Method and apparatus for automatically generating firewall access control policies

Abstract

This application discloses an automatic generation method and apparatus for firewall access control policies, belonging to the field of network information technology. The method generates a current multidimensional path tree based on a security policy knowledge graph, representing at least one access control policy matching the current configuration request. It converts the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into current one-dimensional encoded values. The current one-dimensional encoded values ​​are then queried and matched with a set of historical one-dimensional encoded values ​​converted from historical multidimensional path trees generated based on historical configuration requests to identify whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of historical multidimensional path trees. If no partial overlap exists, configuration scripts corresponding to the local and remote firewall control points are generated for automatic configuration of the access control policy. This application can improve the visualization and intelligence level of automated configuration of firewall access control policies.

Description

Technical Field

[0001] This application relates to the field of network information technology, and more specifically, to a method and apparatus for automatically generating firewall access control policies. Background Technology

[0002] The operation and maintenance of access control policies for firewall devices in banking network systems is complex and requires specialized expertise, consistently impacting the efficiency of security operations. Changing firewall access control policies involves multiple steps, including compliance checks, firewall device location, and firewall configuration script generation, all of which rely on manual judgment and operation, significantly affecting the efficiency and accuracy of firewall access control policy maintenance. To address this, existing technologies can automatically generate firewall configuration commands using a pre-set policy library to automate the configuration of firewall access control policies. For example, CN117596139B obtains a configuration requirement table through a computing device, queries outbound and inbound policies in a pre-set policy library, and automatically generates and issues firewall configuration commands, enabling rapid configuration of firewall access control policies. However, this method still lacks sufficient intelligence for the automatic location and configuration of firewall devices.

[0003] Furthermore, as the scale of banking network systems increases, the number of access control policies in firewall devices distributed across various network security zones within these systems grows rapidly. The automatic generation of access control policies in these firewall devices requires consideration of compliance verification of policy activation data. Traditionally, this involves comparing each rule condition in the required access control policy with the set of already configured access control policies to determine if there are policy conflicts or redundancy issues. Existing technologies can also optimize access control policy conflict and redundancy detection using linked lists or tree data structures. For example, CN105743871B stores each rule condition in the access control policy as a decision tree, implementing firewall policy conflict detection based on the decision tree. However, this method essentially still compares each rule condition in each access control policy one by one, which remains insufficient when the number of access control policies in the firewall device is very large, affecting the processing efficiency and intelligence level of automatic firewall access control policy generation. Therefore, an improved technical solution is urgently needed to address these issues. Summary of the Invention

[0004] In view of this, this application proposes a method and apparatus for automatically generating firewall access control policies to solve the above-mentioned technical problems.

[0005] Firstly, this application proposes a method for automatically generating firewall access control policies, including:

[0006] Based on the current configuration request of the firewall access control policy, a current multidimensional path tree is generated according to the security policy knowledge graph to represent at least one access control policy that matches the current configuration request. The intermediate nodes of the current multidimensional path tree represent the multidimensional matching conditions in the access control policy, and the leaf nodes of the current multidimensional path tree represent the control actions in the access control policy.

[0007] The multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree are converted into current one-dimensional encoded values. The current one-dimensional encoded values ​​are then queried and matched with the set of historical one-dimensional encoded values ​​converted from historical multidimensional path trees generated based on historical configuration requests to identify whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree.

[0008] If there is no partial overlap, a configuration script corresponding to the local firewall control point and the peer firewall control point in the at least one access control policy is generated, and the access control policy is automatically configured for the local firewall control point and the peer firewall control point.

[0009] Optionally, the security policy knowledge graph is used to characterize the corresponding control relationships between each network security zone and each firewall control point in the network system, as well as the inbound and outbound access policies between each network security zone.

[0010] Optionally, generating a current multidimensional path tree based on the security policy knowledge graph to represent at least one access control policy matching the current configuration request includes:

[0011] Based on the configuration parameters included in the current configuration request, the local firewall control point, the peer firewall control point, and the control action corresponding to the current configuration request are located from the security policy knowledge graph.

[0012] Generate at least one access control policy that includes the configuration parameters, the local firewall control point, the peer firewall control point, and the control action.

[0013] Optionally, converting the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into current one-dimensional encoded values ​​includes:

[0014] The original data of each matching condition in the multidimensional matching condition represented by the intermediate node of each sub-path tree of the current multidimensional path tree is mapped to the sorted index of the global numerical space.

[0015] The binary number of the sorted index mapped to the original data of each matching condition is sequentially and crosswise arranged in order from high bit to low bit or from low bit to high bit, and converted into the current one-dimensional encoded value.

[0016] Optionally, the step of querying and matching the current one-dimensional encoded value with the set of historical one-dimensional encoded values ​​converted from the historical multi-dimensional path tree generated based on the historical configuration request to identify whether the intermediate nodes of the current multi-dimensional path tree partially overlap with the intermediate nodes of the historical multi-dimensional path tree includes:

[0017] A B+ tree index is constructed using the set of historical one-dimensional encoded values ​​converted from the historical multidimensional path tree generated based on historical configuration requests. The non-leaf nodes and leaf nodes of the B+ tree index use the historical one-dimensional encoded values ​​as keys, and the leaf nodes of the B+ tree index store pointers to the sub-path trees of the historical multidimensional path tree corresponding to the key values.

[0018] The current one-dimensional encoding value is used to query the B+ tree index to see if there is a historical one-dimensional encoding value that is the same, so as to identify whether the intermediate node of the current multidimensional path tree has partial overlap with the intermediate node of the historical multidimensional path tree.

[0019] Optionally, the method includes:

[0020] If there is overlap, the control actions represented by the leaf nodes of the current multidimensional path tree and the historical multidimensional path tree that have partial overlap are compared to identify whether there is a policy conflict anomaly or a redundancy anomaly.

[0021] Optionally, the method includes:

[0022] The security policy knowledge graph identifies whether the specified matching conditions in the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree match the attribute fields of the target business application. The specified matching conditions include at least the destination IP address, port, and protocol type.

[0023] If a match is found, the second peer firewall control point corresponding to the server IP address is located based on the server IP address list of the target business application, excluding the destination IP address.

[0024] Based on the current multidimensional path tree, the server IP address, and the second peer firewall control point, a second multidimensional path tree is generated to characterize at least one second access control policy that matches the target business application.

[0025] Optionally, generating a second multidimensional path tree based on the current multidimensional path tree, the server IP address, and the second peer firewall control point to characterize at least one second access control policy matching the target business application includes:

[0026] The destination IP address and peer firewall control point in the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree are replaced by the server IP address and the peer firewall control point, respectively, to generate the second multidimensional path tree.

[0027] Optionally, the method further includes:

[0028] The multidimensional matching conditions represented by the intermediate nodes of the second multidimensional path tree are converted into second one-dimensional encoded values. The second one-dimensional encoded values ​​are then matched with the set of historical one-dimensional encoded values ​​to identify whether the intermediate nodes of the second multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree.

[0029] If there is no partial overlap, a configuration script corresponding to the local firewall control point and the second peer firewall control point in the at least one second access control policy is generated, and access control policies are automatically configured for the local firewall control point and the second peer firewall control point.

[0030] Secondly, this application also proposes an automatic generation device for firewall access control policies, comprising:

[0031] The multidimensional path tree generation module is used to generate a current multidimensional path tree based on the current configuration request of the firewall access control policy and the security policy knowledge graph to represent at least one access control policy that matches the current configuration request. The intermediate nodes of the current multidimensional path tree represent the multidimensional matching conditions in the access control policy, and the leaf nodes of the current multidimensional path tree represent the control actions in the access control policy.

