Method and system for managing firewall using policy object model

Abstract

The present invention provides a method and system for managing a firewall using a policy object model, comprising: step S1: collecting device data, and distinguishing the device data into policy objects and common objects; step S2: modeling the policy object according to the basic data structure of the policy object on the original firewall to obtain the policy object model; step S3: performing data reduction on the common object based on the policy attribute type, service attribute type and time attribute type to obtain specific domain data; step S4: binding the specific domain data and the policy object model through associated attributes, and using the bound policy object model to implement compliance conflict checking of a unified algorithm.

Description

Technical Field

[0001] The present invention relates to the field of firewall technology, and in particular, to a method and system for managing firewalls using a policy object model, and more particularly, to a method and system for uniformly managing policy object modeling for firewalls, and a data modeling technology for managing policy objects on firewalls of different brands and models. Background Art

[0002] With the rapid development of IT infrastructure and information system construction, the capabilities of network security prevention and network operation and maintenance have gradually been strengthened. The importance of firewalls as network security protection devices has become increasingly prominent. There are often many different brands and models of firewalls in operation and maintenance. In order to improve operation and maintenance efficiency and promptly discover possible configuration problems, they need to be managed in a unified and centralized manner.

[0003] Patent document CN105812326B (application number: 201410848484.5) discloses a centralized control method and system for heterogeneous firewall policies, including: customizing different firewall templates according to different firewall models from different manufacturers using XML highly abstract model technology. Select a firewall template, and for different devices of the same model of firewall, build a network security combination policy applied to different devices in the firewall template, each network security combination policy contains one or more firewall rules. Combine, delete and / or modify the firewall rules, and monitor the combination, deletion and / or modification. The network security combination policy is referenced once or multiple times by the scheduling engine to execute the issuance and / or irregular synchronization of firewall rules.

[0004] Centralized and unified management means that a unified platform is needed for presentation. Different brands and models of firewalls often have different data structures for policies and objects. If these policies and objects are simply presented on a unified platform, the data structure of the brand model itself can be directly copied. However, in the actual production process, it is necessary to conduct in-depth management and inspection of the policy objects collected on the unified platform, such as object reference judgment, policy conflict judgment, policy hit judgment, etc. If a separate set of programs is made for each inspection based on specific brand model data modeling, it often consumes a lot of resources and if there are new brands and models in the future, it needs to be expanded, which is neither efficient nor flexible. Therefore, if there is a modeling technology that can meet the heterogeneity of data structures under different firewalls and the uniformity of subsequent inspection management, then the firewall can be managed efficiently and flexibly.

[0005] In view of the above problems, the present invention mainly solves and meets the following requirements:

[0006] 1. Personalized data structure collection and display of firewalls of different brands and models;

[0007] 2. Support adding business data to the original firewall policy object data;

[0008] 3. When checking policy objects, a unified data structure is used for checking.

[0009] We will not establish a large and comprehensive firewall policy object model to accommodate the policies and objects of all brands and models. Instead, we will use our modeling technology to define a unified model that conforms to the unique data structure of different brands of firewalls and is in line with firewall principles, using a unified algorithm for data inspection.

[0010] Therefore, driven by this demand, we invented a firewall policy object modeling technology that is applicable to different brands and models. Users can define the policy objects of different brands and models of firewalls according to certain specifications and standards, and only need to define them once in advance to achieve various management and inspection functions later. Summary of the invention

[0011] In view of the defects in the prior art, the object of the present invention is to provide a method and system for managing a firewall using a policy object model.

[0012] The method for managing a firewall using a policy object model provided by the present invention includes:

[0013] Step S1: Collect device data and divide the device data into policy objects and common objects;

[0014] Step S2: Modeling the policy object according to the basic data structure of the policy object on the original firewall to obtain a policy object model;

[0015] Step S3: performing data reduction on common objects based on the policy attribute type, service attribute type and time attribute type to obtain specific domain data;

[0016] Step S4: Bind the specific domain data and the policy object model through the association attribute, and use the bound policy object model to implement the compliance conflict check of the unified algorithm;

[0017] The policy object is a policy for intercepting and releasing data traffic packets on the firewall;

[0018] The common object is an external object to which the attributes in the policy apply;

[0019] The basic data structure includes a display name, a unique identification name, and a field display width sequence number;

[0020] The association attribute is to associate different objects.

