Access control management method, device and medium

Abstract

The present application discloses an access control management method, device and medium, the method comprising: in the case of adding or reducing ACL nodes, traversing the ACL linked list, judging whether the enablement flag is valid, and in the case of the enablement flag being valid, obtaining all ACL five-tuple information of the node corresponding to the enablement flag, and configuring the five-tuple information into the ACL interface, if the enablement flag is invalid, the ACL node is not configured. Since the enablement flag is judged to be valid before configuring the ACL node, the nodes that do not need to be configured for the ACL node are prevented from being reconfigured, that is, only the nodes with valid enablement flags are configured, and other nodes do not need to be reconfigured, thereby reducing the consumption of memory resources, while reducing the consumption of time, and improving the running speed of the software developed based on DPDK and supporting the ACL function.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an access control management method, device and medium. Background Art

[0002] With the widespread popularity of computer networks, new application software emerges in an endless stream. These application software greatly influences and changes the way people work and live, and increases people's dependence on computers. In recent years, due to the complexity and wide accessibility of computer information systems, the systems are facing increasing security threats. In this case, access control, as an important security support technology, has been widely used. Since access control clearly defines and restricts user access operations to resources, it effectively protects the confidentiality and integrity of information resources.

[0003] The existing technology mainly has the problem that the access control lists (ACL) interface cannot be dynamically configured after configuration. When adding or deleting ACL nodes, it is necessary to delete and release the interface configuration of all ACL nodes, and then reconfigure all ACL nodes. Therefore, a large amount of memory resources will be consumed, and a lot of time will also be consumed, affecting the timeliness of the software system developed based on the data plane development kit (Data Plane Development Kit, DPDK) and supporting the ACL function. Summary of the invention

[0004] The purpose of this application is to provide an access control management method, which is conducive to reducing the consumption of system memory resources and improving the timeliness of the system. The purpose of this application is also to provide an access control management device and medium based on a two-dimensional bidirectional linked list.

[0005] In order to solve the above technical problems, the present application provides an access control management method, which includes:

[0006] In the case of adding or reducing an ACL node, traversing the ACL linked list to determine whether the enable flag is valid; wherein the enable flag is pre-set in the node;

[0007] When the enabling identifier is valid, obtaining 5-tuple information of each ACL of the node corresponding to the enabling identifier;

[0008] Configuring each of the ACL five-tuple information to the ACL interface;

[0009] When the enabling flag is invalid, no ACL configuration is performed.

[0010] Preferably, before traversing the ACL linked list, the method further includes: presetting an ACL two-dimensional bidirectional linked list;

[0011] The traversal of the ACL chain list is specifically as follows:

[0012] Each ACL column in the ACL two-dimensional bidirectional linked list and each of the nodes in each of the ACL columns are traversed.

[0013] Preferably, the adding of an ACL node specifically includes:

[0014] Get the first target name and target five-tuple information of the added first target ACL node;

[0015] Traverse the ACL linked list to determine whether there is a second target node;

[0016] If the second target node exists, traverse the ACL node linked list of the second target node to determine whether the first target name and each ACL name and the target five-tuple information and each ACL five-tuple information are not repeated;

[0017] If there is no duplication, the first target ACL node is added to the second target node.

[0018] Preferably, the step of judging whether the target quintuple information and each ACL quintuple information are not repeated is as follows:

[0019] Determine whether the source and destination ports of the target quintuple are not equal to the source and destination ports of each of the ACL quintuples;

[0020] Determine whether the transmission protocol of the target quintuple is not equal to the transmission protocol of each of the ACL quintuples;

[0021] When the source and destination IP mask lengths of the target quintuple are equal to the source and destination IP mask lengths of each of the ACL quintuples, determining whether the source and destination IP mask of the target quintuple are not equal to the source and destination IP mask of each of the ACL quintuples;