[0032] The encoding conversion and matching module is used to convert the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into the current one-dimensional encoding value, and to query and match the current one-dimensional encoding value with the set of historical one-dimensional encoding values ​​converted from the historical multidimensional path tree generated based on the historical configuration request to identify whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree.

[0033] The policy script generation module is used to generate configuration scripts corresponding to the local firewall control point and the peer firewall control point in the at least one access control policy if there is no partial overlap, and to automatically configure the access control policy for the local firewall control point and the peer firewall control point.

[0034] This application can achieve at least the following beneficial effects:

[0035] This application generates a current multidimensional path tree based on a security policy knowledge graph to represent at least one access control policy that matches the current configuration request. By converting the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into current one-dimensional encoded values, and querying and matching the current one-dimensional encoded values ​​with the set of historical one-dimensional encoded values ​​converted from historical multidimensional path trees generated based on historical configuration requests, it identifies whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path trees. This avoids the need for one-by-one comparison of each matching condition in policy conflict and redundancy anomaly detection, significantly improving the processing efficiency of policy conflict and redundancy anomaly detection, thereby improving the visualization and intelligence level of automated configuration of firewall access control policies, and further enhancing the security of firewall operation and maintenance in bank network systems. Attached Figure Description

[0036] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as limiting the scope of this application.

[0037] Figure 1 This is a schematic diagram of an exemplary network system 100 applied to financial enterprises such as banks;

[0038] Figure 2 This is a flowchart illustrating the automatic generation method of firewall access control policies according to the first embodiment of this application;

[0039] Figure 3 This is a schematic diagram illustrating the structural principle of an exemplary security policy knowledge graph according to the first embodiment of this application;

[0040] Figure 4 A schematic diagram of a multidimensional path tree automatically generated according to the first embodiment of this application is presented as an example;

[0041] Figure 5 An illustrative diagram of a policy conflict anomaly based on a multidimensional path tree is presented;

[0042] Figure 6 An illustrative diagram of policy redundancy anomalies based on a multidimensional path tree is presented;

[0043] Figure 7 This is a partial flowchart illustrating the automatic generation method of firewall access control policies according to the second embodiment of this application;

[0044] Figure 8 This is a partial flowchart illustrating the automatic generation method of firewall access control policies according to the third embodiment of this application;

[0045] Figure 9 This is a partial flowchart illustrating the automatic generation method of firewall access control policies according to the fourth embodiment of this application;

[0046] Figure 10 This is a schematic diagram illustrating the structural principle of an exemplary security policy knowledge graph according to the fourth embodiment of this application;

[0047] Figure 11 A schematic diagram of a multidimensional path tree automatically generated according to the fourth embodiment of this application is presented as an example;

[0048] Figure 12 This is a partial flowchart illustrating the automatic generation method of firewall access control policies according to the fifth embodiment of this application;

[0049] Figure 13 This is a schematic diagram of the structure of an automatic generation device for firewall access control policies according to the first embodiment of this application;

[0050] Figure 14 This is a partial structural schematic diagram of an automatic generation device for firewall access control policies according to a second embodiment of this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. However, it should be understood that the described embodiments are merely some exemplary embodiments of this application, and not all embodiments. Therefore, the following detailed description of the embodiments of this application is not intended to limit the scope of protection claimed by this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0052] It should be noted that the terms "first," "second," etc., in the specification and claims of this application are only used to distinguish and describe similar objects, and are not used to describe a specific order or sequence, nor should they be construed as indicating or implying relative importance.

[0053] As mentioned earlier, existing technologies can automatically generate firewall configuration commands using a preset policy library to achieve automatic configuration of access control policies for firewall devices. However, this method is still not intelligent enough for the automatic location and configuration of firewall devices. Furthermore, with the increasing scale of bank network systems, the number of access control policies in firewall devices distributed across various network security zones of the bank network is growing rapidly. The automatic generation of access control policy configurations in each network security zone requires consideration of compliance verification of policy activation data. Existing technologies determine whether there are policy conflicts or redundancy anomalies by comparing each rule condition in the required access control policy with the set of configured access control policies one by one. This approach is insufficient when the number of access control policies in the firewall device is very large, affecting the processing efficiency and intelligence level of automatic firewall access control policy generation. Therefore, this application proposes an automatic generation method and apparatus for firewall access control policies to improve the above-mentioned problems.

[0054] Figure 1 This is a schematic diagram of an exemplary network system 100 applied to financial enterprises such as banks. Figure 1 As shown, the network system 100 includes multiple network security zones 101. Figure 1 The example only presents network security zones A, B, and C. In reality, the number of network security zones in network system 100 can be divided into more network security zones 101 according to network security level requirements. Each network security zone 101 includes a group of computer or server terminals connected via a switch network, each corresponding to a set of IP address ranges. In this network system 100, each network security zone 101 is connected to the backbone network 103 through a corresponding firewall control point 102. For example, network security zone A is connected to firewall control point FC1, network security zone B is connected to firewall control point FC2, and network security zone C is connected to firewall control point FC3. The network system 100 also includes a security policy automation platform 104 for automated management and configuration of firewall access control policies in network system 100. At least some or all embodiments of this application can be implemented in the security policy automation platform 104.

[0055] Figure 2 This is a flowchart illustrating the automatic generation method of firewall access control policies according to the first embodiment of this application. Figure 2 As shown, the automatic generation method for firewall access control policies in this application embodiment includes the following steps:

[0056] Step 210: Based on the current configuration request of the firewall access control policy, generate a current multidimensional path tree according to the security policy knowledge graph to represent at least one access control policy that matches the current configuration request. The intermediate nodes of the current multidimensional path tree represent the multidimensional matching conditions in the access control policy, and the leaf nodes of the current multidimensional path tree represent the control actions in the access control policy.

[0057] Step 220: Convert the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into current one-dimensional encoded values, and query and match the current one-dimensional encoded values ​​with the set of historical one-dimensional encoded values ​​converted from historical multidimensional path trees generated based on historical configuration requests to identify whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree.

[0058] Step 230: If there is no partial overlap, generate a configuration script corresponding to the local firewall control point and the peer firewall control point in the at least one access control policy, and automatically configure the access control policy for the local firewall control point and the peer firewall control point.

[0059] In this embodiment, a security policy knowledge graph is pre-generated in the security policy automation platform 104 of the network system 100 based on the topology and configuration information of the network system 100. The security policy knowledge graph is used to characterize the corresponding control relationships between each network security zone 101 and each firewall control point 102 in the network system 100, as well as the inbound and outbound access policies between each network security zone 101.

[0060] Figure 3 This is a schematic diagram illustrating the structural principle of an exemplary security policy knowledge graph according to an embodiment of this application. For example... Figure 3 As shown, network security zone 101 and firewall control point 102 in network system 100 are constructed as entity nodes in a security policy knowledge graph. A one-way connection between network security zone 101 and firewall control point 102 represents the corresponding control relationship between them. A two-way connection between network security zones 101 represents the inbound and outbound access policies between the two network security zones 101. For example, the inbound and outbound access policies between network security zone A and network security zone B include access control policies from network security zone A (inbound) and network security zone B (outbound), as well as access control policies from network security zone A (outbound) and network security zone B (inbound).