[0021] Preferably, collecting device data includes: reading data on the device using HTTP through an API interface provided by the device; or simulating command line commands on the device by simulating remote SSH or Telnet login, and collecting terminal output to obtain device data.

[0022] Preferably, the step S2 adopts: establishing a multi-level directory, and performing policy object modeling based on each level of the directory; the sub-category directory inherits the policy object model of the parent category directory, and the newly created policy object model of the sub-category directory is invisible to the parent category.

[0023] Preferably, the policy attribute types include: policy set, interface, sequence number, protocol, source address, source port, source domain, destination address, destination port, destination domain, action, service and time.

[0024] Preferably, in the service attribute type, attributes including protocol, source port and destination port are added to the service object, which solves the problem that the source and destination ports cannot be satisfied by using the associated attributes.

[0025] Preferably, in the time attribute type, the time attributes are increased to include a period, an effective time and an actual time.

[0026] Preferably, in the associated attributes, the attribute of object A is set to be associated with the attribute B1 of object B, and the attribute B2 of object B is obtained. The attribute B1 of object B is the index attribute of the associated object; the attribute B2 of object B is the value attribute of the associated object.

[0027] A system for managing a firewall using a policy object model according to the present invention includes:

[0028] Module M1: collects device data and divides the device data into policy objects and common objects;

[0029] Module M2: Modeling the policy object according to the basic data structure of the policy object on the original firewall to obtain the policy object model;

[0030] Module M3: Perform data reduction on common objects based on policy attribute type, service attribute type and time attribute type to obtain specific domain data;

[0031] Module M4: Bind the specific domain data and the policy object model through the associated attributes, and use the bound policy object model to implement the compliance conflict check of the unified algorithm;

[0032] The policy object is a policy for intercepting and releasing data traffic packets on the firewall;

[0033] The common object is an external object to which the attributes in the policy apply;

[0034] The basic data structure includes a display name, a unique identification name, and a field display width sequence number;

[0035] The association attribute is to associate different objects.

[0036] Preferably, the module M2 adopts: establishing a multi-level directory, and performing policy object modeling based on each level of the directory; the sub-category directory inherits the policy object model of the parent category directory, and the newly created policy object model of the sub-category directory is invisible to the parent category.

[0037] Preferably, the policy attribute types include: policy set, interface, sequence number, protocol, source address, source port, source domain, destination address, destination port, destination domain, action, service and time;

[0038] In the service attribute type, attributes including protocol, source port, and destination port are added to the service object, solving the problem that the source and destination ports cannot be satisfied by using the associated attributes;

[0039] In the time attribute type, the time attribute is increased to include period, effective time and actual time;

[0040] In the associated attribute, the attribute of object A is set to be associated with the attribute B1 of object B, and the attribute B2 of object B is obtained. The attribute B1 of object B is the index attribute of the associated object; the attribute B2 of object B is the value attribute of the associated object.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] 1. The present invention realizes the original retention function of the original factory data by defining the attribute field, reflecting the differences between different brands of manufacturers; and realizes the upper-level summary of firewalls of different brands by selecting the attribute type technology predefined by the definition system; uses the association attribute technology to realize the reference relationship between different models; based on the above modeling technology, it finally realizes the unified management of different brands of equipment, and uses a unified algorithm to check the data; and finds a balance between data restoration and adaptation flexibility;

[0043] 2. The present invention solves the problem that the data model cannot be expanded when a large and comprehensive data structure is used to uniformly manage data of multiple brands and models of firewalls, and the problem that the data structure does not match when encountering new manufacturers is solved. It also effectively solves the problem that the data structures of different brands and manufacturers are different in subsequent data inspections. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0045] Figure 1Schematic diagram of modeling the classic firewall policy quintuple. DETAILED DESCRIPTION

