Rule matching method and apparatus, firewall device, and machine readable storage medium

Abstract

The embodiment of the invention provides a rule matching method and apparatus, a firewall device, and a machine readable storage medium. The rule matching method comprises the following steps: when amessage is received, obtaining a security policy rule, and if it is determined that an address range segment in a filtering condition of the security policy rule contains at least one excluded address, segmenting the address range segment according to the excluded addresses to obtain a plurality of first address range segments excluding the excluded addresses; and matching the received message based on the first address range segments. By adoption of the scheme, the matching performance of the security policy rule can be improved.

Description

technical field [0001] The present invention relates to the technical field of security defense, in particular to a rule matching method, device, firewall equipment and machine-readable storage medium. Background technique [0002] A firewall device refers to a protective barrier composed of software and hardware, constructed between the internal network and the external network, between the private network and the public network, so that a security gateway can be established between the networks, thereby protecting the internal network from Intruded by illegal users. Security policy rules can be configured on the firewall device. Security policy rules can support filtering conditions such as address object groups, and matching items such as address range segments can be configured in address object groups. For example, for an enterprise, in order to facilitate the normal access of enterprise employees to the corporate network, configure the filter conditions that support a...

AI Technical Summary

Problems solved by technology

[0004] However, in practical applications, especially in enterprises, employees have different access rights to the enterprise network due to their different positions. If the address range segment in the filter condition of the security policy rule covers the addresses of all employees, the When matching, the packets of all employees will be matched successfully, resulting in abnormal access, that is, the matching performance of security policy rules is poor

Images