[0061] Each entity node of network security zone 101 and firewall control point 102 has corresponding attribute fields. The attribute fields of the entity node of network security zone 101 include at least the security zone name, IP address range, and network area. The security zone name is the logical name of network security zone 101 in network system 100, the IP address range is the range of IP addresses covered by network security zone 101, and the network area is a network partition divided according to the geographical area or business function area of ​​network system 100. The attribute fields of the entity node of firewall control point 102 include at least the firewall name, firewall type, device IP address, and local IP address range. The firewall name is the device identifier of firewall control point 102, the firewall type is the device model of firewall control point 102, which determines the syntax format of the adapted firewall configuration script, the device IP address is the device ID address of firewall control point 102 in network system 100, and the local IP address range is the IP address range of network security zone 101 with which firewall control point 102 has a corresponding control relationship.

[0062] In step 210 of this embodiment, a current configuration request for a firewall access control policy is first received. Based on the current configuration request and the aforementioned pre-generated security policy knowledge graph, a current multidimensional path tree is generated to represent at least one access control policy matching the current configuration request. The firewall access control policy configuration request may originate from a business department's firewall policy activation requirement. This configuration request includes configuration parameters such as request ID, source IP address, destination IP address, protocol type, and port. Among these, the source IP address, destination IP address, protocol type, and port are key fields related to the access control policy to be activated. In this embodiment, for ease of distinction, the most recently received configuration request to be processed can be referred to as the current configuration request, and previously received and processed configuration requests can be referred to as historical configuration requests.

[0063] In this embodiment, the multidimensional path tree is an automatically generated path tree with multiple conditional dimensions, consisting of multidimensional matching conditions and control actions of at least one access control policy, based on the configuration parameters related to the access control policy carried in the configuration request. The root node of the multidimensional path tree represents the request ID of the configuration request, the intermediate nodes represent the multidimensional matching conditions in the access control policy (e.g., source IP address, local firewall control point, peer firewall control point, destination IP address, port, protocol type), and the leaf nodes represent the control actions in the access control policy (e.g., deny access and allow access). For ease of distinction, this application refers to the multidimensional path tree generated based on the received current configuration request as the current multidimensional path tree, and the multidimensional path tree generated based on the received historical configuration requests as the historical multidimensional path tree.

[0064] Among them, the local firewall control point is firewall control point 102, which has a corresponding control relationship with the source network security zone to which the source IP address belongs; the remote firewall control point is firewall control point 102, which has a corresponding control relationship with the destination network security zone to which the destination IP address belongs. For example... Figure 1 If the source IP address belongs to network security zone A and the destination IP address belongs to network security zone B, then the local firewall control point is firewall control point FC1, and the remote firewall control point is firewall control point FC2. The control actions in the access control policy can be determined based on the inbound and outbound access policies and inbound / outbound access policies between network security zones 101 in the aforementioned pre-generated security policy knowledge graph.

[0065] In one implementation, step 210, which generates a current multidimensional path tree based on a security policy knowledge graph to represent at least one access control policy matching the current configuration request, may include:

[0066] Based on the configuration parameters included in the current configuration request, the local firewall control point, the peer firewall control point, and the control action corresponding to the current configuration request are located from the security policy knowledge graph.

[0067] Generate at least one access control policy that includes the configuration parameters, the local firewall control point, the peer firewall control point, and the control action.

[0068] The local and remote firewall control points corresponding to the current configuration request can be located by first identifying the source network security zone to which the source IP address belongs and the destination network security zone to which the destination IP address belongs from the security policy knowledge graph. Then, based on firewall control points 102 that have corresponding control relationships with the source and destination network security zones, the local and remote firewall control points can be located. Simultaneously, based on the inbound and outbound access policies between the source and destination network security zones in the security policy knowledge graph, the control action corresponding to the current configuration request can be determined, i.e., whether the access control policy configured this time allows or denies access.

[0069] Figure 4 A schematic diagram of a multidimensional path tree automatically generated according to the first embodiment of this application is presented as an example. Figure 4The diagram shows a multidimensional path tree 401 generated based on a configuration request with request ID 1 and a multidimensional path tree 402 generated based on a configuration request with request ID 2. The root node 410 of each multidimensional path tree represents the request ID of the configuration request, the intermediate nodes 420 represent the multidimensional matching conditions in the access control policy, including the source IP address, the local firewall control point, the peer firewall control point, the destination IP address, the port, and the protocol type, and the leaf nodes 430 represent the control actions in the access control policy, including denying access and allowing access.

[0070] like Figure 4 As shown, the multidimensional path tree 401 can be represented as a path link consisting of at least one access control policy that matches the configuration request with request ID 1:

[0071] {1—>Source IP address (192.168.1.1-4)—>Local firewall control point (FC1)—>Peer firewall control point (FC2)—>Destination IP address (168.16.1.1-5)—>Port (8080)—>Protocol type (TCP)—>Control action (deny access)}.

[0072] A 402 multi-path tree can be represented as a path link consisting of at least one access control policy that matches the configuration request with request ID 2:

[0073] {2—>Source IP address (192.168.1.4-6)—>Local firewall control point (FC1)—>Peer firewall control point (FC3)—>Destination IP address (172.64.1.1)—>Port (8081)—>Protocol type (UDP)—>Control action (Allow access)}.

[0074] The above multidimensional path tree can be represented mathematically as a tuple:

[0075] .

[0076] in, Represents a multidimensional path tree that matches the request ID of the configuration request; This indicates the request ID of the configuration request. This represents the set of source IP addresses (srcIP) included in the configuration request. This indicates the local firewall control point corresponding to the network security zone to which the source IP address belongs; This indicates the peer firewall control point corresponding to the network security zone to which the destination IP address belongs; This represents the set of destination IPs (dstIPs) included in the configuration request; This represents the set of ports included in the configuration request; This represents the set of protocol types included in the configuration request; This indicates the control actions involved in the current access control policy.

[0077] In this embodiment, after the current multidimensional path tree has been generated based on the current configuration request, step 220 can further convert the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into current one-dimensional encoded values. Then, the current one-dimensional encoded values ​​are queried and matched with the set of historical one-dimensional encoded values ​​converted from historical multidimensional path trees generated based on historical configuration requests to identify whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree.

[0078] In the automated configuration of firewall access control policies, conflicts and redundancy anomalies between policies are two common anomalies. To address the problem of low efficiency in detecting conflicts and redundancy anomalies when the number of access control policies in firewall control points is very large, this application embodiment can convert the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into the current one-dimensional encoded value. This allows the comparison of multidimensional conditions one by one to be mapped to the comparison of one-dimensional conditions, thereby accelerating the efficiency of conflict and redundancy anomaly detection.

[0079] Figure 5 An illustrative diagram of a policy conflict anomaly based on a multidimensional path tree is presented. Figure 6 An illustrative diagram of policy redundancy anomalies based on a multidimensional path tree is presented.

[0080] Since each intermediate node in the multidimensional path tree constitutes a condition dimension to be matched, conflicts and redundancy anomalies between policies can manifest as partial overlap between the multidimensional path trees generated by two configuration requests in terms of source IP address, local firewall control point, peer firewall control point, destination IP address, port, and protocol type.

[0081] like Figure 5 As shown, multidimensional path tree 403 It can be represented as a path link consisting of at least one access control policy that matches the current configuration request with request ID 3. :

[0082] : {3—>Source IP address (192.168.1.4-6)—>Local firewall control point (FC1)—>Peer firewall control point (FC2)—>Destination IP address (168.16.1.5)—>Port (8080)—>Protocol type (TCP)—>Control action (Allow access)}.