[0046] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0047] Example 1

[0048] A method for managing a firewall using a policy object model provided by the present invention includes:

[0049] Step S1: Collect device data and divide the device data into policy objects and common objects;

[0050] Step S2: Modeling the policy object according to the basic data structure of the policy object on the original firewall to obtain a policy object model;

[0051] Step S3: performing data reduction on common objects based on the policy attribute type, service attribute type and time attribute type to obtain specific domain data;

[0052] Step S4: Bind the specific domain data and the policy object model through the association attribute, and use the bound policy object model to implement the compliance conflict check of the unified algorithm;

[0053] The policy object is a policy for intercepting and releasing data traffic packets on the firewall;

[0054] The common object is an external object to which the attributes in the policy apply;

[0055] The basic data structure includes a display name, a unique identification name, and a field display width sequence number;

[0056] The association attribute is to associate different objects.

[0057] Specifically, the collecting device data includes: reading the data on the device using the HTTP method through the API interface provided by the device; or simulating the command line command by simulating the remote SSH or Telnet login to the device, and collecting the terminal output to obtain the device data.

[0058] Specifically, the step S2 adopts: establishing a multi-level directory, and performing policy object modeling based on each level of the directory; the sub-category directory inherits the policy object model of the parent category directory, and the newly created policy object model is invisible to the parent category.

[0059] Specifically, the policy attribute types include: policy set, interface, sequence number, protocol, source address, source port, source domain, destination address, destination port, destination domain, action, service and time.

[0060] Specifically, in the service attribute type, attributes including protocol, source port, and destination port are added to the service object, which solves the problem that the source and destination ports cannot be satisfied by using the associated attributes.

[0061] Specifically, in the time attribute type, the time attributes are increased to include a period, an effective time, and an actual time.

[0062] Specifically, in the associated attribute, the attribute of object A is set to be associated with attribute B1 of object B, and attribute B2 of object B is obtained. Attribute B1 of object B is the index attribute of the associated object; attribute B2 of object B is the value attribute of the associated object.

[0063] A system for managing a firewall using a policy object model according to the present invention includes:

[0064] Module M1: collects device data and divides the device data into policy objects and common objects;

[0065] Module M2: Modeling the policy object according to the basic data structure of the policy object on the original firewall to obtain the policy object model;

[0066] Module M3: Perform data reduction on common objects based on policy attribute type, service attribute type and time attribute type to obtain specific domain data;

[0067] Module M4: Bind the specific domain data and the policy object model through the associated attributes, and use the bound policy object model to implement the compliance conflict check of the unified algorithm;

[0068] The policy object is a policy for intercepting and releasing data traffic packets on the firewall;

[0069] The common object is an external object to which the attributes in the policy apply;

[0070] The basic data structure includes a display name, a unique identification name, and a field display width sequence number;

[0071] The association attribute is to associate different objects.

[0072] Specifically, the module M2 adopts: establishing a multi-level directory, and performing policy object modeling based on each level of the directory; the sub-category directory inherits the policy object model of the parent category directory, and the newly created policy object model is invisible to the parent category.

[0073] Specifically, the policy attribute types include: policy set, interface, sequence number, protocol, source address, source port, source domain, destination address, destination port, destination domain, action, service and time;

[0074] In the service attribute type, attributes including protocol, source port, and destination port are added to the service object, solving the problem that the source and destination ports cannot be satisfied by using the associated attributes;

[0075] In the time attribute type, the time attribute is increased to include period, effective time and actual time;

[0076] In the associated attribute, the attribute of object A is set to be associated with the attribute B1 of object B, and the attribute B2 of object B is obtained. The attribute B1 of object B is the index attribute of the associated object; the attribute B2 of object B is the value attribute of the associated object.

