Access control list migration method and device, storage medium and electronic device

Abstract

The present application discloses a migration method and device for access control lists, a routing method and device, a computer storage medium and an electronic device, wherein the migration method comprises: determining the access control list to be migrated; obtaining the current network architecture information according to the access control list to be migrated; generating a migration strategy that satisfies the same configuration information of the access control list to be migrated before and after the migration according to the current network architecture information; and migrating the access control list to be migrated according to the migration strategy. Thus, it is possible to ensure that the access control list to be migrated still maintains the same configuration information after the migration as before the migration, thereby avoiding the problem of network security and stability caused by the configuration information of the access control list changing incorrectly before and after the migration.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more particularly to a method and device for migrating an access control list. The present application also relates to a routing method and device, as well as a computer storage medium and an electronic device. Background Art

[0002] Access Control List (ACL) is an important means to ensure network security. As part of the routing device configuration, it is widely used in large-scale networks to provide fine-grained network packet control (such as release or isolation) because its rule description is intuitive.

[0003] With the expansion of network scale and the rapid growth of business types, all routing devices are filled with a large number of ACLs in their configuration. These ACLs are added to the network configuration by different people for different purposes, different needs, at different times, and provide routing dependencies and controls for different services, thus forming extremely complex logical relationships. Based on the needs of business and network architecture transformation, it is often necessary to migrate and change ACLs in batches, for example: move the ACL on a certain type of routing device to the next layer of routing devices, or move the ACL on the routing device from the ingress interface to the egress interface. The migrated routing devices can be replaced in batches with cheaper routing devices that do not need to support ACLs, and can also support more types of routing protocols, thereby greatly reducing the network maintenance cost and improving the ease of network maintenance.

[0004] However, if an error occurs in ACL migration, for example, some external network segments are denied before migration but are released after migration, this will cause extremely serious network security and stability problems.

[0005] In the prior art, there are only some ACL management methods for ACL management, such as removing redundant ACLs or compressing ACLs. These methods cannot solve the network security and stability problems caused by ACL migration errors. Summary of the invention

[0006] The present application provides an access control list migration method to solve the network security stability problem caused by access control list change errors in the prior art.

[0007] The present application provides a method for migrating an access control list, including:

[0008] Determine the access control list to be migrated;

[0009] According to the access control list to be migrated, obtaining current network architecture information;

[0010] Generate a migration strategy that satisfies the configuration information of the access control list to be migrated to be the same before and after the migration according to the current network architecture information;

[0011] The access control list to be migrated is migrated according to the migration strategy.

[0012] In some embodiments, determining the access control list to be migrated includes:

[0013] According to the received migration request for the access control list in the current network architecture, an access control list to be migrated is determined.

[0014] In some embodiments, the migration request includes at least one of the following information:

[0015] Source device address information of the access control list to be migrated;

[0016] The migration destination device address information of the access control list to be migrated;

[0017] Migration scope information of the access control list to be migrated.

[0018] In some embodiments, obtaining current network architecture information according to the access control list to be migrated includes:

[0019] According to the access control list to be migrated, the routing configuration information and the access control list configuration information in the current network architecture information are obtained.

[0020] In some embodiments, generating, based on the current network architecture information, a migration strategy that satisfies the same configuration information of the access control list to be migrated before and after the migration includes:

[0021] Classifying network traffic according to the current network architecture information to obtain network traffic types;

[0022] Determine, according to the network traffic type, a network node in the migration range whose configuration information of the access control list to be migrated is changed after the migration;

[0023] According to the network node whose configuration information is changed after the access control list to be migrated is migrated, generating a new access control list to be migrated for the network node;

[0024] The new access control list to be migrated is determined as the migration strategy.

[0025] In some embodiments, classifying the network traffic according to the current network architecture information to obtain the network traffic classification includes:

[0026] Extracting access control list configuration information of network nodes in the current network architecture information within the migration range, and obtaining a set of access control list configuration information of different network nodes within the migration range;

[0027] According to the set marking dimension, the access control list configuration information set of different network nodes within the migration range is marked;

[0028] According to the mark, a network traffic classification table within the migration range is obtained.

[0029] In some embodiments, the set marking dimension includes at least one of the following dimensions:

[0030] Source IP address dimension;

[0031] Destination IP address dimension;

[0032] Source communication port dimension;

[0033] Destination communication port dimension;

[0034] Routing protocol type dimension.

[0035] In some embodiments, marking the access control list configuration information sets of different network nodes within the migration range according to the set marking dimension includes:

[0036] According to the set marking dimension, information used to describe the network traffic status in the access control list configuration information set of different network nodes within the migration range is marked; the network traffic status includes a release status and a blocking status.

[0037] In some embodiments, obtaining the network traffic classification table within the migration range according to the tag includes:

[0038] According to the tag, the same tag information of different network nodes under the tag dimension is classified into one category to obtain the network traffic type within the migration range;

[0039] A network traffic classification table is established according to the network traffic type, and the network traffic classification table is used to describe the network traffic status of the network traffic type.

[0040] In some embodiments, determining, according to the network traffic type, the network nodes within the migration range whose configuration information of the access control list to be migrated is changed after the migration includes:

[0041] Modeling is performed within the migration range according to the predetermined route reachability between network nodes and the network traffic type to obtain a logical expression describing the network traffic state between the network nodes;

[0042] Determine, according to the logical expression, a network traffic status result of the network traffic type after the access control list to be migrated is migrated;

[0043] According to the network traffic status result and the network traffic classification table, the network nodes in the migration range whose configuration information of the access control list to be migrated is changed after the migration are determined.