[0022] When the source and destination IP mask lengths of the target quintuple are greater than the source and destination IP mask lengths of each of the ACL quintuples, after the source and destination IP of the target quintuple and the source and destination IP of each of the ACL quintuples are respectively compared with the source and destination IP of each of the ACL quintuples, it is determined whether the source and destination IP masks of the target quintuple are not equal to the source and destination IP masks of each of the ACL quintuples;

[0023] When the source and destination IP mask lengths of the target quintuple are less than the source and destination IP mask lengths of each of the ACL quintuples, then after the source and destination IP of the target quintuple and the source and destination IP of each of the ACL quintuples are respectively compared with the source and destination IP of the target quintuple, it is determined whether the source and destination IP masks of the target quintuple are not equal to the source and destination IP masks of each of the ACL quintuples;

[0024] When the source and destination ports, transport protocols and source and destination IP masks of the target quintuple are not equal to the source and destination ports, transport protocols and source and destination IP masks of each of the ACL quintuples, it is determined that the target quintuple information and the ACL quintuple information are not repeated.

[0025] Preferably, reducing the ACL nodes specifically includes:

[0026] Get the second target name of the reduced second target ACL node;

[0027] Traverse the ACL linked list to determine whether there is a third target node;

[0028] If the third target node exists, traverse the ACL node list of the third target node to determine whether the second target name is the same as each ACL name;

[0029] In the same situation, the second target ACL node is deleted.

[0030] Preferably, reducing the ACL nodes further comprises:

[0031] When the system is idle, it is effective to set the enabling flag of the third target node through the application.

[0032] In order to solve the above technical problems, the present application also provides an access control management device, which includes:

[0033] A first judgment module is used to traverse the ACL linked list and judge whether the enable flag is valid when adding or reducing an ACL node; wherein the enable flag is pre-set in the node;

[0034] A first acquisition module, configured to acquire, when the enabling identifier is valid, each ACL quintuple information of the node corresponding to the enabling identifier;

[0035] The configuration module is used to configure each of the ACL five-tuple information to the ACL interface.

[0036] The execution module is used for not performing ACL configuration when the enabling flag is invalid.

[0037] In order to solve the above technical problems, the present application also provides an access control management device, including:

[0038] Memory for storing computer programs;

[0039] A processor is used to implement the steps of the access control management method as described above when executing the computer program.

[0040] In order to solve the above technical problems, the present application also provides a computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the access control management method as described above are implemented.

[0041] The access control management method provided by the present application, when adding or reducing ACL nodes, traverses the ACL linked list to determine whether the enable identifier is valid. When the enable identifier is valid, obtains all ACL five-tuple information of the node corresponding to the enable identifier, and configures the five-tuple information into the ACL interface. If the enable identifier is invalid, the ACL node is not configured. Since the enable identifier is first determined before configuring the ACL node, the nodes that do not need to be configured for the ACL node are prevented from being reconfigured, that is, only the nodes with valid enable identifiers are configured, and other nodes do not need to be reconfigured, thereby reducing the consumption of memory resources, while reducing the consumption of time, and improving the running speed of software developed based on DPDK and supporting ACL functions.

[0042] In addition, the present application provides an access control management device and medium, which correspond to the above-mentioned access control management method and have the same effect as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 A flowchart of an access control management method provided in an embodiment of the present application;

[0045] Figure 2 A structural diagram of a two-dimensional bidirectional linked list of ACL provided in an embodiment of the present application;

[0046] Figure 3 A flowchart of adding an ACL node provided in an embodiment of the present application;

[0047] Figure 4A flowchart for determining whether target quintuple information and each ACL quintuple information are non-repetitive is provided in an embodiment of the present application;

[0048] Figure 5 A flowchart for reducing ACL nodes provided in an embodiment of the present application;

[0049] Figure 6 A structural diagram of an access control management device provided in an embodiment of the present application;

[0050] Figure 7 A structural diagram of another access control management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0052] The core of this application is to provide an access control management method, device and medium.