[0083] It is evident that the multidimensional path tree 403 generated based on the current configuration request with request ID 3 is the current multidimensional path tree; relative to multidimensional path tree 403, the multidimensional path trees 401 and 402 generated based on the historical configuration requests with request IDs 1 and 2 are the historical multidimensional path trees, which can be represented as follows: , .

[0084] Among them, such as Figure 5 As shown by the dashed line, the sub-path tree {3 -> source IP address (192.168.1.4) -> local firewall control point (FC1) -> peer firewall control point (FC2) -> destination IP address (168.16.1.5) -> port (8080) -> protocol type (TCP) -> control action (allow access)} contained in multidimensional path tree 403 overlaps with the sub-path tree {1 -> source IP address (192.168.1.4) -> local firewall control point (FC1) -> peer firewall control point (FC2) -> destination IP address (168.16.1.5) -> port (8080) -> protocol type (TCP) -> control action (deny access)} contained in multidimensional path tree 401 at intermediate node 420. However, if the control action (allow access) represented by the leaf node of the multidimensional path tree 403 is different from the control action (deny access) represented by the leaf node of the multidimensional path tree 401, this situation is considered a policy conflict exception.

[0085] like Figure 6 As shown, the multidimensional path tree 403 can be represented as a path link consisting of at least one access control policy that matches the current configuration request with request ID 3: {3 -> Source IP address (192.168.1.4-6) -> Local firewall control point (FC1) -> Peer firewall control point (FC2) -> Destination IP address (168.16.1.5) -> Port (8080) -> Protocol type (TCP) -> Control action (Deny access)}.

[0086] As mentioned earlier, the multidimensional path tree 403 generated based on the current configuration request with request ID 3 is the current multidimensional path tree; relative to the multidimensional path tree 403, the multidimensional path trees 401 and 402 generated based on the historical configuration requests with request IDs 1 and 2 are the historical multidimensional path trees.

[0087] Among them, such as Figure 6As shown by the dashed line, the sub-path tree {3 -> source IP address (192.168.1.4) -> local firewall control point (FC1) -> peer firewall control point (FC2) -> destination IP address (168.16.1.5) -> port (8080) -> protocol type (TCP) -> control action (deny access)} contained in multidimensional path tree 403 overlaps with the sub-path tree {1 -> source IP address (192.168.1.4) -> local firewall control point (FC1) -> peer firewall control point (FC2) -> destination IP address (168.16.1.5) -> port (8080) -> protocol type (TCP) -> control action (deny access)} contained in multidimensional path tree 401 at intermediate node 420. Furthermore, if the control action (deny access) represented by the leaf node of the multidimensional path tree 403 is the same as the control action (deny access) represented by the leaf node of the multidimensional path tree 401, this situation constitutes a policy redundancy anomaly.

[0088] for Figure 5 and Figure 6 To address the strategy conflicts and redundancy anomalies shown, this embodiment converts the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into current one-dimensional encoded values. Then, it queries and matches these current one-dimensional encoded values ​​with a set of historical one-dimensional encoded values ​​converted from historical multidimensional path trees to identify whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path trees. This allows for the rapid detection of strategy conflicts and redundancy anomalies.

[0089] In step 230 of this embodiment, if the intermediate nodes of the multidimensional path tree 403 do not partially overlap with the intermediate nodes of the multidimensional path trees 401 and 402, a configuration script corresponding to the local firewall control point and the peer firewall control point in the at least one access control policy is generated, and the access control policy is automatically configured for the local firewall control point and the peer firewall control point.

[0090] Specifically, based on the attribute fields of the device models of the local and peer firewall control points in the security policy knowledge graph, the syntax format of the firewall configuration scripts adapted to the local and peer firewall control points can be determined. The access control policy represented by the current multidimensional path tree can be converted into the syntax format of the firewall configuration scripts adapted to the local and peer firewall control points. The policy can then be automatically distributed to the local and peer firewall control points for automatic configuration based on their device IP addresses.

[0091] In summary, the automatic generation method for firewall access control policies in this application generates a current multidimensional path tree based on a security policy knowledge graph to represent at least one access control policy that matches the current configuration request. By converting the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into current one-dimensional encoded values, and querying and matching these current one-dimensional encoded values ​​with the set of historical one-dimensional encoded values ​​converted from historical multidimensional path trees generated based on historical configuration requests, the method identifies whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path trees. This avoids the need for one-by-one comparison of each matching condition in policy conflict and redundancy anomaly detection, significantly improving the processing efficiency of policy conflict and redundancy anomaly detection. Furthermore, it enhances the visualization and intelligence level of automated configuration of firewall access control policies, and further improves the firewall operation and maintenance security of the bank network system.

[0092] Figure 7 This is a partial flowchart illustrating the automatic generation method of firewall access control policies according to the second embodiment of this application. Figure 7 As shown, step 220, which converts the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into the current one-dimensional encoded values, may include the following steps:

[0093] Step 710: Map the original data of each matching condition in the multidimensional matching conditions represented by the intermediate node of each sub-path tree of the current multidimensional path tree to the sorted index of the global numerical space.

[0094] Step 720: The binary number of the sorting index mapped to the original data of each matching condition is sequentially cross-arranged from high bit to low bit or from low bit to high bit and converted into the current one-dimensional encoded value.

[0095] Specifically, with Figure 5 For example, the multidimensional path tree 403, which is the current multidimensional path tree, can be split into multiple sub-path trees. , , :

[0096] : {3—>Source IP address (192.168.1.4)—>Local firewall control point (FC1)—>Peer firewall control point (FC2)—>Destination IP address (168.16.1.5)—>Port (8080)—>Protocol type (TCP)—>Control action (Allow access)};

[0097] : {3—>Source IP address (192.168.1.5)—>Local firewall control point (FC1)—>Peer firewall control point (FC2)—>Destination IP address (168.16.1.5)—>Port (8080)—>Protocol type (TCP)—>Control action (Allow access)};

[0098] : {3—>Source IP address (192.168.1.6)—>Local firewall control point (FC1)—>Peer firewall control point (FC2)—>Destination IP address (168.16.1.5)—>Port (8080)—>Protocol type (TCP)—>Control action (Allow access)}.

[0099] First, the original data of each intermediate node in each sub-path tree, excluding the root and leaf nodes, is mapped to the sorting index of the global numerical space in which each intermediate node resides. The global numerical space in which each intermediate node resides refers to the range of values ​​for the matching condition represented by each intermediate node across the entire dataset in network system 100. This is to improve the performance degradation of sorting the transformed one-dimensional encoded values ​​caused by the unbalanced distribution of dimensions among the original data of each matching condition. For example, in the multi-dimensional matching conditions represented by each intermediate node, source IP address and destination IP address typically have a higher cardinality than matching conditions such as port and protocol type. Cardinality refers to the number of distinct values ​​of the matching condition in the dataset.