[0044] In some embodiments, determining the network nodes in the migration range whose configuration information of the access control list to be migrated is changed after migration according to the network traffic status result and the network traffic classification table includes:

[0045] The network traffic status result is compared with the network wandering classification table to determine the network nodes within the migration range whose configuration information of the access control list to be migrated is changed before and after the migration.

[0046] In some embodiments, generating a new access control list to be migrated for the network node whose configuration information has changed within a migration range according to the determined access control list to be migrated includes:

[0047] Determine the configuration information modification content according to the configuration information of the access control list of the destination network node where the configuration information is changed and the configuration information of the access control list on the source network node before the migration of the range control list to be migrated;

[0048] A new access control list to be migrated is generated for the network node whose configuration information has been changed according to the configuration information modification content.

[0049] In some embodiments, migrating the access control list to be migrated according to the migration strategy includes:

[0050] The generated new access control list to be migrated is migrated to the network node where the configuration information has been changed.

[0051] In some embodiments, it also includes:

[0052] The redundant access control list in the current network architecture information is filtered.

[0053] The present application also provides an access control list migration device, comprising:

[0054] A determination unit, used to determine the access control list to be migrated;

[0055] An acquisition unit, configured to acquire current network architecture information according to the access control list to be migrated;

[0056] A generating unit, configured to generate, according to the current network architecture information, a migration strategy that satisfies the configuration information of the access control list to be migrated to be the same before and after the migration;

[0057] A migration unit is used to migrate the access control list to be migrated according to the migration strategy.

[0058] The present application also provides a routing method, comprising:

[0059] Receive data packets to be sent;

[0060] Determine the routing path of the data packet according to the migration strategy generated according to the current network architecture information to ensure that the configuration information of the access control list to be migrated is the same before and after the migration, the migration access control list that completes the migration, and the configuration information of the routing table;

[0061] The data packet is routed to the destination address according to the determined routing path.

[0062] The present application also provides a routing device, including:

[0063] A receiving unit, used for receiving a data packet to be sent;

[0064] A determination unit, configured to determine a routing path of the data packet according to a migration strategy generated according to current network architecture information to satisfy the same configuration information of the access control list to be migrated before and after the migration, a migration access control list that completes the migration, and configuration information of the routing table;

[0065] The routing unit is used to route the data packet to the destination address according to the determined routing path.

[0066] The present application also provides a computer storage medium for storing data generated by a network platform and a program for processing the data generated by the network platform;

[0067] When the program is read and executed by the processor, the steps of the access control list migration method described above are executed.

[0068] The present application also provides an electronic device, comprising:

[0069] processor;

[0070] The memory is used to store a program for processing data generated by a network platform. When the program is read and executed by the processor, the steps of the access control list migration method as described above are executed.

[0071] Compared with the prior art, this application has the following advantages:

[0072] The present application provides a method for migrating an access control list, which comprises the following steps: determining an access control list to be migrated; obtaining current network architecture information based on the access control list to be migrated; generating a migration strategy that satisfies the same configuration information of the access control list to be migrated before and after migration based on the current network architecture information; migrating the access control list to be migrated according to the migration strategy; thereby ensuring that the access control list to be migrated still maintains the same configuration information as before migration after migration, thereby avoiding network security and stability issues caused by erroneous configuration information changes of the access control list before and after migration. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 It is a flow chart of an implementation example of a method for migrating an access control list provided by the present application;

[0074] Figure 2 It is a structural diagram of a migration scope in an embodiment of a migration method for an access control list provided by the present application;

[0075] Figure 3 It is a schematic diagram of a traffic classification process in an embodiment of an access control list migration method provided by the present application;

[0076] Figure 4 It is a structural schematic diagram of a traffic classification table obtained after traffic classification in an embodiment of an access control list migration method provided by the present application;

[0077] Figure 5 It is a schematic diagram of a function model of routing reachability in an embodiment of an access control list migration method provided by the present application;

[0078] Figure 6 It is a schematic diagram of network traffic status results in an embodiment of an access control list migration method provided by the present application;

[0079] Figure 7 It is a structural diagram of an embodiment of a migration device for access control lists provided by the present application;

[0080] Figure 8 is a flow chart of an embodiment of a routing method provided by the present application;

[0081] Fig. 9 It is a structural diagram of an embodiment of a routing device provided by the present application. DETAILED DESCRIPTION

[0082] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0083] The terms used in this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The descriptions used in this application and the appended claims, such as "a", "first", and "second", are not limitations on quantity or sequence, but are used to distinguish the same type of information from each other.

[0084] Since the access control list only supports limited routing protocols, in order to enable the routing device to support more routing protocols, the access control list needs to be removed, and the access control list to be removed is migrated to other routing devices, while ensuring that the configuration information of the access control list before and after the migration is the same, thereby supporting a large number of routing protocols while further ensuring the stability of network security. Therefore, the present application provides a migration method for an access control list, which can automatically generate a migration strategy that satisfies the same configuration information of the access control list to be migrated before and after the migration, and the access control list to be migrated still maintains the same configuration after the migration, thereby ensuring the stability of network security. The migration method of the present application is described in detail below.

[0085] Please refer to Figure 1 As shown, Figure 1 : is a flowchart of an embodiment of a migration method of an access control list provided by the present application, the migration method comprising:

[0086] Step S101: Determine the access control list to be migrated.

