图来确定是否多个安全设备上是否存在安全策略的配置冗余，有利于及时发现冗余的安全策略，提高对安全设备上资源的利用率。此外，提供了第一安全意图的另一种应用方式，扩展了本方案的应用场景，进一步提高了本方案的灵活性。
还可以向用户显示一项或多项校验结果，有利于提示用户及时发现安全设备中已经部署的安全策略或者待部署的安全策略中存在的问题，帮助用户及时的发现已经存在或潜在的风险，有利于提高网络运行的稳定性。
请参阅图14，图14为本申请实施例提供的一种安全策略的处理装置的结构示意图。如图14所示， 安全策略的处理装置1400包括获取模块1401和生成模块1402。获取模块1401，用于获取第一安全设备上配置的第一安全策略，第一安全策略指示第一地址对第二地址的第一访问行为，第一访问行为为允许或禁止访问。生成模块1402，用于根据第一安全策略生成第一安全意图，第一安全意图指示第一对象对第二对象的第一访问行为。第一对象或第二对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称。
可选的，请参阅图15，图15为本申请实施例提供的一种安全策略的处理装置的结构示意图。安全策略的处理装置1400还包括确定模块1403。
可选的，确定模块1403，用于根据第一地址确定第一对象，根据第二地址确定第二对象。
可选的，确定模块1403，还用于根据第一地址和对象信息库确定第一对象，根据第二地址和对象信息库确定第二对象。对象信息库包括至少一个对象中的每个对象和每个对象的地址信息。至少一个对象包括第一对象和第二对象。每个对象为以下任一项：一种用户的类型，一种业务的名称，或一个网络区域的名称。
可选的，第一安全意图用于校验第一安全策略是否匹配安全策略部署意图。
可选的，安全策略部署意图指示第三对象对第四对象的第二访问行为。可选的，确定模块1403，还用于当第三对象和第一对象均包括第一子地址，第四对象和第二对象均包括第二子地址，且第一访问行为和第二访问行为相同时，确定第一安全策略匹配安全策略部署意图。
可选的，第一安全意图用于校验新增安全策略部署意图是否与第一安全意图冲突。
可选的，新增安全策略部署意图指示第五对象对第六对象的第三访问行为。可选的，确定模块1403，还用于当第一对象和第五对象均包括第三子地址，第二对象和第六对象均包括第四子地址，且第一访问行为和第三访问行为不同时，确定新增安全策略部署意图与第一安全意图冲突。
可选的，获取模块1401，还用于获取第二安全设备上配置的第二安全策略，生成模块1402，还用于根据第二安全策略生成第二安全意图。第二安全策略指示第一地址对第二地址的第四访问行为，第二安全意图指示第一对象对第二对象执行第四访问行为。第一安全设备位于第一地址对第二地址的访问路径上，第二安全设备是访问路径上的任意一个其他安全设备。
可选的，第一安全意图和第二安全意图用于校验第一安全策略和第二安全策略是否匹配安全策略部署意图。
可选的，安全策略部署意图指示第三对象对第四对象的第二访问行为。可选的，确定模块1403，还用于当第三对象包括第一对象，第四对象包括第二对象，且第一访问行为和第四访问行为与第二访问行为相同时，确定第一安全策略和第二安全策略匹配安全策略配置意图。
可选的，第一安全意图和第二安全意图用于校验配置冗余。
可选的，确定模块1403，还用于当第一安全意图和第二安全意图均指示禁止第一对象访问第二对象时，确定存在配置冗余。
可选的，请参阅图15，安全策略的处理装置1400还包括显示模块1404。显示模块1404，用于显示第一安全策略和第一安全意图。
可选的，显示模块1404，还用于显示以下一项或多项：第一校验结果，第二校验结果，第三校验结果，或者第四校验结果。第一校验结果指示第一安全策略是否匹配安全策略部署意图。第二校验结果指示新增安全策略部署意图是否与第一安全意图冲突。第三校验结果指示第一安全策略和第二安全策略是否匹配安全策略部署意图。第四校验结果指示是否存在配置冗余。
可选的，获取模块1401，还用于从第三安全设备获取第三安全策略，第三安全策略指示允许或禁止第三地址对第四地址的访问行为。可选的，获取模块1401，还用于获取与第三地址对应的第七对象，获取与第四地址对应的第八对象，并在对象信息库中添加第七对象和第三地址之间的对应关系，以及第八对象和第四地址之间的对应关系，得到新的对象信息库。第七对象或第八对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称。