[0100] Assuming that the sorting index of the source IP address (192.168.1.4-6) in the global IP address space of network system 100 can be mapped to the numerical range [201, 203], the sorting index of the local firewall control point (FC1) in the global firewall control point space of network system 100 can be mapped to 1; the sorting index of the remote firewall control point (FC2) in the global firewall control point space of network system 100 can be mapped to 2; the sorting index of the destination IP address (168.16.1.5) in the global IP address space of network system 100 can be mapped to 51; the sorting index of the port (8080) in the global port space of network system 100 can be mapped to 100; and the sorting index of the protocol type (TCP) in the global protocol type space of network system 100 can be mapped to 1, then the sorting index mapped to the original data of each matching condition can be represented as a binary number of a specified number of bits, such as a sixteen-bit binary number. Using the above sub-path trees... For example, sub-path tree The sorted index that maps the original data of each matching condition in the multidimensional matching conditions represented by the intermediate node can be represented as:

[0101] Source IP address (192.168.1.4): 00000000 11001001;

[0102] Local firewall control point (FC1): 00000000 00000001;

[0103] Peer firewall control point (FC2): 00000000 00000010;

[0104] Destination IP address (168.16.1.5): 00000000 00110011;

[0105] Port (8080): 00000000 01100100;

[0106] Protocol type (TCP): 00000000 00000001.

[0107] Then, the binary numbers of the sorted indices mapped to the original data of each matching condition are cross-sorted from high-order bits to low-order bits and converted into one-dimensional encoded values. This is still based on the sub-path tree described above. For example, the converted one-dimensional odcode value is as follows:

[0108] odcode=srcIP

[15] lcp

[15] ocp

[15] dstIP

[15] port

[15] potocol

[15] srcIP

[14] lcp

[14] ocp

[14] dstIP

[14] port

[14] potocol

[14] ...srcIP[0]lcp[0]ocp[0]dstIP[0]port[0]potocol[0].

[0109] Wherein, srcIP, lcp, ocp, dstIP, port, and portocol represent the binary numbers of the source IP address, local firewall control point, peer firewall control point, destination IP address, port, and protocol type in the multidimensional matching conditions, respectively. srcIP[], lcp[], ocp[], dstIP[], port[], and portocol[] represent the binary bits of the binary numbers of the source IP address, local firewall control point, peer firewall control point, destination IP address, port, and protocol type, respectively.

[0110] In other implementations, the binary numbers of the sorted indices mapped to the original data of each matching condition can be interleaved and converted into one-dimensional encoded values ​​in ascending order of the least significant bit. This is still based on the sub-path tree described above. For example, in this implementation, the converted one-dimensional odcode value can be as follows:

[0111] odcode=srcIP[0]lcp[0]ocp[0]dstIP[0]port[0]potocol[0]srcIP[1]lcp[1]ocp[1]dstIP[1]port[1]potocol[1]...srcIP

[15] lcp

[15] ocp

[15] dstIP

[15] port

[15] potocol

[15] .

[0112] Similarly, those skilled in the art will understand that, for Figure 5 The multidimensional path trees 401 and 402, which serve as historical multidimensional path trees, are also based on the same method. The original data of each matching condition in the multidimensional matching condition represented by the intermediate node of each sub-path tree is mapped to the sorting index of the global numerical space. The binary number of the sorting index mapped to the original data of each matching condition is sequentially cross-arranged in order from high bit to low bit or from low bit to high bit, thereby converting it into a historical one-dimensional encoded value, and a set of historical one-dimensional encoded values ​​can be obtained.

[0113] Among them, the multidimensional path tree 401 can be divided into 20 sub-path trees according to the pairwise combination of intermediate nodes. The multidimensional path tree 402 can be split into three sub-path trees based on the pairwise combinations of intermediate nodes. The 20 sub-path trees of multi-path tree 401 are shown below:

[0114] : {1—>Source IP address (192.168.1.1)—>Local firewall control point (FC1)—>Peer firewall control point (FC2)—>Destination IP address (168.16.1.1)—>Port (8080)—>Protocol type (TCP)—>Control action (deny access)};

[0115] : {1—>Source IP address (192.168.1.1)—>Local firewall control point (FC1)—>Peer firewall control point (FC2)—>Destination IP address (168.16.1.2)—>Port (8080)—>Protocol type (TCP)—>Control action (deny access)};

[0116] And so on,

[0117] : {1—>Source IP address (192.168.1.4)—>Local firewall control point (FC1)—>Peer firewall control point (FC2)—>Destination IP address (168.16.1.5)—>Port (8080)—>Protocol type (TCP)—>Control action (deny access)}.

[0118] The three sub-path trees of multi-path tree 402 are shown below:

[0119] : {2—>Source IP address (192.168.1.4)—>Local firewall control point (FC1)—>Peer firewall control point (FC3)—>Destination IP address (172.64.1.1)—>Port (8081)—>Protocol type (UDP)—>Control action (Allow access)};

[0120] : {2—>Source IP address (192.168.1.5)—>Local firewall control point (FC1)—>Peer firewall control point (FC3)—>Destination IP address (172.64.1.1)—>Port (8081)—>Protocol type (UDP)—>Control action (Allow access)};

[0121] : {2—>Source IP address (192.168.1.6)—>Local firewall control point (FC1)—>Peer firewall control point (FC3)—>Destination IP address (172.64.1.1)—>Port (8081)—>Protocol type (UDP)—>Control action (Allow access)}.

[0122] In this embodiment, the current one-dimensional encoded value, obtained by converting the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree 403, can then be queried and matched with the set of historical one-dimensional encoded values ​​converted from the multidimensional path trees 401 and 402, to identify whether the intermediate nodes of the multidimensional path tree 403 partially overlap with the intermediate nodes of the multidimensional path trees 401 and 402. This allows for rapid detection of policy conflicts and redundancy anomalies. This method of querying and matching the current one-dimensional encoded value obtained by converting the multidimensional matching conditions with the set of historical one-dimensional encoded values ​​transforms the one-to-one comparison of the multidimensional matching conditions of access control policies into one-dimensional condition matching. Especially when the number of firewall access control policies is very large, this method can accelerate the processing efficiency of policy conflict and redundancy detection and reduce computational performance overhead.

[0123] In one embodiment, the method further includes:

[0124] If there is overlap, the control actions represented by the leaf nodes of the current multidimensional path tree and the historical multidimensional path tree that have partial overlap are compared to identify whether there is a policy conflict anomaly or a redundancy anomaly.

[0125] In this embodiment, when it is detected that the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree, it is further determined whether the control actions represented by the leaf nodes of the partially overlapping current and historical multidimensional path trees are the same. If the control actions represented by the leaf nodes of the partially overlapping current multidimensional path tree are different from those represented by the leaf nodes of the historical multidimensional path tree, then the current configuration request has a policy conflict anomaly. If the control actions represented by the leaf nodes of the partially overlapping current multidimensional path tree are the same as those represented by the leaf nodes of the historical multidimensional path tree, then the current configuration request has a policy redundancy anomaly. At this time, corresponding processing measures can be taken for the current configuration request, such as notifying the operation and maintenance personnel to modify the configuration request again or modify the historical firewall access control policy to eliminate policy conflicts and redundancy anomalies.

[0126] Figure 8 This is a partial flowchart illustrating the automatic generation method of firewall access control policies according to the third embodiment of this application. Figure 8 As shown, step 220, which involves querying and matching the current one-dimensional encoded value with the set of historical one-dimensional encoded values ​​converted from the historical multi-dimensional path tree generated based on the historical configuration request to identify whether the intermediate nodes of the current multi-dimensional path tree partially overlap with the intermediate nodes of the historical multi-dimensional path tree, may include the following steps:

[0127] Step 810: Construct a B+ tree index using the set of historical one-dimensional encoded values ​​converted from the historical multidimensional path tree generated based on the historical configuration request, wherein the non-leaf nodes and leaf nodes of the B+ tree index use the historical one-dimensional encoded values ​​as keys, and the leaf nodes of the B+ tree index store pointers to the sub-path trees of the historical multidimensional path tree corresponding to the key values.