[0077] The present invention adapts to the management of different objects of different devices through heterogeneous modeling, and uses a set of common algorithms to check objects of different brands and manufacturers through the underlying normalization modeling, which undoubtedly improves the efficiency and flexibility of the unified management platform for the management of firewalls of different brands and models, and finds a balance between the rigor of data restoration and the flexibility of adaptation. At the same time, if there are more inspection requirements in the future, it is only necessary to expand the modeling model horizontally. It perfectly solves the problem of both individuality and unification when managing heterogeneous data of multiple brands and models of firewalls.

[0078] Example 2

[0079] Embodiment 2 is a preferred embodiment of Embodiment 1

[0080] The most important data on the firewall is the security policy. In addition, in order to improve the efficiency of configuration, each brand manufacturer often has an object concept, that is, a certain attribute in the policy references an external object, such as referencing the same address object in the source address of different policies to improve the reuse rate of its own address. Therefore, in our invention, first of all, in order to distinguish between policies and ordinary objects, we made the first-level type distinction, that is, policy objects and ordinary objects. All collected data are divided into policy objects and ordinary objects. Ordinary objects will be further distinguished in the following text, such as Figure 1 shown.

[0081] Basic Attributes

[0082] For all policy objects and common objects, the basic operations of data modeling on firewalls of different brands and models are consistent. In order to adapt to different brands and models, we first refer to its basic data structure for modeling. For example, for the firewall policy of Palo Alto, the policy object has the following basic structure.

[0083]

[0084]

[0085] For the policy object of Cisco's ASA firewall, it has the following structure

[0086] name illustrate AccessListName Policy Set Line Serial number Action Action Protocol protocol Port Port Number SourceAddress Source Address DestAddress Destination Address Log log TimeRange Effective time

[0087] It can be seen that different firewalls have different structures on policy objects, which are manifested in the following two aspects:

[0088] Even the expressions for the same actual object may be different. For example, for the protocol port, pa directly uses service to include both, while asa clearly distinguishes the two into protocol and port.

[0089] Different firewalls have personalized settings for different policy objects, such as active users, log forwarding, etc.

[0090] Unified management requires a true reflection of the configuration on the firewall. Therefore, first of all, in our modeling, based on the definition of the policy object, we can freely add or remove attributes. For example, the pa policy object has 14 attributes. In the first step, we directly add these 14 attributes, and then add the attribute name of each attribute, distinguishing between Chinese and English. Here we take an example and refer to the table above to directly build these 14 attributes. Similarly, we also use the same method to build the nine attributes of asa. In this way, we can achieve a one-to-one correspondence with the real objects on the device.

[0091] At the same time, in actual use, it is often necessary to identify other business attributes of the policy, such as who applied for the establishment and which application uses it. When encountering such a problem here, we also directly create the corresponding attributes, but we need to mark these attributes as not corresponding to the attributes on the device, and these attributes can be directly modified.

[0092] Association attributes

[0093] Later, for a certain attribute such as the address attribute of the policy object, the address object can often be associated. Different from the traditional database foreign key technology, we use a custom association method here, that is, the attribute b of object a references object c, and the real attribute value e is found through the attribute d of object c. Here, we call attribute d the index attribute of the associated object, and attribute e the value attribute of the associated object. Take an example, the source address in policy a is addressA, and addressA corresponds to the name of address object b, but often we need the IP value in the data of address object b named addressA. The IP value is the value attribute here. Through such data definition, we establish the association between attributes. For better constraints, the association connection between attributes does not exceed three layers, that is, the address references the address group, and the address group references the address, with a maximum of three layers of reference relationship. Back to the example of pa above, the policy references the address object. We refer to the address object of pa to build the address object, and then associate the source address and destination address of the policy object to the address object respectively and set the corresponding index attribute and value attribute.

[0094] At this point, we have simply restored the original data on the firewalls of each manufacturer. The next step is to perform the most critical steps such as policy redundancy checks.