[0053] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0054] Figure 1 A flowchart of an access control management method provided in an embodiment of the present application. Figure 1 As shown, the method includes:

[0055] S10: Determine whether to add or reduce access control lists (ACL) nodes. If yes, proceed to S11; if no, end the ACL configuration.

[0056] S11: traverse the ACL linked list to determine whether the enable flag is valid. If yes, proceed to S12; if no, end the ACL configuration.

[0057] It should be noted that the enable flag is pre-set in the node, and there is no specific restriction on the enable flag, and there is no restriction on its valid and invalid states. Usually, the enable flag is set to 1 for valid, and the enable flag is set to 0 for invalid.

[0058] S12: Acquire 5-tuple information of each ACL of the node corresponding to the enable flag.

[0059] It should be noted that the ACL five-tuple information specifically includes source Internet Protocol (IP), destination IP, source port, destination port and transport protocol.

[0060] S13: Configure each ACL quintuple information to the ACL interface.

[0061] It should be noted that the ACL interface is specifically an ACL interface of a data plane development kit (Data Plane Development Kit, DPDK).

[0062] As a preferred embodiment, before S12 or before S13, the original ACL interface configuration may be deleted.

[0063] The access control management method provided in this embodiment traverses the ACL linked list to determine whether the enable flag is valid when adding or reducing ACL nodes. When the enable flag is valid, all ACL five-tuple information of the node corresponding to the enable flag is obtained, and the five-tuple information is configured in the ACL interface. If the enable flag is invalid, the ACL node is not configured. Since the validity of the enable flag is determined before configuring the ACL node, the nodes that do not need to be configured for the ACL node are prevented from being reconfigured, that is, only the nodes with valid enable flags are configured, and other nodes do not need to be reconfigured, thereby reducing the consumption of memory resources, while reducing the consumption of time, and improving the running speed of software developed based on DPDK and supporting ACL functions.

[0064] On the basis of the above embodiment, before traversing the ACL linked list, the method further includes: presetting an ACL two-dimensional bidirectional linked list.

[0065] Traversing the ACL linked list specifically includes traversing each ACL column and each node in each ACL column in the ACL two-dimensional bidirectional linked list.

[0066] Figure 2 This is a structural diagram of an ACL two-dimensional bidirectional linked list provided in an embodiment of the present application. Figure 2 As shown, the ACL column list consists of the head pointer of the ACL column, the ACL column consists of the head pointer and multiple nodes, and the ACL node list consists of one node and multiple ACL nodes, wherein the node includes the column name, enable flag and ACL head pointer, and the ACL node includes the node name, source and destination IP, source and destination port and transmission protocol.

[0067] The specific method of traversing the ACL linked list is as follows: traverse the ACL column head pointer in the ACL column linked list, find the ACL column corresponding to the ACL head pointer, traverse each node in the ACL column, and find each ACL node corresponding to the node.

[0068] It should be noted that there is no restriction on the data of the node, the number of ACL nodes, and the connection basis between ACL nodes. For example, similar access restrictions of the same resource can be placed in the same node.

[0069] The access control management method provided in this embodiment pre-sets an ACL two-dimensional bidirectional linked list, and traverses the ACL two-dimensional bidirectional linked list by traversing each ACL column and each node of each ACL column. Since a two-dimensional bidirectional linked list is set, the ACL linked list can be traversed efficiently and quickly when adding or reducing ACL nodes and performing ACL configuration, reducing the time spent on traversing all ACL nodes, and further improving the running speed of software developed based on DPDK and supporting ACL functions.

[0070] Figure 3 A flowchart of adding an ACL node is provided in an embodiment of the present application. Figure 3 As shown, based on the above embodiment, the method for adding an ACL node is specifically as follows:

[0071] S20: Acquire the first target name and target quintuple information of the added first target ACL node.

[0072] It should be noted that the first target ACL node is the ACL node to be added.

[0073] S21: traverse the ACL linked list to determine whether the second target node exists. If yes, proceed to S22; if no, end the process of adding the ACL node.