[0128] Step 820: Use the current one-dimensional encoding value to query whether there is a historical one-dimensional encoding value in the B+ tree index to identify whether the intermediate node of the current multidimensional path tree partially overlaps with the intermediate node of the historical multidimensional path tree.

[0129] In this embodiment, a B+ tree index is further constructed using the set of historical one-dimensional encoded values ​​converted from the historical multidimensional path tree. The historical one-dimensional encoded values ​​are used as the keys of the non-leaf nodes and leaf nodes of the B+ tree index. The leaf nodes of the B+ tree index store pointers to the sub-path trees of the historical multidimensional path tree corresponding to the key values. This allows for fast lookup and matching of the current one-dimensional encoded value in the B+ tree index, quickly identifying the key value that is the same as the current one-dimensional encoded value, and then obtaining the pointers to the sub-path trees of the historical multidimensional path tree corresponding to the same key value. This enables rapid detection of whether the intermediate node of any sub-path tree of the current multidimensional path tree generated based on the current configuration request partially overlaps with the intermediate node of any sub-path tree of the historical multidimensional path tree, i.e., whether there is a policy conflict or redundancy anomaly.

[0130] If the current one-dimensional encoded value converted from the intermediate node of each sub-path of the current multidimensional path tree does not find a matching key value in the B+ tree index, then it is determined that the intermediate node of any sub-path of the current multidimensional path tree generated based on the current configuration request does not overlap with the intermediate node of any sub-path of the historical multidimensional path tree, i.e., there is no policy conflict or redundancy anomaly. Subsequently, according to step 230, configuration scripts corresponding to the local firewall control point and the peer firewall control point can be generated to automatically configure access control policies for the local firewall control point and the peer firewall control point.

[0131] Figure 9 This is a partial flowchart illustrating the automatic generation method of firewall access control policies according to the fourth embodiment of this application. Figure 9 As shown, based on any of the foregoing embodiments, the method of this embodiment may include the following steps:

[0132] Step 910: Identify whether the specified matching conditions in the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree match the attribute fields of the target business application based on the security policy knowledge graph. The specified matching conditions include at least the destination IP address, port, and protocol type.

[0133] Step 920: If a match is found, locate the second peer firewall control point corresponding to the server IP address based on the server IP addresses in the server IP address list of the target business application, excluding the destination IP address.

[0134] Step 930: Generate a second multidimensional path tree based on the current multidimensional path tree, the server IP address, and the second peer firewall control point to represent at least one second access control policy that matches the target business application.

[0135] In this embodiment, within network system 100, each service application can be a distributed application system spanning multiple network security zones. Figure 1 Taking the system architecture diagram as an example, the server of business application 1 may be deployed in both network security zone B and network security zone C. The aforementioned security policy knowledge graph is also used to characterize the relationship between the servers of each business application in network system 100 and each network security zone 101. This relationship reflects the network security zones 101 involved in the distributed deployment of the servers of each business application.

[0136] like Figure 10 As shown, the security policy knowledge graph further includes entity nodes for each business application. The attribute fields of each business application's entity node include at least the application identifier, a list of server IP addresses, service ports, and service protocols. The unidirectional connection between each business application's entity node and network security zone 101 represents the association between the server of each business application and network security zone 101. Specifically, business application 1 is connected to both network security zones B and C, and business application 2 is connected to both network security zones A and C, indicating that the server of business application 1 is deployed in both network security zones B and C, and the server of business application 2 is deployed in both network security zones A and C. The server IP address list, service ports, and service protocol information for each business application can be obtained from the server configuration information or log files of each business application in network system 100.

[0137] Taking business application 1 as an example, when the destination IP address, port, and protocol type of at least one access control policy generated based on the current configuration request of the firewall access control policy involve one of the server IP addresses, service ports, and service protocols deployed by business application 1, if the other server IP addresses deployed by business application 1 are not configured with the same firewall access control policy, it will cause some servers to have missing or inconsistent firewall access control policies during the actual operation of business application 1 when multiple servers are running in a high availability mechanism. This will affect the normal and secure operation of the business application, which is particularly serious for the business of the bank's network system.

[0138] Figure 11 An exemplary schematic diagram of a multidimensional path tree automatically generated according to the fourth embodiment of this application is presented. Figure 11 As shown, assuming that the multidimensional path tree 402 is the current multidimensional path tree generated based on the current configuration request with request ID 2, the multidimensional path tree 402 can be represented as a path link consisting of at least one access control policy that matches the current configuration request with request ID 2. Figure 11 (shown in bold)

[0139] {2—>Source IP address (192.168.1.4-6)—>Local firewall control point (FC1)—>Peer firewall control point (FC3)—>Destination IP address (172.64.1.1)—>Port (8081)—>Protocol type (UDP)—>Control action (Allow access)}.

[0140] Based on the security policy knowledge graph, it can be identified that the destination IP address (172.64.1.1), port (8081), and protocol type (UDP) in the multidimensional matching conditions represented by the intermediate nodes of the multidimensional path tree 402 all match the server IP address list, service port, and service protocol in the attribute fields of business application 1 (target business application). The destination network security zone to which the destination IP address (172.64.1.1) belongs is network security zone C, and the located peer firewall control point is FC3. Since it can be identified from the security policy knowledge graph that the server IP address list of business application 1 also includes the destination IP address (168.16.1.6) located in network security zone B, the destination network security zone to which the destination IP address (168.16.1.6) belongs can be located based on the destination IP address (168.16.1.6) in the server IP address list of business application 1, and the second peer firewall control point FC2 can be located based on the firewall control point that has a corresponding control relationship with network security zone B.

[0141] Therefore, based on the currently generated multidimensional path tree 402, the destination IP address (168.16.1.6) in the server IP address list of the identified business application 1, and the second peer firewall control point FC2, a new multidimensional path tree 403 can be automatically created for the destination IP address (168.16.1.6) as the second multidimensional path tree, such as... Figure 11 As shown by the dashed line path. The multidimensional path tree 403 can be represented as the following path link of at least one second access control policy matching the service application 1:

[0142] {3—>Source IP address (192.168.1.4-6)—>Local firewall control point (FC1)—>Peer firewall control point (FC2)—>Destination IP address (168.16.1.6)—>Port (8081)—>Protocol type (UDP)—>Control action (Allow access)}.

[0143] In one implementation, step 930, which generates a second multidimensional path tree based on the current multidimensional path tree, the server IP address, and the second peer firewall control point to characterize at least one second access control policy matching the target business application, may include:

[0144] The destination IP address and peer firewall control point in the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree are replaced by the server IP address and the peer firewall control point, respectively, to generate the second multidimensional path tree.

[0145] In this embodiment, by identifying whether the specified matching conditions in the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree match the attribute fields of the target business application based on the security policy knowledge graph, if a match is found, the second peer firewall control point corresponding to the server IP address is located based on the server IP address list of the target business application (excluding the destination IP address). Based on the current multidimensional path tree, the server IP address, and the second peer firewall control point, a second multidimensional path tree is automatically generated to represent at least one second access control policy matching the target business application. This avoids the problem of missing or inconsistent firewall access control policies for distributed business applications in the network system, further improving the visualization and intelligence level of automated configuration of firewall access control policies, thereby further enhancing the firewall operation and maintenance security of the bank's network system.