[0087] Before describing the step S101 in detail, the migration access control list is explained first. As described in the background technology of this application, the access control list (ACL) is an important means to ensure network security. As part of the configuration of routing devices, it provides fine-grained network data packet control. Specifically, ACL is a router configuration script that controls whether the router should allow or deny data packets to pass according to the conditions found in the data packet header. In the following process, the term ACL is the same as the access control list.

[0088] ACLs can perform the following tasks:

[0089] Limit network traffic to improve network performance;

[0090] Provide flow control;

[0091] Limit the transmission of routing updates;

[0092] Provide basic network access security;

[0093] Allow one host to access part of the network while preventing other hosts from accessing the same area;

[0094] Decide which types of traffic to forward or block on router interfaces;

[0095] Control which areas of the network the client can access;

[0096] Screen hosts to allow or deny access to network services;

[0097] Allow or deny users access to specific file types, such as FTP or HTTP.

[0098] The specific implementation of step S101 may be to determine the access control list to be migrated according to the needs of the user, and of course, the access control list to be migrated may also be determined according to the set migration conditions, for example: a migration time of an access control list is pre-set for a certain routing device, and when the migration time is reached, it means that the migration conditions are met, and the access control list on the routing device is determined as the access control list to be migrated.

[0099] In this embodiment, the access control list to be migrated is determined mainly based on the needs of the user, so the step S101 includes:

[0100] Step S101 - 1 : Determine the access control list to be migrated according to the received migration request for the access control list in the current network architecture.

[0101] The migration request in step S101-1 may be a migration request initiated by a user according to his / her own migration requirements, and the user may be a network management side. Migration requirements may generally include: an access control list of a migration routing device, a routing device receiving the migration access control list, a migration scope, etc. Therefore, the migration request may include at least one of the following information:

[0102] Source device address information of the access control list to be migrated;

[0103] The migration destination device address information of the access control list to be migrated;

[0104] Migration scope information of the access control list to be migrated.

[0105] In other words, normally, the migration request needs to specify that the access control list on a certain routing device is to be migrated to the access control list on another routing device, therefore, the source device address and the destination device address information are required, however, a certain network layer can also be predetermined, and the access control list of a routing device on this layer can be randomly selected for migration, and the destination address information of the migration can be within the entire network, therefore, the migration request can only include the source device address information or the destination device address information or the migration range, or it can be any combination of the source device address information, the destination device address information, and the migration range. Of course, the entire network range is an extreme case, and normally, the migration range, the migration source device address information, and the migration destination device address information also need to be specified.

[0106] To better understand the technical solution of this application, the following examples are given:

[0107] Please refer to Figure 2 As shown, Figure 2 is a schematic diagram of a migration scope in an embodiment of an access control list migration method provided by the present application. In this embodiment, the migration scope can be as follows: Figure 2 As shown in , in routing devices A, B, C, and D; wherein the access control list on routing device B can be determined as the access control list to be migrated, that is, the address information of routing device B is the source device address information, and the address information of routing devices A, C, and D is the destination device address information.

[0108] In the following process, the above migration range examples are used for explanation, but the migration method of the present application is not limited to the scope of the above examples.

[0109] After the access control list to be migrated is obtained according to step S101, the following steps need to be performed.

[0110] Step S102: Acquire current network architecture information according to the access control list to be migrated.

[0111] The purpose of step S102 is to obtain, based on the access control list to be migrated, relevant information about the current network architecture in which the access control list to be migrated is located, namely, information such as the topology and configuration of the current network architecture, and obtain relevant routing information and ACL information from the information. Using the example in step S101, the topology of the current network architecture can be as follows: Figure 2 In the structure shown, the configuration information may be the routing configuration information and ACL configuration information obtained on routing devices A, B, C, and D.

[0112] Therefore, the step S102 includes:

[0113] Step S102-1: According to the access control list to be migrated, the routing configuration information and the access control list configuration information in the current network architecture information are obtained.

[0114] In this embodiment, the routing configuration information includes routing reachability information, protocol type, etc.; following the example in step S101, within the migration range of A, B, C, and D, the routing reachability information may be that routing devices directly reachable by routing device A include: routing device B and routing device C; routing device A can reach routing device D through routing device B; routing device C and routing device D are unreachable; routing device C and routing device D are unreachable.

[0115] The access control list configuration information includes: the status information of the data packets in and out of the control port, that is, to allow (permit) or block (deny) the network traffic of a specific destination address, source address and protocol, and may also include source port information, destination port information, etc. Following the example in step S101, the ACL configuration in routing device A is to allow all network traffic (permit); the status of network traffic 3 and 4 configured by the ACL in routing device B is to block (deny), and network traffic 1, 2, and 5 is to allow (permit); the status of network traffic 1, 3, and 5 configured by the ACL in routing device C is to block (deny), and network traffic 2 and 4 is to allow (permit); the status of network traffic 4 and 5 configured by the ACL in routing device D is to block (deny), and network traffic 1, 2, and 3 is to allow (permit). The network traffic configured by the ACL will be described in detail in the following step S103, and the above is only a brief introduction.

[0116] Step S103: generating a migration strategy that satisfies the configuration information of the access control list to be migrated to be the same before and after the migration according to the current network architecture information.

[0117] The purpose of step S103 is to ensure that the configuration information of the access control list ACL to be migrated is the same before and after the migration, that is, the configuration information in the access control list after the migration is consistent with that before the migration. For example, the ACL in routing device B is migrated to routing devices A, C, and D, and the configuration information in the ACL after the migration is still that network traffic 1, 2, and 5 are permitted, and network traffic 3 and 4 are blocked. In order to ensure the consistency of the configuration information, it is necessary to generate a migration strategy that satisfies the same configuration information of the access control list to be migrated before and after the migration.