[0074] S22: traverse the ACL node linked list of the second target node, and determine whether the first target name and each ACL name and the target five-tuple information and each ACL five-tuple information are not repeated. If yes, enter S23; if not, end the process of adding the ACL node.

[0075] S23: Add the first target ACL node under the second target node.

[0076] It should be noted that after the first target ACL node is added, the state of the enable flag of the second target node will become valid, which is convenient for subsequent ACL configuration.

[0077] The present embodiment provides an access control management method, which obtains the target node name and target five-tuple information of the ACL node to be added, and in the case of a second target node, traverses the ACL node linked list of the second target node to determine whether the target node name and target five-tuple information are not repeated with each ACL name and five-tuple information, and if they are not repeated, adds the ACL node. Since the ACL node is added by traversing the ACL two-dimensional bidirectional linked list, compared with the existing ACL single linked list, the method provided by the embodiment of the present application only needs to determine whether the ACL node to be added is repeated with the original ACL node of the second target node, and other ACL nodes do not need to be determined, thereby reducing the time consumption of adding ACL nodes.

[0078] Figure 4 A flowchart for determining whether target five-tuple information and each ACL five-tuple information are not repeated is provided in the embodiment of the present application. Figure 4 As shown, based on the above embodiment, the method includes:

[0079] S30: Determine whether the source and destination ports of the target quintuple are not equal to the source and destination ports of each ACL quintuple. If yes, proceed to S31; if not, terminate the determination.

[0080] S31: Determine whether the transmission protocol of the target quintuple is not equal to the transmission protocol of each ACL quintuple. If yes, proceed to S32; if not, end the determination.

[0081] S32: Compare the source and destination IP mask lengths of the target quintuple with the source and destination IP mask lengths of each ACL quintuple. If the source and destination IP mask lengths of the target quintuple are greater than the source and destination IP mask lengths of each ACL quintuple, enter S33; if the source and destination IP mask lengths of the target quintuple are less than, enter S34; if they are equal, enter S35.

[0082] S33: The source and destination IP of the target quintuple and the source and destination IP of each ACL quintuple are respectively compared with the source and destination IP of each ACL quintuple, and then the process goes to S35.

[0083] S34: The source and destination IP of the target quintuple and the source and destination IP of each ACL quintuple are respectively compared with the source and destination IP of the previous target quintuple, and then proceed to S35.

[0084] S35: Determine whether the source and destination IP masks of the target quintuple are not equal to the source and destination IP masks of each ACL quintuple. If yes, proceed to S36; if not, end the determination.

[0085] S36: Determine that the target quintuple information and each ACL quintuple information are not repeated.

[0086] It should be noted that there is no order in determining whether the source and destination ports of the target quintuple are not equal to the source and destination ports of each ACL quintuple, determining whether the transport protocol of the target quintuple is not equal to the transport protocol of each ACL quintuple, and determining whether the source and destination IP masks of the target quintuple are not equal to the source and destination IP masks of each ACL quintuple. The following can be used: Figure 4 The judgment may be performed in the order shown, or it may not be performed in this order, or it may be performed simultaneously.

[0087] The present embodiment provides an access control management method, which determines whether the source and destination ports, transmission protocols, and source and destination IPs of the target quintuple are not equal to the source and destination ports, transmission protocols, and source and destination IPs of each ACL quintuple of the second target node. If they are not equal, it is determined that the target quintuple information and each ACL quintuple information are not repeated. The method provided in the embodiment of the present application only needs to determine whether the added ACL quintuple information is the same as the ACL quintuple information of the second target node, and there is no need to determine it with all ACL quintuple information, thereby reducing the time consumption of adding ACL nodes.

[0088] Figure 5 A flowchart of reducing ACL nodes provided in an embodiment of the present application. Figure 5 As shown, based on the above embodiment, the method for reducing ACL nodes is specifically as follows:

[0089] S40: Acquire the second target name of the reduced second target ACL node.