[0095] Policy attribute type

[0096] In traditional firewall policy modeling, the firewall policy model consists of five tuples: source address, destination address, sequence number, protocol, port (such as Figure 1 ), and based on this, perform policy redundancy conflict checks. However, in actual firewalls, policies are often not simply composed of simple five-tuples, such as adding policy effective time, policy associated physical interface, etc., refer to the previous pa and asa.

[0097] In the redundant conflict check of policies, the most important thing is to check the relationship between the five-tuples of different firewall policies. Briefly speaking, it is necessary to determine the sequence numbers of the policies, then determine the inclusion relationship of the source and destination addresses, ports and protocols, and whether the final actions are the same or opposite to determine the policy conflict.

[0098] After combining the mainstream brands and models of firewalls on the market and considering the underlying implementation principles of firewall policies, we have further constrained the attributes of the policies. That is, if the stored policies are to undergo subsequent redundant conflict checks, individual key attributes need to be identified. Here we can mark the attributes with attribute types to distinguish them.

[0099] Based on the five-tuple in the basic paper, we enriched it as follows. The policy attributes can have the following types

[0100] Policy set, interface, sequence number, protocol, source address, source port, source domain, destination address, destination port, destination domain, action, service, and time.

[0101] Not all of them need to be set. We can think of service and protocol, source port, and destination port as two groups of values ​​representing the same protocol port. They can appear at the same time, or only one of them can appear. Policy set, source domain, destination domain, and interface are also optional.

[0102] Referring to the differences from the default five-tuple, we have added policy set, interface, source domain, destination domain, service, and time. Policy set can be considered as a grouping representation of policies; in actual use, two policies with the same address, protocol, and port may be associated with different ports or domains, and are actually two different policies in the actual traffic flow direction. These tuple attributes are optional according to different brands; time is reflected in most brands and models, representing the effective time of the policy.

[0103] Referring to the PA model we described in the previous article, there is no sequence number or policy set in the original PA model. However, we can actually know from the firewall policy model that the policies are arranged in a certain order, and the traffic hits the front one first. Therefore, the sequence number is a certain value. Although it is not actually displayed for PA, it is also a hidden value, and we still need to build it. For the policy set, PA is distinguished by the vsys virtual wall technology. PA implies a global policy set. There is no need to set the policy set when normalizing data, but in subsequent inspections, the policy set is regarded as an implicit global hidden value.

[0104] Service attribute type

[0105] We have previously explained that common objects will be further subdivided. Here we have service objects and time objects. For service objects, we have added the attributes of protocol, source port, and destination port, which solves the problem that the source and destination ports cannot be satisfied by using associated attributes.

[0106] Time attribute type

[0107] We have added cycle, effective time, and actual time to the time attribute, which solves the difference between interval time and cycle time, and solves the problem of nested cycle time in interval time through effective time. For example, from January to mid-June, it takes effect every Friday.

[0108] Parent class inheritance

[0109] Finally, our modeling is based on the three-level directory of brand (manufacturer) -> model -> operating system version. If the model is on the parent class, it will be inherited to the child class. The child class can create its own model but it is invisible to the parent class. This solves the subtle problem that most objects of most brands and models are the same, but different operating system versions may have different objects.

[0110] Those skilled in the art know that, in addition to implementing the system, device and its various modules provided by the present invention in a purely computer-readable program code, it is entirely possible to implement the same program in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded microcontrollers by logically programming the method steps. Therefore, the system, device and its various modules provided by the present invention can be considered as a hardware component, and the modules included therein for implementing various programs can also be considered as structures within the hardware component; the modules for implementing various functions can also be considered as both software programs for implementing the method and structures within the hardware component.