[0118] The step S103 includes:

[0119] Step S103-1: Classify the network traffic according to the current network architecture information to obtain the network traffic type.

[0120] Please refer to Figure 3 and Figure 4 As shown, Figure 3 It is a schematic diagram of a traffic classification process in an embodiment of an access control list migration method provided by the present application; Figure 4 It is a structural schematic diagram of a traffic classification table obtained after traffic classification in an embodiment of an access control list migration method provided by the present application.

[0121] The specific implementation process of step S103-1 may include:

[0122] Step S103-1a: extracting the access control list configuration information of the network nodes in the current network architecture information within the migration range, and obtaining a set of access control list configuration information of different network nodes within the migration range.

[0123] First, it should be noted that the network node in this embodiment can be understood as a routing device. Therefore, in the following description, the network node and the routing device refer to the same component.

[0124] In this embodiment, the purpose of step S103-1a is to extract the ACL configurations in the routing devices within the migration range and establish an ACL configuration equivalence class information set.

[0125] The configuration equivalence class information set may include configuration information such as source IP address, source port (port), destination IP address, destination port (port) and protocol type. The ACL configuration equivalence class information is an ACL information set, in which all ACLs have the same decision-making behavior (blocking or releasing) for all network traffic within the migration range based on the above five types of traffic, so these ACLs are put together to form an equivalence class information set. The ACL information from all routing devices within the migration range will be divided into multiple different equivalence class information, so they together form an ACL equivalence class information set.

[0126] Step S103 - 1b: Mark the access control list configuration information sets of different network nodes within the migration range according to the set marking dimension.

[0127] The purpose of step S103-1b is to mark the access control list configuration information set according to the set marking dimension, so as to obtain the blocked network traffic information and the released network traffic information in the access control list configuration information set.

[0128] The marking dimension may include at least one of the following dimensions:

[0129] Source IP address dimension;

[0130] Destination IP address dimension;

[0131] Source communication port dimension;

[0132] Destination communication port dimension;

[0133] Routing protocol type dimension.

[0134] The step S103-1b can mark the information describing the network traffic status in the access control list configuration information set of different network nodes within the migration range according to the set marking dimension; the network traffic status includes a release status and a blocking status.

[0135] In this embodiment, the source IP address dimension and the destination IP address dimension are used for description.

[0136] like Figure 3 As shown, in this embodiment, P B , P C and P D Respectively represent the ACLs of routing devices B, C, and D. Figure 3 The x-axis of each square is the complete set of all routing device ACLs divided by source IP address; the y-axis is the complete set of all routing device ACLs divided by destination IP address. The network traffic status of the ACL configuration in the routing device can be marked by adding identification information, and the network traffic status can be blocked (deny) or released (permit). The marking method of the identification information can be to mark the network traffic status of release as √ or color it, and to mark the network traffic status of blocking as × or to use other colors different from the release identification information to color it.

[0137] The marking method of the identification information is not limited to the above-mentioned check mark, cross mark or coloring. In fact, the identification form of the ACL status in the routing device is block (deny) and release (permit) as long as it can reflect the difference between the two states of block (deny) and release (permit). Considering display and other issues, the present embodiment uses the character form of √ and × for marking.

[0138] like Figure 3 As shown, the routing device B in P B Configuration information is marked as follows:

[0139] The network traffic status from source IP addresses 1-3 to destination IP address 2 is blocked (deny), marked with ×;

[0140] The network traffic status from source IP addresses 1-3 to destination IP address 1 and destination IP address 2 is permitted, marked as √.

[0141] Routing device C in P C Configuration information is marked as follows:

[0142] The network traffic status from source IP address 1 and source IP address 3 to destination IP addresses 1-3 is blocked (deny), marked with ×;

[0143] The network traffic status from source IP address 2 to destination IP address 1-3 is permit, which is marked as √.

[0144] Routing device D in P D Configuration information is marked as follows:

[0145] The network traffic status from source IP address 1 to destination IP addresses 2-3 is permitted, marked as √;

[0146] The network traffic status from source IP address 1 to destination IP address 1 is blocked (deny), marked with ×;

[0147] The network traffic status from source IP address 2 to destination IP addresses 1 and 3 is permitted, marked as √;

[0148] The network traffic status from source IP address 2 to destination IP address 2 is blocked (deny) and marked as ×;

[0149] The network traffic status from source IP address 3 to destination IP addresses 1-3 is permitted, marked as √.

[0150] After marking the network traffic status of the ACL configuration in the routing device within the migration range, continue to perform the following steps.

[0151] Step S103-1c: Obtain a network traffic classification table within the migration range according to the mark.

[0152] like Figure 4 As shown, the step S103-1c may specifically mark the information describing the network traffic status in the access control list, and classify the network traffic after obtaining the marking result. Specifically, it may include:

[0153] Step S103-1c-1: According to the label, the same label information of different network nodes under the label dimension is classified into one category to obtain the network traffic type within the migration range.

[0154] The specific implementation of step S103-1c-1 is to classify the network traffic status information of the ACL in the marked routing device within the migration range. The so-called same marking information can refer to the same marking information for a certain network traffic type, that is, the network traffic from the source IP address to the destination IP address. The same marking information is classified into one category to obtain the network traffic type within the migration range.