[0090] It should be noted that the second target ACL node is the ACL node to be deleted.

[0091] S41: traverse the ACL linked list to determine whether there is a third target node. If yes, proceed to S42; if no, end the deletion of the ACL node.

[0092] S42: traverse the ACL node linked list of the third target node to determine whether the second target name is the same as each ACL name. If yes, proceed to S43; if not, end the deletion of the ACL node.

[0093] S43: Delete the second target ACL node.

[0094] It should be noted that after the second target ACL node is deleted, the state of the enable flag of the third target node becomes valid, which facilitates the subsequent configuration of the ACL.

[0095] As a preferred embodiment, it also includes: when the system is idle, the enable flag of the third target node is set to be effective through the application. In the process of deleting ACL nodes, since the application can control each node individually, the enable flag of the third target node is set to 1 or 0 by the application, so whether to perform ACL configuration when the system is idle can be determined. Therefore, performing ACL configuration when the system is idle is beneficial to the long-term operation of the system, and effectively avoids resource consumption caused by frequent configuration when deleting multiple ACL nodes.

[0096] The present embodiment provides an access control management method, which obtains the target node name of the ACL node to be deleted, and in the case of a third target node, traverses the ACL node linked list of the third target node to determine whether the target node name is the same as the ACL names of the third target node, and if they are the same, deletes the ACL node. Since the ACL node is deleted by traversing the ACL two-dimensional bidirectional linked list, compared with the existing ACL single linked list, the method provided by the embodiment of the present application only needs to determine whether the ACL node to be deleted is the same as the original ACL node of the third target node, and other ACL nodes do not need to be determined, thereby reducing the time consumption of deleting ACL nodes.

[0097] In the above embodiments, the access control management method is described in detail, and the present application also provides an embodiment of the access control management device. It should be noted that the present application describes the embodiments of the device part from two perspectives, one is based on the functional module perspective, and the other is based on the hardware perspective.

[0098] Figure 6 This is a structural diagram of an access control management device provided in an embodiment of the present application. Figure 6 As shown, based on the perspective of functional modules, the device includes:

[0099] The first judgment module 10 is used to traverse the ACL chain list and judge whether the enable flag is valid when adding or reducing an ACL node.

[0100] The first acquisition module 11 is used to acquire 5-tuple information of each ACL of the node corresponding to the enable flag when the enable flag is valid.

[0101] The configuration module 12 is used to configure each ACL five-tuple information to the ACL interface.

[0102] The execution module 13 is used for not performing ACL configuration when the enabling flag is invalid.

[0103] As a preferred embodiment, it also includes:

[0104] The first setting module is used to pre-set the ACL two-dimensional bidirectional linked list.

[0105] Also includes:

[0106] The second acquisition module is used to acquire the first target name and target quintuple information of the added first target ACL node.

[0107] The second judgment module is used to traverse the ACL linked list to determine whether a second target node exists.

[0108] The third judgment module is used to traverse the ACL node list of the second target node when there is a second target node, and judge whether the first target name and each ACL name and the target five-tuple information and each ACL five-tuple information are not repeated.

[0109] The adding module is used to add the first target ACL node to the second target node when there is no duplication.

[0110] Also includes:

[0111] The third acquisition module is used to acquire the second target name of the reduced second target ACL node.

[0112] The fourth judgment module is used to traverse the ACL linked list to determine whether there is a third target node.

[0113] The fifth judgment module is used to traverse the ACL node list of the third target node when there is a third target node, and judge whether the second target name is the same as each ACL name.

[0114] The deleting module is used to delete the second target ACL node under the same circumstances.

[0115] The second setting module is used to set the enabling flag of the third target node to be valid through the application program when the system is idle.

[0116] Since the embodiments of the apparatus part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the apparatus part, which will not be repeated here.