图16申请实施例提供的一种网络设备1600的结构示意图。网络设备1600搭载有上述的安全策略 的处理装置。网络设备1600由一般性的总线体系结构来实现。
网络设备1600包括至少一个处理器1601、通信总线1602、存储器1603以及至少一个通信接口1604。
可选的，处理器1601是一个通用处理器(central processing unit,CPU)、网络处理器(network processor,NP)、微处理器、或者是一个或多个用于实现本申请方案的集成电路，例如，专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。
通信总线1602用于在上述组件之间传送信息。通信总线1602分为地址总线、数据总线、控制总线等。为便于表示，图中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
可选的，存储器1603是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备。可替换的，存储器1603是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备。可替换的，存储器1603是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。可选的，存储器1603是独立存在的，并通过通信总线1602与处理器1601相连接。可选的，存储器1603和处理器1601集成在一起。
通信接口1604使用任何收发器一类的装置，用于与其它设备或通信网络通信。通信接口1604包括有线通信接口。可选的，通信接口1604还包括无线通信接口。其中，有线通信接口例如为以太网接口。以太网接口是光接口，电接口或其组合。无线通信接口为无线局域网(wireless local area networks，WLAN)接口，蜂窝网络通信接口或其组合等。
在具体实现中，作为一种实施例，处理器1601包括一个或多个CPU，如图16中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，网络设备1600包括多个处理器，如图16中所示的处理器1601和处理器1605。这些处理器中的每一个是一个单核处理器(single-CPU)，或者是一个多核处理器(multi-CPU)。这里的处理器指一个或多个设备、电路、和/或用于处理数据(如计算机程序指令)的处理核。
在一些实施例中，存储器1603用于存储执行本申请方案的程序代码1616，处理器1601执行存储器1603中存储的程序代码1616。也就是说，网络设备1600通过处理器1601以及存储器1603中的程序代码1616，来实现上述的方法实施例。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分可互相参考，每个实施例重点说明的都是与其他实施例的不同之处。
A参考B，指的是A与B相同或者A为B的简单变形。
本申请实施例的说明书和权利要求书中的术语“第一”和“第二”等是用于区别不同的对象，而不是用于描述对象的特定顺序，也不能理解为指示或暗示相对重要性。例如，第一限速通道和第二限速通道用于区别不同的限速通道，而不是用于描述限速通道的特定顺序，也不能理解为第一限速通道比第二限速通道更重要。
本申请实施例，除非另有说明，“至少一个”的含义是指一个或多个，“多个”的含义是指两个或两个以上。
上述实施例可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例描述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以 存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(Digital Subscriber Line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (33)