[0155] Using the above example, for ease of understanding, Figure 4 In the figure, the routing devices B, C, and D mark information is converted to the following table. √ indicates release, and × indicates blocking. The network traffic information is the traffic information from the source IP address to the destination IP address. Please refer to the following table 1:

[0156] Table 1

[0157]

[0158]

[0159] According to the table above, network traffic type 1 means P B and P D The status is released; network traffic type 2 means P A , P B and P D The status is released; network traffic type 3 means P D The status is released; network traffic type 4 means P C and P D The status is released; network traffic type 5 means P B The status is released; therefore, the same ACL status information can be classified into one category, so as to obtain the following Figure 4 The network traffic type shown on the right.

[0160] Step S103-1c-2: Establish a network traffic classification table according to the network traffic type, and the network traffic classification table is used to describe the network traffic status of the network traffic type.

[0161] The specific implementation of step S103-1c-2 is to establish a network traffic state describing the network traffic types in different routing devices according to the network traffic types obtained in step S103-1c-1. Step S103-1c-1 can obtain 5 types of network traffic, and each network traffic type corresponds to a different control state of the routing device, thereby establishing a network traffic classification table.

[0162] Continuing with the above example: ACL (P B) is configured to allow the ACL of routing device C (P C ) is configured to block, and the ACL (P D ) is configured as a pass. ACL (P B ), ACL of routing device C (P C ), and the ACL of routing device D (P D ) are all configured to allow traffic. B ) is configured to block, and the ACL (P C ) is configured to block, and the ACL (P D ) is configured as a pass. ACL (P B ) is configured to block, and the ACL (P C ) is configured to allow access, and the ACL (P D ) is configured as a pass. ACL (P B ) is configured to allow the ACL of routing device C (P C ) is configured to block, and the ACL (P D )The control information configured is blocking.

[0163] It should be noted that the above classification of network traffic types adopts two marking dimensions, namely: source IP address dimension and destination IP address dimension. In fact, the marking dimensions can also include source communication port dimension, destination communication port dimension and routing protocol type dimension, etc. Therefore, the marking dimensions can be set according to different needs.

[0164] After obtaining the network traffic classification table according to the above control information, it is necessary to determine whether the configuration information of the access control list to be migrated has changed after being migrated to other routing devices within the migration scope, that is, whether the network traffic status in the network traffic type has changed. Please refer to the description of the following steps.

[0165] Step S103-2: According to the network traffic type, determine the network nodes within the migration range whose configuration information of the access control list to be migrated is changed after the migration.

[0166] The specific implementation process of step S103-2 may include:

[0167] Step S103 - 2a: within the migration range, modeling is performed according to the predetermined route reachability between the network nodes and the network traffic type to obtain a logical expression describing the network traffic status between the network nodes.

[0168] like Figure 2 As shown in the example of step S101, within the migration range determined by routing devices A, B, C, and D, the routing reachability information may be that routing device A can directly reach routing devices B and C; routing device A can reach routing device D through routing device B; routing device C and routing device D are unreachable; routing device C and routing device D are unreachable. In this embodiment, the access control list to be migrated is the ACL of routing device B. Therefore, when modeling, the routing device where the access control list to be migrated is located, that is, routing device B, can be excluded. Based on this, for each network traffic type, the reachability of routing devices A and D and the reachability of routing devices A and C are modeled to obtain a logical expression describing the network traffic status between the network nodes.

[0169] Based on the description of step S102-1, following the example in step S101, the ACL configuration in routing device A is to allow all network traffic (permit); the ACL configuration in routing device B is to deny the status of network traffic 3 and 4, and to permit the status of network traffic 1, 2, and 5; the ACL configuration in routing device C is to deny the status of network traffic 1, 3, and 5, and to permit the status of network traffic 2 and 4; the ACL configuration in routing device D is to deny the status of network traffic 4 and 5, and to permit the status of network traffic 1, 2, and 3. Therefore, through the function f i (x) indicates that the ACL on the routing device allows traffic i to pass; function ~f i (x) represents the traffic blocking by ACL on the routing device; function modeling is performed based on function f to obtain a function model. f in the model 1 (A)^f 1 (D) is the logical expression of the network traffic state of network traffic type 1 between routing devices A and D.

[0170] Step S103-2b: Determine the network traffic status result of the network traffic type after the access control list to be migrated is migrated according to the logical expression.

[0171] After the logical expression describing the network traffic state of network traffic type 1 between routing devices A and D established in step S103-2b, it is necessary to determine the network traffic state result of the routing device network traffic type after the access control list to be migrated is migrated according to the logical expression, such as Figure 6 As shown, Figure 6This is a schematic diagram of the network traffic status result in an embodiment of the access control list migration method provided by the present application. In this embodiment, the network traffic status result can be obtained by using the SMTsolver to solve each logical expression; wherein, the full name of SMT in the SMT solver is Satisfiability Modulo Theories, i.e., Satisfiability Modulo Theories. Under the usual logical interpretation and background theory interpretation, if there is an assignment that makes the SMT formula false, then the SMT formula is unsatisfiable, such as Figure 5 The third type of network traffic that can be reached by AD in the 3 (A)^f 3 (D), where ~f 3 (A) is false, then the logical expression ~f 3 (A)^f 3 (D) is false, which means blocked.

[0172] Step S103-2c: According to the network traffic status result and the network traffic classification table, determine the network nodes within the migration range whose configuration information of the access control list to be migrated is changed after the migration.

[0173] The specific implementation process of step S103-2c may be, based on the network traffic classification table established in step S103-1c-2 and the network traffic status result obtained in step S103-2b, by comparing the two, finding the access control list to be migrated within the migration range, and the network nodes whose configuration information has changed before and after the migration.