[0117] The access control management device provided in this embodiment traverses the ACL linked list to determine whether the enable flag is valid when adding or reducing ACL nodes. If the enable flag is valid, all ACL five-tuple information of the node corresponding to the enable flag is obtained, and the five-tuple information is configured in the ACL interface. If the enable flag is invalid, the ACL node is not configured. Since the validity of the enable flag is determined before configuring the ACL node, the nodes that do not need to be configured for the ACL node are prevented from being reconfigured, that is, only the nodes with valid enable flags are configured, and other nodes do not need to be reconfigured, thereby reducing the consumption of memory resources, while reducing the consumption of time, and improving the running speed of software developed based on DPDK and supporting ACL functions.

[0118] Figure 7 This is a structural diagram of another access control management device provided in an embodiment of the present application. Figure 7 As shown, from the perspective of hardware structure, the device includes:

[0119] A memory 20, for storing computer programs;

[0120] The processor 21 is used to implement the steps of the access control management method in the above embodiment when executing the computer program.

[0121] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a graphics processing unit (GPU), and the GPU is responsible for rendering and drawing the content to be displayed on the display screen.

[0122] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 20 is at least used to store the following computer program 201, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps of the access control management method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 202 may include Windows, Unix, Linux, etc. The data 203 may include, but is not limited to, data involved in the access control management method, etc.

[0123] In some embodiments, the access control management device may further include a display screen 22 , an input / output interface 23 , a communication interface 24 , a power supply 25 , and a communication bus 26 .

[0124] Those skilled in the art will understand that Figure 7 The structure shown in the figure does not constitute a limitation on the access control management device, and may include more or fewer components than those shown in the figure.

[0125] The access control management device provided in this embodiment includes a memory and a processor. When the processor executes the program stored in the memory, it can implement the following method: when adding or reducing ACL nodes, traverse the ACL linked list to determine whether the enable flag is valid. When the enable flag is valid, obtain all ACL five-tuple information of the node corresponding to the enable flag, and configure the five-tuple information into the ACL interface. If the enable flag is invalid, the ACL node is not configured. Since it is determined whether the enable flag is valid before configuring the ACL node, it prevents the nodes that do not need to be configured for the ACL node from being reconfigured, that is, only the nodes with valid enable flags are configured, and other nodes do not need to be reconfigured, thereby reducing the consumption of memory resources, while reducing the consumption of time, and improving the running speed of software developed based on DPDK and supporting ACL functions.

[0126] Finally, the present application also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps recorded in the above method embodiment are implemented.

[0127] It is understandable that if the method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0128] The computer-readable storage medium provided in this embodiment stores a computer program on the medium. When the computer program is executed by the processor, the following method can be implemented: when adding or reducing ACL nodes, traverse the ACL linked list to determine whether the enable flag is valid. When the enable flag is valid, obtain all ACL five-tuple information of the node corresponding to the enable flag, and configure the five-tuple information into the ACL interface. If the enable flag is invalid, the ACL node is not configured. Since the enable flag is determined to be valid before configuring the ACL node, the nodes that do not need to be configured for the ACL node are prevented from being reconfigured, that is, only the nodes with valid enable flags are configured, and other nodes do not need to be reconfigured, thereby reducing the consumption of memory resources, while reducing the consumption of time, and improving the running speed of software developed based on DPDK and supporting ACL functions.

[0129] The above is a detailed introduction to an access control management method, device and medium provided by the present application. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can refer to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can refer to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0130] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. An access control management method, characterized in that: The method includes: In the case of adding or reducing an ACL node, traversing the ACL linked list to determine whether the enable flag is valid; wherein the enable flag is pre-set in the node; When the enabling identifier is valid, obtaining 5-tuple information of each ACL of the node corresponding to the enabling identifier; Configuring each of the ACL five-tuple information to the ACL interface; If the enabling flag is invalid, no ACL configuration is performed; The steps to add an ACL node include: Get the first target name and target five-tuple information of the added first target ACL node; Traverse the ACL linked list to determine whether there is a second target node; If the second target node exists, traverse the ACL node linked list of the second target node to determine whether the first target name and each ACL name and the target five-tuple information and each ACL five-tuple information are not repeated; If there is no duplication, add the first target ACL node to the second target node; Reducing ACL nodes specifically includes: Get the second target name of the reduced second target ACL node; Traverse the ACL linked list to determine whether there is a third target node; If the third target node exists, traverse the ACL node list of the third target node to determine whether the second target name is the same as each ACL name; In the same situation, the second target ACL node is deleted.