  1. 一种安全策略的处理方法，其特征在于，所述方法包括：
    获取第一安全设备上配置的第一安全策略，所述第一安全策略指示第一地址对第二地址的第一访问行为，所述第一访问行为为允许或禁止访问；
    根据所述第一安全策略生成第一安全意图，其中，所述第一安全意图指示第一对象对第二对象的所述第一访问行为，所述第一对象或第二对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述第一安全策略生成第一安全意图，包括：
    根据所述第一地址确定所述第一对象；
    根据所述第二地址确定所述第二对象。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    根据所述第一地址和对象信息库确定所述第一对象；
    根据所述第二地址和所述对象信息库确定所述第二对象；
    其中，所述对象信息库包括至少一个对象中的每个对象和所述每个对象的地址信息，所述至少一个对象包括所述第一对象和所述第二对象，所述每个对象为以下任一项：一种用户的类型，一种业务的名称，或一个网络区域的名称。
  4. 根据权利要求1至3任一所述的方法，其特征在于，所述第一安全意图用于校验所述第一安全策略是否匹配安全策略部署意图。
  5. 根据权利要求4所述的方法，其特征在于，所述安全策略部署意图指示第三对象对第四对象的第二访问行为，所述方法还包括：
    当所述第三对象和所述第一对象均包括第一子地址，所述第四对象和所述第二对象均包括第二子地址，且所述第一访问行为和所述第二访问行为相同时，确定所述第一安全策略匹配所述安全策略部署意图。
  6. 根据权利要求1至3任一所述的方法，其特征在于，所述第一安全意图用于校验新增安全策略部署意图是否与所述第一安全意图冲突。
  7. 根据权利要求6所述的方法，其特征在于，所述新增安全策略部署意图指示第五对象对第六对象的第三访问行为，所述方法还包括：
    当所述第一对象和所述第五对象均包括第三子地址，所述第二对象和所述第六对象均包括第四子地址，且所述第一访问行为和所述第三访问行为不同时，确定所述新增安全策略部署意图与所述第一安全意图冲突。
  8. 根据权利要求1至7任一所述的方法，其特征在于，所述方法还包括：
    获取第二安全设备上配置的第二安全策略，所述第二安全策略指示所述第一地址对所述第二地址的第四访问行为，所述第一安全设备位于所述第一地址对所述第二地址的访问路径上，所述第二安全设备是所述访问路径上的任意一个其他安全设备；
    根据所述第二安全策略生成第二安全意图，其中，所述第二安全意图指示所述第一对象对所述第二对象的所述第四访问行为。
  9. 根据权利要求8所述的方法，其特征在于，所述第一安全意图和所述第二安全意图用于校验所述第一安全策略和所述第二安全策略是否匹配所述安全策略部署意图。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    当所述第三对象和所述第一对象均包括第一子地址，所述第四对象和所述第二对象均包括第二子地址，且所述第一访问行为和所述第四访问行为与所述第二访问行为相同时，确定所述第一安全策略和所述第二安全策略匹配所述安全策略部署意图。
  11. 根据权利要求8所述的方法，其特征在于，所述第一安全意图和所述第二安全意图用于校验配置冗余。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    当所述第一安全意图和所述第二安全意图均指示禁止所述第一对象访问所述第二对象时，确定存在配置冗余。
  13. 根据权利要求1至12任一所述的方法，其特征在于，所述方法还包括：
    显示所述第一安全策略和所述第一安全意图。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    显示以下一项或多项：第一校验结果，第二校验结果，第三校验结果，或者第四校验结果；
    其中，所述第一校验结果指示所述第一安全策略是否匹配安全策略部署意图，所述第二校验结果指示新增安全策略部署意图是否与所述第一安全意图冲突，所述第三校验结果指示所述第一安全策略和所述第二安全策略是否匹配所述安全策略部署意图，所述第四校验结果指示是否存在配置冗余。
  15. 根据权利要求1至14任一项所述的方法，其特征在于，所述方法还包括：
    从第三安全设备获取第三安全策略，所述第三安全策略指示允许或禁止第三地址对第四地址的第五访问行为；
    获取与所述第三地址对应的第七对象，获取与所述第四地址对应的第八对象，所述第七对象或第八对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称；
    在所述对象信息库中添加所述第七对象和所述第三地址之间的对应关系，以及所述第八对象和所述第四地址之间的对应关系，得到新的对象信息库。
  16. 一种安全策略的处理装置，其特征在于，所述装置包括：
    获取模块，用于获取第一安全设备上配置的第一安全策略，所述第一安全策略指示第一地址对第二地址的第一访问行为，所述第一访问行为为允许或禁止访问；
    生成模块，用于根据所述第一安全策略生成第一安全意图，其中，所述第一安全意图指示第一对象对第二对象的所述第一访问行为，所述第一对象或第二对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称。
