Method and device for merging network access policies

Abstract

The invention discloses a method and a device for combining network access strategies. The method comprises the following steps: acquiring a set of strategies to be combined, determining any dimension as a current dimension, and determining dimensions other than the current dimension as dimensions to be combined; finding the strategies to be combined in which elements corresponding to the dimensions to be combined have an equivalence relation, and combining elements corresponding to the current dimension; determining the current dimension as a combined dimension, and determining a dimension to be combined as the current dimension once again; after that dimensions to be combined exist is determined, finding strategies to be combined in which elements corresponding to the dimensions to be combined have an equivalence relation, finding the strategies to be combined in which elements corresponding the combined dimensions have the equivalence relation or an inclusion relation in the found strategies to be combined, and finishing combination; and after that the dimensions to be combined do not exist is determined, finding the strategies to be combined in which the elements corresponding to the combined dimensions have the equivalence relation or the inclusion relation, and finishing combination. Through adoption of the method and the device, self-learned point-to-point strategies are combined reasonably, so that the number of the strategies is reduced, and the strategy matching system performance is enhanced.

Description

technical field [0001] The invention relates to the field of data processing, in particular to a method and device for merging network access policies. Background technique [0002] A network access policy is a forwarding rule that includes source and destination network addresses and corresponding forwarding actions (allow or deny). It is a simple and effective means of network traffic control and is widely used in network data forwarding devices such as gateways, routers, and firewalls. . [0003] As a device parameter, the network access policy is usually manually configured in advance by the administrator before the device goes online. However, data forwarding devices in non-marginal networks, such as routers of network operators, egress gateways or firewall devices of a company, usually need to support more complex network topologies and service access, and the network access policies that need to be configured are relatively complex. Many and complex, which requires ...

AI Technical Summary

Problems solved by technology

[0006] Due to the complexity of the non-marginal network, the data forwarding device of the non-marginal network will self-learn a large number of "point-to-point" policies, and directly writing these "point-to-point" policies into the device will cause matching policies during the policy use process. When the system performance is reduced, it is also difficult to maintain too many policies

Images