2. The access control management method according to claim 1, characterized in that: Before traversing the ACL linked list, the method further includes: presetting an ACL two-dimensional bidirectional linked list; The traversal of the ACL chain list is specifically as follows: Each ACL column in the ACL two-dimensional bidirectional linked list and each of the nodes in each of the ACL columns are traversed.

3. The access control management method according to claim 1, characterized in that: Determining whether the target quintuple information and each ACL quintuple information are not repeated is specifically as follows: Determine whether the source and destination ports of the target quintuple are not equal to the source and destination ports of each of the ACL quintuples; Determine whether the transmission protocol of the target quintuple is not equal to the transmission protocol of each of the ACL quintuples; When the source and destination IP mask lengths of the target quintuple are equal to the source and destination IP mask lengths of each of the ACL quintuples, determining whether the source and destination IP mask of the target quintuple are not equal to the source and destination IP mask of each of the ACL quintuples; When the source and destination IP mask lengths of the target quintuple are greater than the source and destination IP mask lengths of each of the ACL quintuples, after the source and destination IP of the target quintuple and the source and destination IP of each of the ACL quintuples are respectively compared with the source and destination IP of each of the ACL quintuples, it is determined whether the source and destination IP masks of the target quintuple are not equal to the source and destination IP masks of each of the ACL quintuples; When the source and destination IP mask lengths of the target quintuple are less than the source and destination IP mask lengths of each of the ACL quintuples, then after the source and destination IP of the target quintuple and the source and destination IP of each of the ACL quintuples are respectively compared with the source and destination IP of the target quintuple, it is determined whether the source and destination IP masks of the target quintuple are not equal to the source and destination IP masks of each of the ACL quintuples; When the source and destination ports, transport protocols and source and destination IP masks of the target quintuple are not equal to the source and destination ports, transport protocols and source and destination IP masks of each of the ACL quintuples, it is determined that the target quintuple information and the ACL quintuple information are not repeated.

4. The access control management method according to claim 1, characterized in that: The reducing of ACL nodes further comprises: When the system is idle, it is effective to set the enabling flag of the third target node through the application.

5. An access control management device, characterized in that: The device includes: A first judgment module is used to traverse the ACL linked list and judge whether the enable flag is valid when adding or reducing an ACL node; wherein the enable flag is pre-set in the node; A first acquisition module, configured to acquire, when the enabling identifier is valid, each ACL quintuple information of the node corresponding to the enabling identifier; A configuration module, used for configuring each of the ACL quintuple information to the ACL interface; An execution module, configured to not perform ACL configuration when the enabling flag is invalid; Wherein, the first judgment module includes: The second acquisition module is used to acquire the first target name and target five-tuple information of the added first target ACL node; A second judgment module is used to traverse the ACL linked list to determine whether there is a second target node; A third judgment module is used for traversing the ACL node list of the second target node when the second target node exists, and judging whether the first target name and each ACL name and the target five-tuple information and each ACL five-tuple information are not repeated; An adding module, used for adding the first target ACL node to the second target node when both are not repeated; Also includes: A third acquisition module is used to acquire a second target name of the reduced second target ACL node; A fourth judgment module, used for traversing the ACL linked list to determine whether there is a third target node; a fifth judgment module, configured to, if the third target node exists, traverse the ACL node linked list of the third target node to judge whether the second target name is the same as each ACL name; The deleting module is used to delete the second target ACL node under the same circumstances.

6. An access control management device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the access control management method according to any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the access control management method according to any one of claims 1 to 4 are implemented.

Images