  17. 根据权利要求16所述的装置，其特征在于，所述装置还包括确定模块，
    所述确定模块，用于根据所述第一地址确定所述第一对象；
    所述确定模块，还用于根据所述第二地址确定所述第二对象。
  18. 根据权利要求17所述的装置，其特征在于，
    所述确定模块，用于根据所述第一地址和对象信息库确定所述第一对象；
    所述确定模块，还用于根据所述第二地址和所述对象信息库确定所述第二对象；
    其中，所述对象信息库包括至少一个对象中的每个对象和所述每个对象的地址信息，所述至少一个对象包括所述第一对象和所述第二对象，所述每个对象为以下任一项：一种用户的类型，一种业务的名称，或一个网络区域的名称。
  19. 根据权利要求16至18任一所述的装置，其特征在于，所述第一安全意图用于校验所述第一安全策略是否匹配安全策略部署意图。
  20. 根据权利要求19所述的装置，其特征在于，所述安全策略部署意图指示第三对象对第四对象的第二访问行为；
    所述确定模块，还用于当所述第三对象和所述第一对象均包括第一子地址，所述第四对象和所述第二对象均包括第二子地址，且所述第一访问行为和所述第二访问行为相同时，确定所述第一安全策略匹配所述安全策略部署意图。
  21. 根据权利要求16至18任一所述的装置，其特征在于，所述第一安全意图用于校验新增安全策略部署意图是否与所述第一安全意图冲突。
  22. 根据权利要求21所述的装置，其特征在于，所述新增安全策略部署意图指示第五对象对第六对象的第三访问行为；
    所述确定模块，还用于当所述第一对象和所述第五对象均包括第三子地址，所述第二对象和所述第六对象均包括第四子地址，且所述第一访问行为和所述第三访问行为不同时，确定所述新增安全策略部署意图与所述第一安全意图冲突。
  23. 根据权利要求16至22任一所述的装置，其特征在于，
    所述获取模块，还用于获取第二安全设备上配置的第二安全策略，所述第二安全策略指示所述第一地址对所述第二地址的第四访问行为，所述第一安全设备位于所述第一地址对所述第二地址的访问路径上，所述第二安全设备是所述访问路径上的任意一个其他安全设备；
    所述生成模块，还用于根据所述第二安全策略生成第二安全意图，其中，所述第二安全意图指示所述第一对象对所述第二对象的所述第四访问行为。
  24. 根据权利要求23所述的装置，其特征在于，所述第一安全意图和所述第二安全意图用于校验所述第一安全策略和所述第二安全策略是否匹配所述安全策略部署意图。
  25. 根据权利要求24所述的装置，其特征在于，
    所述确定模块，还用于当所述第三对象和所述第一对象均包括第一子地址，所述第四对象和所述第二对象均包括第二子地址，且所述第一访问行为和所述第四访问行为与所述第二访问行为相同时，确定所述第一安全策略和所述第二安全策略匹配所述安全策略部署意图。
  26. 根据权利要求23所述的装置，其特征在于，所述第一安全意图和所述第二安全意图用于校验配置冗余。
  27. 根据权利要求26所述的装置，其特征在于，
    所述确定模块，还用于当所述第一安全意图和所述第二安全意图均指示禁止所述第一对象访问所述第二对象时，确定存在配置冗余。
  28. 根据权利要求16至27任一所述的装置，其特征在于，所述装置还包括：
    显示模块，用于显示所述第一安全策略和所述第一安全意图。
  29. 根据权利要求28所述的装置，其特征在于，
    所述显示模块，还用于显示以下一项或多项：第一校验结果，第二校验结果，第三校验结果，或者第四校验结果；
    其中，所述第一校验结果指示所述第一安全策略是否匹配安全策略部署意图，所述第二校验结果指示新增安全策略部署意图是否与所述第一安全意图冲突，所述第三校验结果指示所述第一安全策略和所述第二安全策略是否匹配所述安全策略部署意图，所述第四校验结果指示是否存在配置冗余。
  30. 根据权利要求16至29任一项所述的装置，其特征在于，
    所述获取模块，还用于从第三安全设备获取第三安全策略，所述第三安全策略指示允许或禁止第三地址对第四地址的第五访问行为；
    所述获取模块，还用于获取与所述第三地址对应的第七对象，获取与所述第四地址对应的第八对象，所述第七对象或第八对象包括以下任一项：用户的类型，业务的名称，或者网络区域的名称；
    在所述对象信息库中添加所述第七对象和所述第三地址之间的对应关系，以及所述第八对象和所述第四地址之间的对应关系，得到新的对象信息库。
  31. 一种通信设备，包括处理器和存储器，所述存储器用于存储程序代码，所述处理器用于调用所述存储器中的程序代码以使得所述通信设备执行如权利要求1-15任一项所述的方法。
  32. 一种计算机可读存储介质，存储有指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1-15任一项所述的方法。
  33. 一种计算机程序产品，其特征在于，包括程序代码，当计算机运行所述计算机程序产品时，使得所述计算机执行如权利要求1-15任一项所述的方法。
PCT/CN2023/102352 2022-06-29 2023-06-26 一种安全策略的处理方法及相关装置 WO2024001998A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210752166.3A CN117353958A (zh) 2022-06-29 2022-06-29 一种安全策略的处理方法及相关装置
CN202210752166.3 2022-06-29