[0174] The flow classification table in this embodiment is as follows: Figure 4 As shown, the network traffic status results are as follows Figure 6 As shown in the following table, the contents of the two are compared:

[0175]

[0176] It can be seen from the above table that after comparing the traffic classification table and the network traffic status results, the network traffic status results of network traffic type 3 are inconsistent with the network traffic type before migration, and the routing device D is determined as the network node whose configuration information of the access control list to be migrated is changed after the migration within the migration range.

[0177] Step S103-3: according to the network node whose configuration information is changed after the access control list to be migrated is migrated, a new access control list to be migrated is generated for the network node.

[0178] The specific implementation process of step S103-3 may include:

[0179] Step S103-3a: Determine the modified content of the configuration information according to the configuration information of the access control list of the destination network node where the configuration information has been changed and the configuration information of the access control list on the source network node before the migration of the to-be-migrated range control list.

[0180] The destination network node is a destination routing device, that is, a routing device that receives the network control list to be migrated; the source network node is a source routing device, that is, a source routing device to which the network control list to be migrated belongs.

[0181] In this embodiment, the modified content of the configuration information can be obtained through a Cartesian product operation, wherein the Cartesian product refers to the Cartesian product (also known as the direct product) of two sets X and Y in mathematics, expressed as X×Y, where the first object is a member of X and the second object is one of the members of all possible ordered pairs of Y.

[0182] Step S103 - 3b: Generate a new access control list to be migrated for the network node whose configuration information has been changed according to the modified content.

[0183] Before generating a new access control list to be migrated for the network node whose configuration information has been changed according to the modified content, the following steps may be included:

[0184] The redundant access control list in the current network architecture information is filtered, that is, the redundant ACL existing on the routing device is filtered, and after filtering, a new access control list to be migrated is generated.

[0185] The so-called redundant ACL means that since a large number of ACL rules exist in the router, and the matching priority of ACL rules for data packets is from top to bottom, many ACL rules are seriously redundant, that is, they are covered by the previous ACL, so that the ACL with low priority will never be matched, which is a redundant ACL.

[0186] Step S103 - 4 : Determine the new access control list to be migrated as the migration strategy.

[0187] Step S104: Migrate the access control list to be migrated according to the migration strategy.

[0188] The specific implementation process of step S104 may be to migrate the generated new access control list to be migrated to the network node where the configuration information has been changed.

[0189] The above is a detailed description of an access control list migration method embodiment provided by the present application. Corresponding to the aforementioned access control list migration method embodiment, the present application also discloses an access control list migration device embodiment, please refer to Figure 7 Since the device embodiment is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device embodiment described below is only illustrative.

[0190] like Figure 7 As shown, Figure 7 : is a structural diagram of an embodiment of a migration device for access control lists provided by the present application, the migration device comprising:

[0191] The determining unit 701 is used to determine the access control list to be migrated.

[0192] The determining unit 701 includes:

[0193] The request receiving subunit is used to determine the access control list to be migrated according to the received migration request for the access control list in the current network architecture.

[0194] The migration request received by the request receiving subunit includes at least the following information:

[0195] Source device address information of the access control list to be migrated;

[0196] The migration destination device address information of the access control list to be migrated;

[0197] Migration scope information of the access control list to be migrated.

[0198] The acquisition unit 702 is used to acquire current network architecture information according to the access control list to be migrated.

[0199] The acquisition unit 702 is specifically configured to acquire routing configuration information and access control list configuration information in the current network architecture information according to the access control list to be migrated.

[0200] The generating unit 703 is used to generate, according to the current network architecture information, a migration strategy that satisfies the requirement that the configuration information of the access control list to be migrated is the same before and after the migration.

[0201] The generating unit 703 includes:

[0202] The classification subunit is used to classify the network traffic according to the current network architecture information to obtain the network traffic type.

[0203] The change determination subunit is used to determine, according to the network traffic type, the network nodes within the migration range whose configuration information of the access control list to be migrated is changed after the migration.

[0204] The generating subunit is used to generate a new access control list to be migrated for the network node according to the network node whose configuration information is changed after the access control list to be migrated is migrated.

[0205] The migration strategy determination subunit is used to determine the new access control list to be migrated as the migration strategy.

[0206] Wherein, the classification subunit includes:

[0207] An obtaining subunit, configured to extract access control list configuration information of network nodes in the current network architecture information within a migration range, and obtain a set of access control list configuration information of different network nodes within the migration range;

[0208] The marking subunit is used to mark the access control list configuration information set of different network nodes within the migration range according to the set marking dimension; wherein the marking dimension includes at least one of the following dimensions: source IP address dimension; destination IP address dimension; source communication port dimension; destination communication port dimension; routing protocol type dimension.

[0209] The classification table obtaining subunit is used to obtain the network traffic classification table within the migration range according to the mark.

[0210] The migration unit 704 is configured to migrate the access control list to be migrated according to the migration policy.

[0211] Among them, the marking subunit is specifically used to mark the information describing the network traffic status in the access control list configuration information set of different network nodes within the migration range according to the set marking dimension; the network traffic status includes a release status and a blocking status.

[0212] The classification table obtaining subunit comprises:

[0213] A classification subunit, configured to classify the same tag information of different network nodes under the tag dimension into one category according to the tag, and obtain the network traffic type within the migration range;

[0214] The classification table establishing subunit is used to establish a network traffic classification table according to the network traffic type, and the network traffic classification table is used to describe the network traffic status of the network traffic type.