[0111] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A method for managing a firewall using a policy object model, characterized in that: include: Step S1: Collect device data and divide the device data into policy objects and common objects; Step S2: Modeling the policy object according to the basic data structure of the policy object on the original firewall to obtain a policy object model; Step S3: performing data reduction on common objects based on the policy attribute type, service attribute type and time attribute type to obtain specific domain data; Step S4: Bind the specific domain data and the policy object model through the association attribute, and use the bound policy object model to implement the compliance conflict check of the unified algorithm; The policy object is a policy for intercepting and releasing data traffic packets on the firewall; The common object is an external object to which the attributes in the policy apply; The basic data structure includes a display name, a unique identification name, and a field display width sequence number; The association attribute is to associate different objects; The attribute b of object a is set to reference object c, and the real attribute value e is found through the attribute d of object c. The attribute d is called the index attribute of the associated object, and the attribute value e becomes the value attribute of the associated object.

2. The method for managing a firewall using a policy object model according to claim 1, characterized in that: The device data collection includes: reading the data on the device using HTTP through the API interface provided by the device; or simulating remote SSH or Telnet to log in to the device to simulate command line commands, and collecting terminal output to obtain device data.

3. The method for managing a firewall using a policy object model according to claim 1, characterized in that: The step S2 adopts: establishing a multi-level directory, and performing policy object modeling based on each level of the directory; the sub-category directory inherits the policy object model of the parent category directory, and the newly created policy object model of the sub-category directory is invisible to the parent category.

4. The method for managing a firewall using a policy object model according to claim 1, characterized in that: The policy attribute types include: policy set, interface, sequence number, protocol, source address, source port, source domain, destination address, destination port, destination domain, action, service and time.

5. The method for managing a firewall using a policy object model according to claim 1, characterized in that: In the service attribute type, attributes including protocol, source port and destination port are added to the service object, which solves the problem that the source and destination ports cannot be satisfied by using the associated attributes.

6. The method for managing a firewall using a policy object model according to claim 1, characterized in that: In the time attribute type, the time attributes are increased to include a period, an effective time and an actual time.

7. The method for managing a firewall using a policy object model according to claim 1, characterized in that: In the associated attribute, the attribute of object A is set to be associated with the attribute B1 of object B, and the attribute B2 of object B is obtained. The attribute B1 of object B is the index attribute of the associated object; the attribute B2 of object B is the value attribute of the associated object.

8. A system for managing a firewall using a policy object model, characterized in that: include: Module M1: collects device data and divides the device data into policy objects and common objects; Module M2: Modeling the policy object according to the basic data structure of the policy object on the original firewall to obtain the policy object model; Module M3: Perform data reduction on common objects based on policy attribute type, service attribute type and time attribute type to obtain specific domain data; Module M4: Bind the specific domain data and the policy object model through the associated attributes, and use the bound policy object model to implement the compliance conflict check of the unified algorithm; The policy object is a policy for intercepting and releasing data traffic packets on the firewall; The common object is an external object to which the attributes in the policy apply; The basic data structure includes a display name, a unique identification name, and a field display width sequence number; The association attribute is to associate different objects; The attribute b of object a is set to reference object c, and the real attribute value e is found through the attribute d of object c. The attribute d is called the index attribute of the associated object, and the attribute value e becomes the value attribute of the associated object.

9. The system for managing a firewall using a policy object model according to claim 8, characterized in that: The module M2 adopts: establishing a multi-level directory, and performing policy object modeling based on each level of the directory; the sub-category directory inherits the policy object model of the parent category directory, and the newly created policy object model is invisible to the parent category.

10. The system for managing a firewall using a policy object model according to claim 8, characterized in that: The policy attribute types include: policy set, interface, sequence number, protocol, source address, source port, source domain, destination address, destination port, destination domain, action, service and time; In the service attribute type, attributes including protocol, source port, and destination port are added to the service object, solving the problem that the source and destination ports cannot be satisfied by using the associated attributes; In the time attribute type, the time attribute is increased to include period, effective time and actual time; In the associated attribute, the attribute of object A is set to be associated with the attribute B1 of object B, and the attribute B2 of object B is obtained. The attribute B1 of object B is the index attribute of the associated object; the attribute B2 of object B is the value attribute of the associated object.

Images