[0146] In one implementation, such as Figure 12 As shown, the method may further include:

[0147] Step 1210: Convert the multidimensional matching conditions represented by the intermediate nodes of the second multidimensional path tree into second one-dimensional encoded values, and perform query matching between the second one-dimensional encoded values ​​and the set of historical one-dimensional encoded values ​​converted from the historical multidimensional path tree generated based on the historical configuration request to identify whether the intermediate nodes of the second multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree.

[0148] Step 1220: If there is no partial overlap, generate a configuration script corresponding to the local firewall control point and the second peer firewall control point in the at least one second access control policy, and automatically configure the access control policy for the local firewall control point and the second peer firewall control point.

[0149] In one embodiment, the method further includes:

[0150] If there is overlap, the control actions represented by the leaf nodes of the partially overlapping second multidimensional path tree and the historical multidimensional path tree are compared to identify whether there is a policy conflict anomaly or a redundancy anomaly.

[0151] Similarly, step 1210 in this embodiment can adopt the aforementioned method. Figure 7 and Figure 8The same technical means are used to implement any of the embodiments described, and will not be repeated here.

[0152] Figure 13 This is a schematic diagram of the structure of an automatic generation device for firewall access control policies according to the first embodiment of this application. Figure 13 As shown, the device includes the following modules:

[0153] The multidimensional path tree generation module 1310 is used to generate a current multidimensional path tree based on the current configuration request of the firewall access control policy and the security policy knowledge graph to represent at least one access control policy that matches the current configuration request. The intermediate nodes of the current multidimensional path tree represent the multidimensional matching conditions in the access control policy, and the leaf nodes of the current multidimensional path tree represent the control actions in the access control policy.

[0154] The encoding conversion and matching module 1320 is used to convert the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into the current one-dimensional encoding value, and to query and match the current one-dimensional encoding value with the set of historical one-dimensional encoding values ​​converted from the historical multidimensional path tree generated based on the historical configuration request to identify whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree.

[0155] The policy script generation module 1330 is used to generate configuration scripts corresponding to the local firewall control point and the peer firewall control point in the at least one access control policy if there is no partial overlap, and to automatically configure the access control policy for the local firewall control point and the peer firewall control point.

[0156] In one embodiment, the multidimensional path tree generation module 1310 can also be used for:

[0157] Based on the configuration parameters included in the current configuration request, the local firewall control point, the peer firewall control point, and the control action corresponding to the current configuration request are located from the security policy knowledge graph.

[0158] Generate at least one access control policy that includes the configuration parameters, the local firewall control point, the peer firewall control point, and the control action.

[0159] In one embodiment, the encoding conversion and matching module 1320 can also be used for:

[0160] The original data of each matching condition in the multidimensional matching condition represented by the intermediate node of each sub-path tree of the current multidimensional path tree is mapped to the sorted index of the global numerical space.

[0161] The binary number of the sorted index mapped to the original data of each matching condition is sequentially and crosswise arranged in order from high bit to low bit or from low bit to high bit, and converted into the current one-dimensional encoded value.

[0162] In one embodiment, the apparatus further includes:

[0163] The strategy anomaly identification module is used to compare the control actions represented by the leaf nodes of the partially overlapping current multidimensional path tree and the historical multidimensional path tree if there is overlap, so as to identify whether there is a strategy conflict anomaly or a redundancy anomaly.

[0164] In one embodiment, the encoding conversion and matching module 1320 can also be used for:

[0165] A B+ tree index is constructed using the set of historical one-dimensional encoded values ​​converted from the historical multidimensional path tree generated based on historical configuration requests. The non-leaf nodes and leaf nodes of the B+ tree index use the historical one-dimensional encoded values ​​as keys, and the leaf nodes of the B+ tree index store pointers to the sub-path trees of the historical multidimensional path tree corresponding to the key values.

[0166] The current one-dimensional encoding value is used to query the B+ tree index to see if there is a historical one-dimensional encoding value that is the same, so as to identify whether the intermediate node of the current multidimensional path tree has partial overlap with the intermediate node of the historical multidimensional path tree.

[0167] Figure 14 This is a partial structural schematic diagram of an automatic generation device for firewall access control policies according to a second embodiment of this application. Figure 14 As shown, based on any of the foregoing embodiments, the device includes the following modules:

[0168] The application matching and identification module 1410 is used to identify, based on the security policy knowledge graph, whether the specified matching conditions in the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree match the attribute fields of the target business application. The specified matching conditions include at least the destination IP address, port, and protocol type.

[0169] Firewall location module 1420 is used to locate the second peer firewall control point corresponding to the server IP address based on the server IP address list of the target business application, excluding the destination IP address, if a match is found.

[0170] The multidimensional path tree generation module 1310 is further configured to generate a second multidimensional path tree based on the current multidimensional path tree, the server IP address, and the second peer firewall control point, for representing at least one second access control policy that matches the target business application.

[0171] In one embodiment, the multidimensional path tree generation module 1310 can also be used for:

[0172] The destination IP address and peer firewall control point in the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree are replaced by the server IP address and the peer firewall control point, respectively, to generate the second multidimensional path tree.

[0173] In one embodiment, the encoding conversion and matching module 1320 can also be used for:

[0174] The multidimensional matching conditions represented by the intermediate nodes of the second multidimensional path tree are converted into second one-dimensional encoded values. The second one-dimensional encoded values ​​are then queried and matched with the set of historical one-dimensional encoded values ​​converted from the historical multidimensional path tree generated based on the historical configuration request to identify whether the intermediate nodes of the second multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree.

[0175] In one embodiment, the strategy script generation module 1330 can also be used for:

[0176] If there is no partial overlap, a configuration script corresponding to the local firewall control point and the second peer firewall control point in the at least one second access control policy is generated, and access control policies are automatically configured for the local firewall control point and the second peer firewall control point.

[0177] In one implementation, the policy anomaly identification module can also be used for:

[0178] If there is overlap, the control actions represented by the leaf nodes of the partially overlapping second multidimensional path tree and the historical multidimensional path tree are compared to identify whether there is a policy conflict anomaly or a redundancy anomaly.

[0179] In summary, the firewall access control policy automatic generation method and apparatus of this application generates a current multidimensional path tree based on a security policy knowledge graph to represent at least one access control policy matching the current configuration request. By converting the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into current one-dimensional encoded values, and querying and matching the current one-dimensional encoded values ​​with the set of historical one-dimensional encoded values ​​converted from historical multidimensional path trees generated based on historical configuration requests to identify whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree, the method avoids comparing each matching condition one by one in policy conflict and redundancy anomaly detection, significantly improves the processing efficiency of policy conflict and redundancy anomaly detection, and further improves the visualization and intelligence level of the automated configuration of firewall access control policies, thereby further improving the firewall operation and maintenance security of the bank network system.

[0180] It should be noted that those skilled in the art will understand that the different implementation methods, their descriptions and explanations, and the technical effects achieved as described in the method embodiments of this application are also applicable to the device embodiments of this application, and will not be repeated here.

[0181] Furthermore, embodiments of this application also propose an electronic device, which may include a processor and a memory. The memory stores computer program instructions, and the processor can invoke the computer program instructions in the memory to execute all or part of the steps of the method described in any embodiment of this application. The computer program instructions in the memory described above can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0182] Furthermore, this application also provides a computer program product, the computer program product including a non-transitory computer-readable storage medium storing a computer program, which, when connected to a computer device, is executed by one or more processors of the computer device, is capable of performing all or part of the steps of the method described in any embodiment of this application.