[0215] The change determination subunit comprises:

[0216] A modeling subunit, configured to perform modeling within the migration range according to the predetermined route reachability between the network nodes and the network traffic type, and obtain a logical expression describing the network traffic state between the network nodes;

[0217] A status result determination subunit, used to determine the network traffic status result of the network traffic type after the access control list to be migrated is migrated according to the logical expression;

[0218] The network node determination subunit is used to determine the network nodes whose configuration information of the access control list to be migrated is changed after migration within the migration range according to the network traffic state result and the network traffic classification table.

[0219] The network node determination subunit can be specifically used to compare the network traffic status result with the network wandering classification table to determine the network node within the migration range whose configuration information of the access control list to be migrated is changed before and after the migration.

[0220] The generating subunit comprises:

[0221] A modification content determination subunit, used to determine the configuration information modification content according to the configuration information of the access control list of the destination network node where the configuration information is changed and the configuration information of the access control list on the source network node before the migration of the to-be-migrated range control list;

[0222] The generating subunit is specifically configured to generate a new access control list to be migrated for the network node whose configuration information has been changed according to the configuration information modification content.

[0223] The migration unit 704 is specifically configured to migrate the generated new access control list to be migrated to the network node where the configuration information has been changed.

[0224] Based on the above content, this embodiment may also include:

[0225] The filtering unit is used to migrate the generated new access control list to be migrated to the network node where the configuration information has been changed.

[0226] The above is a description of an embodiment of an access control list migration device provided in the present application. The description is relatively brief. For specific contents, please refer to the description of the above-mentioned access control list migration method embodiment, and no further details will be given here.

[0227] Based on the above content, this application also provides a routing method, please refer to Figure 8 As shown, Figure 8 The present application also provides a flowchart of an embodiment of a routing method, the method comprising:

[0228] Step S801: receiving a data packet to be sent;

[0229] Step S802: determining the routing path of the data packet according to the migration strategy generated according to the current network architecture information to satisfy the same configuration information of the access control list to be migrated before and after the migration, the migration access control list that completes the migration, and the configuration information of the routing table;

[0230] Step S803: Routing the data packet to the destination address according to the determined routing path.

[0231] The generation of the migration strategy in step S802 may refer to the description of steps S101 to S104 above.

[0232] In view of the routing method provided by the present application, the present application also provides a routing device, please refer to Fig. 9 As shown, Fig. 9 : is a schematic diagram of a structure of a routing device embodiment provided by the present application, the device comprising:

[0233] The receiving unit 901 is used to receive a data packet to be sent;

[0234] The determining unit 902 is used to determine the routing path of the data packet according to the migration strategy generated according to the current network architecture information to satisfy the same configuration information of the access control list to be migrated before and after the migration, the migration access control list that completes the migration, and the configuration information of the routing table;

[0235] The routing unit 903 is used to route the data packet to the destination address according to the determined routing path.

[0236] Based on the above content, the present application also provides a computer storage medium for storing data generated by a network platform, and a program for processing the data generated by the network platform;

[0237] When the program is read and executed by the processor, the program executes the steps of the access control list migration method described above, or executes the steps of the routing method described above.

[0238] Based on the above content, the present application also provides an electronic device, including:

[0239] processor;

[0240] The memory is used to store a program for processing data generated by a network platform. When the program is read and executed by the processor, the program executes the steps of the access control list migration method as described above, or executes the steps of the routing method as described above.

[0241] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0242] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0243] 1. Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include non-transitory media such as modulated data signals and carrier waves.

[0244] 2. Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0245] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. A method for migrating an access control list, characterized in that: include: Determine the access control list to be migrated; According to the access control list to be migrated, obtaining current network architecture information; Generate a migration strategy that satisfies the configuration information of the access control list to be migrated to be the same before and after the migration according to the current network architecture information; Migrating the access control list to be migrated according to the migration strategy; The step of generating, according to the current network architecture information, a migration strategy that satisfies the requirement that the configuration information of the access control list to be migrated is the same before and after the migration, comprises: Classifying network traffic according to the current network architecture information to obtain network traffic types; Determine, according to the network traffic type, a network node in the migration range whose configuration information of the access control list to be migrated is changed after the migration; According to the network node whose configuration information is changed after the access control list to be migrated is migrated, generating a new access control list to be migrated for the network node; The new access control list to be migrated is determined as the migration strategy.

2. The method for migrating an access control list according to claim 1, characterized in that: The step of determining the access control list to be migrated includes: According to the received migration request for the access control list in the current network architecture, an access control list to be migrated is determined.

3. The method for migrating an access control list according to claim 2, characterized in that: The migration request includes at least one of the following information: Source device address information of the access control list to be migrated; The migration destination device address information of the access control list to be migrated; Migration scope information of the access control list to be migrated.

4. The method for migrating an access control list according to claim 1, characterized in that: The acquiring current network architecture information according to the access control list to be migrated includes: According to the access control list to be migrated, the routing configuration information and the access control list configuration information in the current network architecture information are obtained.

5. The method for migrating an access control list according to claim 1, characterized in that: The classifying the network traffic according to the current network architecture information to obtain the network traffic type includes: Extracting access control list configuration information of network nodes in the current network architecture information within the migration range, and obtaining a set of access control list configuration information of different network nodes within the migration range; According to the set marking dimension, the access control list configuration information set of different network nodes within the migration range is marked; According to the mark, a network traffic classification table within the migration range is obtained.