Publications (1)

Publication Number Publication Date
WO2024001998A1 true WO2024001998A1 (zh) 2024-01-04

Family

ID=89354486

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/102352 WO2024001998A1 (zh) 2022-06-29 2023-06-26 一种安全策略的处理方法及相关装置

Country Status (2)

Country Link
CN (1) CN117353958A (zh)
WO (1) WO2024001998A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1863193A (zh) * 2005-05-10 2006-11-15 联想网御科技(北京)有限公司 实现网络安全装置安全策略的方法
CN101364877A (zh) * 2008-09-28 2009-02-11 福建星网锐捷网络有限公司 安全策略配置方法及其装置
US20190007453A1 (en) * 2017-06-29 2019-01-03 Juniper Networks, Inc. Intent-based network security policy modification
US20200344171A1 (en) * 2019-04-23 2020-10-29 Hewlett Packard Enterprise Development Lp Verifying intents in stateful networks using atomic address objects
CN114640590A (zh) * 2022-01-26 2022-06-17 北京邮电大学 意图网络中策略集冲突检测方法及相关设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1863193A (zh) * 2005-05-10 2006-11-15 联想网御科技(北京)有限公司 实现网络安全装置安全策略的方法
CN101364877A (zh) * 2008-09-28 2009-02-11 福建星网锐捷网络有限公司 安全策略配置方法及其装置
US20190007453A1 (en) * 2017-06-29 2019-01-03 Juniper Networks, Inc. Intent-based network security policy modification
US20200344171A1 (en) * 2019-04-23 2020-10-29 Hewlett Packard Enterprise Development Lp Verifying intents in stateful networks using atomic address objects
CN114640590A (zh) * 2022-01-26 2022-06-17 北京邮电大学 意图网络中策略集冲突检测方法及相关设备

Also Published As

Publication number Publication date
CN117353958A (zh) 2024-01-05

Similar Documents

Publication Publication Date Title
US11102079B2 (en) Cross-regional virtual network peering
US10437775B2 (en) Remote direct memory access in computing systems
US11088944B2 (en) Serverless packet processing service with isolated virtual network integration
CN105684391B (zh) 基于标签的访问控制规则的自动生成
CN106850324B (zh) 虚拟网络接口对象
JP6266696B2 (ja) サービス志向ソフトウェア定義型セキュリティのフレームワーク
US9825808B2 (en) Network configuration via abstraction components and standard commands
CN115699698A (zh) 虚拟l2网络中的环路防止
US20220150154A1 (en) Automatically managing a mesh network based on dynamically self-configuring node devices
US10652280B2 (en) User interface features for enterprise security management
US11777897B2 (en) Cloud infrastructure resources for connecting a service provider private network to a customer private network
US20220210005A1 (en) Synchronizing communication channel state information for high flow availability
US20240089328A1 (en) Systems and methods for dynamic federated api generation
JP2024507146A (ja) キャッシュされた構成情報およびキャッシュされない構成情報に基づいたクラウドインフラストラクチャにおけるパケットフロー
US20220141080A1 (en) Availability-enhancing gateways for network traffic in virtualized computing environments
US20230421610A1 (en) Resolving Access Policies Between Intent-Based Network Architectures and Cloud Native Architectures
US20230396579A1 (en) Cloud infrastructure resources for connecting a service provider private network to a customer private network
US11683228B2 (en) Automatically managing a role of a node device in a mesh network
US11296981B2 (en) Serverless packet processing service with configurable exception paths
WO2024001998A1 (zh) 一种安全策略的处理方法及相关装置
US11063758B1 (en) Methods for facilitating cipher selection and devices thereof
Ahmad et al. Protection of centralized SDN control plane from high-rate Packet-In messages
CN116897527A (zh) 用于将服务提供商私有网络连接到客户私有网络的云基础设施资源
JP2017175373A (ja) 設定情報生成装置、ネットワーク制御装置、方法、及び、プログラム
CN117353961A (zh) 一种安全策略的获取方法及相关装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23830175

Country of ref document: EP

Kind code of ref document: A1