[0183] Furthermore, this application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which can be executed by one or more processors to perform all or part of the steps of the method described in any embodiment of this application.

[0184] Through the above description of the embodiments, those skilled in the art can clearly understand that the various embodiments of this application can be implemented by means of software or software combined with necessary general-purpose hardware platforms, and of course, can also be implemented by hardware functions. Based on this understanding, the technical solution of this application, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a computer device, such as, but not limited to, a personal computer, a server, or a network device, to execute all or part of the steps of the method described in any embodiment of this application. The aforementioned storage medium may include: USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, and other media capable of storing computer program code.

[0185] The foregoing description of exemplary embodiments of this application should be understood as not limiting, but illustrative, and the scope of protection of this application is not limited thereto. It should be understood that those skilled in the art can make modifications and variations to the embodiments of this application without departing from the spirit and scope of this application, and such modifications and variations should be within the scope of protection of this application.

Claims

1. A method for automatically generating a firewall access control policy, characterized by, include: Based on the current configuration request of the firewall access control policy, a current multidimensional path tree containing at least one access control policy is generated according to the security policy knowledge graph, which matches the request ID of the current configuration request. The root node of the current multidimensional path tree represents the request ID of the current configuration request, the intermediate nodes of the current multidimensional path tree represent the multidimensional matching conditions in the access control policy, and the leaf nodes of the current multidimensional path tree represent the control actions in the access control policy. The multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree are converted into current one-dimensional encoded values. The current one-dimensional encoded values ​​are then queried and matched with the set of historical one-dimensional encoded values ​​converted from historical multidimensional path trees generated based on historical configuration requests to identify whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path trees. Specifically, the original data of each matching condition represented by the intermediate nodes of each sub-path tree of the current multidimensional path tree is mapped to a sorted index in the global numerical space. The binary number of the sorted index mapped to the original data of each matching condition is sequentially and alternately arranged from high-order bits to low-order bits or from low-order bits to high-order bits and converted into the current one-dimensional encoded value. If there is no partial overlap, a configuration script corresponding to the local firewall control point and the peer firewall control point in the at least one access control policy is generated, and the access control policy is automatically configured for the local firewall control point and the peer firewall control point.

2. The automatic generation method for firewall access control policies according to claim 1, characterized in that, The security policy knowledge graph is used to represent the corresponding control relationships between each network security zone and each firewall control point in the network system, as well as the inbound and outbound access policies between each network security zone.

3. The automatic generation method for firewall access control policies according to claim 2, characterized in that, The step of generating a current multidimensional path tree containing at least one access control policy that matches the request ID of the current configuration request based on the security policy knowledge graph includes: Based on the configuration parameters included in the current configuration request, the local firewall control point, the peer firewall control point, and the control action corresponding to the current configuration request are located from the security policy knowledge graph. Generate at least one access control policy that includes the configuration parameters, the local firewall control point, the peer firewall control point, and the control action.

4. The automatic generation method for firewall access control policies according to claim 3, characterized in that, The step of querying and matching the current one-dimensional encoded value with the set of historical one-dimensional encoded values ​​converted from the historical multi-dimensional path tree generated based on the historical configuration request to identify whether the intermediate nodes of the current multi-dimensional path tree partially overlap with the intermediate nodes of the historical multi-dimensional path tree includes: A B+ tree index is constructed using the set of historical one-dimensional encoded values ​​converted from the historical multidimensional path tree generated based on historical configuration requests. The non-leaf nodes and leaf nodes of the B+ tree index use the historical one-dimensional encoded values ​​as keys, and the leaf nodes of the B+ tree index store pointers to the sub-path trees of the historical multidimensional path tree corresponding to the key values. The current one-dimensional encoding value is used to query the B+ tree index to see if there is a historical one-dimensional encoding value that is the same, so as to identify whether the intermediate node of the current multidimensional path tree has partial overlap with the intermediate node of the historical multidimensional path tree.

5. The method for automatically generating firewall access control policies according to any one of claims 1-4, characterized in that, The method includes: If there is overlap, the control actions represented by the leaf nodes of the current multidimensional path tree and the historical multidimensional path tree that have partial overlap are compared to identify whether there is a policy conflict anomaly or a redundancy anomaly.

6. The automatic generation method for firewall access control policies according to claim 5, characterized in that, The method includes: The security policy knowledge graph identifies whether the specified matching conditions in the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree match the attribute fields of the target business application. The specified matching conditions include at least the destination IP address, port, and protocol type. If a match is found, the second peer firewall control point corresponding to the server IP address is located based on the server IP address list of the target business application, excluding the destination IP address. Based on the current multidimensional path tree, the server IP address, and the second peer firewall control point, a second multidimensional path tree is generated to characterize at least one second access control policy that matches the target business application.

7. The automatic generation method for firewall access control policies according to claim 6, characterized in that, The generation of a second multidimensional path tree based on the current multidimensional path tree, the server IP address, and the second peer firewall control point to characterize at least one second access control policy matching the target business application includes: The destination IP address and peer firewall control point in the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree are replaced by the server IP address and the peer firewall control point, respectively, to generate the second multidimensional path tree.

8. The method for automatically generating firewall access control policies according to claim 7, characterized in that, The method further includes: The multidimensional matching conditions represented by the intermediate nodes of the second multidimensional path tree are converted into second one-dimensional encoded values. The second one-dimensional encoded values ​​are then matched with the set of historical one-dimensional encoded values ​​to identify whether the intermediate nodes of the second multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path tree. If there is no partial overlap, a configuration script corresponding to the local firewall control point and the second peer firewall control point in the at least one second access control policy is generated, and access control policies are automatically configured for the local firewall control point and the second peer firewall control point.

9. An automatic generation device for firewall access control policies, characterized in that, include: The multidimensional path tree generation module is used to generate a current multidimensional path tree containing at least one access control policy that matches the request ID of the current configuration request based on the current configuration request of the firewall access control policy and according to the security policy knowledge graph. The root node of the current multidimensional path tree represents the request ID of the current configuration request, the intermediate nodes of the current multidimensional path tree represent the multidimensional matching conditions in the access control policy, and the leaf nodes of the current multidimensional path tree represent the control actions in the access control policy. The encoding conversion and matching module is used to convert the multidimensional matching conditions represented by the intermediate nodes of the current multidimensional path tree into current one-dimensional encoded values, and to query and match the current one-dimensional encoded values ​​with the set of historical one-dimensional encoded values ​​converted from historical multidimensional path trees generated based on historical configuration requests to identify whether the intermediate nodes of the current multidimensional path tree partially overlap with the intermediate nodes of the historical multidimensional path trees; wherein, the original data of each matching condition in the multidimensional matching conditions represented by the intermediate nodes of each sub-path tree of the current multidimensional path tree is mapped to a sorted index in the global numerical space; and the binary number of the sorted index mapped to the original data of each matching condition is sequentially and alternately arranged in order from high bit to low bit or from low bit to high bit to convert it into the current one-dimensional encoded value. The policy script generation module is used to generate configuration scripts corresponding to the local firewall control point and the peer firewall control point in the at least one access control policy if there is no partial overlap, and to automatically configure the access control policy for the local firewall control point and the peer firewall control point.

Images