6. The method for migrating an access control list according to claim 5, characterized in that: The set marking dimension includes at least one of the following dimensions: Source IP address dimension; Destination IP address dimension; Source communication port dimension; Destination communication port dimension; Routing protocol type dimension.

7. The method for migrating an access control list according to claim 6, characterized in that: The step of marking the access control list configuration information set of different network nodes within the migration range according to the set marking dimension includes: According to the set marking dimension, information used to describe the network traffic status in the access control list configuration information set of different network nodes within the migration range is marked; the network traffic status includes a release status and a blocking status.

8. The method for migrating an access control list according to claim 7, characterized in that: The obtaining, according to the mark, a network traffic classification table within the migration range includes: According to the tag, the same tag information of different network nodes under the tag dimension is classified into one category to obtain the network traffic type within the migration range; A network traffic classification table is established according to the network traffic type, and the network traffic classification table is used to describe the network traffic status of the network traffic type.

9. The method for migrating an access control list according to claim 8, characterized in that: The determining, according to the network traffic type, of the network nodes in the migration range whose configuration information of the access control list to be migrated is changed after the migration includes: Modeling is performed within the migration range according to the predetermined route reachability between network nodes and the network traffic type to obtain a logical expression describing the network traffic state between the network nodes; Determine, according to the logical expression, a network traffic status result of the network traffic type after the access control list to be migrated is migrated; According to the network traffic status result and the network traffic classification table, the network nodes in the migration range whose configuration information of the access control list to be migrated is changed after the migration are determined.

10. The method for migrating an access control list according to claim 9, characterized in that: The determining, according to the network traffic status result and the network traffic classification table, of the network nodes in the migration range whose configuration information of the access control list to be migrated is changed after the migration, comprises: The network traffic status result is compared with the network traffic classification table to determine the network nodes within the migration range whose configuration information of the access control list to be migrated is changed before and after the migration.

11. The method for migrating an access control list according to claim 9, characterized in that: The step of generating a new access control list to be migrated for a network node whose configuration information has changed within a migration range according to the determined access control list to be migrated comprises: Determine the configuration information modification content according to the configuration information of the access control list of the network node whose configuration information has been changed and the configuration information of the access control list on the source network node before the migration of the access control list to be migrated; A new access control list to be migrated is generated for the network node whose configuration information has been changed according to the configuration information modification content.

12. The method for migrating an access control list according to claim 9, characterized in that: The migrating the access control list to be migrated according to the migration strategy includes: The generated new access control list to be migrated is migrated to the network node where the configuration information is changed.

13. The method for migrating an access control list according to claim 1, characterized in that: Also includes: The redundant access control list in the current network architecture information is filtered.

14. A device for migrating an access control list, characterized in that: include: A determination unit, used to determine the access control list to be migrated; An acquisition unit, configured to acquire current network architecture information according to the access control list to be migrated; A generating unit, configured to generate, according to the current network architecture information, a migration strategy that satisfies the configuration information of the access control list to be migrated to be the same before and after the migration; A migration unit, configured to migrate the access control list to be migrated according to the migration strategy; The generating unit comprises: A classification subunit, used to classify network traffic according to the current network architecture information to obtain a network traffic type; A change determination subunit, used to determine, according to the network traffic type, a network node within a migration range whose configuration information of the access control list to be migrated is changed after the migration; A generating subunit, configured to generate a new access control list to be migrated for the network node according to the network node whose configuration information has changed after the access control list to be migrated is migrated; The migration strategy determination subunit is used to determine the new access control list to be migrated as the migration strategy.

15. A routing method, characterized in that: include: Receive data packets to be sent; Determine the routing path of the data packet according to the migration strategy generated according to the current network architecture information to ensure that the configuration information of the access control list to be migrated is the same before and after the migration, the access control list to be migrated that has been migrated, and the configuration information of the routing table; Routing the data packet to the destination address according to the determined routing path; The migration strategy generated according to the current network architecture information to ensure that the configuration information of the access control list to be migrated is the same before and after the migration includes: Classifying network traffic according to the current network architecture information to obtain network traffic types; Determine, according to the network traffic type, a network node in the migration range whose configuration information of the access control list to be migrated is changed after the migration; According to the network node whose configuration information is changed after the access control list to be migrated is migrated, generating a new access control list to be migrated for the network node; The new access control list to be migrated is determined as the migration strategy.

16. A routing device, characterized in that: include: A receiving unit, used for receiving a data packet to be sent; A determination unit, configured to determine a routing path of the data packet according to a migration strategy generated according to current network architecture information to satisfy the same configuration information of the access control list to be migrated before and after the migration, the access control list to be migrated that has completed the migration, and the configuration information of the routing table; A routing unit, used to route the data packet to a destination address according to a determined routing path; The determining unit is specifically used to classify the network traffic according to the current network architecture information to obtain the network traffic type; Determine, according to the network traffic type, a network node in the migration range whose configuration information of the access control list to be migrated is changed after the migration; According to the network node whose configuration information is changed after the access control list to be migrated is migrated, generating a new access control list to be migrated for the network node; The new access control list to be migrated is determined as the migration strategy.

17. A computer storage medium for storing data generated by a network platform and a program for processing the data generated by the network platform; When the program is read and executed by a processor, the program executes the steps of the access control list migration method as described in any one of claims 1 to 13; or executes the steps of the routing method as described in claim 15.

18. An electronic device, comprising: processor; A memory for storing a program for processing data generated by a network platform, wherein when the program is read and executed by the processor, the program executes the steps of the access control list migration method as described in any one of claims 1 to 13; or executes the steps of the routing method as described in claim 15.

Images